# changelog

author: Miroslav Rezanina <mrezanin@redhat.com> - 2.2.18-1.el7
changelog:
  - Rebase to 2.2.18 [bz#1491873]
  - Resolves: bz#1491873
    ([WALA]Request to package WALA 2.2.18 into RHEL 7 Repo)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.2.18-2.el7
changelog:
  - wa-Add-show-configuration-option.patch [bz#1508340]
  - Resolves: bz#1508340
    ([WALA] WALA usage prompt lack of " waagent -show-configuration")


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.2.26-4.el8
changelog:
  - Fix unit file location [bz#1637545]
  - Resolves: bz#1637545
    (Wrong macro used for systemd unit file location)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.2.26-5.el8
changelog:
  - wala-Switch-to-platform-python-in-systemd-unit-file.patch [bz#1639775]
  - Resolves: bz#1639775
    (WALinuxAgent: Systemd unit file will fail to execute)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.2.26-6.el8
changelog:
  - wala-Use-sys.executable-to-find-system-python.patch [bz#1639775]
  - Resolves: bz#1639775
    (WALinuxAgent: Systemd unit file will fail to execute)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.2.32-1.el8
changelog:
  - Rebase to 2.2.32 [bz#1639498]
  - Resolves: bz#1639498]
    (walinuxagent 2.2.32 packaging request for RHEL 8)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.2.32-1.el8_0.1
changelog:
  - wla-Add-fixes-for-handling-swap-file-and-other-nit-fixes.patch [bz#1711338]
  - Resolves: bz#1711338
    (CVE-2019-0804 WALinuxAgent: swapfile created with weak permissions [rhel-8])


author: Michael Simacek <msimacek@redhat.com> - 3.2.2-1
changelog:
  - Update to upstream version 3.2.2
  - Merge two javadoc subpackages
  - Install with XMVn
  - Specfile cleanup


author: Mat Booth <mat.booth@redhat.com> - 3.2.2-8
changelog:
  - Allow testframework to still be built even with tests disabled, which is
    needed by other packages


author: Vojtech Trefny <vtrefny@redhat.com> - 3.1.0-3
changelog:
  - Check device dependencies only for device actions
    Related: rhbz#1605213
  - Allow removing btrfs volumes without btrfs support
    Resolves: rhbz#1605213


author: Vojtech Trefny <vtrefny@redhat.com> - 3.1.0-5
changelog:
  - arm: add support for EFI on ARMv7 (probinson)
    Related: rhbz#1623882
  - Aarch64 platforms: Fix gpt defaults for 64 bit arm platforms (probinson)
    Resolves: rhbz#1623882
  - arch: arm: drop get_arm_machine function (probinson)
    Related: rhbz#1623882
  - arch: arm: drop omap specifics for partitioning (probinson)
    Related: rhbz#1623882


author: David Lehman <dlehman@redhat.com> - 3.1.0-9
changelog:
  - Update to latest translations.
    Resolves: rhbz#1608337
  - Require libfc instead of fcoe for offloaded FCoE.
    Resolves: rhbz#1575953
  - Use udev to determine if disk is a multipath member.
    Related: rhbz#1575953
  - Don't crash if blockdev mpath plugin isn't available.
    Resolves: rhbz#1672971


author: Mike Fabian <mfabian@redhat.com> - 1.0.10-2
changelog:
  - Fix build for RHEL-8
  - Resolves: rhbz#1523696
  - add BuildRequires:  glibc-locale-source
  - fix glibc-cs_CZ@SAP.patch
  - fix glibc-cs_CZ@HPUX.patch
  - fix glibc-sk_SK@SAP.patch
  - fix glibc-tr_TR@SAP.patch
  - fix category in glibc-2.5-de_DE and glibc-2.5-es_ES
  - add patch for iconv stuff for RHEL-8
  - add


author: Mike Fabian <mfabian@redhat.com> - 1.0.10-5
changelog:
  - Move all files into the main package and drop compat-locales-sap-common
    sub-package.
  - Resolves: rhbz#1639296


author: Mike Fabian <mfabian@redhat.com> - 1.0.10-7
changelog:
  - Remove "Requires: glibc-all-langpacks" again and drop the
    posttrans and postun scripts instead. If these scripts are removed,
    glibc-all-langpacks is not needed anymore.
    This avoids problems with /usr/sbin/build-locale-archive.
  - Related: rhbz#1688815


author: Mike Fabian <mfabian@redhat.com> - 1.0.10-8
changelog:
  - Remove  BuildArch: noarch. The binary locales are architecture
    dependent.
  - Related: rhbz#1688815


author: Mike Fabian <mfabian@redhat.com> - 1.0.10-9
changelog:
  - Add Conflicts: compat-locales-sap <= 1.0.10-6 to avoid
    rpmdeplint error because of the architecture change.
  - Related: rhbz#1688815


author: Brian C. Lane <bcl@redhat.com> 28.14.21-1
changelog:
  - Remove unneeded else from for/else loop. It confuses pylint (bcl)
    Related: rhbz#1664485
  - Allow customizations to be specified as a toml list (dshea)
    Resolves: rhbz#1664485
  - New lorax documentation - 28.14.21 (bcl)
    Related: rhbz#1650295
  - Update the example livemedia-creator kickstarts for RHEL8 (bcl)
    Resolves: rhbz#1650295
  - Change default releasever to 8 (bcl)
    Related: rhbz#1650295


author: Brian C. Lane <bcl@redhat.com> 28.14.22-1
changelog:
  - Report an error if the blueprint doesn't exist (bcl)
    Related: rhbz#1653934
  - tmux is version 2.8 on Fedora 28 (atodorov)
    Related: rhbz#1653934
  - Disable pylint no-member errors for 2 dnf constants (atodorov)
    Related: rhbz#1653934
  - Backport cloud image tests to RHEL 8 (atodorov)
    Related: rhbz#1653934


author: Brian C. Lane <bcl@redhat.com> 28.14.23-1
changelog:
  - lorax: Move default tmp dir to /var/tmp/lorax (bcl)
    Resolves: rhbz#1668408
  - Expand parameters as separate words (jstodola)
    Related: rhbz#1653934
  - Add /usr/local/bin to PATH for tests (atodorov) (atodorov)
  - Do not generate journal.xml from beakerlib (atodorov)
    Related: rhbz#1653934
  - Use any tmux version (atodorov)
    Related: rhbz#1653934
  - Make test scripts executable with chmod +x (atodorov)
    Related: rhbz#1653934


author: Brian C. Lane <bcl@redhat.com> 28.14.23-2
changelog:
  - lorax-composer: pass customization.kernel append to extra_boot_args (bcl)
    Resolves: rhbz#1690068
  - Improve logging for template syntax errors (bcl)
    Related: rhbz#1690068
  - Add extra boot args to the livemedia-creator iso templates (bcl)
    Related: rhbz#1690068
  - lorax-composer: Add the ability to append to the kernel command-line (bcl)
    Related: rhbz#1690068
  - Add some extra cancel_func protection to QEMUInstall (bcl)
    Related: rhbz#1690507
  - installer: make sure cancel_func has a value (yuvalt)
    Resolves: rhbz#1690507


author: Brian C. Lane <bcl@redhat.com> 28.14.23-4
changelog:
  - Revert "lorax-composer: Add CDN repo checks to startup and compose start." (bcl)
    Related: rhbz#1693801
  - Revert "lorax-composer: Check for CDN only repos" (bcl)
    Related: rhbz#1693801
  - Fix bz# for ssl cert patch (bcl)
    Resolves: rhbz#1693801


author: Brian C. Lane <bcl@redhat.com> 28.14.23-6
changelog:
  - Fix path to generic.prm (jstodola)
    Resolves: rhbz#1712822
  - Add kernel to ext4-filesystem template (bcl)
    Resolves: rhbz#1710969
  - lorax-composer: Return UnknownBlueprint errors when using deleted blueprints (bcl)
    Resolves: rhbz#1682992
  - lorax-composer: Delete workspace copy when deleting blueprint (bcl)
    Related: rhbz#1682992


author: Brian C. Lane <bcl@redhat.com> 28.14.23-7
changelog:
  - tests: Make it easier to update version globs (bcl)
    Related: rhbz#171282
  - Add patches to lorax.spec (bcl)
    Related: rhbz#1712822


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.20.0-13
changelog:
  - 1602470 - covscan fixes from upstream
  - 1632268 - cups-filters needs to obsolete ghostscript-cups and foomatic-filters
  - 1626996 - cups-filters: Sticky EOF behavior in glibc breaks descriptor concatenation using dup2


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.7-2.gitef6d98b
changelog:
  - Update Source to latest upstream commit
    * Previous patches 0001-0018 are included in this commit
  - Rename files
    * Previous patches 0019-0028 are now patches 0002-0003 & 0012-0019
  - Add 0001-libmultipath-remove-last-of-rbd-code.patch
  - Add 0004-mpathpersist-add-param-alltgpt-option.patch
    * mpathpersist now accepts --param-alltgpt
  - Add 0005-libmutipath-remove-unused-IDE-bus-type.patch
  - Add 0006-multipathd-add-new-protocol-path-wildcard.patch
    * multipathd show paths format now accepts %PATCH for the path protocol/transport
  - Add 0007-libmultipath-add-protocol-blacklist-option.patch
    * You can now use the "protocol" blacklist section parameter to blacklist
      by protocol/transport
  - Add 0008-libmultipath-remove-_filter_-blacklist-functions.patch
  - Add 0009-multipath-tests-change-to-work-with-old-make-version.patch
  - Add 0010-multipath-tests-add-blacklist-tests.patch
  - Add 0011-mpathpersist-add-missing-param-rk-usage-info.patch
  - Refresh 0013-RH-Remove-the-property-blacklist-exception-builtin.patch
  - Modify 0016-RH-add-mpathconf.patch
    * improve usage message and man page
  - Modify device-mapper-multipath.spec
    * updated dependencies


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.8-1
changelog:
  - Update Source to upstream version 0.7.8
    * Previous patches 0001-0011 are included in this version
  - Rename files
    * Previous patches 0012-0019 are now patches 0007-0014
  - Add 0001-multipath-tweak-logging-style.patch
  - Add 0002-multipathd-check-for-NULL-udevice-in-cli_add_path.patch
  - Add 0003-libmultipath-remove-max_fds-code-duplication.patch
  - Add 0004-multipathd-set-return-code-for-multipathd-commands.patch
  - Add 0005-mpathpersist-fix-registration-rollback-issue.patch
  - Add 0006-libmultipath-timeout-on-unresponsive-tur-thread.patch
    * The above 6 patches have been submitted upstream
  - Resolves: bz #1606947, #1631883


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.8-2
changelog:
  - Add 0015-libmultipath-free-allocated-value-in-set_int.patch
  - Add 0016-kpartx-fix-new-memory-leak-in-dm_find_part.patch
  - change hardcoded /usr/lib/udev/rules.d to _udevrulesdir
  - Resolves: bz #1606947


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.8-3
changelog:
  - Add 0017-BZ-1648397-fix-mpp-hwe-handling-when-paths-are-freed.patch
    * Fix crash by deleting in use hardware entry list pointer
  - Add 0018-libmultipath-cleanup-pthread_cleanup_pop-call.patch
    * Fix compiler warning
  - Add 0019-libmultipath-fix-false-removes-in-dmevents-polling-c.patch
    * The above 3 patches have been accepted upstream
  - Resolves: bz #1648397


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.8-5
changelog:
  - Add 0021-BZ-1673167-Fix-miscounting-active-paths.patch
  - Add 0022-BZ-1673167-ignore-failed-wwid-recheck.patch
  - Resolves: bz #1673167


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.8-6
changelog:
  - Fix multipath_conf_syntax CI test
    * need to wait for udev to settle before removing multipath device
  - Resolves: bz #1673167


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.8-7.1
changelog:
  - Add 0024-BZ-1723746-check-on-multipathd-without-starting-it.patch
  - Add 0025-BZ-1723746-test-socket-connection-in-non-blocking-mo.patch
  - Update CI testing
  - Resolves: bz #1723746


author: Omair Majid <omajid@redhat.com> - 2.1.504-1
changelog:
  - Update to .NET Core Runtime 2.1.8 and SDK 2.1.504
  - Sync with Fedora copr spec file
  - Resolves: RHBZ#1646713


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.34-1
changelog:
  - dovecot updated to 2.2.34, pigeonhole updated to 0.4.22
  - fixes CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be reached
    and the process restarted. This happens only if Dovecot config has
    local_name { } or local { } configuration blocks and attacker uses
    randomly generated SNI servernames.
  - fixes CVE-2017-14461: Parsing invalid email addresses may cause a crash or
    leak memory contents to attacker. For example, these memory contents
    might contain parts of an email from another user if the same imap
    process is reused for multiple users.
  - fixes CVE-2017-15132: Aborted SASL authentication leaks memory in login
    process.


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-3
changelog:
  - fix global ACL directory configuration search path (#1630383)
  - update first/last_valid_gid range patch (#1630410)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-5.1
changelog:
  - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
    when scanning data in quoted strings, leading to out of bounds heap
    memory writes (#1741788)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-11
changelog:
  - fence_scsi: fix incorrect SCSI-key when node ID is 10 or higher
    Resolves: rhbz#1654968
  - fence_scsi: add watchdog retry support
    Resolves: rhbz#1654976
  - fence_hpblade: fix log_expect syntax
    Resolves: rhbz#1654616
  - fence_vmware_soap: cleanup when receiving SIGTERM
    Resolves: rhbz#1654973


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-13
changelog:
  - fence-agents-scsi: add missing fence-agents-common dependency
    Resolves: rhbz#1665170
  - fence_azure_arm: add bundled directory to search path
    Resolves: rhbz#1650214


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-17.1
changelog:
  - fence_gce: fix Python 3 encoding issue
    Resolves: rhbz#1710066
  - fence_aliyun: upgrade python-aliyun-sdk-core to fix httplib issue
    Resolves: rhbz#1710056
  - fence_redfish: use ipport parameter
    Resolves: rhbz#1710055


author: Adam Jackson <ajax@redhat.com> - 0.11.7-2
changelog:
  - Remove Requires: kernel >= 4.0.4-202, which corresponds to rawhide
    somewhere before Fedora 22 which this spec file certainly no longer
    supports.


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.15-16
changelog:
  - Add make to Requires(post) to fix certificate generation on install.
    Resolves: Bug#1628213 FreeRADIUS fails to start due to default certificate
                          permissions


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.15-18
changelog:
  - Actually apply patches added previously.
    Related: Bug#1612512 Man page scan results for freeradius


author: Alexander Scheel <ascheel@redhat.com> - 3.0.17-1
changelog:
  - Update to FreeRADIUS server version 3.0.17
  - Adds OpenSSL HMAC patches from upstream (unreleased)
  - Adds Python2 shebang patches from upstream (unreleased)


author: Alexander Scheel <ascheel@redhat.com> - 3.0.17-4
changelog:
  - Fixes two EAP-PWD security issues
    Resolves: bz#1699416 authentication bypass with an invalid curve attack


author: Sergio Durigan Junior <sergiodj@redhat.com> - 8.2-1.fc29
changelog:
  - Rebase to FSF GDB 8.2.
  - Backport "Indicate batch mode failures by exiting with nonzero status"
    (Gary Benson, RH BZ 1491128).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 8.2-2.fc29
changelog:
  - Backport "Use pulongest in aarch64-linux-tdep.c" (Tom Tromey),
    needed to unbreak the compilation on 32-bit architectures.


