# changelog

author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37
changelog:
  - Resolves: #837369 [RFE] Switch to client promotion to replica model
  - Resolves: #1199516 [RFE] Move replication topology to the shared tree
  - Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
  - Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
  - Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
    list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
  - Resolves: #1267206 ipa-server-install uninstall should warn if no
    installation found
  - Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
    ipa-client-automount is executed.
  - Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
    displayed when certificate generated using IPA on RHEL 7.2up2.
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605191449GITf8edf37


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37.1
changelog:
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
    - Rebuild with krb5-1.14.1


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3
changelog:
  - Resolves: #1339233 CA installed on replica is always marked as renewal master
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605241723GIT1b427d3


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3.1
changelog:
  - Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
    - Fix incorrect rebase of patch 1001


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.1.alpha1
changelog:
  - Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
    setting password for default sudo binddn.
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
  - Resolves: #825391 [RFE] Replica installation should provide a means for
    inheriting nssldap security access settings
  - Resolves: #921497 Incorrect *.py[co] files placement
  - Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
  - Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
  - Resolves: #1196958 IPA replica installation failing with high number of users
    (160000).
  - Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
    uninstall a replica
  - Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
    Authentication Indicator
  - Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
    principal expiration"
  - Resolves: #1234223 [WebUI] General invalid password error message appearing
    for "Locked user"
  - Resolves: #1254267 ipa-server-install failure applying ldap updates with
    limits exceeded
  - Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
    doamin already is in forwardzone.
  - Resolves: #1259020 ipa-server-adtrust-install doesn't allow
    NetBIOS-name=EXAMPLE-TEST.COM (dash character)
  - Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
    message when DNSSEC master not installed
  - Resolves: #1262747 dnssec options missing in ipa-dns-install man page
  - Resolves: #1265900 Fail installation immediately after dirsrv fails to
    install using ipa-server-install
  - Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
    resolvable anymore
  - Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
    LimitsExceeded: limits exceeded for this query
  - Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
  - Resolves: #1269200 ipa-server crashing while trying to preserve admin user
  - Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
  - Resolves: #1271579 Automember rule expressions disappear from tables on
    single expression delete
  - Resolves: #1275816 Incomplete ports for IPA ad-trust
  - Resolves: #1276351 [RFE] Remove
    /usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
  - Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
    the IPA UI
  - Resolves: #1278426 Better error message needed for invalid ca-signing-algo
    option
  - Resolves: #1279932 ipa-client-install --request-cert needs workaround in
    anaconda chroot
  - Resolves: #1282521 Creating a user w/o private group fails when doing so in
    WebUI
  - Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
    by "IPA is not configured on this system"
  - Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
    file
  - Resolves: #1287194 [RFE] Support of UPN for trusted domains
  - Resolves: #1288967 Normalize Manager entry in ipa user-add
  - Resolves: #1289487 Priority field missing in Password Policy detail tab
  - Resolves: #1291140 ipa client should configure kpasswd_server directive in
    krb5.conf
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0.alpha1
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1300576 Browser setup page includes instructions for Internet
    Explorer
  - Resolves: #1301586 ipa host-del --updatedns should remove related dns
    entries.
  - Resolves: #1304618 Residual Files After IPA Server Uninstall
  - Resolves: #1305144 ipa-python does not require its dependencies
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
  - Resolves: #1313798 Console output post ipa-winsync-migrate command should be
    corrected.
  - Resolves: #1314786 [RFE] External Trust with Active Directory domain
  - Resolves: #1319023 Include description for 'status' option in man page for
    ipactl command.
  - Resolves: #1319912 ipa-server-install does not completely change hostname and
    named-pkcs11 fails
  - Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
    Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
    it is executed on server already installed with KRA.
  - Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
    to 'rpcbind'
  - Resolves: #1329275 ipa-nis-manage command should include status option
  - Resolves: #1330843 'man ipa' should be updated with latest commands
  - Resolves: #1333755 ipa cert-request causes internal server error while
    requesting certificate
  - Resolves: #1337484 EOF is not handled for ipa-client-install command
  - Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
    members of the role which has "User Administrators" privilege.
  - Resolves: #1343142 IPA DNS should do better verification of DNS zones
  - Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
    browser


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.2.alpha1
changelog:
  - Resolves: #1348948 IPA server install fails with build
    ipa-server-4.4.0-0.el7.1.alpha1
    - Revert "Increased mod_wsgi socket-timeout"


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-1
changelog:
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
    in the default global_policy in IPA sets user's password expiration
    (krbPasswordExpiration) to be 90 days
  - Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
  - Resolves: #1084018 [RFE] Add IdM user password change support for legacy
    client compat tree
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - Fix incorrect check for principal type when evaluating CA ACLs
  - Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
  - Resolves: #1238190 ipasam unable to lookup group in directory yet manual
    search works
  - Resolves: #1250110 search by users which don't have read rights for all attrs
    in search_attributes fails
  - Resolves: #1263764 Show Certificate displays in useless format
  - Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
    the options after adding new certificate
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0
  - Resolves: #1294503 IPA fails to issue 3rd party certs
  - Resolves: #1298242 [RFE] API compatibility - compatibility of clients
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1298966 [RFE] Extend Smart Card support
  - Resolves: #1315146 Multiple clients cannot join domain simultaneously:
    /var/run/httpd/ipa/clientcaches race condition?
  - Resolves: #1318903 ipa server install failing when SUBCA signs the cert
  - Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
    console output
  - Resolves: #1324055 IPA always qualify requests for admin
  - Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
  - Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
    hold
  - Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
  - Resolves: #1349281 Fix `Conflicts` with ipa-python
  - Resolves: #1350695 execution of copy-schema script fails
  - Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
  - Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
    execution to 7.3
  - Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
    create ipa-ca entry
  - Related: #1343422 [RFE] Add GssapiImpersonate option


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2
changelog:
  - Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
    with certmonger
    - uninstall: untrack lightweight CA certs
  - Resolves: #1351807 ipa-nis-manage config.get_dn missing
    - ipa-nis-manage: Use server API to retrieve plugin status
  - Resolves: #1353452 ipa-compat-manage command failed,
    exception: NotImplementedError: config.get_dn()
    - ipa-compat-manage: use server API to retrieve plugin status
  - Resolves: #1353899 ipa-advise: object of type 'type' has no len()
    - ipa-advise: correct handling of plugin namespace iteration
  - Resolves: #1356134 'kinit -E' does not work for IPA user
    - kdb: check for local realm in enterprise principals
  - Resolves: #1353072 ipa unknown command vault-add
    - Enable vault-* commands on client
    - vault-add: set the default vault type on the client side if none was given
  - Resolves: #1353995 Default CA can be used without a CA ACL
    - caacl: expand plugin documentation
  - Resolves: #1356144 host-find should not print SSH keys by default, only
    SSH fingerprints
    - host-find: do not show SSH key by default
  - Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
    - Removed unused method parameter from migrate-ds


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2.1
changelog:
  - Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
  - Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
  - Related: #1356134 'kinit -E' does not work for IPA user


