kernel August 2021

kernel@lists.fedoraproject.org

10 participants
56 discussions

[OS-BUILD PATCH 0/0] common: build TRUSTED_KEYS in everywhere
by pbrobinson (via Email Bridge) 25 Oct '21

25 Oct '21

From: pbrobinson on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1284 NOTE: Truncated patchset due to missing public @redhat.com email address on your GitLab profile at https://gitlab.com/-/profile. Once that is fixed, close and reopen the merge request to retrigger sending the emails. We want the TRUSTED_KEYS support built in everywhere, it's currently just built in for x86/power on ark. We need it built in for aarch64 as well, and it should be the same on Fedora. Signed-off-by: Peter Robinson <pbrobinson(a)redhat.com> --- redhat/configs/ark/generic/powerpc/CONFIG_TRUSTED_KEYS | 1 - redhat/configs/ark/generic/x86/x86_64/CONFIG_TRUSTED_KEYS | 1 - redhat/configs/ark/generic/CONFIG_TEE => redhat/configs/common/generic/CONFIG_TEE | 0 redhat/configs/common/generic/CONFIG_TRUSTED_KEYS | 2 +- redhat/configs/fedora/generic/arm/CONFIG_TEE | 1 - redhat/configs/fedora/generic/CONFIG_TEE | 1 - 6 files changed, 1 insertions(+), 5 deletions(-)

3 6

[OS-BUILD PATCH] Use common config for NODES_SHIFT
by Mark Salter (via Email Bridge) 08 Oct '21

08 Oct '21

From: Mark Salter <msalter(a)redhat.com> Use common config for NODES_SHIFT ARK is currently has CONFIG_NODES_SHIFT=6 where Fedora is set to 9. Let's simplify things and share the Fedora config with ARK. Signed-off-by: Mark Salter <msalter(a)redhat.com> diff --git a/redhat/configs/ark/generic/arm/aarch64/CONFIG_NODES_SHIFT b/redhat/configs/ark/generic/arm/aarch64/CONFIG_NODES_SHIFT deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/ark/generic/arm/aarch64/CONFIG_NODES_SHIFT +++ /dev/null @@ -1 +0,0 @@ -CONFIG_NODES_SHIFT=6 diff --git a/redhat/configs/fedora/generic/arm/aarch64/CONFIG_NODES_SHIFT b/redhat/configs/common/generic/arm/aarch64/CONFIG_NODES_SHIFT rename from redhat/configs/fedora/generic/arm/aarch64/CONFIG_NODES_SHIFT rename to redhat/configs/common/generic/arm/aarch64/CONFIG_NODES_SHIFT index blahblah..blahblah 100644 --- a/redhat/configs/fedora/generic/arm/aarch64/CONFIG_NODES_SHIFT +++ b/redhat/configs/common/generic/arm/aarch64/CONFIG_NODES_SHIFT -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1333

7 10

[OS-BUILD PATCH] redhat/configs: Disable Soft-RoCE driver
by Kamal Heib (via Email Bridge) 05 Oct '21

05 Oct '21

From: Kamal Heib <kheib(a)redhat.com> redhat/configs: Disable Soft-RoCE driver We decided to disable the Soft-RoCE driver due to the current unstable status of the driver in the upstream kernel, also because the driver is not fully maintained in the upstream community. Upstream: RHEL-only. Signed-off-by: Kamal Heib <kheib(a)redhat.com> diff --git a/redhat/configs/common/generic/CONFIG_RDMA_RXE b/redhat/configs/common/generic/CONFIG_RDMA_RXE index blahblah..blahblah 100644 --- a/redhat/configs/common/generic/CONFIG_RDMA_RXE +++ b/redhat/configs/common/generic/CONFIG_RDMA_RXE @@ -1 +1 @@ -CONFIG_RDMA_RXE=m +# CONFIG_RDMA_RXE is not set -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1299

4 7

[OS-BUILD PATCHv2] redhat/configs: enable KEXEC_SIG which is already enabled in RHEL8 for s390x and x86_64
by Coiby Xu (via Email Bridge) 15 Sep '21