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 8.2-3.fc29
changelog:
  - Fix annobin complaints (RH BZ 1630564):
    --without-stage1-ldflags: Disable static libstdc++ and libgcc linking.
    --disable-libmcheck: That is a distro-level decision, not package decision.


author: Keith Seitz <keiths@redhat.com> - 8.2-4.el8
changelog:
  - Update gdb.spec for RHEL supported architectures and multilibs.
  - Merge from Fedora 29:
     gdb-rhbz1639242-fix-dwarf2_find_containing_comp_unit-binary-search.patch
     [RHEL RHBZ#1660220]
     gdb-rhbz1653410-avoid-crash-when-calling-warning-too-early.patch
     [RHEL RHBZ#1660221]


author: Keith Seitz <keiths@redhat.com> - 8.2-5.el8
changelog:
  - Merge from Fedora 29:
    gdb-rhbz1560010-fix-assertion-symbol-language-dict-language-?of5.patch
    (Keith Seitz, RHBZ 1664456).


author: Keith Seitz <keiths@redhat.com> - 8.2-6.el8
changelog:
  - Backport "Fix 'gdb fails to read zN registers from corefile with aarc64 SVE'"
    (Alan Hayward, RH BZ 1699376)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.24-1
changelog:
  - rebase to latest upstream version, which contains important CVE fixes
  - additional ZER0-DAY fixes added


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.25-1
changelog:
  - rebase to latest upstream version to fix issues discovered in previous CVE fixes (bug #1631701 and #1626997)


author: Martin Osvald <mosvald@redhat.com> - 9.25-2
changelog:
  - Resolves: #1652937 - CVE-2018-19409 ghostscript: Improperly implemented
    security check in zsetdevice function in psi/zdevice.c
  - Resolves: #1642586 - CVE-2018-18073 ghostscript: saved execution stacks
    can leak operator arrays
  - Resolves: #1642580 - CVE-2018-17961 ghostscript: saved execution stacks
    can leak operator arrays (incomplete fix for CVE-2018-17183)
  - Resolves: #1642941 - CVE-2018-18284 ghostscript: 1Policy operator
    allows a sandbox protection bypass
  - Resolves: #1656336 - CVE-2018-19134 ghostscript: Type confusion in
    setpattern (700141)
  - Resolves: #1660571 - CVE-2018-19475 ghostscript: access bypass in
    psi/zdevice2.c (700153)
  - Resolves: #1660830 - CVE-2018-19476 ghostscript: access bypass in
    psi/zicc.c
  - Resolves: #1661280 - CVE-2018-19477 ghostscript: access bypass in
    psi/zfjbig2.c (700168)
  - Resolves: #1668891 - CVE-2019-6116 ghostscript: subroutines within
    pseudo-operators must themselves be pseudo-operators (700317)


author: Martin Osvald <mosvald@redhat.com> - 9.25-2.1
changelog:
  - Resolves: #1692798 - CVE-2019-3839 ghostscript: missing attack vector
    protections for CVE-2019-6116
  - Resolves: #1678170 - CVE-2019-3835 ghostscript: superexec operator
    is available (700585)
  - Resolves: #1691414 - CVE-2019-3838 ghostscript: forceput in DefineResource
    is still accessible (700576)
  - fix included for ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata
  - fix for pdf2dsc regression added to allow fix for CVE-2019-3839


author: Martin Osvald <mosvald@redhat.com> - 9.25-2.3
changelog:
  - Resolves: #1744010 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445)
  - Resolves: #1744014 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444)
  - Resolves: #1744005 - CVE-2019-14813 ghostscript: Safer Mode Bypass by .forceput Exposure in setsystemparams (701443)
  - Resolves: #1744230 - CVE-2019-14817 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdfexectoken and other procedures (701450)


author: Derek Parker <deparker@redhat.com> - 1.10.3-10
changelog:
  - Remove usage of redhat hardening flag file, just pass a select few manually
  - Resolves: rhbz#1642798


author: Tom Stellard <tstellar@redhat.com> - 1.11.13-2
changelog:
  - Improve error message when using non-FIPS API in FIPS mode.
  - Fixes CVE-2019-9512.
  - Fixes CVE-2019-9514.
  - Resolves: rhbz#1745711
  - Resolves: rhbz#1745705


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-1
changelog:
  - Update to 1.36.2
  - Remove mount-archive.desktop helper
  - Remove obsolete gvfs utils
  - Disable nfs support


author: Danilo de Paula <ddepaula@redhat.com> - 1.3.15-7
changelog:
  - Rebuild all virt packages to fix RHEL's upgrade path
  - Resolves: rhbz#1696354
    (Ensure modular RPM upgrade path [ZStream Clone] [rhel-8.0.0.z])


author: Joe Orton <jorton@redhat.com> - 2.4.37-7
changelog:
  - add DefaultStateDir/ap_state_dir_relative() (#1653009)
  - mod_dav_fs: use state dir for default DAVLockDB
  - mod_md: use state dir for default MDStoreDir


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-11
changelog:
  - Resolves: #1695431 - CVE-2019-0211 httpd: privilege escalation
    from modules scripts
  - Resolves: #1696090 - CVE-2019-0215 httpd:2.4/httpd: mod_ssl: access control 
    bypass when using per-location client certification authentication


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-12
changelog:
  - Resolves: #1744997 - CVE-2019-9511 httpd:2.4/mod_http2: HTTP/2: large amount
    of data request leads to denial of service
  - Resolves: #1745084 - CVE-2019-9516 httpd:2.4/mod_http2: HTTP/2: 0-length
    headers leads to denial of service
  - Resolves: #1745152 - CVE-2019-9517 httpd:2.4/mod_http2: HTTP/2: request
    for large response leads to denial of service


author: - Jiri Vanek <jvanek@redhat.com> -1.7.1-3
changelog:
  - added buildrequires on gcc/gcc-c++
  - to follow new packaging guidelines which no longer automatically pulls gcc/c++ to build root


author: - Jiri Vanek <jvanek@redhat.com> -1.7.1-5
changelog:
  - added 1473-1480.patch
  - added support for javafx-desc and so allwong run of pure-javafx only applications
  - --nosecurity enhanced for possibility to skip invalid signatures
  - enhanced to allow resources to be read also from j2se/java element (OmegaT)


author: Jiri Vanek <jvanek@redhat.com> 1.7.1-16
changelog:
  - added patch1, patch4 and patch11 to fix CVE-2019-10182
  - added patch2 to fix CVE-2019-10181
  - added patch3 and patch33 to fix CVE-2019-10185
  - Resolves: rhbz#1724958 
  - Resolves: rhbz#1725928 
  - Resolves: rhbz#1724989


author: Phil Sutter - 1.8.2-2
changelog:
  - Point out that nftables-variants are installed in package description
  - Fix for deleting arptables rules by referencing them


author: Phil Sutter - 1.8.2-4
changelog:
  - Fix iptables init script for nftables-backend
  - Drop references to unsupported broute table from ebtables man page
  - xtables: Don't use native nftables comments


author: Phil Sutter - 1.8.2-6
changelog:
  - Improve performance with large rulesets
  - Fix for changes in arptables output
  - Fix for inserting rules at wrong position
  - Fix segfault when comparing rules with standard target
  - Fix ebtables output for negated values
  - Document missing arptables FORWARD chain


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.201.b09-4
changelog:
  - Update patch for RH1566890.
    - Renamed rh1566890_speculative_store_bypass_so_added_more_per_task_speculation_control_CVE_2018_3639 to
      rh1566890-CVE_2018_3639-speculative_store_bypass.patch
    - Added dependent patch,
      rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b13-0
changelog:
  - Update to aarch64-shenandoah-jdk8u201-b13.
  - Drop JDK-8160748 & JDK-8189170 AArch64 patches now applied upstream.
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.202.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u202-b08.
  - Remove patches included upstream
    - JDK-8211387/PR3559
    - JDK-8207057/PR3613
    - JDK-8165852/PR3468
    - JDK-8073139/PR1758/RH1191652
    - JDK-8044235
    - JDK-8172850/RH1640127
    - JDK-8209639/RH1640127
    - JDK-8131048/PR3574/RH1498936
    - JDK-8164920/PR3574/RH1498936
  - Re-generate patches
    - JDK-8210647/RH1632174
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-0
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b02.
  - Remove patches included upstream
    - JDK-8197429/PR3546/RH153662{2,3}
    - JDK-8184309/PR3596
    - JDK-8210647/RH1632174
    - JDK-8029661/PR3642/RH1477159
    - JDK-8145096/PR3693
  - Re-generate patches
    - JDK-8203030
  - Add casts to resolve s390 ambiguity in calls to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-1
changelog:
  - Add JDK-8223219 to avoid -fstack-protector overriding -fstack-protector-strong
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b04-1
changelog:
  - Remove additions to EXTRA_CFLAGS and EXTRA_CPP_FLAGS which are now made by upstream.
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b02.
  - Drop 8064786/PR3599 & 8210416/RH1632174 as applied upstream (8064786 silently in 8176100).
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b03.
  - Drop 8210425 patches applied upstream. Still need to add AArch64 version in aarch64/shenandoah-jdk8u.
  - Re-generate JDK-8141570 & JDK-8143245 patches due to 8210425 zeroshark.make changes.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b04.
  - Drop remaining JDK-8210425/RH1632174 patch now AArch64 part is upstream.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b08-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b08.
  - Adjust PR3083/RH134640 to apply after JDK-8182999
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b01.
  - Switch to EA mode.
  - Drop JDK-8210761/RH1632174 as now upstream.
  - Drop JDK-8223219 as now upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b01-0.0.ea
changelog:
  - JDK-8226870 removed clhsdb and hdsdb from the JRE bin directory, so we should do likewise.
  - Add alternatives support for these two new SDK binaries.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05.
  - Drop upstreamed patch JDK-8141570/PR3548.
  - Adjust context of JDK-8143245/PR3548 to apply against upstream JDK-8141570.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b09.
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.1.13-11
changelog:
  - Update to shenandoah-jdk-11.0.1+13-20190101
  - Update tarball generation script in preparation for PR3681/RH1656677 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Fix PR1983 SunEC patch so that ecc_impl.h is patched rather than added
  - Add missing RH1022017 patch to reduce curves reported by SSL to those we support.
  - Remove RH1648995; fixed upstream
  - Resolves: rhbz#1659143


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.2.7-0
changelog:
  - Update to shenandoah-jdk-11.0.2+7 (January 2019 CPU)
  - Drop JDK-8211105/RH1628612/RH1630996 applied upstream.
  - Drop JDK-8209639/RH1640127 applied upstream.
  - Re-generate JDK-8210416/RH1632174 following JDK-8209786
  - Resolves: rhbz#1666532
  - Resolves: rhbz#1659143


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.2.7-1
changelog:
  - Add PR3695 to allow the system crypto policy to be turned off.
  - Correct original system crypto policy patch to refer to OpenJDK 11 bug (PR3694)
  - Resolves: rhbz#1666532


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.2.7-2
changelog:
  - Add explicit requirement for libXcomposite which is used when performing
    screenshots from Java.
  - Add explicit BR unzip required for building OpenJDK.
  - Resolves: rhbz#1666532


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.3.6-0
changelog:
  - Update to shenandoah-jdk-11.0.3+6 (April 2019 EA)
  - Drop JDK-8210416/RH1632174 applied upstream.
  - Drop JDK-8210425/RH1632174 applied upstream.
  - Drop JDK-8210647/RH1632174 applied upstream.
  - Drop JDK-8210761/RH1632174 applied upstream.
  - Drop JDK-8210703/RH1632174 applied upstream.
  - Add cast to resolve s390 ambiguity in call to log2_intptr
  - Resolves: rhbz#1693468


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.3.7-1
changelog:
  - Don't package lib/client and lib/client/classes.jsa which don't exist (see RH1643469)
  - Resolves: rhbz#1693468


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.3.7-2
changelog:
  - Fix requires/provides for the non-system JDK case. JDK 11 is not a system JDK at this point.
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.4.6-0.0.ea
changelog:
  - Provide Javadoc debug subpackages for now, but populate them from the normal build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.4.11-0
changelog:
  - Update to shenandoah-jdk-11.0.4+11 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.1-0.0.ea
changelog:
  - Update to shenandoah-jdk-11.0.5+1 (EA)
  - Switch to EA mode for 11.0.5 pre-release builds.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.10-0
changelog:
  - Update to shenandoah-jdk-11.0.5+10 (GA)
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Ryan O'Hara <rohara@redhat.com> - 2.0.10-4.2
changelog:
  - Fix segfault when smtp alerts configured (#1693706)
  - Fix double free when smtp_helo_name copied from local_name (#1693706)