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-3
changelog:
  - Resolves: #1296140 Remove redhat-access-plugin-ipa support
    - Obsolete and conflict redhat-access-plugin-ipa
  - Resolves: #1351119 Multiple issues while uninstalling ipa-server
    - server uninstall fails to remove krb principals
  - Resolves: #1351758 ipa commands not showing expected error messages
    - frontend: copy command arguments to output params on client
    - Show full error message for selinuxusermap-add-hostgroup
  - Resolves: #1352883 Traceback on adding default automember group and hostgroup
    set
    - allow 'value' output param in commands without primary key
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - schema: Fix subtopic -> topic mapping
  - Resolves: #1354348 ipa trustconfig-show throws internal error.
    - allow 'value' output param in commands without primary key
  - Resolves: #1354381 ipa trust-add with raw option gives internal error.
    - trust-add: handle `--all/--raw` options properly
  - Resolves: #1354493 Replica install fails with old IPA master
    - DNS install: Ensure that DNS servers container exists
  - Resolves: #1354628 ipa hostgroup-add-member does not return error message
    when adding itself as member
    - frontend: copy command arguments to output params on client
  - Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
    - messages: specify message type for ResultFormattingError
  - Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
    secret key
    - expose `--secret` option in radiusproxy-* commands
    - prevent search for RADIUS proxy servers by secret
  - Resolves: #1356099 Bug in the ipapwd plugin
    - Heap corruption in ipapwd plugin
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
  - Resolves: #1356964 Renaming a user removes all of his principal aliases
    - Preserve user principal aliases during rename operation


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-4
changelog:
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - harden the check for trust namespace overlap in new principals
  - Resolves: #1351142 CLI is not using session cookies for communication with
    IPA API
    - Fix session cookies
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - help: Add dnsserver commands to help topic 'dns'
  - Resolves: #1354406 host-del updatedns options complains about missing ptr
    record for host
    - Host-del: fix behavior of --updatedns and PTR records
  - Resolves: #1355718 ipa-replica-manage man page example output differs actual
    command output
    - Minor fix in ipa-replica-manage MAN page
  - Resolves: #1358229 Traceback message should be fixed, seen while editing
    winsync migrated user information in Default trust view.
    - baseldap: Fix MidairCollision instantiation during entry modification
  - Resolves: #1358849 CA replica install logs to wrong log file
    - unite log file name of ipa-ca-install
  - Resolves: #1359130 ipa-server-install command fails to install IPA server.
    - DNS Locations: fix update-system-records unpacking error
  - Resolves: #1359237 AVC on dirsrv config caused by IPA installer
    - Use copy when replacing files to keep SELinux context
  - Resolves: #1359692 ipa-client-install join fail with traceback against
    RHEL-6.8 ipa-server
    - compat: fix ping call
  - Resolves: #1359738 ipa-replica-install --domain=<IPA primary domain> option
    does not work
    - replica-install: Fix --domain
  - Resolves: #1360778 Vault commands are available in CLI even when the server
    does not support them
    - Revert "Enable vault-* commands on client"
    - client: fix hiding of commands which lack server support
  - Related: #1281704 Rebase to softhsm 2.1.0
    - Remove the workaround for softhsm bug #1293340
  - Related: #1298288 [RFE] Improve performance in large environments.
    - Create indexes for krbCanonicalName attribute


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-5
changelog:
  - Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
    - Do not initialize API in ipa-client-automount uninstall
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - idrange: fix unassigned global variable
  - Resolves: #1360792 Migrating users doesn't update krbCanonicalName
    - re-set canonical principal name on migrated users
  - Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
    and 'bool' objects
    - Fix ipa hbactest output
  - Resolves: #1362260 ipa vault-mod no longer allows defining salt
    - vault: add missing salt option to vault_mod
  - Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
    public key
    - vault: Catch correct exception in decrypt
  - Resolves: #1362537 ipa-server-install fails to create symlink from
    /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
    - Correct path to HTTPD's systemd service directory
  - Resolves: #1363756 Increase length of passwords generated by installer
    - Increase default length of auto generated passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-6
changelog:
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
    - Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
  - Resolves: #1341249 Subsequent external CA installation fails
    - install: fix external CA cert validation
  - Resolves: #1353831 ipa-server-install fails in container because of
    hostnamectl set-hostname
    - server-install: Fix --hostname option to always override api.env values
    - install: Call hostnamectl set-hostname only if --hostname option is used
  - Resolves: #1356091 ipa-cacert-manage --help and man differ
    - Improvements for the ipa-cacert-manage man and help
  - Resolves: #1360631 ipa-backup is not keeping the
    /etc/tmpfiles.d/dirsrv-<instance>.conf
    - ipa-backup: backup /etc/tmpfiles.d/dirsrv-<instance>.conf
  - Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
    file is needed
    - Update ipa-replica-install documentation
  - Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
    not rpm-require it
    - client: RPM require initscripts to get *-domainname.service
  - Resolves: #1364197 caacl: error when instantiating rules with service
    principals
    - caacl: fix regression in rule instantiation
  - Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
    - parameters: move the `confirm` kwarg to Param
  - Resolves: #1364464 Topology graph: ca and domain adders shows question marks
    instead of plus icon
    - Fix unicode characters in ca and domain adders
  - Resolves: #1365083 Incomplete output returned for command ipa vault-add
    - client: add missing output params to client-side commands
  - Resolves: #1365526 build fails during "make check"
    - ipa-kdb: Fix unit test after packaging changes in krb5


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-7
changelog:
  - Resolves: #1361119 UPN-based search for AD users does not match an entry in
    slapi-nis map cache
    - support multiple uid values in schema compatibility tree


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-8
changelog:
  - Resolves: #1298288 [RFE] Improve performance in large environments.
    - cert: speed up cert-find
  - Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
    authentication
    - service: add flag to allow S4U2Self
    - Add 'trusted to auth as user' checkbox
    - Added new authentication method
  - Resolves: #1353881 ipa-replica-install suggests about
    non-existent --force-ntpd option
    - Don't show --force-ntpd option in replica install
  - Resolves: #1354441 DNS forwarder check is too strict: unable to add
    sub-domain to already-broken domain
    - DNS: allow to add forward zone to already broken sub-domain
  - Resolves: #1356146 performance regression in CLI help
    - schema: Speed up schema cache
    - frontend: Change doc, summary, topic and NO_CLI to class properties
    - schema: Introduce schema cache format
    - schema: Generate bits for help load them on request
    - help: Do not create instances to get information about commands and topics
    - schema cache: Do not reset ServerInfo dirty flag
    - schema cache: Do not read fingerprint and format from cache
    - Access data for help separately
    - frontent: Add summary class property to CommandOverride
    - schema cache: Read server info only once
    - schema cache: Store API schema cache in memory
    - client: Do not create instance just to check isinstance
    - schema cache: Read schema instead of rewriting it when SchemaUpToDate
  - Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
    - server install: do not prompt for cert file PIN repeatedly
  - Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
    cache directory: [Errno 13] Permission denied: '/home/test_user'
    - schema: Speed up schema cache
  - Resolves: #1366604 `cert-find` crashes on invalid certificate data
    - cert: do not crash on invalid data in cert-find
  - Resolves: #1366612 Middle replica uninstallation in line topology works
    without '--ignore-topology-disconnect'
    - Fail on topology disconnect/last role removal
  - Resolves: #1366626 caacl-add-service: incorrect error message when service
    does not exists
    - Fix ipa-caalc-add-service error message
  - Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
    does not happen to run during dnf upgrade
    - DNS server upgrade: do not fail when DNS server did not respond
  - Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
    with CA
    - Add warning about only one existing CA server
    - Set servers list as default facet in topology facet group
  - Resolves: #1367773 thin client ignores locale change
    - schema check: Check current client language against cached one