15 Sep '21

From: Coiby Xu <coxu(a)redhat.com> redhat/configs: enable KEXEC_SIG which is already enabled in RHEL8 for s390x and x86_64 Enable KEXEC_SIG for s390x and x86_64 which is already enabled in RHEL8. Note when building .src.rpm, process_configs.sh would error on unset config options. So CONFIG_KEXEC_SIG_FORCE files are added as well. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1976835 Signed-off-by: Coiby Xu <coxu(a)redhat.com> diff --git a/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG b/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG @@ -0,0 +1 @@ +CONFIG_KEXEC_SIG=y diff --git a/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG_FORCE b/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG_FORCE new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG_FORCE @@ -0,0 +1 @@ +# CONFIG_KEXEC_SIG_FORCE is not set diff --git a/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG b/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG @@ -0,0 +1 @@ +CONFIG_KEXEC_SIG=y diff --git a/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG_FORCE b/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG_FORCE new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG_FORCE @@ -0,0 +1 @@ +# CONFIG_KEXEC_SIG_FORCE is not set -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1227

6 8

[OS-BUILD PATCH] redhat: drop certificates that were deprecated after GRUB's BootHole flaw
by Herton R. Krzesinski (via Email Bridge) 15 Sep '21

15 Sep '21

From: Herton R. Krzesinski <herton(a)redhat.com> redhat: drop certificates that were deprecated after GRUB's BootHole flaw Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1994849 Since newer RHEL should already have newer enough grub versions, we don't need anymore to keep signing the kernel for secure boot with older keys for compatibility with older grub. The second signature also causes problems because the upstream kernel so far does not support checking more than one signature as reported on bug above, where kexec signature checking can fail in a secure boot enabled environment. More than one signature requires that we patch the kernel for it to work, but we don't need that now since we can drop the second signature. Signed-off-by: Herton R. Krzesinski <herton(a)redhat.com> diff --git a/redhat/Makefile b/redhat/Makefile index blahblah..blahblah 100644 --- a/redhat/Makefile +++ b/redhat/Makefile @@ -277,10 +277,10 @@ sources-rh: $(TARBALL) generate-testpatch-tmp setup-source dist-configs-check README.rst \ $(SOURCES)/ @if [ "$(RELEASED_KERNEL)" -ne 0 ]; then \ - cp keys/redhatsecureboot{301,501,ca5,ca1}.cer $(SOURCES)/; \ + cp keys/redhatsecureboot{501,ca5}.cer $(SOURCES)/; \ cp keys/secureboot_{ppc,s390}.cer $(SOURCES)/; \ else \ - cp keys/redhatsecureboot{003,401,ca2,ca4}.cer $(SOURCES)/; \ + cp keys/redhatsecureboot{401,ca4}.cer $(SOURCES)/; \ fi @for KABIARCH in $(ARCH_LIST); do \ cp kabi/Module.kabi_$$KABIARCH $(SOURCES)/; \ diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template index blahblah..blahblah 100755 --- a/redhat/kernel.spec.template +++ b/redhat/kernel.spec.template @@ -690,26 +690,21 @@ Source9: x509.genkey.fedora %if %{?released_kernel} Source10: redhatsecurebootca5.cer -Source11: redhatsecurebootca1.cer -Source12: redhatsecureboot501.cer -Source13: redhatsecureboot301.cer -Source14: secureboot_s390.cer -Source15: secureboot_ppc.cer - -%define secureboot_ca_1 %{SOURCE10} -%define secureboot_ca_0 %{SOURCE11} +Source11: redhatsecureboot501.cer +Source12: secureboot_s390.cer +Source13: secureboot_ppc.cer + +%define secureboot_ca_0 %{SOURCE10} %ifarch x86_64 aarch64 -%define secureboot_key_1 %{SOURCE12} -%define pesign_name_1 redhatsecureboot501 -%define secureboot_key_0 %{SOURCE13} -%define pesign_name_0 redhatsecureboot301 +%define secureboot_key_0 %{SOURCE11} +%define pesign_name_0 redhatsecureboot501 %endif %ifarch s390x -%define secureboot_key_0 %{SOURCE14} +%define secureboot_key_0 %{SOURCE12} %define pesign_name_0 redhatsecureboot302 %endif %ifarch ppc64le -%define secureboot_key_0 %{SOURCE15} +%define secureboot_key_0 %{SOURCE13} %define pesign_name_0 redhatsecureboot303 %endif @@ -717,16 +712,11 @@ Source15: secureboot_ppc.cer %else Source10: redhatsecurebootca4.cer -Source11: redhatsecurebootca2.cer -Source12: redhatsecureboot401.cer -Source13: redhatsecureboot003.cer - -%define secureboot_ca_1 %{SOURCE10} -%define secureboot_ca_0 %{SOURCE11} -%define secureboot_key_1 %{SOURCE12} -%define pesign_name_1 redhatsecureboot401 -%define secureboot_key_0 %{SOURCE13} -%define pesign_name_0 redhatsecureboot003 +Source11: redhatsecureboot401.cer + +%define secureboot_ca_0 %{SOURCE10} +%define secureboot_key_0 %{SOURCE11} +%define pesign_name_0 redhatsecureboot401 # released_kernel %endif @@ -1630,9 +1620,7 @@ BuildKernel() { fi %ifarch x86_64 aarch64 - %pesign -s -i $SignImage -o vmlinuz.tmp -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0} - %pesign -s -i vmlinuz.tmp -o vmlinuz.signed -a %{secureboot_ca_1} -c %{secureboot_key_1} -n %{pesign_name_1} - rm vmlinuz.tmp + %pesign -s -i $SignImage -o vmlinuz.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0} %endif %ifarch s390x ppc64le if [ -x /usr/bin/rpm-sign ]; then @@ -2097,13 +2085,7 @@ BuildKernel() { # Red Hat UEFI Secure Boot CA cert, which can be used to authenticate the kernel mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer - %ifarch x86_64 aarch64 - install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20200609.cer - install -m 0644 %{secureboot_ca_1} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20140212.cer - ln -s kernel-signing-ca-20200609.cer $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer - %else - install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer - %endif + install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer %ifarch s390x ppc64le if [ $DoModules -eq 1 ]; then if [ -x /usr/bin/rpm-sign ]; then diff --git a/redhat/keys/redhatsecureboot003.cer b/redhat/keys/redhatsecureboot003.cer deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/keys/redhatsecureboot003.cer +++ /dev/null Binary files a/redhat/keys/redhatsecureboot003.cer and /dev/null differ diff --git a/redhat/keys/redhatsecureboot301.cer b/redhat/keys/redhatsecureboot301.cer deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/keys/redhatsecureboot301.cer +++ /dev/null Binary files a/redhat/keys/redhatsecureboot301.cer and /dev/null differ diff --git a/redhat/keys/redhatsecurebootca1.cer b/redhat/keys/redhatsecurebootca1.cer deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/keys/redhatsecurebootca1.cer +++ /dev/null Binary files a/redhat/keys/redhatsecurebootca1.cer and /dev/null differ diff --git a/redhat/keys/redhatsecurebootca2.cer b/redhat/keys/redhatsecurebootca2.cer deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/keys/redhatsecurebootca2.cer +++ /dev/null Binary files a/redhat/keys/redhatsecurebootca2.cer and /dev/null differ -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1321

4 7

[OS-BUILD PATCH] [redhat] configs: Remove pending CONFIG_CHELSIO_IPSEC_INLINE file
by Patrick Talbert (via Email Bridge) 31 Aug '21

31 Aug '21

From: Patrick Talbert <ptalbert(a)redhat.com> [redhat] configs: Remove pending CONFIG_CHELSIO_IPSEC_INLINE file The redhat/configs/pending-common/generic/CONFIG_CHELSIO_IPSEC_INLINE file was left behind. It enables the config item as a module. However, the common/generic/ directory includes this item as a built-in (=y). Remove the pending-common CONFIG_CHELSIO_IPSEC_INLINE file AND change the common/generic/ entry from =y to =m. The result is the generated kernel config files do not change. Signed-off-by: Patrick Talbert <ptalbert(a)redhat.com> diff --git a/redhat/configs/common/generic/CONFIG_CHELSIO_IPSEC_INLINE b/redhat/configs/common/generic/CONFIG_CHELSIO_IPSEC_INLINE index blahblah..blahblah 100644 --- a/redhat/configs/common/generic/CONFIG_CHELSIO_IPSEC_INLINE +++ b/redhat/configs/common/generic/CONFIG_CHELSIO_IPSEC_INLINE @@ -1 +1 @@ -CONFIG_CHELSIO_IPSEC_INLINE=y +CONFIG_CHELSIO_IPSEC_INLINE=m diff --git a/redhat/configs/pending-common/generic/CONFIG_CHELSIO_IPSEC_INLINE b/redhat/configs/pending-common/generic/CONFIG_CHELSIO_IPSEC_INLINE deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/pending-common/generic/CONFIG_CHELSIO_IPSEC_INLINE +++ /dev/null @@ -1 +0,0 @@ -CONFIG_CHELSIO_IPSEC_INLINE=m -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1342