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-73.el8]
changelog:
  - [net] tun: forbid iface creation with rtnl ops (Sabrina Dubroca) [1680969]
  - [net] revert "bridge: do not add port to router list when receives query with source 0.0.0.0" (Hangbin Liu) [1679896]
  - [net] sctp: walk the list of asoc safely (Marcelo Leitner) [1679920] {CVE-2019-8956}
  - [net] netfilter: nf_nat: skip nat clash resolution for same-origin entries (Florian Westphal) [1677647]
  - [net] netfilter: nf_conntrack: resolve clash for matching conntracks (Florian Westphal) [1677647]
  - [net] netfilter: nf_tables: fix flush after rule deletion in the same batch (Phil Sutter) [1677672]
  - [net] gro_cell: add napi_disable in gro_cells_destroy (Stefano Brivio) [1674408]
  - [net] sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment (Xin Long) [1669386]
  - [net] ipvs: fix dependency on nf_defrag_ipv6 (Andrea Claudi) [1660808]
  - [net] sctp: check and update stream->out_curr when allocating stream_out (Xin Long) [1651877]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-74.el8]
changelog:
  - [x86] revert "cpu/hotplug: Add SMT policy options" (Josh Poimboeuf) [1683690]
  - [crypto] net: crypto set sk to NULL when af_alg_release (Neil Horman) [1679450] {CVE-2019-8912}
  - [drm] drm/i915/gvt: update force-to-nonpriv register whitelist (Paul Lai) [1643972]
  - [kernel] MODSIGN: Also check platform keyring in mod_verify_sig() (Lenny Szubowicz) [1568532]
  - [kernel] Fix for module sig verification (Lenny Szubowicz) [1568532]
  - [security] efi: Lock down the kernel if booted in secure boot mode (Lenny Szubowicz) [1568532]
  - [firmware] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode (Lenny Szubowicz) [1568532]
  - [x86] Copy secure_boot flag in boot params across kexec reboot (Lenny Szubowicz) [1568532]
  - [fs] debugfs: Restrict debugfs when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [mm] x86/mmiotrace: Lock down the testmmiotrace module (Lenny Szubowicz) [1568532]
  - [kernel] Lock down module params that specify hardware parameters (eg. ioport) (Lenny Szubowicz) [1568532]
  - [tty] Lock down TIOCSSERIAL (Lenny Szubowicz) [1568532]
  - [pcmcia] Prohibit PCMCIA CIS storage when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [acpi] acpi: Disable ACPI table override if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [acpi] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down (Lenny Szubowicz) [1568532]
  - [acpi] ACPI: Limit access to custom_method when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [x86] x86/msr: Restrict MSR access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [x86] x86: Lock down IO port access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [pci] PCI: Lock down BAR access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] uswsusp: Disable when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] hibernate: Disable when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] kexec_load: Disable at runtime if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [char] Restrict /dev/{mem, kmem, port} when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] MODSIGN: Enforce module signatures if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [security] Add a SysRq option to lift kernel lockdown (Lenny Szubowicz) [1568532]
  - [security] Add the ability to lock down access to the running kernel image (Lenny Szubowicz) [1568532]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-75.el8]
changelog:
  - [netdrv] net: hns3: add 8 BD limit for tx flow (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: fix a SSU buffer checking bug (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: aligning buffer size in SSU to 256 bytes (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: getting tx and dv buffer size through firmware (Xiaojun Tan) [1676771]
  - [net] netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs (Florian Westphal) [1676602]
  - [char] ipmi: fix use-after-free of user->release_barrier.rda (Xiaojun Tan) [1677550]
  - [char] ipmi: Prevent use-after-free in deliver_response (Xiaojun Tan) [1677550]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-76.el8]
changelog:
  - [security] revert "Add a SysRq option to lift kernel lockdown" (Lenny Szubowicz) [1684348]
  - [s390] s390/setup: fix boot crash for machine without EDAT-1 (Philipp Rudo) [1677357]
  - [s390] s390/setup: fix early warning messages (Philipp Rudo) [1677357]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-77.el8]
changelog:
  - [firmware] efi: Reduce the amount of memblock reservations for persistent allocations (Bhupesh Sharma) [1682988]
  - [firmware] efi: Permit multiple entries in persistent memreserve data structure (Bhupesh Sharma) [1682988]
  - [kernel] cpu/hotplug: Create SMT sysfs interface for all arches (Josh Poimboeuf) [1686068]
  - [net] netfilter: nft_set_hash: bogus element self comparison from deactivation path (Florian Westphal) [1678574]
  - [net] netfilter: nft_set_hash: fix lookups with fixed size hash on big endian (Florian Westphal) [1678574]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-79.el8]
changelog:
  - [firmware] drivers/firmware: psci_checker: stash and use topology_core_cpumask for hotplug tests (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: re-introduce numa mask check for scheduler MC selection (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: rename llc_siblings to align with other struct members (Josh Poimboeuf) [1687101]
  - [arm64] arm64: smp: remove cpu and numa topology information when hotplugging out CPU (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: restrict updating siblings_masks to online cpus only (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: add support to remove cpu topology sibling masks (Josh Poimboeuf) [1687101]
  - [arm64] arm64: numa: separate out updates to percpu nodeid and NUMA node cpumap (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: refactor reset_cpu_topology to add support for removing topology (Josh Poimboeuf) [1687101]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.el8]
changelog:
  - [arm64] revert "arm64: tlb: Avoid synchronous TLBIs when freeing page tables" (Christoph von Recklinghausen) [1685697]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.1.2.el8_0]
changelog:
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [s390] s390/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [powerpc] powerpc/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add 'mitigations=' support for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [kernel] cpu/speculation: Add 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Fix comment (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add SMT warning message (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [documentation] Documentation: Add MDS vulnerability documentation (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [documentation] Documentation: Move L1TF to separate directory (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Consolidate CPU whitelists (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/msr-index: Cleanup bit defines (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Cast ~SPEC_CTRL_STIBP atomic value to int (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [include] locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [tools] tools include: Adopt linux/bits.h (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.2.1.el8_0]
changelog:
  - [netdrv] qed: Fix qed_mcp_halt|resume() (Manish Chopra) [1704184 1697310]
  - [cpufreq] cpufreq: intel_pstate: Also use CPPC nominal_perf for base_frequency (Prarit Bhargava) [1706739 1696131]
  - [acpi] ACPI / CPPC: Fix guaranteed performance handling (Prarit Bhargava) [1706739 1696131]
  - [arm64] arm64: Add workaround for Fujitsu A64FX erratum 010001 (Mark Langsdorf) [1700902 1666951]
  - [s390] vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem (Cornelia Huck) [1700290 1686044]
  - [netdrv] net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [netdrv] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [pci] PCI: pciehp: Fix re-enabling the slot marked for safe removal (Myron Stowe) [1700288 1695922]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.3.1.el8_0]
changelog:
  - [mm] mm: enforce min addr even if capable() in expand_downwards() (Rafael Aquini) [1708829 1687667] {CVE-2019-9213}
  - [powerpc] powerpc/radix: Fix kernel crash with mremap() (Steve Best) [1708617 1674186]
  - [powerpc] powerpc/security: Fix spectre_v2 reporting (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/powernv: Query firmware for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add support for software count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1708112 1694456]
  - [of] of: __of_detach_node() - remove node from phandle cache (Steve Best) [1708102 1669198]
  - [of] of: of_node_get()/of_node_put() nodes held in phandle cache (Steve Best) [1708102 1669198]
  - [fs] debugfs: Fix EPERM regression from kernel lockdown check (Lenny Szubowicz) [1708100 1686755]
  - [block] nvme: lock NS list changes while handling command effects (David Milburn) [1701140 1672759]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.4.1.el8_0]
changelog:
  - [netdrv] ice: Do autoneg based on VSI state (Jonathan Toppins) [1709433 1687903]
  - [arm64] arm64: apply workaround on A64FX v1r0 (Mark Langsdorf) [1700901 1692306]
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [s390] s390/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [powerpc] powerpc/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add 'mitigations=' support for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kernel] cpu/speculation: Add 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Fix comment (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add SMT warning message (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [documentation] Documentation: Add MDS vulnerability documentation (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [documentation] Documentation: Move L1TF to separate directory (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Consolidate CPU whitelists (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/msr-index: Cleanup bit defines (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Cast ~SPEC_CTRL_STIBP atomic value to int (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [include] locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [tools] tools include: Adopt linux/bits.h (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.4.2.el8_0]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719857 1719858] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719602 1719603] {CVE-2019-11477}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.5.1.el8_0]
changelog:
  - [kernel] sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup (Joel Savitz) [1715345 1695651]
  - [kernel] sched/fair: Fix O(nr_cgroups) in the load balancing path (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Fix insertion in rq->leaf_cfs_rq_list (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Add tmp_alone_branch assertion (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [rpmspec] apply linux-kernel-test.patch when building ("Herton R. Krzesinski") [1715340 1690534]
  - [rpmspec] Fix cross builds (Jiri Olsa) [1715339 1694956]
  - [kernel] sched/fair: Do not re-read ->h_load_next during hierarchical load calculation (Phil Auld) [1715337 1701762]
  - [kvm] KVM: PPC: Book3S HV: Save/restore vrsave register in kvmhv_p9_guest_entry() (Suraj Jitindar Singh) [1714753 1700272]
  - [powerpc] KVM: PPC: Book3S HV: Perserve PSSCR FAKE_SUSPEND bit on guest exit (Suraj Jitindar Singh) [1714751 1689768]
  - [powerpc] powerpc/powernv/ioda: Fix locked_vm counting for memory used by IOMMU tables (David Gibson) [1714746 1674410]
  - [char] ipmi_si: fix use-after-free of resource->name (Tony Camuso) [1714409 1714410] {CVE-2019-11811}
  - [x86] Update stepping values for coffee lake desktop (David Arcari) [1711048 1704800]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.6.1.el8_0]
changelog:
  - [mm] mm: defer ZONE_DEVICE page initialization to the point where we init pgmap (Waiman Long) [1719635 1666538]
  - [mm] mm: create non-atomic version of SetPageReserved for init use (Waiman Long) [1719635 1666538]
  - [mm] mm: provide kernel parameter to allow disabling page init poisoning (Waiman Long) [1719635 1666538]
  - [mm] mm, slub: restore the original intention of prefetch_freepointer() (Rafael Aquini) [1718237 1714671]
  - [security] selinux: do not report error on connect(AF_UNSPEC) (Ondrej Mosnacek) [1717870 1707828]
  - [security] selinux: Check address length before reading address family (Ondrej Mosnacek) [1717870 1707828]
  - [powerpc] powerpc/tm: Fix stack pointer corruption (Desnes Augusto Nunes do Rosario) [1717869 1707635]
  - [md] dm cache metadata: Fix loading discard bitset (Mike Snitzer) [1717868 1701618]
  - [md] dm mpath: fix missing call of path selector type->end_io (Mike Snitzer) [1717804 1686227]
  - [mm] mm/memory.c: do_fault: avoid usage of stale vm_area_struct ("Herton R. Krzesinski") [1717801 1684734]
  - [net] sunrpc: fix 4 more call sites that were using stack memory with a scatterlist (Scott Mayhew) [1717800 1679183]
  - [net] sunrpc: Don't use stack buffer with scatterlist (Scott Mayhew) [1717800 1679183]
  - [scsi] scsi: mpt3sas: Fix kernel panic during expander reset (Tomas Henzl) [1717791 1677693]
  - [security] selinux: always allow mounting submounts (Ondrej Mosnacek) [1717777 1647723]
  - [drm] drm/bufs: Fix Spectre v1 vulnerability (Rob Clark) [1717382 1663467]
  - [drm] drm/ioctl: Fix Spectre v1 vulnerabilities (Rob Clark) [1717382 1663467]
  - [tools] perf annotate: Fix getting source line failure (Michael Petlan) [1716887 1614435]
  - [iommu] iommu/amd: Set exclusion range correctly (Jerry Snitselaar) [1715336 1702766]
  - [iommu] iommu/amd: Reserve exclusion range in iova-domain (Jerry Snitselaar) [1717344 1694835]
  - [kvm] KVM: PPC: Book3S: Add count cache flush parameters to kvmppc_get_cpu_char() (Vitaly Kuznetsov) [1715018 1694456]
  - [s390] kvm: s390: Fix potential spectre warnings (Thomas Huth) [1714754 1702344]
  - [drm] drm/i915/gvt: Fix mmap range check (Alex Williamson) [1713572 1713573] {CVE-2019-11085}
  - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712862 1712863] {CVE-2019-11810}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.7.1.el8_0]
changelog:
  - [x86] Update stepping values for Whiskey Lake U/Y (David Arcari) [1722372 1704801]
  - [x86] x86/perf/amd: Resolve NMI latency issues for active PMCs (David Arcari) [1722367 1640238]
  - [x86] x86/perf/amd: Resolve race condition when disabling PMC (David Arcari) [1722367 1640238]
  - [edac] EDAC/amd64: Set maximum channel layer size depending on family (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Adjust printed chip select sizes when interleaved (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Recognize x16 symbol size (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Support more than two Unified Memory Controllers (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Use a macro for iterating over Unified Memory Controllers (Gary Hook) [1722365 1690984]
  - [edac] EDAC, amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Add Family 17h Model 30h PCI IDs (Aristeu Rozanski) [1722365 1696603]
  - [x86] mark AMD Rome processors supported (David Arcari) [1721972 1520002]
  - [x86] x86/mce: Handle varying MCA bank counts (David Arcari) [1721233 1668779]
  - [iommu] iommu/vt-d: Disable ATS support on untrusted devices (Jerry Snitselaar) [1700376 1692246]
  - [documentation] thunderbolt: Export IOMMU based DMA protection support to userspace (Jerry Snitselaar) [1700376 1692246]
  - [iommu] iommu/vt-d: Do not enable ATS for untrusted devices (Jerry Snitselaar) [1700376 1692246]
  - [iommu] iommu/vt-d: Force IOMMU on for platform opt in hint (Jerry Snitselaar) [1700376 1692246]
  - [pci] PCI / ACPI: Identify untrusted PCI devices (Myron Stowe) [1700376 1704979]
  - [acpi] ACPI / property: Allow multiple property compatible _DSD entries (Myron Stowe) [1700376 1537397]
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719857 1719858] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719602 1719603] {CVE-2019-11477}


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-79.rt9.135.el8]
changelog:
  - [rt] kernel-rt-4.18.0-79.rt9.134.el8 (Juri Lelli) [1503308]
  - [firmware] drivers/firmware: psci_checker: stash and use topology_core_cpumask for hotplug tests (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: re-introduce numa mask check for scheduler MC selection (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: rename llc_siblings to align with other struct members (Josh Poimboeuf) [1687101]
  - [arm64] arm64: smp: remove cpu and numa topology information when hotplugging out CPU (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: restrict updating siblings_masks to online cpus only (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: add support to remove cpu topology sibling masks (Josh Poimboeuf) [1687101]
  - [arm64] arm64: numa: separate out updates to percpu nodeid and NUMA node cpumap (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: refactor reset_cpu_topology to add support for removing topology (Josh Poimboeuf) [1687101]


author: Clark Williams <williams@redhat.com> [4.18.0-80.rt9.136.el8]
changelog:
  - [rt] kernel-rt-4.18.0-80.rt9.135.el8 (Clark Williams) [1503308]
  - [arm64] revert "arm64: tlb: Avoid synchronous TLBIs when freeing page tables" (Christoph von Recklinghausen) [1685697]


author: Clark Williams <williams@redhat.com> [4.18.0-80.1.1.rt9.139.el8_0]
changelog:
  - [rt] kernel-rt-4.18.0-80.1.1.rt9.138.el8_0 (Clark Williams)
  - [zstream] switch to zstream (Frantisek Hrbata)


author: Clark Williams <williams@redhat.com> [4.18.0-80.1.2.rt9.140.el8_0]
changelog:
  - [rt] kernel-rt-4.18.0-80.1.2.rt9.139.el8_0 (Clark Williams)
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [s390] s390/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [powerpc] powerpc/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add 'mitigations=' support for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [kernel] cpu/speculation: Add 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Fix comment (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add SMT warning message (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [documentation] Documentation: Add MDS vulnerability documentation (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [documentation] Documentation: Move L1TF to separate directory (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Consolidate CPU whitelists (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/msr-index: Cleanup bit defines (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Cast ~SPEC_CTRL_STIBP atomic value to int (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [include] locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [tools] tools include: Adopt linux/bits.h (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}


author: Clark Williams <williams@redhat.com> [4.18.0-80.1.2.rt9.144.el8_0]
changelog:
  - [rt] kernel-rt-4.18.0-80.1.2.rt9.143.el8_0 (Clark Williams)
  - [rt] kernel-rt-4.18.0-80.1.2.rt9.142.el8_0.test (Clark Williams)


author: Clark Williams <williams@redhat.com> [4.18.0-80.1.2.rt9.145.el8_0]
changelog:
  - [rt] kernel-rt-4.18.0-80.1.2.rt9.144.el8_0 (Clark Williams)
  - [rhel-rt] fix incorrect build number (Clark Williams)
  - [rt] kernel-rt-4.18.0-80.1.2.rt9.144.el8_0 (Clark Williams)
  - [rt] kernel-rt-4.18.0-80.1.2.rt9.143.el8_0 (Clark Williams)
  - [rt] kernel-rt-4.18.0-80.1.2.rt9.142.el8_0.test (Clark Williams)
  - [rt] kernel-rt-4.18.0-80.1.2.rt9.141.el8_0.test (Clark Williams)
  - [netdrv] qed: Fix qed_mcp_halt|resume() (Manish Chopra) [1704184 1697310]
  - [cpufreq] cpufreq: intel_pstate: Also use CPPC nominal_perf for base_frequency (Prarit Bhargava) [1706739 1696131]
  - [acpi] ACPI / CPPC: Fix guaranteed performance handling (Prarit Bhargava) [1706739 1696131]
  - [arm64] arm64: Add workaround for Fujitsu A64FX erratum 010001 (Mark Langsdorf) [1700902 1666951]
  - [s390] vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem (Cornelia Huck) [1700290 1686044]
  - [netdrv] net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [netdrv] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [pci] PCI: pciehp: Fix re-enabling the slot marked for safe removal (Myron Stowe) [1700288 1695922]


author: Clark Williams <williams@redhat.com> [4.18.0-80.3.1.rt9.147.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.1.2.el8_0 into RT tree as kernel-rt-4.18.0-80.3.1.rt9.146.el8_0 (Clark Williams) [1704955 1678887]
  - [mm] mm: enforce min addr even if capable() in expand_downwards() (Rafael Aquini) [1708829 1687667] {CVE-2019-9213}
  - [powerpc] powerpc/radix: Fix kernel crash with mremap() (Steve Best) [1708617 1674186]
  - [powerpc] powerpc/security: Fix spectre_v2 reporting (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/powernv: Query firmware for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add support for software count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1708112 1694456]
  - [of] of: __of_detach_node() - remove node from phandle cache (Steve Best) [1708102 1669198]
  - [of] of: of_node_get()/of_node_put() nodes held in phandle cache (Steve Best) [1708102 1669198]
  - [fs] debugfs: Fix EPERM regression from kernel lockdown check (Lenny Szubowicz) [1708100 1686755]
  - [block] nvme: lock NS list changes while handling command effects (David Milburn) [1701140 1672759]


author: Clark Williams <williams@redhat.com> [4.18.0-80.4.1.rt9.148.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.4.1.el8_0 into RT tree as kernel-rt-4.18.0-80.4.1.rt9.147.el8_0 (Clark Williams) [1704955 1678887]
  - [rt] Merged RHEL kernel-4.18.0-80.1.2.el8_0 into RT tree as kernel-rt-4.18.0-80.3.1.rt9.146.el8_0 (Clark Williams) [1704955 1678887]
  - Merged RHEL v4.18 into RT tree as kernel-rt-4.18.0-80.2.1.rt9.145.el8_0 (Clark Williams) [1704955 1678887]
  - [netdrv] ice: Do autoneg based on VSI state (Jonathan Toppins) [1709433 1687903]
  - [arm64] arm64: apply workaround on A64FX v1r0 (Mark Langsdorf) [1700901 1692306]
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [s390] s390/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [powerpc] powerpc/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add 'mitigations=' support for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kernel] cpu/speculation: Add 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Fix comment (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add SMT warning message (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [documentation] Documentation: Add MDS vulnerability documentation (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [documentation] Documentation: Move L1TF to separate directory (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Consolidate CPU whitelists (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/msr-index: Cleanup bit defines (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Cast ~SPEC_CTRL_STIBP atomic value to int (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [include] locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [tools] tools include: Adopt linux/bits.h (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [mm] mm: enforce min addr even if capable() in expand_downwards() (Rafael Aquini) [1708829 1687667] {CVE-2019-9213}
  - [powerpc] powerpc/radix: Fix kernel crash with mremap() (Steve Best) [1708617 1674186]
  - [powerpc] powerpc/security: Fix spectre_v2 reporting (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/powernv: Query firmware for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add support for software count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1708112 1694456]
  - [of] of: __of_detach_node() - remove node from phandle cache (Steve Best) [1708102 1669198]
  - [of] of: of_node_get()/of_node_put() nodes held in phandle cache (Steve Best) [1708102 1669198]
  - [fs] debugfs: Fix EPERM regression from kernel lockdown check (Lenny Szubowicz) [1708100 1686755]
  - [block] nvme: lock NS list changes while handling command effects (David Milburn) [1701140 1672759]
  - [netdrv] qed: Fix qed_mcp_halt|resume() (Manish Chopra) [1704184 1697310]
  - [cpufreq] cpufreq: intel_pstate: Also use CPPC nominal_perf for base_frequency (Prarit Bhargava) [1706739 1696131]
  - [acpi] ACPI / CPPC: Fix guaranteed performance handling (Prarit Bhargava) [1706739 1696131]
  - [arm64] arm64: Add workaround for Fujitsu A64FX erratum 010001 (Mark Langsdorf) [1700902 1666951]
  - [s390] vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem (Cornelia Huck) [1700290 1686044]
  - [netdrv] net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [netdrv] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [pci] PCI: pciehp: Fix re-enabling the slot marked for safe removal (Myron Stowe) [1700288 1695922]