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-9
changelog:
  - Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
    - Fix ipa-server-install in pure IPv6 environment
  - Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
    reachable via the forest root
    - trust: make sure ID range is created for the child domain even if it exists
    - ipa-kdb: simplify trusted domain parent search
  - Resolves: #1335567 Update Warning in IdM Web UI API browser
    - WebUI: add API browser is tech preview warning
  - Resolves: #1348560 Mulitple domain Active Directory Trust conflict
    - ipaserver/dcerpc: reformat to make the code closer to pep8
    - trust: automatically resolve DNS trust conflicts for triangle trusts
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)
  - Resolves: #1353936 custodia.conf and server.keys file is world-readable.
    - Remove Custodia server keys from LDAP
    - Secure permissions of Custodia server.keys
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
    - custodia: include known CA certs in the PKCS#12 file for Dogtag
    - custodia: force reconnect before retrieving CA certs from LDAP
  - Resolves: #1362333 ipa vault container owner cannot add vault
    - Fix: container owner should be able to add vault
  - Resolves: #1365546 External trust with root domain is transitive
    - trust: make sure external trust topology is correctly rendered
  - Resolves: #1365572 IPA server broken after upgrade
    - Require pki-core-10.3.3-7
  - Resolves: #1367864 Server assumes latest version of command instead of
    version 1 for old / 3rd party clients
    - rpcserver: assume version 1 for unversioned command calls
    - rpcserver: fix crash in XML-RPC system commands
  - Resolves: #1367773 thin client ignores locale change
    - schema cache: Fallback to 'en_us' when locale is not available
  - Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
    - Fail on topology disconnect/last role removal
  - Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
    - otptoken, permission: Convert custom type parameters on server
  - Resolves: #1369414 ipa server-del fails with Python stack trace
    - Handled empty hostname in server-del command
  - Resolves: #1369761 ipa-server must depend on a version of httpd that support
    mod_proxy with UDS
    - Require httpd 2.4.6-31 with mod_proxy Unix socket support
  - Resolves: #1370512 Received ACIError instead of DuplicatedError in
    stageuser_tests
    - Raise DuplicatedEnrty error when user exists in delete_container
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add missing param values to cert-find output
  - Renamed patch 1011 to 0100, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-10
changelog:
  - Resolves: #1355753 adding two way non transitive(external) trust displays
    internal error on the console
    - Always fetch forest info from root DCs when establishing two-way trust
    - factor out `populate_remote_domain` method into module-level function
    - Always fetch forest info from root DCs when establishing one-way trust
  - Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
    after `ipa-replica-install`
    - Track lightweight CAs on replica installation
  - Resolves: #1357488 ipa command stuck forever on higher versioned client with
    lower versioned server
    - compat: Save server's API version in for pre-schema servers
    - compat: Fix ping command call
    - schema cache: Store and check info for pre-schema servers
  - Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
    - Fix man page ipa-replica-manage: remove duplicate -c option
      from --no-lookup
  - Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
    when revoking certificate
    - cert: include CA name in cert command output
    - WebUI add support for sub-CAs while revoking certificates
  - Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
    - Add support for additional options taken from table facet
    - WebUI: Fix showing certificates issued by sub-CA
  - Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
    internactively
    - dns: normalize record type read interactively in dnsrecord_add
    - dns: prompt for missing record parts in CLI
    - dns: fix crash in interactive mode against old servers
  - Resolves: #1370519 Certificate revocation in service-del and host-del isn't
    aware of Sub CAs
    - cert: fix cert-find --certificate when the cert is not in LDAP
    - Make host/service cert revocation aware of lightweight CAs
  - Resolves: #1371901 Use OAEP padding with custodia
    - Use RSA-OAEP instead of RSA PKCS#1 v1.5
  - Resolves: #1371915 When establishing external two-way trust, forest root
    Administrator account is used to fetch domain info
    - do not use trusted forest name to construct domain admin principal
  - Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
    certificate request
    - Fix CA ACL Check on SubjectAltNames
  - Resolves: #1373272 CLI always sends default command version
    - cli: use full name when executing a command
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix ipa-certupdate for CA-less installation
  - Resolves: #1373540 client-install with IPv6 address fails on link-local
    address (always)
    - Fix parse errors with link-local addresses


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-11
changelog:
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix regression introduced in ipa-certupdate


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-12
changelog:
  - Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
  - Resolves: #1375269 ipa trust-fetch-domains throws internal error


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-13
changelog:
  - Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
    - Keep NSS trust flags of existing certificates
  - Resolves: #1360813 ipa-server-certinstall does not update all certificate
    stores and doesn't set proper trust permissions
    - Add cert checks in ipa-server-certinstall
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add revocation reason back to cert-find output
  - Resolves: #1375133 WinSync users who have First.Last casing creates users who
    can have their password set
    - ipa passwd: use correct normalizer for user principals
  - Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
    - Properly handle LDAP socket closures in ipa-otpd
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Make httpd publish its CA certificate on DL1


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14
changelog:
  - Resolves: #1378353 Replica install fails with old IPA master sometimes during
    replication process
    - spec file: bump minimal required version of 389-ds-base
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Fix missing file that fails DL1 replica installation
  - Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
    - WebUI: services without canonical name are shown correctly
  - Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
    - trustdomain-del: fix the way how subdomain is searched


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.1
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - password policy: Add explicit default password policy for hosts and
      services
  - Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
    certprofile-mod
    - certprofile-mod: correctly authorise config update


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.2
changelog:
  - Resolves: #1382812 Creation of replica for disconnected environment is
    failing with CA issuance errors; Need good steps.
    - gracefully handle setting replica bind dn group on old masters
  - Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
    temporary CA admin
    - replication: ensure bind DN group check interval is set on replica config
    - add missing attribute to ipaca replica during CA topology update
  - Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
    named-pkcs11
    - bindinstance: use data in named.conf to determine configuration status


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.3
changelog:
  - Resolves: #1398670 Check IdM Topology for broken record caused by replication
    conflict before upgrading it
    - Check for conflict entries before raising domain level