3 3

[OS-BUILD PATCH] [redhat] configs: Clean up pending-common VIDEO config items
by Patrick Talbert (via Email Bridge) 31 Aug '21

31 Aug '21

From: Patrick Talbert <ptalbert(a)redhat.com> [redhat] configs: Clean up pending-common VIDEO config items Move the pending-common CONFIG_VIDEO_* items over to common/. This should not result in any configuration change. Signed-off-by: Patrick Talbert <ptalbert(a)redhat.com> diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_AD5820 b/redhat/configs/common/generic/CONFIG_VIDEO_AD5820 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_AD5820 @@ -0,0 +1 @@ +# CONFIG_VIDEO_AD5820 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_ADP1653 b/redhat/configs/common/generic/CONFIG_VIDEO_ADP1653 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_ADP1653 @@ -0,0 +1 @@ +# CONFIG_VIDEO_ADP1653 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_AK7375 b/redhat/configs/common/generic/CONFIG_VIDEO_AK7375 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_AK7375 @@ -0,0 +1 @@ +# CONFIG_VIDEO_AK7375 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_DW9714 b/redhat/configs/common/generic/CONFIG_VIDEO_DW9714 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_DW9714 @@ -0,0 +1 @@ +# CONFIG_VIDEO_DW9714 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_DW9807_VCM b/redhat/configs/common/generic/CONFIG_VIDEO_DW9807_VCM new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_DW9807_VCM @@ -0,0 +1 @@ +# CONFIG_VIDEO_DW9807_VCM is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_ET8EK8 b/redhat/configs/common/generic/CONFIG_VIDEO_ET8EK8 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_ET8EK8 @@ -0,0 +1 @@ +# CONFIG_VIDEO_ET8EK8 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_HI556 b/redhat/configs/common/generic/CONFIG_VIDEO_HI556 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_HI556 @@ -0,0 +1 @@ +# CONFIG_VIDEO_HI556 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_IMX258 b/redhat/configs/common/generic/CONFIG_VIDEO_IMX258 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_IMX258 @@ -0,0 +1 @@ +# CONFIG_VIDEO_IMX258 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_IMX274 b/redhat/configs/common/generic/CONFIG_VIDEO_IMX274 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_IMX274 @@ -0,0 +1 @@ +# CONFIG_VIDEO_IMX274 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_IMX319 b/redhat/configs/common/generic/CONFIG_VIDEO_IMX319 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_IMX319 @@ -0,0 +1 @@ +# CONFIG_VIDEO_IMX319 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_IMX355 b/redhat/configs/common/generic/CONFIG_VIDEO_IMX355 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_IMX355 @@ -0,0 +1 @@ +# CONFIG_VIDEO_IMX355 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_IPU3_CIO2 b/redhat/configs/common/generic/CONFIG_VIDEO_IPU3_CIO2 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_IPU3_CIO2 @@ -0,0 +1 @@ +# CONFIG_VIDEO_IPU3_CIO2 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_LM3560 b/redhat/configs/common/generic/CONFIG_VIDEO_LM3560 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_LM3560 @@ -0,0 +1 @@ +# CONFIG_VIDEO_LM3560 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_LM3646 b/redhat/configs/common/generic/CONFIG_VIDEO_LM3646 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_LM3646 @@ -0,0 +1 @@ +# CONFIG_VIDEO_LM3646 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_M5MOLS b/redhat/configs/common/generic/CONFIG_VIDEO_M5MOLS new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_M5MOLS @@ -0,0 +1 @@ +# CONFIG_VIDEO_M5MOLS is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_MT9M001 b/redhat/configs/common/generic/CONFIG_VIDEO_MT9M001 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_MT9M001 @@ -0,0 +1 @@ +# CONFIG_VIDEO_MT9M001 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_MT9M032 b/redhat/configs/common/generic/CONFIG_VIDEO_MT9M032 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_MT9M032 @@ -0,0 +1 @@ +# CONFIG_VIDEO_MT9M032 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_MT9M111 b/redhat/configs/common/generic/CONFIG_VIDEO_MT9M111 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_MT9M111 @@ -0,0 +1 @@ +# CONFIG_VIDEO_MT9M111 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_MT9P031 b/redhat/configs/common/generic/CONFIG_VIDEO_MT9P031 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_MT9P031 @@ -0,0 +1 @@ +# CONFIG_VIDEO_MT9P031 is not set diff --git a/redhat/configs/common/generic/CONFIG_VIDEO_MT9T001 b/redhat/configs/common/generic/CONFIG_VIDEO_MT9T001 new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/CONFIG_VIDEO_MT9T001 @@ -0,0 +1 @@ +# CONFIG_VIDEO_MT9T001 is not set -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1335