author: Clark Williams <williams@redhat.com> [4.18.0-80.4.1.rt9.149.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.4.1.el8_0 into RT tree as kernel-rt-4.18.0-80.4.1.rt9.148.el8_0 (Clark Williams) [1704955 1678887]


author: Clark Williams <williams@redhat.com> [4.18.0-80.4.1.rt9.150.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.4.1.el8_0 into RT tree as kernel-rt-4.18.0-80.4.1.rt9.149.el8_0 (Clark Williams) [1704955 1678887]


author: Clark Williams <williams@redhat.com> [4.18.0-80.5.1.rt9.151.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.5.1.el8_0 into RT tree as kernel-rt-4.18.0-80.5.1.rt9.150.el8_0 (Clark Williams) [1704955 1678887]
  - [kernel] sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup (Joel Savitz) [1715345 1695651]
  - [kernel] sched/fair: Fix O(nr_cgroups) in the load balancing path (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Fix insertion in rq->leaf_cfs_rq_list (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Add tmp_alone_branch assertion (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [rpmspec] apply linux-kernel-test.patch when building ("Herton R. Krzesinski") [1715340 1690534]
  - [rpmspec] Fix cross builds (Jiri Olsa) [1715339 1694956]
  - [kernel] sched/fair: Do not re-read ->h_load_next during hierarchical load calculation (Phil Auld) [1715337 1701762]
  - [kvm] KVM: PPC: Book3S HV: Save/restore vrsave register in kvmhv_p9_guest_entry() (Suraj Jitindar Singh) [1714753 1700272]
  - [powerpc] KVM: PPC: Book3S HV: Perserve PSSCR FAKE_SUSPEND bit on guest exit (Suraj Jitindar Singh) [1714751 1689768]
  - [powerpc] powerpc/powernv/ioda: Fix locked_vm counting for memory used by IOMMU tables (David Gibson) [1714746 1674410]
  - [char] ipmi_si: fix use-after-free of resource->name (Tony Camuso) [1714409 1714410] {CVE-2019-11811}
  - [x86] Update stepping values for coffee lake desktop (David Arcari) [1711048 1704800]


author: Clark Williams <williams@redhat.com> [4.18.0-80.6.1.rt9.152.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.6.1.el8_0 into RT tree as kernel-rt-4.18.0-80.6.1.rt9.151.el8_0 (Clark Williams) [1717516 1678887]
  - [mm] mm: defer ZONE_DEVICE page initialization to the point where we init pgmap (Waiman Long) [1719635 1666538]
  - [mm] mm: create non-atomic version of SetPageReserved for init use (Waiman Long) [1719635 1666538]
  - [mm] mm: provide kernel parameter to allow disabling page init poisoning (Waiman Long) [1719635 1666538]
  - [mm] mm, slub: restore the original intention of prefetch_freepointer() (Rafael Aquini) [1718237 1714671]
  - [security] selinux: do not report error on connect(AF_UNSPEC) (Ondrej Mosnacek) [1717870 1707828]
  - [security] selinux: Check address length before reading address family (Ondrej Mosnacek) [1717870 1707828]
  - [powerpc] powerpc/tm: Fix stack pointer corruption (Desnes Augusto Nunes do Rosario) [1717869 1707635]
  - [md] dm cache metadata: Fix loading discard bitset (Mike Snitzer) [1717868 1701618]
  - [md] dm mpath: fix missing call of path selector type->end_io (Mike Snitzer) [1717804 1686227]
  - [mm] mm/memory.c: do_fault: avoid usage of stale vm_area_struct ("Herton R. Krzesinski") [1717801 1684734]
  - [net] sunrpc: fix 4 more call sites that were using stack memory with a scatterlist (Scott Mayhew) [1717800 1679183]
  - [net] sunrpc: Don't use stack buffer with scatterlist (Scott Mayhew) [1717800 1679183]
  - [scsi] scsi: mpt3sas: Fix kernel panic during expander reset (Tomas Henzl) [1717791 1677693]
  - [security] selinux: always allow mounting submounts (Ondrej Mosnacek) [1717777 1647723]
  - [drm] drm/bufs: Fix Spectre v1 vulnerability (Rob Clark) [1717382 1663467]
  - [drm] drm/ioctl: Fix Spectre v1 vulnerabilities (Rob Clark) [1717382 1663467]
  - [tools] perf annotate: Fix getting source line failure (Michael Petlan) [1716887 1614435]
  - [iommu] iommu/amd: Set exclusion range correctly (Jerry Snitselaar) [1715336 1702766]
  - [iommu] iommu/amd: Reserve exclusion range in iova-domain (Jerry Snitselaar) [1717344 1694835]
  - [kvm] KVM: PPC: Book3S: Add count cache flush parameters to kvmppc_get_cpu_char() (Vitaly Kuznetsov) [1715018 1694456]
  - [s390] kvm: s390: Fix potential spectre warnings (Thomas Huth) [1714754 1702344]
  - [drm] drm/i915/gvt: Fix mmap range check (Alex Williamson) [1713572 1713573] {CVE-2019-11085}
  - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712862 1712863] {CVE-2019-11810}
  - [rhel-rt] update Makefile.common for z-stream batch#2 (Clark Williams)


author: Clark Williams <williams@redhat.com> [4.18.0-80.7.1.rt9.153.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.7.1.el8_0 into RT tree as kernel-rt-4.18.0-80.7.1.rt9.152.el8_0 (Clark Williams) [1717516 1678887]
  - [x86] Update stepping values for Whiskey Lake U/Y (David Arcari) [1722372 1704801]
  - [x86] x86/perf/amd: Resolve NMI latency issues for active PMCs (David Arcari) [1722367 1640238]
  - [x86] x86/perf/amd: Resolve race condition when disabling PMC (David Arcari) [1722367 1640238]
  - [edac] EDAC/amd64: Set maximum channel layer size depending on family (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Adjust printed chip select sizes when interleaved (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Recognize x16 symbol size (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Support more than two Unified Memory Controllers (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Use a macro for iterating over Unified Memory Controllers (Gary Hook) [1722365 1690984]
  - [edac] EDAC, amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Add Family 17h Model 30h PCI IDs (Aristeu Rozanski) [1722365 1696603]
  - [x86] mark AMD Rome processors supported (David Arcari) [1721972 1520002]
  - [x86] x86/mce: Handle varying MCA bank counts (David Arcari) [1721233 1668779]
  - [iommu] iommu/vt-d: Disable ATS support on untrusted devices (Jerry Snitselaar) [1700376 1692246]
  - [documentation] thunderbolt: Export IOMMU based DMA protection support to userspace (Jerry Snitselaar) [1700376 1692246]
  - [iommu] iommu/vt-d: Do not enable ATS for untrusted devices (Jerry Snitselaar) [1700376 1692246]
  - [iommu] iommu/vt-d: Force IOMMU on for platform opt in hint (Jerry Snitselaar) [1700376 1692246]
  - [pci] PCI / ACPI: Identify untrusted PCI devices (Myron Stowe) [1700376 1704979]
  - [acpi] ACPI / property: Allow multiple property compatible _DSD entries (Myron Stowe) [1700376 1537397]
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719857 1719858] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719602 1719603] {CVE-2019-11477}


author: Clark Williams <williams@redhat.com> [4.18.0-80.10.1.rt9.154.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.10.1.el8_0 into RT tree as kernel-rt-4.18.0-80.10.1.rt9.153.el8_0 (Clark Williams) [1717516 1678887]
  - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [netdrv] thunderx: eliminate extra calls to put_page() for pages held for recycling (Dean Nelson) [1726354 1644011]
  - [netdrv] thunderx: enable page recycling for non-XDP case (Dean Nelson) [1726354 1644011]
  - [arm64] arm64: kaslr: ensure randomized quantities are clean also when kaslr is off (Mark Salter) [1726357 1673068]
  - [arm64] arm64: kaslr: ensure randomized quantities are clean to the PoC (Mark Salter) [1726357 1673068]
  - [mm] powerpc/mm/64s/hash: Reallocate context ids on fork (Gustavo Duarte) [1734689 1723808] {CVE-2019-12817}
  - [powerpc] powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/pseries/mobility: prevent cpu hotplug during DT update (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/watchpoint: Restore NV GPRs while returning from exception (Steve Best) [1733281 1728557]
  - [hid] HID: i2c-hid: Don't reset device upon system resume (Perry Yuan) [1727098 1715385]
  - [netdrv] net/mlx5e: RX, Verify MPWQE stride size is in range (Alaa Hleihel) [1726372 1683589]
  - [sound] ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c (Jaroslav Kysela) [1726371 1658924] {CVE-2018-19824}
  - [sound] ALSA: hda - Enable runtime PM only for discrete GPU (Jaroslav Kysela) [1726361 1714817]
  - [cpufreq] cpufreq: intel_pstate: Ignore turbo active ratio in HWP (David Arcari) [1726360 1711970]
  - [infiniband] usnic_verbs: fix deadlock (Govindarajulu Varadarajan) [1726358 1688505]
  - [infiniband] IB/usnic: Fix locking when unregistering (Govindarajulu Varadarajan) [1726358 1688505]
  - [infiniband] IB/usnic: Fix potential deadlock (Govindarajulu Varadarajan) [1726358 1688505]
  - [netdrv] igb: shorten maximum PHC timecounter update interval (Corinna Vinschen) [1726352 1637098]
  - [netdrv] igb: shorten maximum PHC timecounter update interval (Corinna Vinschen) [1726352 1637098]
  - [x86] x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls (Frank Ramsay) [1724534 1677695]
  - [security] selinux: overhaul sidtab to fix bug and improve performance (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: use separate table for initial SID lookup (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: refactor sidtab conversion (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in sidtab (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in services (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in policydb (Ondrej Mosnacek) [1717780 1656787]
  - [crypto] crypto: authenc - fix parsing key with misaligned rta_len (Herbert Xu) [1715335 1707546]
  - [mm] mm, page_alloc: fix has_unmovable_pages for HugePages (David Gibson) [1714758 1688114]
  - [wireless] mwifiex: Abort at too short BSS descriptor element (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}
  - [wireless] mwifiex: Fix possible buffer overflows at parsing bss descriptor (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}
  - [nvme] nvme-pci: add missing unlock for reset error (Gopal Tiwari) [1712261 1703201]
  - [nvme] nvme-pci: fix rapid add remove sequence (Gopal Tiwari) [1712261 1703201]
  - [wireless] brcmfmac: add subtype check for event handling in data path (Stanislaw Gruszka) [1733895 1704684] {CVE-2019-9503}
  - [wireless] brcmfmac: assure SSID length from firmware is limited (Stanislaw Gruszka) [1705385 1705386] {CVE-2019-9500}
  - [include] fs: fix kABI for struct pipe_buf_operations (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [fs] fs: prevent page refcount overflow in pipe_buf_get (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [include] mm: add 'try_get_page()' helper function (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [include] mm: make page ref count overflow check tighter and more explicit (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [fs] fuse: call pipe_buf_release() under pipe lock (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [kvm] KVM: x86: nVMX: fix x2APIC VTPR read intercept (Vitaly Kuznetsov) [1697198 1697199]
  - [kvm] KVM: x86: nVMX: close leak of L0's x2APIC MSRs (CVE-2019-3887) (Vitaly Kuznetsov) [1697198 1697199]
  - [documentation] Documentation: Add ARM64 to kernel-parameters.rst (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbs: Don't treat CPUs with SSBS as unaffected by SSB (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: enable generic CPU vulnerabilites support (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for speculative store bypass (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Always enable ssb vulnerability detection (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for spectre-v2 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Always enable spectre-v2 vulnerability detection (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Use firmware to detect CPUs that are not affected by Spectre-v2 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Advertise mitigation of Spectre-v2, or lack thereof (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for meltdown (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Add sysfs vulnerability show for spectre-v1 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Provide a command line to disable spectre_v2 mitigation (Jeremy Linton) [1726353 1640855]
  - [documentation] powerpc/fsl: Add FSL_PPC_BOOK3E as supported arch for nospectre_v2 boot arg (Jeremy Linton) [1726353 1640855]
  - [documentation] Documentation: Document arm64 kpti control (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Whitelist HiSilicon Taishan v110 CPUs (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Add MIDR encoding for HiSilicon Taishan CPUs (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Update arm64_kernel_use_ng_mappings() when forced on (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Avoid rewriting early page tables when KASLR is enabled (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: capabilities: Merge duplicate Cavium erratum entries (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: capabilities: Merge entries for ARM64_WORKAROUND_CLEAN_CACHE (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Use a raw spinlock in __install_bp_hardening_cb() (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: KVM: Guests can skip __install_bp_hardening_cb()s HYP work (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: fix SSBS sanitization (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: don't zero DIT on signal return (Jeremy Linton) [1726353 1640855]
  - [kvm] KVM: arm64: Set SCTLR_EL2.DSSBS if SSBD is forcefully disabled and !vhe (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbd: Add support for PSTATE.SSBS rather than trapping to EL3 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbd: Drop #ifdefs for PR_SPEC_STORE_BYPASS (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: cpufeature: Detect SSBS and advertise to userspace (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: move SCTLR_EL{1,2} assertions to <asm/sysreg.h> (Jeremy Linton) [1726353 1640855]
  - Revert: [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1726353 1640855] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kernel] ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME (Aristeu Rozanski) [1730958 1730959] {CVE-2019-13272}


author: Clark Williams <williams@redhat.com> [4.18.0-80.10.1.rt9.155.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.10.1.el8_0 into RT tree as kernel-rt-4.18.0-80.10.1.rt9.154.el8_0 (Clark Williams) [1734475 1678887]
  - mm/zswap: Do not disable preemption in zswap_frontswap_store() ("Luis Claudio R. Goncalves") [1726362 1724657]


author: Clark Williams <williams@redhat.com> [4.18.0-80.11.1.rt9.156.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.11.1.el8_0 into RT tree as kernel-rt-4.18.0-80.11.1.rt9.155.el8_0 (Clark Williams) [1734475 1678887]
  - [wireless] mwifiex: Don't abort on small, spec-compliant vendor IEs (Jarod Wilson) [1714475 1728992]
  - [wireless] mwifiex: fix 802.11n/WPA detection (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}


author: Clark Williams <williams@redhat.com> [4.18.0-80.11.2.rt9.157.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.11.2.el8_0 into RT tree as kernel-rt-4.18.0-80.11.2.rt9.156.el8_0 (Clark Williams) [1734475 1678887]
  - [vhost] vhost: make sure log_num < in_num (=?UTF-8?q?Eugenio=20P=C3=A9rez?=) [1750881 1750882] {CVE-2019-14835}