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.4
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - ipa-kdb: search for password policies globally
  - Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.5
changelog:
  - Resolves: #1365858 ipa-ca-install fails on replica when IPA Master is
    installed without CA
    - Set up DS TLS on replica in CA-less topology
  - Resolves: #1398600 IPA replica install fails with dirsrv errors.
    - Do not configure PKI ajp redirection to use "::1"
  - Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
    ca-del, ca-disable and ca-enable commands
    - ca: correctly authorise ca-del, ca-enable and ca-disable


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.6
changelog:
  - Resolves: #1416454 replication race condition prevents IPA to install
    - wait_for_entry: use only DN as parameter
    - Wait until HTTPS principal entry is replicated to replica
    - Use proper logging for error messages


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.7
changelog:
  - Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
    with cert errors (untrusted)
    - added ssl verification using IPA trust anchor
  - Resolves: #1428472 batch param compatibility is incorrect
    - compat: fix `Any` params in `batch` and `dnsrecord`
  - Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-1.el7
changelog:
  - Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
  - Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
    hostname
  - Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
    attribute
  - Resolves: #1321652 ipa-server-install fails when using external certificates
    that encapsulate RDN components in double quotes
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1340880 ipa-server-install: improve prompt on interactive
    installation
  - Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
    incomplete entries
  - Resolves: #1356104 cert-show command does not display Subject Alternative
    Names
  - Resolves: #1357511 Traceback message seen when ipa is provided with invalid
    configuration file name
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
  - Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
    config-mod --enable-migration=TRUE
  - Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
  - Resolves: #1371927 Implement ca-enable/disable commands.
  - Resolves: #1372202 Add Users into User Group editors fails to show Full names
  - Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
    check box in the UI
  - Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
    message
  - Resolves: #1375905 "Normal" group type in the UI is confusing
  - Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
  - Resolves: #1376630 IDM admin password gets written to
    /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
  - Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
    match other options
  - Resolves: #1378461 IPA Allows Password Reuse with History value defined when
    admin resets the password.
  - Resolves: #1379029 conncheck failing intermittently during single step
    replica installs
  - Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
  - Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
  - Resolves: #1392778 Update man page for ipa-adtrust-install by
    removing --no-msdcs option
  - Resolves: #1392858 Rebase to FreeIPA 4.5+
    - Rebase to 4.5.0
  - Resolves: #1399133 Delete option shouldn't be available for hosts applied to
    view.
  - Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
    should contain full trust chain
  - Resolves: #1400416 RFE: Provide option to take backup of IPA server before
    uninstalling IPA server
  - Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
  - Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
    not on details page
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
  - Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
    non-FQDN name of IPA server is first in /etc/hosts
  - Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
    nsupdate
  - Resolves: #1413742 Backport request for bug/issue Change IP address
    validation errors to warnings
  - Resolves: #1415652 IPA replica install log shows password in plain text
  - Resolves: #1427897 different behavior regarding system wide certs in master
    and replica.
  - Resolves: #1430314 The ipa-managed-entries command failed, exception:
    AttributeError: ldap2


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-2.el7
changelog:
  - Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
    - Remove csrgen
  - Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
    - Add options to allow ticket caching


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-3.el7
changelog:
  - Resolves: #800545 [RFE] Support SUDO command rename
    - Reworked the renaming mechanism
    - Allow renaming of the sudorule objects
  - Resolves: #872671 IPA WebUI login for AD Trusted User fails
    - WebUI: check principals in lowercase
    - WebUI: add method for disabling item in user dropdown menu
    - WebUI: Add support for login for AD users
  - Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
    certificates on smart cards (pkinit)
    - ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
    - IPA certauth plugin
    - ipa-kdb: do not depend on certauth_plugin.h
    - spec file: bump krb5-devel BuildRequires for certauth
  - Resolves: #1264370 RFE: disable last successful authentication by default in
    ipa.
    - Set "KDC:Disable Last Success" by default
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
    - configure: fix --disable-server with certauth plugin
    - rpcserver.login_x509: Actually return reply from __call__ method
    - spec file: Bump requires to make Certificate Login in WebUI work
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - extdom: do reverse search for domain separator
    - extdom: improve cert request
  - Resolves: #1430363 [RFE] HBAC rule names command rename
    - Reworked the renaming mechanism
    - Allow renaming of the HBAC rule objects
  - Resolves: #1433082 systemctl daemon-reload needs to be called after
    httpd.service.d/ipa.conf is manipulated
    - tasks: run `systemctl daemon-reload` after httpd.service.d updates
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Use Custodia 0.3.1 features
  - Resolves: #1434384 RPC client should use HTTP persistent connection
    - Use connection keep-alive
    - Add debug logging for keep-alive
    - Increase Apache HTTPD's default keep alive timeout
  - Resolves: #1434729 man ipa-cacert-manage install needs clarification
    - man ipa-cacert-manage install needs clarification
  - Resolves: #1434910 replica install against IPA v3 master fails with ACIError
    - Fixing replica install: fix ldap connection in domlvl 0
  - Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
    used during typing Directory Manager password
    - ipapython.ipautil.nolog_replace: Do not replace empty value
  - Resolves: #1435397 ipa-replica-install can't install replica file produced by
    ipa-replica-prepare on 4.5
    - replica prepare: fix wrong IPA CA nickname in replica file
  - Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
    KRA is not installed
    - WebUI: Fix showing vault in selfservice view
  - Resolves: #1435718 As a ID user I cannot call a command with --rights option
    - ldap2: use LDAP whoami operation to retrieve bind DN for current connection
  - Resolves: #1436319 "Truncated search results" pop-up appears in user details
    in WebUI
    - WebUI: Add support for suppressing warnings
    - WebUI: suppress truncation warning in select widget
  - Resolves: #1436333 Uninstall fails with No such file or directory:
    '/var/run/ipa/services.list'
    - Create temporaty directories at the begining of uninstall
  - Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
    fails
    - WebUI: Allow to add certs to certmapping with CERT LINES around
  - Resolves: #1436338 CLI doesn't work after ipa-restore
    - Backup ipa-specific httpd unit-file
    - Backup CA cert from kerberos folder
  - Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
    separation
    - Bump samba version for FIPS and priv. separation
  - Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
    ipa vault commands
    - Avoid growing FILE ccaches unnecessarily
    - Handle failed authentication via cookie
    - Work around issues fetching session data
    - Prevent churn on ccaches
  - Resolves: #1436657 Add workaround for pki_pin for FIPS
    - Generate PIN for PKI to help Dogtag in FIPS
  - Resolves: #1436714 [vault] cache KRA transport cert
    - Simplify KRA transport cert cache
  - Resolves: #1436723 cert-find does not find all certificates without
    sizelimit=0
    - cert: do not limit internal searches in cert-find
  - Resolves: #1436724 Renewal of IPA RA fails on replica
    - dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
  - Resolves: #1436753 Master tree fails to install
    - httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
      available


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-4.el7
changelog:
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Require correct custodia version