1 0

The kernel-ark os-build branch has been rebased.
by Justin Forbes 30 Aug '21

30 Aug '21

If you have a pending merge request, you will need to rebase your source tree and force push so that things will cleanly merge. As we did with 5.13, we have done this again for os-build, we expect to keep it up as a cadence with every upstream release. This means we will do it again when 5.15 releases, and again with 5.16... It is difficult to manage a regularly rebased tree, because any outstanding MR is invalidated and has to also be rebased. But not doing somewhat regular rebases can also be difficult in the spirit of the openness that Fedora is based upon. While there are plenty of ways to see which patches we carry compared to upstream, some of those patches are fairly old, and would not apply cleanly at all to a modern tree after several releases were merged in with them. As we have gotten into a flow of things with merge requests, we can get to the point of very few outstanding MRs towards the end of a release cycle, and that makes it an opportune time to rebase the tree. This also means that the patches we carry should be no more than 1 release out of date, making them easier to apply to various other trees. I do realize that this is a minor inconvenience every 2-3 months, but I believe the results are worth it. Thanks, Justin

1 0

[OS-BUILD PATCH] arm64: use common CONFIG_MAX_ZONEORDER for arm kernel
by Mark Salter (via Email Bridge) 27 Aug '21

27 Aug '21

From: Mark Salter <msalter(a)redhat.com> arm64: use common CONFIG_MAX_ZONEORDER for arm kernel Now that RHEL9 is using 4K pagesize, MAX_ZONEORDER is defaulting to 11. Fedora uses an out of tree patch to default to 13 when building for server class machines. RHEL9 should also be using 13, so make the MAX_ZONEORDER config and the out of tree patch common between RHEL9 and Fedora. Signed-off-by: Mark Salter <msalter(a)redhat.com> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index blahblah..blahblah 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1155,7 +1155,7 @@ config XEN config FORCE_MAX_ZONEORDER int default "14" if ARM64_64K_PAGES - default "13" if (ARCH_THUNDER && !ARM64_64K_PAGES && !RHEL_DIFFERENCES) + default "13" if (ARCH_THUNDER && !ARM64_64K_PAGES) default "12" if ARM64_16K_PAGES default "11" help diff --git a/redhat/configs/common/generic/arm/aarch64/CONFIG_FORCE_MAX_ZONEORDER b/redhat/configs/common/generic/arm/aarch64/CONFIG_FORCE_MAX_ZONEORDER new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/arm/aarch64/CONFIG_FORCE_MAX_ZONEORDER @@ -0,0 +1,3 @@ +# This relies on an out of tree patch to arch/arm64/Kconfig +# Otherwise, we would be stuck with a default of 11 +CONFIG_FORCE_MAX_ZONEORDER=13 diff --git a/redhat/configs/fedora/generic/arm/aarch64/CONFIG_FORCE_MAX_ZONEORDER b/redhat/configs/fedora/generic/arm/aarch64/CONFIG_FORCE_MAX_ZONEORDER deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/fedora/generic/arm/aarch64/CONFIG_FORCE_MAX_ZONEORDER +++ /dev/null @@ -1,5 +0,0 @@ -# We technically want this to be 13 for Fedora with 4K pages but that's only -# an option with an out of tree patch. Keep this 11 for compatibility until -# we figure out what we want here. -# process_configs_known_broken -CONFIG_FORCE_MAX_ZONEORDER=13 -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1331