author: Clark Williams <williams@redhat.com> [4.18.0-80.2.1.rt9.146.el8_0]
changelog:
  - Merged RHEL v4.18 into RT tree as kernel-rt-4.18.0-80.2.1.rt9.145.el8_0 (Clark Williams) [1704955 1678887]
  - [netdrv] qed: Fix qed_mcp_halt|resume() (Manish Chopra) [1704184 1697310]
  - [cpufreq] cpufreq: intel_pstate: Also use CPPC nominal_perf for base_frequency (Prarit Bhargava) [1706739 1696131]
  - [acpi] ACPI / CPPC: Fix guaranteed performance handling (Prarit Bhargava) [1706739 1696131]
  - [arm64] arm64: Add workaround for Fujitsu A64FX erratum 010001 (Mark Langsdorf) [1700902 1666951]
  - [s390] vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem (Cornelia Huck) [1700290 1686044]
  - [netdrv] net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [netdrv] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [pci] PCI: pciehp: Fix re-enabling the slot marked for safe removal (Myron Stowe) [1700288 1695922]


author: Clark Williams <williams@redhat.com> [4.18.0-80.4.2.rt9.151.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.4.2.el8_0 into RT tree as kernel-rt-4.18.0-80.4.2.rt9.150.el8_0 (Clark Williams) [1704955 1678887]
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719857 1719858] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719602 1719603] {CVE-2019-11477}


author: Clark Williams <williams@redhat.com> [4.18.0-80.4.2.rt9.152.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.4.2.el8_0 into RT tree as kernel-rt-4.18.0-80.4.2.rt9.151.el8_0 (Clark Williams) [1704955 1678887]


author: Clark Williams <williams@redhat.com> [4.18.0-80.7.2.rt9.154.el8_0]
changelog:
  - [rt] Merged RHEL kernel-4.18.0-80.7.2.el8_0 into RT tree as kernel-rt-4.18.0-80.7.2.rt9.153.el8_0 (Clark Williams) [1717516 1678887]
  - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [kernel] ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME (Aristeu Rozanski) [1730958 1730959] {CVE-2019-13272}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.8.1.el8_0]
changelog:
  - [documentation] Documentation: Add ARM64 to kernel-parameters.rst (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbs: Don't treat CPUs with SSBS as unaffected by SSB (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: enable generic CPU vulnerabilites support (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for speculative store bypass (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Always enable ssb vulnerability detection (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for spectre-v2 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Always enable spectre-v2 vulnerability detection (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Use firmware to detect CPUs that are not affected by Spectre-v2 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Advertise mitigation of Spectre-v2, or lack thereof (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for meltdown (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Add sysfs vulnerability show for spectre-v1 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Provide a command line to disable spectre_v2 mitigation (Jeremy Linton) [1726353 1640855]
  - [documentation] powerpc/fsl: Add FSL_PPC_BOOK3E as supported arch for nospectre_v2 boot arg (Jeremy Linton) [1726353 1640855]
  - [documentation] Documentation: Document arm64 kpti control (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Whitelist HiSilicon Taishan v110 CPUs (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Add MIDR encoding for HiSilicon Taishan CPUs (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Update arm64_kernel_use_ng_mappings() when forced on (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Avoid rewriting early page tables when KASLR is enabled (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: capabilities: Merge duplicate Cavium erratum entries (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: capabilities: Merge entries for ARM64_WORKAROUND_CLEAN_CACHE (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Use a raw spinlock in __install_bp_hardening_cb() (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: KVM: Guests can skip __install_bp_hardening_cb()s HYP work (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: fix SSBS sanitization (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: don't zero DIT on signal return (Jeremy Linton) [1726353 1640855]
  - [kvm] KVM: arm64: Set SCTLR_EL2.DSSBS if SSBD is forcefully disabled and !vhe (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbd: Add support for PSTATE.SSBS rather than trapping to EL3 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbd: Drop #ifdefs for PR_SPEC_STORE_BYPASS (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: cpufeature: Detect SSBS and advertise to userspace (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: move SCTLR_EL{1,2} assertions to <asm/sysreg.h> (Jeremy Linton) [1726353 1640855]
  - Revert: [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1726353 1640855] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kernel] ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME (Aristeu Rozanski) [1730958 1730959] {CVE-2019-13272}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.9.1.el8_0]
changelog:
  - [netdrv] thunderx: eliminate extra calls to put_page() for pages held for recycling (Dean Nelson) [1726354 1644011]
  - [netdrv] thunderx: enable page recycling for non-XDP case (Dean Nelson) [1726354 1644011]
  - [arm64] arm64: kaslr: ensure randomized quantities are clean also when kaslr is off (Mark Salter) [1726357 1673068]
  - [arm64] arm64: kaslr: ensure randomized quantities are clean to the PoC (Mark Salter) [1726357 1673068]
  - [mm] powerpc/mm/64s/hash: Reallocate context ids on fork (Gustavo Duarte) [1734689 1723808] {CVE-2019-12817}
  - [powerpc] powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/pseries/mobility: prevent cpu hotplug during DT update (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/watchpoint: Restore NV GPRs while returning from exception (Steve Best) [1733281 1728557]
  - [hid] HID: i2c-hid: Don't reset device upon system resume (Perry Yuan) [1727098 1715385]
  - [netdrv] net/mlx5e: RX, Verify MPWQE stride size is in range (Alaa Hleihel) [1726372 1683589]
  - [sound] ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c (Jaroslav Kysela) [1726371 1658924] {CVE-2018-19824}
  - [sound] ALSA: hda - Enable runtime PM only for discrete GPU (Jaroslav Kysela) [1726361 1714817]
  - [cpufreq] cpufreq: intel_pstate: Ignore turbo active ratio in HWP (David Arcari) [1726360 1711970]
  - [infiniband] usnic_verbs: fix deadlock (Govindarajulu Varadarajan) [1726358 1688505]
  - [infiniband] IB/usnic: Fix locking when unregistering (Govindarajulu Varadarajan) [1726358 1688505]
  - [infiniband] IB/usnic: Fix potential deadlock (Govindarajulu Varadarajan) [1726358 1688505]
  - [netdrv] igb: shorten maximum PHC timecounter update interval (Corinna Vinschen) [1726352 1637098]
  - [netdrv] igb: shorten maximum PHC timecounter update interval (Corinna Vinschen) [1726352 1637098]
  - [x86] x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls (Frank Ramsay) [1724534 1677695]
  - [security] selinux: overhaul sidtab to fix bug and improve performance (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: use separate table for initial SID lookup (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: refactor sidtab conversion (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in sidtab (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in services (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in policydb (Ondrej Mosnacek) [1717780 1656787]
  - [crypto] crypto: authenc - fix parsing key with misaligned rta_len (Herbert Xu) [1715335 1707546]
  - [mm] mm, page_alloc: fix has_unmovable_pages for HugePages (David Gibson) [1714758 1688114]
  - [wireless] mwifiex: Abort at too short BSS descriptor element (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}
  - [wireless] mwifiex: Fix possible buffer overflows at parsing bss descriptor (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}
  - [nvme] nvme-pci: add missing unlock for reset error (Gopal Tiwari) [1712261 1703201]
  - [nvme] nvme-pci: fix rapid add remove sequence (Gopal Tiwari) [1712261 1703201]
  - [wireless] brcmfmac: add subtype check for event handling in data path (Stanislaw Gruszka) [1733895 1704684] {CVE-2019-9503}
  - [wireless] brcmfmac: assure SSID length from firmware is limited (Stanislaw Gruszka) [1705385 1705386] {CVE-2019-9500}
  - [include] fs: fix kABI for struct pipe_buf_operations (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [fs] fs: prevent page refcount overflow in pipe_buf_get (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [include] mm: add 'try_get_page()' helper function (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [include] mm: make page ref count overflow check tighter and more explicit (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [fs] fuse: call pipe_buf_release() under pipe lock (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [kvm] KVM: x86: nVMX: fix x2APIC VTPR read intercept (Vitaly Kuznetsov) [1697198 1697199]
  - [kvm] KVM: x86: nVMX: close leak of L0's x2APIC MSRs (CVE-2019-3887) (Vitaly Kuznetsov) [1697198 1697199]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.10.1.el8_0]
changelog:
  - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.11.1.el8_0]
changelog:
  - [wireless] mwifiex: Don't abort on small, spec-compliant vendor IEs (Jarod Wilson) [1714475 1728992]
  - [wireless] mwifiex: fix 802.11n/WPA detection (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.7.2.el8_0]
changelog:
  - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [kernel] ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME (Aristeu Rozanski) [1730958 1730959] {CVE-2019-13272}


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.10-6
changelog:
  - Rebase to libguestfs 1.36.10 in RHEL 7.5.
    resolves: rhbz#1472272
  - Build against OCaml 4.05
    resolves: rhbz#1447981
  - Enable the copyonread flag when running the appliance using libvirt.
    resolves: rhbz#1466563
  - Make sure kernel-rt is never used as Requires.
    resolves: rhbz#1471651
  - v2v: disable unconfiguration of manually installed VMware tools.
    resolves: rhbz#1477905
  - v2v: prefer pigz or pxz for uncompressing OVA files, if available
    resolves: rhbz#1448739
  - resize: handle empty UUIDs for swap partitions
    resolves: rhbz#1482737
  - v2v: remove mention of --dcpath in an error message
    resolves: rhbz#1486197
  - Disables the QEMU image file locking when opening disks as read-only
    resolves: rhbz#1417306
    resolves: rhbz#1503497
  - Briefly document the format used for URIs
    resolves: rhbz#1450325
  - v2v: deal with grub2 configurations without a default set
    resolves: rhbz#1472288
  - v2v: warn when a guest has passthrough devices
    resolves: rhbz#1472719
  - v2v: fix three regular expressions
    resolves: rhbz#1494555
  - v2v: enable conversion of full-disk LUKS-encrypted Linux guests
    resolves: rhbz#1451665
  - v2v: new 'vddk' import method
    resolves: rhbz#1477912
    resolves: rhbz#1513884
  - Enable libguestfs to work on z Systems
    resolves: rhbz#1479526
  - p2v: fx check for sudo requiring a password
    resolves: rhbz#1500673
  - v2v: handle disks with snapshots in vCenter
    resolves: rhbz#1172425
  - rescue: backport improved version
    resolves: rhbz#1438710
  - v2v: improve bootloader detection
    resolves: rhbz#1508299
  - v2v: parse MAC address of network interfaces in OVF files
    resolves: rhbz#1506572
  - Unconditionally depend on libvirt-daemon-kvm >= 3.9.0-1, which will always
    pull the right qemu-kvm too, and thus remove the unversioned dependencies
    on it
    resolves: rhbz#1500870
  - v2v: fix RPM file owned test
    resolves: rhbz#1503958
  - Do not open read-only disks using <shareable/> in the libvirt backend
    resolves: rhbz#1518517
  - v2v: handle better when grubby does not report any default kernel
    resolves: rhbz#1519204
  - v2v: enhance vmx import method to access via SSH
    resolves: rhbz#1523767
  - builder: fix caching of templates when using --cache-all-templates
    resolves: rhbz#1523650


author: Richard W.M. Jones <rjones@redhat.com> - 7.1-2
changelog:
  - New package for RHEL 7.1
  - Rebase to ntfs-3g 2014.2.15
    resolves: rhbz#1100319
  - Change the package so it works with supermin5.
  - Remove dependency on external FUSE.


author: Richard W.M. Jones <rjones@redhat.com> - 7.2-2
changelog:
  - Fix for handling guest filenames with invalid or incomplete
    multibyte or wide characters
    resolves: rhbz#1301593


author: Richard W.M. Jones <rjones@redhat.com> - 8.0-1
changelog:
  - Rebase to 2017.3.23.
  - Remove patches which are now upstream.
  - Resynch with Fedora package.
  - Enable all architectures for RHEL 8.


author: Cole Robinson <crobinso@redhat.com> - 1.18.0-2
changelog:
  - Fix rdma deps and don't restrict archs
  - Add --disable-werror to fix gcc8 build (bz #1556044)
  - Spec file cleanups (bz #1483290)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.18.0-5.el8
changelog:
  - libiscsi-iser_rcv_completion-unify-error-handling.patch [bz#1634541]
  - libiscsi-iser-fix-posting-of-receive-descriptors.patch [bz#1634541]
  - libiscsi-sync-remove-unnecessary-checks.patch [bz#1634541]
  - libiscsi-do-not-warn-for-strncpy.patch [bz#1634541]
  - libiscsi-avoid-fallthrough.patch [bz#1634541]
  - libiscsi-avoid-truncation-when-logging-message-that-includes-.patch [bz#1634541]
  - Resolves: bz#1634541
    (Fix important coverity issues (libiscsi))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> -
changelog:
  - libiscsi-fix-connection-to-LUN-with-IPv6-address.patch [bz#1597942]
  - Resolves: bz#1597942
    (Qemu-kvm fails to connect to iscsi LUN by IPV6 address)


author: Steve Dickson <steved@redhat.com> 2.3.3-8
changelog:
  - Update junction code with latest upstream code (1543126)
  - Make sure /etc/sysconfig/nfs is immutabl (1639432)


author: Steve Dickson <steved@redhat.com> 2.3.3-12
changelog:
  - Change nfsconvert.sh not to set the immutable bit (bz 1673685)
  - Change nfsconvert.py not to create the new dummy /etc/sysconfig/nfs (bz 1673685)


author: Steve Dickson <steved@redhat.com> 2.3.3-14_0
changelog:
  - Add nfs.conf equivalent for the statd --no-notify cmdline option (1690280)
  - Correct the modes on /etc/nfs.conf after a conversion (bz 1690266)


author: Paul Howarth <paul@city-fan.org> - 1.8.0-1
changelog:
  - Update to 1.8.0
    - Added a basic dockerised test suite
    - crypto: Add support for the mbedTLS backend
    - See RELEASE-NOTES for details of bug fixes


author: Paul Howarth <paul@city-fan.org> - 1.8.0-5
changelog:
  - scp: Do not NUL-terminate the command for remote exec (#1489736, GH#208)
  - Make devel package dependency on main package arch-specific
  - Drop EL-5 support
    - noarch sub-packages always available now
    - Drop legacy Group: and BuildRoot: tags
    - Drop explicit buildroot cleaning
    - %{__isa_bits} always defined now