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-5.el7
changelog:
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1393726 Enumerate all available request type options in ipa
    cert-request help
    - Hide request_type doc string in cert-request help
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - spec file: bump libsss_nss_idmap-devel BuildRequires
    - server: make sure we test for sss_nss_getlistbycert
  - Resolves: #1437378 ipa-adtrust-install produced an error and failed on
    starting smb when hostname is not FQDN
    - adtrust: make sure that runtime hostname result is consistent with the
      configuration
  - Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
    keytab
    - Always check and create anonymous principal during KDC install
    - Remove duplicate functionality in upgrade
  - Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
    principal for PKINIT
    - Upgrade: configure PKINIT after adding anonymous principal
    - Remove unused variable from failed anonymous PKINIT handling
    - Split out anonymous PKINIT test to a separate method
    - Ensure KDC is propery configured after upgrade
  - Resolves: #1437951 Remove pkinit-related options from server/replica-install
    on DL0
    - Fix the order of cert-files check
    - Don't allow setting pkinit-related options on DL0
    - replica-prepare man: remove pkinit option refs
    - Remove redundant option check for cert files
  - Resolves: #1438490 CA-less installation fails on publishing CA certificate
    - Get correct CA cert nickname in CA-less
    - Remove publish_ca_cert() method from NSSDatabase
  - Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
    - IPA-KDB: use relative path in ipa-certmap config snippet
  - Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
    - Allow erasing ipaDomainResolutionOrder attribute


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-6.el7
changelog:
  - Resolves: #1382053 Need to have validation for idrange names
    - idrange-add: properly handle empty --dom-name option
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - dsinstance: reconnect ldap2 after DS is restarted by certmonger
    - httpinstance: avoid httpd restart during certificate request
    - dsinstance, httpinstance: consolidate certificate request code
    - install: request service certs after host keytab is set up
    - renew agent: revert to host keytab authentication
    - renew agent, restart scripts: connect to LDAP after kinit
  - Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
    domain entry
    - ipa-sam: create the gidNumber attribute in the trusted domain entry
    - Upgrade: add gidnumber to trusted domain entry
  - Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
    Incorrect client security database password
    - Add pki_pin only when needed
  - Resolves: #1438348 Console output message while adding trust should be
    mapped with texts changed in Samba.
    - ipaserver/dcerpc: unify error processing
  - Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
    'Credentials': Missing credentials for cross-forest communication
    - trust: always use oddjobd helper for fetching trust information
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - WebUI: cert login: Configure name of parameter used to pass username
  - Resolves: #1437879 [copr] Replica install failing
    - Create system users for FreeIPA services during package installation
  - Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
    - Fix s4u2self with adtrust


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-7.el7
changelog:
  - Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
    WebUI is slow to display user details page
    - cert: defer cert-find result post-processing
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - server-install: No double Kerberos install
  - Resolves: #1437502 ipa-replica-install fails with requirement to
    use --force-join that is a client install option.
    - Add the force-join option to replica install
    - replicainstall: better client install exception handling
  - Resolves: #1437953 Server CA-less impossible option check
    - server-install: remove broken no-pkinit check
  - Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
    - Add debug log in case cookie retrieval went wrong
  - Resolves: #1441548 ipa server install fails with --external-ca option
    - ext. CA: correctly write the cert chain
  - Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
    spawn
    - Fix CA-less to CA-full upgrade
  - Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
    libsss_nss_idmap to every binary in IPA
    - configure: fix AC_CHECK_LIB usage
  - Resolves: #1442815 Replica install fails during migration from older IPA
    master
    - Fix RA cert import during DL0 replication
  - Related: #1442004 Building IdM/FreeIPA internally on all architectures -
    filtering unsupported packages
    - Build all subpackages on all architectures


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-8.el7
changelog:
  - Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
    - Fix CAInstance.import_ra_cert for empty passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-9.el7
changelog:
  - Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
    certificates on smart cards (pkinit)
    - spec file: bump krb5 Requires for certauth fixes
  - Resolves: #1438729 Configure local PKINIT on DL0 or when '--no-pkinit' option
    is used
    - separate function to set ipaConfigString values on service entry
    - Allow for configuration of all three PKINIT variants when deploying KDC
    - API for retrieval of master's PKINIT status and publishing it in LDAP
    - Use only anonymous PKINIT to fetch armor ccache
    - Stop requesting anonymous keytab and purge all references of it
    - Use local anchor when armoring password requests
    - Upgrade: configure local/full PKINIT depending on the master status
    - Do not test anonymous PKINIT after install/upgrade
  - Resolves: #1442427 ipa.ipaserver.install.plugins.adtrust.
    update_tdo_gidnumber: ERROR Default SMB Group not found
    - upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
      installed
  - Resolves: #1442932 ipa restore fails to restore IPA user
    - restore: restart/reload gssproxy after restore
  - Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
    - Fix CA/server cert validation in FIPS
  - Resolves: #1444947 Deadlock between topology and schema-compat plugins
    - compat-manage: behave the same for all users
    - Move the compat plugin setup at the end of install
    - compat: ignore cn=topology,cn=ipa,cn=etc subtree
  - Resolves: #1445358 ipa vault-add raises TypeError
    - vault: piped input for ipa vault-add fails
  - Resolves: #1445382 ipa vault-retrieve fails to retrieve data from vault
    - Vault: Explicitly default to 3DES CBC
  - Resolves: #1445432 uninstall ipa client automount failed with RuntimeWarning
    - automount install: fix checking of SSSD functionality on uninstall
  - Resolves: #1446137 pki_client_database_password is shown in
    ipaserver-install.log
    - Hide PKI Client database password in log file


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-10.el7
changelog:
  - Resolves: #1438833 [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic key for
    host
    - Make sure remote hosts have our keys
  - Resolves: #1442815 Replica install fails during migration from older IPA
    master
    - Refresh Dogtag RestClient.ca_host property
    - Remove the cachedproperty class
  - Resolves: #1444787 Update warning message when KRA installation fails
    - kra install: update installation failure message
  - Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
    - ipa-server-install with external CA: fix pkinit cert issuance
  - Resolves: #1445397 GET in KerberosSession.finalize_kerberos_acquisition()
    must use FreeIPA CA
    - kerberos session: use CA cert with full cert chain for obtaining cookie
  - Resolves: #1447375 ipa-client-install: extra space in pkinit_anchors
    definition
    - ipa-client-install: remove extra space in pkinit_anchors definition
  - Resolves: #1447703 Fix SELinux contex of http.keytab during upgrade
    - Use proper SELinux context with http.keytab