2 1

[OS-BUILD PATCHv2] netfilter: Add deprecation notices for xtables
by Phil Sutter (via Email Bridge) 27 Aug '21

27 Aug '21

From: Phil Sutter <psutter(a)redhat.com> netfilter: Add deprecation notices for xtables Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1945179 Upstream Status: RHEL-only Upon loading legacy xtables table modules or the nft compat module, print a warning suggesting nftables. Signed-off-by: Phil Sutter <psutter(a)redhat.com> diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index blahblah..blahblah 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c @@ -2484,6 +2484,9 @@ static int __init ebtables_init(void) { int ret; + pr_warn_ratelimited("This module is deprecated in Red Hat Enterprise Linux,\n" + "please use nftables instead (https://red.ht/nft_your_tables)\n"); + ret = xt_register_target(&ebt_standard_target); if (ret < 0) return ret; diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c index blahblah..blahblah 100644 --- a/net/ipv4/netfilter/arp_tables.c +++ b/net/ipv4/netfilter/arp_tables.c @@ -1623,6 +1623,9 @@ static int __init arp_tables_init(void) { int ret; + pr_warn_ratelimited("This module is deprecated in Red Hat Enterprise Linux,\n" + "please use nftables instead (https://red.ht/nft_your_tables)\n"); + ret = register_pernet_subsys(&arp_tables_net_ops); if (ret < 0) goto err1; diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index blahblah..blahblah 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1902,6 +1902,9 @@ static int __init ip_tables_init(void) { int ret; + pr_warn_ratelimited("This module is deprecated in Red Hat Enterprise Linux,\n" + "please use nftables instead (https://red.ht/nft_your_tables)\n"); + ret = register_pernet_subsys(&ip_tables_net_ops); if (ret < 0) goto err1; diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index blahblah..blahblah 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c @@ -1909,6 +1909,9 @@ static int __init ip6_tables_init(void) { int ret; + pr_warn_ratelimited("This module is deprecated in Red Hat Enterprise Linux,\n" + "please use nftables instead (https://red.ht/nft_your_tables)\n"); + ret = register_pernet_subsys(&ip6_tables_net_ops); if (ret < 0) goto err1; diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c index blahblah..blahblah 100644 --- a/net/netfilter/ipset/ip_set_core.c +++ b/net/netfilter/ipset/ip_set_core.c @@ -6,6 +6,8 @@ /* Kernel module for IP set management */ +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + #include <linux/init.h> #include <linux/module.h> #include <linux/moduleparam.h> @@ -2362,8 +2364,12 @@ static struct pernet_operations ip_set_net_ops = { static int __init ip_set_init(void) { - int ret = register_pernet_subsys(&ip_set_net_ops); + int ret; + + pr_warn_ratelimited("This module is deprecated in Red Hat Enterprise Linux,\n" + "please use nftables instead (https://red.ht/nft_your_tables)\n"); + ret = register_pernet_subsys(&ip_set_net_ops); if (ret) { pr_err("ip_set: cannot register pernet_subsys.\n"); return ret; diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c index blahblah..blahblah 100644 --- a/net/netfilter/nft_compat.c +++ b/net/netfilter/nft_compat.c @@ -5,6 +5,8 @@ * This software has been sponsored by Sophos Astaro <http://www.sophos.com> */ +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + #include <linux/kernel.h> #include <linux/init.h> #include <linux/module.h> @@ -882,6 +884,9 @@ static int __init nft_compat_module_init(void) { int ret; + pr_warn_ratelimited("This module is deprecated in Red Hat Enterprise Linux,\n" + "please use nftables instead (https://red.ht/nft_your_tables)\n"); + ret = nft_register_expr(&nft_match_type); if (ret < 0) return ret; -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226

5 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

kernel August 2021