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-7.el8_0.1
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-15
changelog:
  - virfile: Take symlink into account in virFileIsSharedFixFUSE (rhbz#1634782)
  - qemu: Ignore nwfilter binding instantiation issues during reconnect (rhbz#1648544)
  - qemu: Set identity for the reconnect all thread (rhbz#1648546)
  - Revert "access: Modify the VIR_ERR_ACCESS_DENIED to include driverName" (rhbz#1631608)
  - access: Modify the VIR_ERR_ACCESS_DENIED to include driverName (rhbz#1631608)
  - qemu: add vfio-ap capability (rhbz#1508146)
  - qemu: vfio-ap device support (rhbz#1508146)
  - qemu: Extract MDEV VFIO PCI validation code into a separate helper (rhbz#1508146)
  - conf: Move VFIO AP validation from post parse to QEMU validation code (rhbz#1508146)
  - qemu: Fix post-copy migration on the source (rhbz#1649169)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-16
changelog:
  - util: Don't overflow in virRandomBits (rhbz#1655586)
  - virrandom: Avoid undefined behaviour in virRandomBits (rhbz#1655586)
  - spec: remove libcgroup and cgconfig (rhbz#1602407)
  - qemu: Drop duplicated code from qemuDomainDefValidateFeatures() (rhbz#1647822)
  - tests: Add capabilities data for QEMU 3.1.0 on ppc64 (rhbz#1647822)
  - qemu: Introduce QEMU_CAPS_MACHINE_PSERIES_CAP_NESTED_HV (rhbz#1647822)
  - conf: Parse and format nested-hv feature (rhbz#1647822)
  - qemu: Format nested-hv feature on the command line (rhbz#1647822)
  - qemu: Add check for whether KVM nesting is enabled (rhbz#1645139)
  - secret: Add check/validation for correct usage when LookupByUUID (rhbz#1656255)
  - cpu: Add support for "stibp" x86_64 feature (rhbz#1655032)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-17
changelog:
  - virsh: Strip XML declaration when extracting CPU XMLs (rhbz#1659048)
  - RHEL: qemu: Add ability to set sgio values for hostdev (rhbz#1582424)
  - RHEL: qemu: Add check for unpriv sgio for SCSI generic host device (rhbz#1582424)
  - qemu: Alter @val usage in qemuSetUnprivSGIO (rhbz#1656362)
  - qemu: Alter qemuSetUnprivSGIO hostdev shareable logic (rhbz#1656362)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-18
changelog:
  - conf: correct false boot order error during domain parse (rhbz#1630393)
  - qemu: Remove duplicated qemuAgentCheckError (rhbz#1665000)
  - qemu: require reply from guest agent in qemuAgentGetInterfaces (rhbz#1665000)
  - qemu: Filter non SCSI hostdevs in qemuHostdevPrepareSCSIDevices (rhbz#1665244)
  - util: remove const specifier from nlmsghdr arg to virNetlinkDumpCallback() (rhbz#1583131)
  - util: add a function to insert new interfaces to IPv6CheckForwarding list (rhbz#1583131)
  - util: use nlmsg_find_attr() instead of an open-coded loop (rhbz#1583131)
  - util: check accept_ra for all nexthop interfaces of multipath routes (rhbz#1583131)
  - util: make forgotten changes suggested during review of commit d40b820c (rhbz#1583131)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-19
changelog:
  - qemu: Fix logic error in qemuSetUnprivSGIO (rhbz#1666605)
  - tests: qemuxml2argv: Add test case for empty CDROM with cache mode (rhbz#1553255)
  - qemu: command: Don't format image properties for empty -drive (rhbz#1553255)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-21
changelog:
  - docs: Drop /dev/net/tun from the list of shared devices (rhbz#1665400)
  - qemu: conf: Remove /dev/sev from the default cgroup device acl list (rhbz#1665400)
  - qemu: cgroup: Expose /dev/sev/ only to domains that require SEV (rhbz#1665400)
  - qemu: domain: Add /dev/sev into the domain mount namespace selectively (rhbz#1665400)
  - security: dac: Relabel /dev/sev in the namespace (rhbz#1665400)
  - qemu: caps: Use CAP_DAC_OVERRIDE for probing to avoid permission issues (rhbz#1665400)
  - qemu: caps: Don't try to ask for CAP_DAC_OVERRIDE if non-root (rhbz#1665400)
  - Revert "RHEL: Require firewalld-filesystem for firewalld rpm macros" (rhbz#1650320)
  - Revert "RHEL: network: regain guest network connectivity after firewalld switch to nftables" (rhbz#1650320)
  - configure: change HAVE_FIREWALLD to WITH_FIREWALLD (rhbz#1650320)
  - util: move all firewalld-specific stuff into its own files (rhbz#1650320)
  - util: new virFirewallD APIs + docs (rhbz#1650320)
  - configure: selectively install a firewalld 'libvirt' zone (rhbz#1650320)
  - network: set firewalld zone of bridges to "libvirt" zone when appropriate (rhbz#1650320)
  - network: allow configuring firewalld zone for virtual network bridge device (rhbz#1650320)
  - util: remove test code accidentally committed to virFirewallDZoneExists (rhbz#1650320)
  - qemu: command: Don't skip 'readonly' and throttling info for empty drive (rhbz#1670337)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-23.1.el8
changelog:
  - cpu_x86: Do not cache microcode version (CVE-2018-12130, CVE-2018-12126, CVE-2018-11091, CVE-2018-12127)
  - qemu: Don't cache microcode version (CVE-2018-12130, CVE-2018-12126, CVE-2018-11091, CVE-2018-12127)
  - cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 (CVE-2018-12130, CVE-2018-12126, CVE-2018-11091, CVE-2018-12127)
  - cpu_map: Define md-clear CPUID bit (CVE-2018-12130, CVE-2018-12126, CVE-2018-11091, CVE-2018-12127)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-23.2.el8
changelog:
  - admin: reject clients unless their UID matches the current UID (CVE-2019-10132)
  - locking: restrict sockets to mode 0600 (CVE-2019-10132)
  - logging: restrict sockets to mode 0600 (CVE-2019-10132)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-23.3.el8
changelog:
  - api: disallow virDomainSaveImageGetXMLDesc on read-only connections (CVE-2019-10161)
  - api: disallow virDomainManagedSaveDefineXML on read-only connections (CVE-2019-10166)
  - api: disallow virConnectGetDomainCapabilities on read-only connections (CVE-2019-10167)
  - api: disallow virConnect*HypervisorCPU on read-only connections (CVE-2019-10168)


author: Caolán McNamara <caolanm@redhat.com> - 0.2.9-1
changelog:
  - Resolves: rhbz#1602602 new version with covscan warnings fixed
  - all cve fixes merged to that new upstream


author: Lubos Uhliarik <luhliari@redhat.com> - 1.11.3-1
changelog:
  - new version 1.11.3
  - Resolves: #1633401 - CVE-2018-11763 mod_http2: httpd:  DoS for HTTP/2
    connections by continuous SETTINGS


author: mskalick@redhat.com - 3.6.6-2
changelog:
  - Don't force third_party/s2 to be built without optimizations. It's working
    with new gcc. Using -O0 failed anobin checks.
    Resolves: RHBZ#1624142


author: Richard W.M. Jones <rjones@redhat.com> - 1.4.0-1
changelog:
  - New upstream version 1.4.0.
  - New plugins: random, zero.
  - New bash tab completion subpackage.
  - Remove unused build dependencies.


author: Richard W.M. Jones <rjones@redhat.com> - 1.4.2-4
changelog:
  - Remove misguided LDFLAGS hack which removed server hardening.
    https://bugzilla.redhat.com/show_bug.cgi?id=1624149#c6
    resolves: rhbz#1624149


author: Josef Ridky <jridky@redhat.com> - 1:5.8-2
changelog:
  - fix default configuration file (#1589480 and #1594147)
  - modify permissions for /var/log files (#1601060)


author: Laine Stump <laine@redhat.com>
changelog:
  - Improve performance with large number of interfaces
     (Bug 1268384, Bug 1271341)
   - recognize bond devices with no slaves


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.14.0-1
changelog:
  - Resolves: #1558420 - directory permissions are now correct after processing
    USR1 signal
  - Resolves: #1601414 - nginx: drop GeoIP support


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.14.1-1
changelog:
  - new version 1.14.1
  - Resolves: #1647257 - CVE-2018-16845 nginx: Denial of service and
    memory disclosure via mp4 module
  - Resolves: #1647262 - CVE-2018-16844 nginx: Excessive CPU usage
    via flaw in HTTP/2 implementation
  - Resolves: #1647263 - CVE-2018-16843 nginx: Excessive memory consumption
    via flaw in HTTP/2 implementation


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.14.1-9
changelog:
  - Resolves: #1744811 - CVE-2019-9511 nginx:1.14/nginx: HTTP/2: large amount of
    data request leads to denial of service
  - Resolves: #1744325 - CVE-2019-9513 nginx:1.14/nginx: HTTP/2: flood using
    PRIORITY frames resulting in excessive resource consumption
  - Resolves: #1745094 - CVE-2019-9516 nginx:1.14/nginx: HTTP/2: 0-length
    headers leads to denial of service


author: Stephen Gallagher <sgallagh@redhat.com> - 1:10.7.0-2
changelog:
  - Update to 10.7.0
  - https://nodejs.org/en/blog/release/v10.7.0/
  - https://nodejs.org/en/blog/release/v10.6.0/


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:10.7.0-5
changelog:
  - Import sources from fedora
  - Allow using python2 at %build and %install
  - turn off debug for aarch64


author: Tom Hughes <tom@compton.nu> - 16-1
changelog:
  - Rewrite nodejs.req to better match npm versioning rules
  - Add tests for nodejs.req and nodejs.prov


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-1
changelog:
  - Update to NSS 3.44
  - Define NSS_SEED_ONLY_DEV_URANDOM=1 to exclusively use getentropy
  - Use %autosetup
  - Clean up manual pages generation
  - Clean up %check
  - Remove prelink dependency, which is not available in RHEL-8
  - Remove upstreamed patches


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-3
changelog:
  - Disable TLS 1.3 under FIPS mode
  - Disable RSASSA-PKCS1-v1_5 in TLS 1.3
  - Fix post-handshake auth transcript calculation if
    SSL_ENABLE_SESSION_TICKETS is set
  - Revert the change to use XDG basedirs (mozilla#818686)


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-6
changelog:
  - Add continuous RNG test required by FIPS
  - fipstest: use CKM_TLS12_MASTER_KEY_DERIVE instead of vendor specific mechanism


author: Dan Walsh <dwalsh@redhat.com> - 2:2.2.0-2.git0a4dcd6
changelog:
  * Thu Sep 21 2017 Dan Walsh <dwalsh@redhat.com> - 2:2.2.0-2.git0a4dcd6
  - Add support for multiple configuration files.
    oci-umount will still read config file /etc/oci-umount.conf if it
    exists, but will also read config files in /usr/share/oci-umount/oci-umount.d
    and config files in /etc/oci-umount/oci-umount.d.  If the same file name exists
    in both directories, then oci-umount will only use the content in /ect/oci-umount/oci-umount.d.
  - Make Logs less noisy
  - Improve logs output, adding containier id, and needed file information
  - Add support for specifying submounts PATH/* will unmount all mountpoints 
    under PATH in a container
  - Support for oci configuration files to specify when to run the plugin


author: Fabiano Fidêncio <fidencio@redhat.com> - 20181011-3
changelog:
  - Resolves: rhbz#1644738 - Latest released Fedora 29 support in RHEL8 instead
                             of Fedora 29 Beta


author: Fabiano Fidêncio <fidencio@redhat.com> - 20181011-7
changelog:
  - Resolves: rhbz#1650197 - Fix the volume-ids of rhel8.0 entry
  - Resolves: rhbz#1650459 - test-mediauris is failing because of ubuntu change
  - Related: rhbz#1580232 - Add support to RHEL7.6 and RHEL8.0


author: Fabiano Fidêncio <fidencio@redhat.com> - 20181011-8.1
changelog:
  - Resolves: rhbz#1714755 - rhel-8.0.x is not detected as rhel-8.0
  - Resolves: rhbz#1714748 - Add win2019 to libosinfo


author: Ken Gaillot <kgaillot@redhat.com> - 2.0.0-9
changelog:
  - Rebase on upstream commit c4330b46bf1c3dcd3e367b436efb3bbf82ef51cd
  - Support podman as bundle container launcher
  - Ignore fence history in crm_mon when using CIB_file
  - Resolves: rhbz#1543494
  - Resolves: rhbz#1607898
  - Resolves: rhbz#1625231


author: Ken Gaillot <kgaillot@redhat.com> - 2.0.0-10
changelog:
  - Rebase on upstream commit b67d8d0de9794e59719608d9b156b4a3c6556344
  - Update spec for Python macro changes
  - Resolves: rhbz#1543494
  - Resolves: rhbz#1633612


author: Ken Gaillot <kgaillot@redhat.com> - 2.0.1-1
changelog:
  - Rebase on upstream commit 0eb799156489376e13fb79dca47ea9160e9d4595 (Pacemaker-2.0.1-rc1)
  - Follow upstream change of splitting XML schemas into separate package
  - Resolves: rhbz#1543494


author: Ken Gaillot <kgaillot@redhat.com> - 2.0.1-2
changelog:
  - Move pacemaker-doc installed files to /usr/share/doc/pacemaker-doc
    to avoid conflict with RHEL 8 location of pacemaker subpackage docs
  - Resolves: rhbz#1543494


author: Ken Gaillot <kgaillot@redhat.com> - 2.0.1-4.1
changelog:
  - Improve clients' authentication of IPC servers (CVE-2018-16877)
  - Fix use-after-free with potential information disclosure (CVE-2019-3885)
  - Improve pacemakerd authentication of running subdaemons (CVE-2018-16878)
  - Restore correct behavior when live migration is interrupted
  - Resolves: rhbz#1694557
  - Resolves: rhbz#1695247
  - Resolves: rhbz#1697264
  - Resolves: rhbz#1697265


author: Ken Gaillot <kgaillot@redhat.com> - 2.0.1-4.2
changelog:
  - New build to apply z-stream tag
  - Resolves: rhbz#1694557
  - Resolves: rhbz#1695247
  - Resolves: rhbz#1697264
  - Resolves: rhbz#1697265


author: Klaus Wenninger <kwenning@redhat.com> - 2.0.1-4.3
changelog:
  - New build with fixed test in gating.yaml
  - Resolves: rhbz#1694557
  - Resolves: rhbz#1695247
  - Resolves: rhbz#1697264
  - Resolves: rhbz#1697265


author: Dave Brolley <brolley@redhat.com> - 4.1.1-1
changelog:
  - SELinux is preventing pmdalinux from 'unix_read' accesses on the shared memory Unknown
    (BZ 1592901)
  - SELinux is preventing pmdalinux from getattr, associate access on the shared memory Unknown
    (BZ 1594991)
  - PCP BCC PMDA AVCs (BZ 1597978)
  - PCP BCC PMDA packaging issue (BZ 1597979)
  - pmdaproc only reads the first 1024 bytes of the /proc/*/status file resulting in lost metric
    values(BZ 1600262)
  - Update to latest PCP sources.


author: Dave Brolley <brolley@redhat.com> - 4.1.1-2
changelog:
  - pcp.spec: Fix the _with_dstat reference in the 
    
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS; 
    [ "1" = 1 ] && for i in $(find $(dirname ./configure) -name config.guess -o -name config.sub) ; do 
        [ -f /usr/lib/rpm/redhat/$(basename $i) ] && /usr/bin/rm -f $i && /usr/bin/cp -fv /usr/lib/rpm/redhat/$(basename $i) $i ; 
    done ; 
    [ "1" = 1 ] && [ x != "x-Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld" ] && 
        for i in $(find . -name ltmain.sh) ; do 
          /usr/bin/sed -i.backup -e 's~compiler_flags=$~compiler_flags="-Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld"~' $i 
        done ; 
    ./configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu \
  	--program-prefix= \
  	--disable-dependency-tracking \
  	 \
  	--prefix=/usr \
  	--exec-prefix=/usr \
  	--bindir=/usr/bin \
  	--sbindir=/usr/sbin \
  	--sysconfdir=/etc \
  	--datadir=/usr/share \
  	--includedir=/usr/include \
  	--libdir=/usr/lib64 \
  	--libexecdir=/usr/libexec \
  	--localstatedir=/var \
  	--sharedstatedir=/var/lib \
  	--mandir=/usr/share/man \
  	--infodir=/usr/share/info command


author: Mark Goodwin <mgoodwin@redhat.com> - 4.2.0-1
changelog:
  - Resolves dstat packaging issues (BZ 1640912)
  - Resolves dstat cursor positioning problem (BZ 1640913)
  - Resolve a signal handling issue in dstat shutdown (BZ 1648552)
  - Rename variable named await in python code (BZ 1633367)
  - New conditionally-built pcp-pmda-podman sub-package.
  - SELinux is preventing pmdalinux from 'unix_read' accesses on the shared memory labeled gpsd_t
    (BZ 1626487)
  - SELinux is preventing ps from 'search' accesses on the directory .cache
    (BZ 1634205, BZ 1635522)
  - SELinux is preventing ps from 'sys_ptrace' accesses on the cap_userns Unknown
    (BZ 1635394)
  - PCP SELinux AVCs (BZ 1633211)
  - SELinux is preventing pmdalinux from 'search' accesses on the directory spider
    (BZ 1647843)
  - Update to latest PCP sources.


author: Nathan Scott <nathans@redhat.com> - 4.3.0-1
changelog:
  - Add the dstat -f/--full option to expand instances (BZ 1651536)
  - Improve systemd interaction for local pmie (BZ 1650999)
  - SELinux is preventing ps from 'search' accesses on the directory
    .config (BZ 1569697)
  - SELinux is preventing pmdalinux from 'search' accesses on
    the directory /var/lib/libvirt/images (BZ 1579988)
  - SELinux is preventing pmdalinux from 'unix_read' accesses
    on the semáforo Unknown (BZ 1607658)
  - SELinux is preventing pmdalinux from 'unix_read' accesses
    on the shared memory Unknown (BZ 1618756, BZ 1619381, BZ 1601721)
  - Update to latest PCP sources.


author: Dave Brolley <brolley@redhat.com> - 4.1.1-2
changelog:
  - pcp.spec: Fix the _with_dstat reference in the 
    