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-12.el7
changelog:
  - Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
    - python2-ipalib: add missing python dependency
    - installer service: fix typo in service entry
    - upgrade: add missing suffix to http instance
  - Resolves: #1444791 Update man page of ipa-kra-install 
    - ipa-kra-install manpage: document domain-level 1
  - Resolves: #1441493 ipa cert-show raises stack traces when
    --certificate-out=/tmp 
    - cert-show: writable files does not mean dirs 
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - Bump version of ipa.conf file
  - Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
    - Turn on NSSOCSP check in mod_nss conf
  - Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
    template on
    - renew agent: respect CA renewal master setting
    - server upgrade: always fix certmonger tracking request
    - cainstance: use correct profile for lightweight CA certificates
    - renew agent: allow reusing existing certs
    - renew agent: always export CSR on IPA CA certificate renewal
    - renew agent: get rid of virtual profiles
    - ipa-cacert-manage: add --external-ca-type
  - Resolves: #1441593 error adding authenticator indicators to host 
    - Fixing adding authenticator indicators to host
  - Resolves: #1449525 Set directory ownership in spec file 
    - Added plugins directory to ipaclient subpackages
    - ipaclient: fix missing RPM ownership
  - Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
    - otptoken-add-yubikey: When --digits not provided use default value


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-13.el7
changelog:
  - Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
    error observed during ipa upgrade with latest package. 
    - ipa-server-install: fix uninstall
  - Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
    replica 
    - ca install: merge duplicated code for DM password
    - installutils: add DM password validator
    - ca, kra install: validate DM password


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-14.el7
changelog:
  - Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to 
    handle PKINIT certificates/anchors
    - certdb: add named trust flag constants
    - certdb, certs: make trust flags argument mandatory
    - certdb: use custom object for trust flags
    - install: trust IPA CA for PKINIT
    - client install: fix client PKINIT configuration
    - install: introduce generic Kerberos Augeas lens
    - server install: fix KDC PKINIT configuration
    - ipapython.ipautil.run: Add option to set umask before executing command
    - certs: do not export keys world-readable in install_key_from_p12
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
    - replica install: respect --pkinit-cert-file
    - cacert manage: support PKINIT
    - server certinstall: support PKINIT
  - Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
    option
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
  - Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
    decommissioned
    - ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname 
  - Resolves: #1451712 KRA installation fails on server that was originally
    installed as CA-less
    - ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
  - Resolves: #1441499 ipa cert-show does not raise error if no file name
    specified
    - ca/cert-show: check certificate_out in options
  - Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
    - Remove pkinit-anonymous command
  - Resolves: #1449523 Provide an API command to retrieve PKINIT status
    in the FreeIPA topology
    - Allow for multivalued server attributes
    - Refactor the role/attribute member reporting code
    - Add an attribute reporting client PKINIT-capable servers
    - Add the list of PKINIT servers as a virtual attribute to global config
    - Add `pkinit-status` command
    - test_serverroles: Get rid of MockLDAP and use ldap2 instead
  - Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
    - Fix rare race condition with missing ccache file
  - Resolves: #1455045 Simple service uninstallers must be able to handle
    missing service files gracefully
    - only stop/disable simple service if it is installed
  - Resolves: #1455541 after upgrade login from web ui breaks
    - krb5: make sure KDC certificate is readable
  - Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
    command "ipa cert-request --add" after upgrade
    - Change python-cryptography to python2-cryptography


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-15.el7
changelog:
  - Resolves: #1442233 IPA client commands fail when pointing to replica 
    - httpinstance: wait until the service entry is replicated
  - Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
    not indexed
    - Fix index definition for ipaAnchorUUID
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Avoid possible endless recursion in RPC call
    - rpc: preparations for recursion fix
    - rpc: avoid possible recursion in create_connection
  - Resolves: #1446087 services entries missing krbCanonicalName attribute.
    - Changing cert-find to do not use only primary key to search in LDAP.
  - Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
    - ipa-kdb: reload certificate mapping rules periodically
  - Resolves: #1455541 after upgrade login from web ui breaks
    - kdc.key should not be visible to all 
  - Resolves: #1435606 Add pkinit_indicator option to KDC configuration
    - ipa-kdb: add pkinit authentication indicator in case of a successful
      certauth
  - Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
    issuance when ipa-ca records are not resolvable
    - Turn off OCSP check
  - Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
    server_del - TypeError: 'NoneType' object is not iterable
    - fix incorrect suffix handling in topology checks


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-16.el7
changelog:
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Only warn when specified server IP addresses don't match intf
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Bump version of python-gssapi
  - Resolves: #1457942 certauth: use canonical principal for lookups
    - ipa-kdb: use canonical principal in certauth plugin
  - Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
    breaking older clients
    - Add code to be able to set default kinit lifetime
    - Revert setting sessionMaxAge for old clients


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-17.el7
changelog:
  - Resolve: #1455946 Provide a tooling automating the configuration 
    of Smart Card authentication on a FreeIPA master
    - server certinstall: update KDC master entry
    - pkinit manage: introduce ipa-pkinit-manage
    - server upgrade: do not enable PKINIT by default
    - Extend the advice printing code by some useful abstractions
    - Prepare advise plugin for smart card auth configuration
  - Resolve: #1461053 allow to modify list of UPNs of a trusted forest
    - trust-mod: allow modifying list of UPNs of a trusted forest
    - WebUI: add support for changing trust UPN suffixes


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-18.el7
changelog:
  - Resolves: #1449189 ipa-kra-install timeouts on replica
    - kra: promote: Get ticket before calling custodia


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-19.el7
changelog:
  - Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
    internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
    - ipa-sam: replace encode_nt_key() with E_md4hash() 
    - ipa_pwd_extop: do not generate NT hashes in FIPS mode
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces 
    - Fix local IP address validation 
    - ipa-dns-install: remove check for local ip address
    - refactor CheckedIPAddress class
    - CheckedIPAddress: remove match_local param
    - Remove ip_netmask from option parser
    - replica install: add missing check for non-local IP address
    - Remove network and broadcast address warnings


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-20.el7
changelog:
  - Resolves: #1452216 Replica installation grants HTTP principal
    access in WebUI
    - Make sure we check ccaches in all rpcserver paths


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7
changelog:
  - Resolves: #1469246 Replica install fails to configure IPA-specific
    temporary files/directories
    - replica install: drop-in IPA specific config to tmpfiles.d
  - Resolves: #1469480 bind package is not automatically updated during
    ipa-server upgrade process
    - Bumped Required version of bind-dyndb-ldap and bind package


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1
changelog:
  - Resolves: #1455946 Provide a tooling automating the configuration 
    of Smart Card authentication on a FreeIPA master
    - smart-card advises: configure systemwide NSS DB also on master
    - smart-card advises: add steps to store smart card signing CA cert
    - Allow to pass in multiple CA cert paths to the smart card advises
    - add a class that tracks the indentation in the generated advises
    - delegate the indentation handling in advises to dedicated class
    - advise: add an infrastructure for formatting Bash compound statements
    - delegate formatting of compound Bash statements to dedicated classes
    - Fix indentation of statements in Smart card advises
    - Use the compound statement formatting API for configuring PKINIT
    - smart card advises: use a wrapper around Bash `for` loops
    - smart card advise: use password when changing trust flags on HTTP cert
    - smart-card-advises: ensure that krb5-pkinit is installed on client
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile 
    (new installs only)
    - Add CommonNameToSANDefault to default cert profile
  - Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s
    during search in cn=ad,cn=trusts,dc=example,dc=com
    - NULL LDAP context in call to ldap_search_ext_s during search