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=x86-64 -mtune=generic -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS; 
    [ "1" = 1 ] && for i in $(find $(dirname ./configure) -name config.guess -o -name config.sub) ; do 
        [ -f /usr/lib/rpm/redhat/$(basename $i) ] && /usr/bin/rm -f $i && /usr/bin/cp -fv /usr/lib/rpm/redhat/$(basename $i) $i ; 
    done ; 
    [ "1" = 1 ] && [ x != "x-Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld" ] && 
        for i in $(find . -name ltmain.sh) ; do 
          /usr/bin/sed -i.backup -e 's~compiler_flags=$~compiler_flags="-Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld"~' $i 
        done ; 
    ./configure --build=i686-redhat-linux-gnu --host=i686-redhat-linux-gnu \
  	--program-prefix= \
  	--disable-dependency-tracking \
  	 \
  	--prefix=/usr \
  	--exec-prefix=/usr \
  	--bindir=/usr/bin \
  	--sbindir=/usr/sbin \
  	--sysconfdir=/etc \
  	--datadir=/usr/share \
  	--includedir=/usr/include \
  	--libdir=/usr/lib \
  	--libexecdir=/usr/libexec \
  	--localstatedir=/var \
  	--sharedstatedir=/var/lib \
  	--mandir=/usr/share/man \
  	--infodir=/usr/share/info command


author: Ondrej Mular <omular@redhat.com> - 0.10.0.alpha.6-2
changelog:
  - Enable tests
  - Cleanup of unnecessary bundle ruby-gem files
  - Switch Require: python3 dependency to platform-python
  - Added required linker flags
  - Resolves: rhbz#1633613 rhbz#1630616


author: Ondrej Mular <omular@redhat.com> - 0.10.0.alpha.7-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1553736 rhbz#1615891 rhbz#1436217 rhbz#1596050 rhbz#1554310 rhbz#1553718 rhbz#1638852 rhbz#1620190 rhbz#1158816 rhbz#1640477


author: Ivan Devát <idevat@redhat.com> - 0.10.1-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Udp/udpu transport is marked as unsupported
  - Require pcmk-cluster-manager instead of pacemaker
  - Require platform-python-setuptools instead of python3-setuptools
  - Resolves: rhbz#1650109 rhbz#1183103 rhbz#1648942 rhbz#1650510 rhbz#1388398 rhbz#1651197 rhbz#1553736


author: Ivan Devat <idevat@redhat.com> - 0.10.1-3
changelog:
  - Fixed configuration names of link options that pcs puts to corosync.conf during cluster setup
  - Fixed webUI issues in cluster setup
  - Command `pcs resource show` was returned back and was signed as deprecated
  - Added dependency on libknet1-plugins-all
  - Resolves: rhbz#1661059 rhbz#1659051 rhbz#1664057


author: Ivan Devat <idevat@redhat.com> - 0.10.1-4
changelog:
  - Fixed crash when using unsupported options in commands `pcs status` and `pcs config`
  - Resolves: rhbz#1668422


author: Ivan Devat <idevat@redhat.com> - 0.10.1-4.el8_0.1
changelog:
  - Fixed crash of the cluster create without knet links specified in webUI
  - Fixed submitting of 'create cluster' form when full domain names are used
  - Resolves: rhbz#1690290 rhbz#1690304


author: Ivan Devat <idevat@redhat.com> - 0.10.1-4.el8_0.4
changelog:
  - Generate 256 bytes long corosync authkey, longer keys are not supported when FIPS is enabled
  - Resolves: rhbz#1746565


author: Daniel P. Berrangé <berrange@redhat.com> - 4.5.0-4
changelog:
  - Fix typed parameter memory handling (rhbz #1602346)
  - Fix missing NWFilterBinding module (rhbz #1615841)


author: Coty Sutherland <csutherl@redhat.com> - 1:9.0.7-14
changelog:
  - Update to JWS 5.0.2 distribution
  - Resolves: rhbz#1658846 CVE-2018-8034 pki-servlet-container: tomcat: host name verification missing in WebSocket client
  - Resolves: rhbz#1579614 CVE-2018-8014 pki-servlet-container: tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
  - Resolves: rhbz#1619232 - CVE-2018-8037 pki-servlet-container: tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up
  - Resolves: rhbz#1641874 - CVE-2018-11784 pki-servlet-container: tomcat: Open redirect in default servlet


author: Tomas Orsava <torsava@redhat.com> - 4.5.1-7
changelog:
  - New subpackage platform-python-coverage without files from /usr/bin/*
  - python3-coverage contains only files from /usr/bin/* and depends
    on platform-python-coverage
  - Resolves: rhbz#1658674


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.7-1
changelog:
  - Update to 3.6.7 (rhbz#1627739)
  - Re-enable test_gdb (rhbz#1639536)
  - Re-enable test_faulthandler (rhbz#1640147)


author: Tomas Orsava <torsava@redhat.com> - 3.6.7-2
changelog:
  - Switch to requiring platform-python-pip/setuptools instead of the python3-
    versions
  - Resolves: rhbz#1638836


author: Lokesh Mandvekar <lsm5@redhat.com> - 0.11.1.1-1.git594495d
changelog:
  - Resolves: #1636230 - build with FIPS enabled golang toolchain
  - bump to v0.11.1.1
  - built commit 594495d


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1.0.0-1.git82e8011
changelog:
  - rebase to v1, yay!
  - rebase conmon to 9b1f0a08285a7f74b21cc9b6bfd98a48905a7ba2
  - Resolves:#1623282
  - python interface removed, moved to https://github.com/containers/python-podman/


author: Marek Kasik <mkasik@redhat.com> - 0.66.0-11.el8_0.8
changelog:
  - Constrain number of cycles in rescale filter
  - Compute correct coverage values for box filter
  - Resolves: #1717866


author: Marek Kasik <mkasik@redhat.com> - 0.66.0-11.el8_0.11
changelog:
  - Check whether input is RGB in PSOutputDev::checkPageSlice()
  - (also when using "-optimizecolorspace" flag)
  - Resolves: #1741145


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.15-18
changelog:
  - Workaround Python's threading library issue with non returning wait, for signals with timeout
  Resolves: rhbz#1653754


author: Tomas Orsava <torsava@redhat.com> - 2.7.15-19
changelog:
  - Remove remaining unversioned executables (idle, msgfmt.py, pygettext.py,
    pynche, smtpd.py, python-config)
  Resolves: rhbz#1656511


author: Tomas Orsava <torsava@redhat.com> - 2.7.15-21
changelog:
  - Fix Tkinter
  - Remove wininst exe files, that are no longer included, from the files section
  - Resolves: rhbz#1656488


author: Tomas Orsava <torsava@redhat.com> - 3.6.1-6
changelog:
  - BuildRequire the python36-devel package when building for the python36 module
  - BuildRequire also python36-rpm-macros as part of the python36 module build


author: Tomas Orsava <torsava@redhat.com> - 1:0.30.0-14
changelog:
  - Removed wheel's own implementation of crypto due to FIPS concerns
  Resolves: rhbz#1732325 rhbz#1732326


author: Tomas Orsava <torsava@redhat.com> - 1:0.30.0-15
changelog:
  - Fixed Patch0, which previously broken the metadata.json file generation
  Resolves: rhbz#1732325 rhbz#1732326


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 4.0.0-3
changelog:
  - Build documentation with Python 3 on Fedora
  - Fix Python 3-only file deployment
  - Don't glob everything under the Python sitelib directory


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-58.el8
changelog:
  - kvm-block-Update-flags-in-bdrv_set_read_only.patch [bz#1644996]
  - kvm-block-Add-auto-read-only-option.patch [bz#1644996]
  - kvm-rbd-Close-image-in-qemu_rbd_open-error-path.patch [bz#1644996]
  - kvm-block-Require-auto-read-only-for-existing-fallbacks.patch [bz#1644996]
  - kvm-nbd-Support-auto-read-only-option.patch [bz#1644996]
  - kvm-file-posix-Support-auto-read-only-option.patch [bz#1644996]
  - kvm-curl-Support-auto-read-only-option.patch [bz#1644996]
  - kvm-gluster-Support-auto-read-only-option.patch [bz#1644996]
  - kvm-iscsi-Support-auto-read-only-option.patch [bz#1644996]
  - kvm-block-Make-auto-read-only-on-default-for-drive.patch [bz#1644996]
  - kvm-qemu-iotests-Test-auto-read-only-with-drive-and-bloc.patch [bz#1644996]
  - kvm-block-Fix-update-of-BDRV_O_AUTO_RDONLY-in-update_fla.patch [bz#1644996]
  - kvm-qemu-img-Add-C-option-for-convert-with-copy-offloadi.patch [bz#1623082]
  - kvm-iotests-Add-test-for-qemu-img-convert-C-compatibilit.patch [bz#1623082]
  - Resolves: bz#1623082
    ([rhel.8.0]Target files for 'qemu-img convert' do not support thin_provisoning with iscsi/nfs backend)
  - Resolves: bz#1644996
    (block-commit can't be used with -blockdev)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-59.el8
changelog:
  - kvm-hw-scsi-cleanups-before-VPD-BL-emulation.patch [bz#1639957]
  - kvm-hw-scsi-centralize-SG_IO-calls-into-single-function.patch [bz#1639957]
  - kvm-hw-scsi-add-VPD-Block-Limits-emulation.patch [bz#1639957]
  - kvm-scsi-disk-Block-Device-Characteristics-emulation-fix.patch [bz#1639957]
  - kvm-scsi-generic-keep-VPD-page-list-sorted.patch [bz#1639957]
  - kvm-scsi-generic-avoid-out-of-bounds-access-to-VPD-page-.patch [bz#1639957]
  - kvm-scsi-generic-avoid-invalid-access-to-struct-when-emu.patch [bz#1639957]
  - kvm-scsi-generic-do-not-do-VPD-emulation-for-sense-other.patch [bz#1639957]
  - Resolves: bz#1639957
    ([RHEL.8] scsi host device passthrough limits IO writes - slow train)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-60.el8
changelog:
  - kvm-ne2000-fix-possible-out-of-bound-access-in-ne2000_re.patch [bz#1636784]
  - kvm-rtl8139-fix-possible-out-of-bound-access.patch [bz#1636784]
  - kvm-pcnet-fix-possible-buffer-overflow.patch [bz#1636784]
  - kvm-net-ignore-packet-size-greater-than-INT_MAX.patch [bz#1636784]
  - kvm-net-drop-too-large-packet-early.patch [bz#1636784]
  - kvm-net-hub-suppress-warnings-of-no-host-network-for-qte.patch [bz#1636784]
  - kvm-virtio-net-test-accept-variable-length-argument-in-p.patch [bz#1636784]
  - kvm-virtio-net-test-remove-unused-macro.patch [bz#1636784]
  - kvm-virtio-net-test-add-large-tx-buffer-test.patch [bz#1636784]
  - kvm-s390x-Return-specification-exception-for-unimplement.patch [bz#1668261]
  - kvm-cpus-ignore-ESRCH-in-qemu_cpu_kick_thread.patch [bz#1665844]
  - Resolves: bz#1636784
    (CVE-2018-17963 qemu-kvm: Qemu: net: ignore packets with large size [rhel-8])
  - Resolves: bz#1665844
    (Guest quit with error when hotunplug cpu)
  - Resolves: bz#1668261
    ([RHEL8] Backport diag308 stable exception fix (qemu-kvm))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-61.el8
changelog:
  - kvm-qemu-ga-make-get-fsinfo-work-over-pci-bridges.patch [bz#1666952]
  - kvm-qga-fix-driver-leak-in-guest-get-fsinfo.patch [bz#1666952]
  - Resolves: bz#1666952
    (qemu-guest-agent does not parse PCI bridge links in "build_guest_fsinfo_for_real_device" (q35))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-62.el8
changelog:
  - kvm-slirp-check-data-length-while-emulating-ident-functi.patch [bz#1669069]
  - Resolves: bz#1669069
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-8.0])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-63.el8
changelog:
  - kvm-scsi-generic-avoid-possible-out-of-bounds-access-to-.patch [bz#1668162]
  - Resolves: bz#1668162
    (CVE-2019-6501 qemu-kvm: QEMU: scsi-generic: possible OOB access while handling inquiry request [rhel-8])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-63.el8_0.1
changelog:
  - kvm-device_tree-Fix-integer-overflowing-in-load_device_t.patch [bz#1693116]
  - Resolves: bz#1693116
    (CVE-2018-20815 qemu-kvm: QEMU: device_tree: heap buffer overflow while loading device tree blob [rhel-8.0])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-63.el8.0.0.2
changelog:
  - kvm-target-i386-define-md-clear-bit-rhev.patch [bz#1704545]
  - Resolves: bz#1704545
    (CVE-2018-12126 virt:rhel/qemu-kvm: hardware: Microarchitectural Store Buffer Data Sampling [rhel-8.0.0.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-64.el8.0.0.2
changelog:
  - Bump release version to fix the versioning problem (zstream release lower than ystream).
  - Resolves: bz#1704545
    (CVE-2018-12126 virt:rhel/qemu-kvm: hardware: Microarchitectural Store Buffer Data Sampling [rhel-8.0.0.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-65.el8_0_0.3
changelog:
  - kvm-slirp-check-sscanf-result-when-emulating-ident.patch [bz#1732324]
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1732324]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1732324]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1732324]
  - kvm-virtio-scsi-Move-BlockBackend-back-to-the-main-AioCo.patch [bz#1718992]
  - kvm-scsi-disk-Acquire-the-AioContext-in-scsi_-_realize.patch [bz#1718992]
  - kvm-virtio-scsi-Forbid-devices-with-different-iothreads-.patch [bz#1718992]
  - Resolves: bz#1718992
    (qemu-kvm core dumped after hotplug the deleted disk with iothread parameter [rhel-8.0.0.z])
  - Resolves: bz#1732324
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu()  [rhel-8.0.0.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-65.el8_0_0.4
changelog:
  - kvm-Introduce-new-no_guest_reset-parameter-for-usb-host-.patch [bz#1719228]
  - kvm-usb-call-reset-handler-before-updating-state.patch [bz#1719228]
  - kvm-usb-host-skip-reset-for-untouched-devices.patch [bz#1719228]
  - kvm-usb-host-avoid-libusb_set_configuration-calls.patch [bz#1719228]
  - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734750]
  - Resolves: bz#1719228
    (Detached device when trying to upgrade USB device firmware when in doing USB Passthrough via QEMU [rhel-8.0.0.z])
  - Resolves: bz#1734750
    (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-8.0.0.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-65.el8_0_0.5
changelog:
  - kvm-i386-Add-new-MSR-indices-for-IA32_PRED_CMD-and-IA32_.patch [bz#1718235]
  - kvm-i386-Add-CPUID-bit-and-feature-words-for-IA32_ARCH_C.patch [bz#1718235]
  - kvm-x86-Data-structure-changes-to-support-MSR-based-feat.patch [bz#1718235]
  - kvm-x86-define-a-new-MSR-based-feature-word-FEATURE_WORD.patch [bz#1718235]
  - kvm-Add-support-to-KVM_GET_MSR_FEATURE_INDEX_LIST-an.patch [bz#1718235]
  - kvm-Use-KVM_GET_MSR_INDEX_LIST-for-MSR_IA32_ARCH_CAP.patch [bz#1718235]
  - kvm-i386-kvm-Disable-arch_capabilities-if-MSR-can-t-be-s.patch [bz#1718235]
  - kvm-i386-Make-arch_capabilities-migratable.patch [bz#1718235]
  - kvm-target-i386-add-MDS-NO-feature.patch [bz#1718235]
  - Resolves: bz#1718235
    ([Intel 8.1 Bug] [KVM][CLX] CPUID_7_0_EDX_ARCH_CAPABILITIES is not enabled in VM - qemu-kvm [rhel-8.0.0.z])


author: Tom Hughes <tom@compton.nu> - 1.1.0-1
changelog:
  - Update to 1.1.0 upstream release
  - Drop -march=native as ppc64 doesn't recognise it
  - Exclude valgrind on aarch64 due to unhandled instruction in libgcc


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-5
changelog:
  - cd to the correct directory before md5sum to fix BACKUP_INTEGRITY_CHECK.
    Upstream PR#1685, bz1532676


author: Pavel Cahyna <pcahyna@redhat.com> - 2.00-6
changelog:
  - Ensure that NetBackup is started automatically upon recovery (PR#1544)
    Also do not kill daemons spawned by sysinit.service at the service's end
    (PR#1610, applies to NetBackup and also to dhclient)
    Resolves #1506231
  - Print a warning if grub2-mkimage is about to fail and suggest what to do.
    bz#1492177
  - Update the patch for #1388653 to the one actually merged upstream (PR1418)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-1
changelog:
  - Rebase to version 2.4, drop patches integrated upstream
    Resolves #1534646 #1484051 #1498828 #1571266 #1496518


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-3
changelog:
  - Merge some spec changes from Fedora.
  - Apply upstream patch PR1887
    LPAR/PPC64 bootlist is incorrectly set when having multiple 'prep' partitions
  - Apply upstream patch PR1885
    Partition information recorded is unexpected when disk has 4K block size


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-4
changelog:
  - Backport fixes for upstream bugs 1974 and 1975
  - Backport fix for upstream bug 1913 (backup succeeds in case of tar error)
  - Backport fix for upstream bug 1926 (support for LACP bonding and teaming)
  - Apply upstream PR1954 (record permanent MAC address for bond members)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-6
changelog:
  - Require xorriso instead of genisoimage, it is now the preferred method
    and supports files over 4GB in size.
  - Apply upstream PR2004 (support for custom network interface naming)
  - Backport upstream PR2001 (UEFI support broken on Fedora 29 and RHEL 8)


author: Neil Horman <nhorman@tuxdriver.com> - 0.1-2
changelog:
  - Updated requires for python3
  - Removed unneeded BuildRequires
  - Globed the inclusion of man page
  - Fixed license file tagging


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-15
changelog:
  - nfsserver: fix start-issues when nfs_shared_infodir parameter is
    changed

    Resolves: rhbz#1642027


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-16
changelog:
  - vdo-vol: fix monitor-action
  - LVM-activate: dont fail initial probe

    Resolves: rhbz#1662466
    Resolves: rhbz#1643307


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-17.1
changelog:
  - gcloud-ra: fix Python 3 issue and remove Python 2 detection
  - aliyuncli-ra: upgrade bundled python-aliyun-sdk-core and fix Python 3 issues
  - aws-vpc-move-ip: use "--query" to avoid a possible race condition

    Resolves: rhbz#1710060
    Resolves: rhbz#1710057
    Resolves: rhbz#1710061


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-17.2
changelog:
  - gcp-vpc-move-route/gcp-vpc-move-vip: fix Python 3 encoding issue
  - aws-vpc-move-ip: add multi route-table support and fix issue
    w/multiple NICs

    Resolves: rhbz#1710063
    Resolves: rhbz#1714104


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-17.4
changelog:
  - podman: fixes to avoid bundle resources restarting when probing
    takes too long
  - CTDB: add support for v4.9+

    Resolves: rhbz#1734062
    Resolves: rhbz#1734067


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-17.6
changelog:
  - rabbitmq-cluster: fail monitor when node is in minority partition,
    fix stop regression, retry start when cluster join fails, ensure
    node attributes are removed

    Resolves: rhbz#1746148


author: Pavel Cahyna <pcahyna@redhat.com> - 0.6-1
changelog:
  - Drop hard dependency on ansible (#1525655), patch from Yaakov Selkowitz
  - Update the network role to version 0.4, solves bz#1487747, bz#1478576


author: Pavel Cahyna <pcahyna@redhat.com> - 0.6-2
changelog:
  - Document network role options: static routes, ethernet, dns
    Upstream PR#36, bz1550128, documents bz1487747 and bz1478576


author: Pavel Cahyna <pcahyna@redhat.com> - 0.6-4
changelog:
  - Fix complaints about /usr/bin/python during RPM build by making the affected scripts non-exec
  - Fix merge botch


author: Pavel Cahyna <pcahyna@redhat.com> - 1.0-3
changelog:
  - Rebase the network role to the last revision (d866422).
    Many improvements to tests, introduces autodetection of the current provider
    and defaults to using profile name as interface name.
  - Rebase the selinux, timesync and kdump roles to their 1.0rc1 versions.
    Many changes to the role interfaces to make them more consistent
    and conforming to Ansible best practices.
  - Update the description.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.0-4
changelog:
  - Format the READMEs as html, by vdolezal, with changes to use highlight
    (source-highlight does not understand YAML)


author: Pavel Cahyna <pcahyna@redhat.com> - 1.0-5
changelog:
  - spec file improvement: Unify the source macros with deftag() and defcommit()
  - Update to upstream released versions and drop unnecessary patches.
  - Unify the spec file with Fedora (no functional changes intended).
  - Misc spec file comments fixes (by Mike DePaulo)
  - Fix rpmlint error by escaping a previous changelog entry with a macro (by Mike DePaulo)
  - Comply with Fedora guidelines by always using "cp -p" in %install (by Mike DePaulo)
  - Rebase network role - doc improvements, Fedora 29 and Ansible 2.7 support
  - Regenerate network role patch to apply without offset
  - Rebase kdump role to fix a forgotten edit, rhbz#1645633
  - Update timesync examples: add var prefix (rhbz#1642152), correct role prefix
  - Add Obsoletes for the -techpreview subpackage
  - Add warnings to role READMEs and other doc updates, rhbz#1616018
  - network: split the state setting into state and persistent_state, rhbz#1616014
  - depend on python-jmespath as Ansible will not ship it, rhbz#1660559


author: Pavel Cahyna <pcahyna@redhat.com> - 1.0-6
changelog:
  - Rebase the selinux role, fixes typo in tests, uncovered by Ansible 2.7,
    (rhbz#1677743) and lists all input variables in defaults
    to make Satellite aware of them (rhbz#1674004, PR#43)
  - Rebase the kdump role to fix check mode problems: rhbz#1685904
  - Rebase the timesync role: fixes check mode problems (rhbz#1685904)
    and lists all input variables in defaults (rhbz#1674004)
  - Rebase the network role: keeps the interface up for state: up
    if persistent_state is absent and solves problems with defining
    VLAN and MACVLAN interface types (issue #19) (rhbz#1685902)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-1
changelog:
  - Buildrequire audit-libs-devel to actually enable the feature (#1607612)
  - Update to rpm 4.14.2 final (http://rpm.org/wiki/Releases/4.14.2)


author: Panu Matilainen <pmatilai@redhat.com> - 4.14.2-7
changelog:
  - Move python-macro-helper to main package where the macros are (#1651926)
  - Document --noverify in the man page (#1646458)
  - Handle unsupported digests the same as disabled ones (#1652529)


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-97
changelog:
  - Fix TLS 1.3 issues.
    * ruby-2.6.0-fix-test-failure-with-TLS-1.3.patch
    * ruby-2.6.0-net-http-net-ftp-fix-session-resumption-with-TLS-1.3.patch
    Related: rhbz#1616213


author: Jun Aruga <jaruga@redhat.com> - 2.5.1-99
changelog:
  - Fix generated rdoc template issues.
    * ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch
    Resolves: rhbz#1612026


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-99
changelog:
  - Additional OpenSSL 1.1.1 fixes.
    * ruby-2.6.0-fix-test-failure-with-TLS-1.3-maint.patch
    * ruby-2.6.0-config-support-include-directive.patch
    * ruby-2.6.0-use-larger-keys-for-SSL-tests.patch
    Related: rhbz#1616213


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-100
changelog:
  - Properly harden package using -fstack-protector-strong.
    * ruby-2.6.0-configure-fstack-protector-strong.patch
    Resolves: rhbz#1624168


author: Dan Walsh <dwalsh@redhat.name> - 2:1.0.0-46.dev.gitb4e2ecb
changelog:
  - Add patch https://github.com/opencontainers/runc/pull/1807 to allow
  - runc and podman to work with sd_notify


author: Klaus Wenninger <kwenning@redhat.com> - 1.3.1-15
changelog:
  - rebuild against new versions of libqb (1.0.3-7.el8),
    corosync (2.99.3-4.el8) and pacemaker (2.0.0-9.el8)

    Related: rhbz#1615945


author: Klaus Wenninger <kwenning@redhat.com> - 1.3.1-18.1
changelog:
  - assume graceful pacemaker exit if leftovers are unmanaged
  - make handling of cib-connection loss more robust

    Resolves: rhbz#1734061


author: Danilo C. L. de Paula <ddepaula@redhat.com> - 1.11.0-1.el8
changelog:
  - Creating RHEL-8.0 initial branch based on 1.11.0
  - Resolves: bz#1515300
  - (Prepare seabios for RHEL-8.0)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:4.0.23-5
changelog:
  - Resolves: #1585617 - Build against libdb only instead of libdb4
  - disabled strict checking for now (squid can not be built with GCC8)


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-1
changelog:
  - Resolves: #1656871 - squid rebase to 4.4
  - Resolves: #1645148 - CVE-2018-19131 squid: Cross-Site Scripting when
    generating HTTPS response messages about TLS errors
  - Resolves: #1645156 - CVE-2018-19132 squid: Memory leak in SNMP query
    rejection code


author: Lubos Uhliarik <luhliari@redhat.com> - 7:4.4-5
changelog:
  - Resolves: #1744672 - CVE-2019-12527 squid:4/squid: heap-based buffer overflow
    in HttpHeader::getAuth


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-1
changelog:
  - rebase to the new upstream version 1.8.25p1
  - sync patches with rhel-7.6
  - sync sudoers with rhel-7.6
    resolves: rhbz#1633144


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.25-2
changelog:
  - Depend explicitly on /usr/sbin/sendmail instead of sendmail (rhel-7 sync)
  - Simplified pam configuration file by removing duplicate pam stack entries
  Resolves: rhbz#1633144


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-4.1
changelog:
  - RHEL 8.0.0z ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1743168


author: Martin Stransky <stransky@redhat.com> - 60.7.2-3
changelog:
  - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
    with gmail with ssl/tls and OAuth2.


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018.
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds.
    - Includes two patches to deal with build issues.


author: Patsy Franklin <pfrankli@redhat.com> - 2018c-1
changelog:
  - Rebase to tzdata-2018c:
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Patsy Franklin <pfrankli@redhat.com> - 2018d-1
changelog:
  - Rebase to tzdata-2018d:
    - DST for Asia/Gaza and Asia/Hebron has changed 
      from March 31 to March 24.
    - Antarctica/Casey station changed to UTC+8 on March 11.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-1
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018g-1
changelog:
  - Rebase to tzdata-2018g
    - Morocco will remain at UTC+1 rather than switching back to UTC+0 as
      planned.  This change is effective Octobober 28, 2018.
  - Include changes introduced in tzdata-2018f
    - Volgograd will change from UTC+03 to UTC+04 on 2018-10-28 at 02:00.
    - Fiji will end DST on 2019-01-13 instead of the 2019-01-20 as
      previously predicted.
    - Most of Chile will end DST on the first Saturday in April at 24:00
      and restart DST on the first Saturday in September at 24:00.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Mark Wielaard <mjw@redhat.com> - 3.14.0-2
changelog:
  - Add valgrind-3.14.0-s390x-fix-reg-alloc-vr-vs-fpr.patch.
  - Add valgrind-3.14.0-s390x-sign-extend-lochi.patch.
  - Add valgrind-3.14.0-s390x-vec-reg-vgdb.patch.
  - Add valgrind-3.14.0-s390x-vec-float-point-code.patch
    and valgrind-3.14.0-s390x-vec-float-point-tests.patch
  - Only run full regtests on x86_64 on fedora or latest rhel.


author: Mark Wielaard <mjw@redhat.com> - 3.14.0-4
changelog:
  - Add valgrind-3.14.0-get_otrack_shadow_offset_wrk-ppc.patch,
    valgrind-3.14.0-new-strlen-IROps.patch,
    valgrind-3.14.0-ppc-instr-new-IROps.patch,
    valgrind-3.14.0-memcheck-new-IROps.patch,
    valgrind-3.14.0-ppc-frontend-new-IROps.patch,
    valgrind-3.14.0-transform-popcount64-ctznat64.patch and
    valgrind-3.14.0-enable-ppc-Iop_Sar_Shr8.patch (#1532205)


author: Mark Wielaard <mjw@redhat.com>
changelog:
  - Add valgrind-3.14.0-wcsncmp.patch (#1655642)

  - Replace valgrind-3.14.0-s390x-vec-float-point-{code,test}.patch
    with upstream versions. (#1525405)


author: Mark Wielaard <mjw@redhat.com> - 3.14.0-6
changelog:
  - Add valgrind-3.14.0-final_tidyup.patch
  - Add valgrind-3.14.0-ppc64-ldbrx.patch
  - Add valgrind-3.14.0-ppc64-unaligned-words.patch
  - Add valgrind-3.14.0-ppc64-lxvd2x.patch
  - Add valgrind-3.14.0-ppc64-unaligned-vecs.patch
  - Add valgrind-3.14.0-ppc64-lxvb16x.patch
  - Add valgrind-3.14.0-set_AV_CR6.patch
  - Add valgrind-3.14.0-undef_malloc_args.patch
  - Add valgrind-3.14.0-jm-vmx-constraints.patch
  - Add valgrind-3.14.0-sigkill.patch
  - Add valgrind-3.14.0-ppc64-ptrace.patch


author: Mark Wielaard <mjw@redhat.com> - 3.14.0-8
changelog:
  - Update valgrind-3.14.0-jm-vmx-constraints.patch for ppc64. (#1658680)
  - Show all diff files in check, not just the main/default one.


author: gil cattaneo <puntogil@libero.it> 0:1.7-18
changelog:
  - fix FTBFS rhbz#1240035
  - fix BR list, change log4j with log4j12
  - set javac source/target to 1.6
  - disable Java8doc doclint
  - remove werken-xpath Import/Export refences in manifest file
  - resolve some rpmlint problems
  - remove zero-length file
  - introduce license macro


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.1763-2
changelog:
  - 1576470 - Suggest correct packages to get embedded interpreters working
  - add libappstream-glib for appstream-util
  - 1576483 - Vim needs Python2 to build


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-8
changelog:
  - 1640919 - augroup fedora, test case failure: /CoreOS/vim/Regression/bz241308-use-augroup-for-rh-autocmds


author: Cole Robinson <crobinso@redhat.com> - 1.5.0-1
changelog:
  - Rebased to version 1.5.0
  - python3 prep work (Radostin Stoyanov, Cole Robinson, Cédric Bosdonnat)
  - Switch --location ISO to use isoinfo (Andrew Wong)
  - virt-install: add --cpu numa distance handling (Menno Lageman)
  - virt-install: fix --disk for rbd volumes with auth (Rauno Väli)
  - virt-install: add --cputune vcpupin handling (Wim ten Have)
  - details ui: Showing attached scsi devices per controller (Lin Ma)
  - network ui: Show details about SR-IOV VF pool (Lin Ma)
  - Greatly expand UI test suite coverage


author: Iryna Shcherbina <ishcherb@redhat.com> - 1.5.0-2
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Pavel Hrdina <phrdina@redhat.com> - 2.0.0-2
changelog:
  - virt-install: Fix description for --os-variant (rhbz#1649406)
  - virt-install: Add "Guest OS" options group (rhbz#1649406)
  - virt-xml: Accept --os-variant option (rhbz#1649406)
  - tests: Add some tests for virt-xml with KVM (rhbz#1649406)
  - virt-xml: Start using --os-variant (rhbz#1649406)
  - cli: s390x+graphics specified, use video=virtio (bz #1654994) (rhbz#1654994)


author: Pavel Hrdina <phrdina@redhat.com> - 2.0.0-5.1.el8
changelog:
  - cli: Fix pool=default when path belongs to another pool (bz 1692489) (rhbz#1714752)
  - tests: clitest: Add a test case for the last commit (rhbz#1714752)
  - domcapabilities: introduce get_cpu_security_features (rhbz#1716402)
  - domain: cpu: introduce set_model function (rhbz#1716402)
  - domain: cpu: automatically add CPU security features for "custom" mode (rhbz#1716402)
  - domcapabilities: remove recommended CPU features from security features (rhbz#1716402)
  - domcapabilities: fix typo in function name (rhbz#1716402)
  - cli: introduce CPU secure parameter (rhbz#1716402)
  - domcapabilities: add caching of CPU security features (rhbz#1716402)
  - virt-manager: add new checkbox to control CPU security features (rhbz#1716402)
  - DomainCpu: fix detection of CPU security features (rhbz#1716402)
  - DomainCpu: check CPU model name only if model exists (rhbz#1716402)
  - domcapabilities: detect MDS new vulnerability (rhbz#1716402)
  - cli: fix cpu secure option to actually work (rhbz#1716402)