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.1
changelog:
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile
    (new installs only)
    - Restore old version of caIPAserviceCert for upgrade only


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7.1.2
changelog:
  - Resolves: #1477703 IPA upgrade fails for latest ipa package
      - Restore old version of caIPAserviceCert for upgrade only


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2
changelog:
  - Resolves: #1477178 - [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic
    key for host
      - Always check peer has keys before connecting
  - Resolves: #1482802 - Unable to set ca renewal master on replica
      - Fix ipa config-mod --ca-renewal-master
  - Resolves: #1486283 - TypeError in renew_ca_cert prevents from swiching
    back to self-signed CA
      - Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
  - Resolves: #1480102 - ipa-server-upgrade failes with "This entry already exists"
      - Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This entry already exists
  - Resolves: #1484826 - FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
      - Adds whoami DS plugin in case that plugin is missing
  - Resolves: #1478251 - IPA WebUI does not work after upgrade from IPA 4.4 to 4.5
      - Fixing how sssd.conf is updated when promoting a client to replica
  - Resolves: #1461177 - ipa-otptoken-import - XML file is missing PBKDF2
    parameters!
      - ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
  - Resolves: #1484428 - Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
      - Backport 4-5: Fix ipa-server-upgrade with server cert tracking


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.0-21.el7.2.2
changelog:
  - Resolves: #1477367 ipa-server-upgrade timeouts on wait_for_open ports
    expecting IPA services listening on IPv6 ports
      - Make sure upgrade also checks for IPv6 stack
      - control logging of host_port_open from caller
      - log progress of wait_for_open_ports
  - Resolves: #1477243 ipa help command returns traceback when no cache
    is present
      - Store help in Schema before writing to disk
      - Disable pylint in get_help function because of type confusion.


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-1.el7
changelog:
  - Use OpenJDK 8 to bootstrap on AArch64 until RH1482244 is resolved in
    buildroot
  - Resolves: #1470177 - Rebase IPA to latest 4.5.x version
  - Resolves: #1398594 ipa topologysuffix-verify should only warn about 
    maximum number of replication agreements. 
  - Resolves: #1404236 Web UI: Change "Host Based" and "Role Based" 
    to "Host-Based" and "Role-Based" 
  - Resolves: #1409786 Second phase of --external-ca ipa-server-install
    setup fails when dirsrv is not running
  - Resolves: #1451576 ipa cert-request failed to generate certificate from csr 
  - Resolves: #1452086 Pagination Size under Customization in IPA WebUI 
    accepts negative values
  - Resolves: #1458169 --force-join option is not mentioned in 
    ipa-replica-install man page 
  - Resolves: #1463186 IPA shouldn't allow objectclass if not all in lower case 
  - Resolves: #1478322 user-show command fails when sizelimit is configured 
    to number <= number of entity which is user member of 
  - Resolves: #1496775 Enterprise principals should be able to trigger
    a refresh of the trusted domain data in the KDC
  - Resolves: #1502533 Changing cert-find to go through the proxy 
    instead of using the port 8080
  - Resolves: #1502663 pkinit-status command fails after an upgrade from
    a pre-4.5 IPA
  - Resolves: #1498168 Error when trying to modify a PTR record
  - Resolves: #1457876 ipa-backup fails silently
  - Resolves: #1493531 In case full PKINIT configuration is failing during 
    server/replica install the error message should be more meaningful.
  - Resolves: #1449985 Suggest CA installation command in KRA installation
    warning


author: Felipe Barreto <fbarreto@redhat.com> - 4.5.4-2.el7
changelog:
  - Resolves: #1461177 ipa-otptoken-import  - XML file is missing PBKDF2
    parameters!
  - Resolves: #1464205 NULL LDAP context in call to ldap_search_ext_s during
    search in cn=ad, cn=trusts,dc=example,dc=com
  - Resolves: #1467887 iommu platform support for ipxe
  - Resolves: #1477178 [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic key for
    host
  - Resolves: #1478251 IPA WebUI does not work after upgrade from IPA 4.4 to
    4.5
  - Resolves: #1480102 ipa-server-upgrade failes with "This entry already
    exists"
  - Resolves: #1482802 Unable to set ca renewal master on replica
  - Resolves: #1484428 Updating from RHEL 7.3 fails with Server-Cert not found
    (ipa-server-upgrade)
  - Resolves: #1484826 FreeIPA/IdM installations which were upgraded from
    versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and
    thus startup of Web UI fails
  - Resolves: #1486283 TypeError in renew_ca_cert prevents from swiching back
    to self-signed CA
  - Resolves: #1469246 Replica install fails to configure IPA-specific
    temporary files/directories
  - Resolves: #1469480 bind package is not automatically updated during
    ipa-server upgrade process
  - Resolves: #1475238 Use CommonNameToSANDefault in default profile (new
    installs only)
  - Resolves: #1477703 IPA upgrade fails for latest ipa package


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-3.el7
changelog:
  - Drop workaround for building on AArch64 (#1482244)
  - Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-4.el7
changelog:
  - Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
    - ldap: limit the retro changelog to dns subtree
  - Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
    of "CA:FALSE" IPA CA CSR
    - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1493145 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
    - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
    - ds: ignore time skew during initial replication step
    - ipa-replica-manage: implicitly ignore initial time skew in force-sync 
  - Resolves: #1500218 Replica installation at domain-level 0 fails against
    upgraded ipa-server
    - Fix ipa-replica-conncheck when called with --principal
  - Resolves: #1506188 server-del doesn't remove dns-server configuration
    from ldap


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.5.4-5.el7
changelog:
  - Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
  - Resolves: #1378892 host-find slowness caused by missing host attributes in index


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-7.el7
changelog:
  - Resolves: #1421869 Unable to re-add broken AD trust - Unexpected Information received
    - adtrust: filter out subdomains when defining our topology to AD
  - Resolves: #1486286 IPA failing to authenticate via password+OTP on RHEL7.4 with fips enabled
    - Don't allow OTP or RADIUS in FIPS mode
  - Resolves: #1494226 IPA User Details not being displayed in WebUI
    - Fix cert-find for CA-less installations
  - Resolves: #1498387 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
    - 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
  - Resolves: #1503022 ipa-getkeytab man page should have more details about consequences of krb5 key renewal
    - ipa-getkeytab man page: add more details about the -r option
  - Resolves: #1509288 IPA trust-add internal error (expected security.dom_sid got None)
    - ipaserver/plugins/trust.py; fix some indenting issues
    - trust: detect and error out when non-AD trust with IPA domain name exists
    - ipaserver/plugins/trust.py: pep8 compliance
  - Resolves: #1511019 ipa-restore broken with python2
    - Fix ipa-restore (python2)
  - Resolves: #1511607 ipa-backup does not backup Custodia keys and files
    - Backup ipa-custodia conf and keys
  - Resolves: #1512482 kra install fails after ipa cert renewed
    - Don't use admin cert during KRA installation
    - Prevent set_directive from clobbering other keys
    - pep8: reduce line lengths in CAInstance.__enable_crl_publish
    - installutils: refactor set_directive
    - Add tests for installutils.set_directive
    - Add safe DirectiveSetter context manager
    - Old pylint doesn't support bad python3 option
  - Resolves: #1514163 CA less IPA install with external certificates fails on RHEL 7 in FIPS mode
    - Fix ca less IPA install on fips mode


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-8.el7
changelog:
  - Resolves: #1477531 Incorrect attribute level rights (ipaallowedtoperform) of service object
    - WebUI: make keytab tables on service and host pages writable
  - Resolves: #1529444 ObjectclassViolation seen while adding idview with domain-resolution-order option
    - Idviews: fix objectclass violation on idview-add
  - Resolves: #1451576 ipa cert-request failed to generate certificate from csr
    - Fixing the cert-request comparing whole email address case-sensitively.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-9.el7
changelog:
  - Resolves: #1458169 --force-join option is not mentioned in ipa-replica-install man page
    - Add --force-join into ipa-replica-install manpage
  - Resolves: #1457876 ipa-backup fails silently
    - Changed ownership of ldiffile to DS_USER
  - Resolves: #1409786 Second phase of --external-ca ipa-server-install setup fails when dirsrv is not running
    - Checks if Dir Server is installed and running before IPA installation
  - Resolves: #1452086 Pagination Size under Customization in IPA WebUI accepts negative values
    - WebUI: Add positive number validator
    - WebUI: change validator of page size settings
    - WebUI: fix jslint error


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-11.el7
changelog:
  - Resolves: #1518157 Clarify the need to restart services in ipa-server-certinstall(1)
    - Add a notice to restart ipa services after certs are installed
  - Resolves: #1544679 OTP and Radius Authentication does not work in FIPS mode
    - Fix OTP validation in FIPS mode
    - Increase the default token key size
    - Revert "Don't allow OTP or RADIUS in FIPS mode"
    - Log errors from NSS during FIPS OTP key import
  - Resolves: #1470916 ipa client pointing to replica shows KDC has no support for encryption type
    - ipa-replica-install: make sure that certmonger picks the right master
  - Resolves: #1542627 DNS records updated with all IPAddresses of an interface when IPA server/replica try to install with Specific IP address of that interface
    - replica-install: pass --ip-address to client install


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.2
changelog:
  - Resolves: #1565633 nsds5ReplicaReleaseTimeout should be set by default
    - Add nsds5ReplicaReleaseTimeout to replica config
    - Fix upgrade (update_replica_config) in single master mode
  - Resolves: #1577108 Improve Custodia client and key distribution handling
    - Use single Custodia instance in installers
  - Resolves: #1577805 4.5.0 -> 4.5.4 upgrade breaks in ipa-server-upgrade: No such file or directory: '/var/lib/pki/pki-tomcat/conf/ca/CS.cfg'
    - Don't try to backup CS.cfg during upgrade if CA is not configured


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-1.el7
changelog:
  - Resolves: #1561581  Rebase IPA to latest 4.6.x version
  - Resolves: #1234219 [WebUI] Error message could be better while adding idrange with untrusted domain name.
  - Resolves: #1274488 ipa-client-install should use previously entered username when performing setup validation
  - Resolves: #1289487 Priority field missing in Password Policy detail tab
  - Resolves: #1339129 ipa vault-archive overwrites an existing value without warning
  - Resolves: #1368345 Replace ERROR: cannot connect to 'http://localhost:8888/ipa/json': [Errno 111] Connection refused with 'IPA is not configured on this system'
  - Resolves: #1424735 While performing ipa-server-upgrade, sssd goes offline and stalls the upgrade process
  - Resolves: #1427105 RFE - Option to add custom OID or display name in IPA Cert
  - Resolves: #1434924 ipa-restore fails when umask is set to 0027
  - Resolves: #1441262 ipa group-del gives ipa: ERROR: Insufficient access: but still deletes group
  - Resolves: #1452081 Suggest user to install libyubikey package instead of traceback
  - Resolves: #1458183 Users can delete their last active OTP token
  - Resolves: #1478366 Crash noticed during IPA upgrade process due to ipa package
  - Resolves: #1480502 ipa server uninstall with -v option displays "IOError: [Errno 9] Bad file descriptor Logged from file ipautil.py, line 442"
  - Resolves: #1481936 Limit number of times the DNS response for the ipa-server A and AAAA records are done during uninstallation.
  - Resolves: #1483139 ipa-restore command doesn't exit with failure if wrong directory manager's password is provided
  - Resolves: #1485429 domain resolution order field in Identity->ID Views->Settings tab missing in WebUI 
  - Resolves: #1485851 ipa param-find: command displays internal error
  - Resolves: #1494198 ipa-replica-manage re-initialize TypeError: 'NoneType' object does not support item assignment
  - Resolves: #1504565 API schema generated by server doesn't follow language requested by client.
  - Resolves: #1505925 kdc segfault in openldap libs when ipa-server is installed and custom pkinit is configured
  - Resolves: #1506709 ipa trust-add - Filter out overlapping namespace domains automatically
  - Resolves: #1513041 ipa-restore does not enable/start oddjobd
  - Resolves: #1515314 ipa-replica-install fails with PIN error [ CA-less environment ]
  - Resolves: #1515374 Custodia keys are not removed on uninstall
  - Resolves: #1518932 The Issuer DN field in IPA is not updating properly
  - Resolves: #1519723 admins group is not including all permissions of Role "User Administrator"
  - Resolves: #1527020 nsslapd-sasl-max-buffer-size is hardcoded to '2097152' during install even if another value was provided in an LDIF ( --dirsrv-config-file )
  - Resolves: #1534726 IPA 'Generate OTP' option in web gui does not show OTP code when no reverse zone is managed
  - Resolves: #1547641 ipa: Please log something after restarting the KDC
  - Resolves: #1547995 CRL url on replicas gets incorrectly redirected
  - Resolves: #1549187 IdM servers:/usr/share/ipa/html/ca.crt does not include the complete chain
  - Resolves: #1553594 ldappasswd cause the IPA embedded Directory server to SIGSEGV
  - Resolves: #1568748 Allow hosts to delete their own services
  - Resolves: #1576133 Radius Proxy OTP Auth in IPA is not failing over to the second server in a radius-proxy
  - Resolves: #1577108 Improve Custodia client and key distribution handling


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-2.el7
changelog:
  - Resolves: #1594142 SRV lookup doesn't correctly sort results
    - Sort and shuffle SRV record by priority and weight
  - Resolves: #1594141 Replication races in DogtagInstance.setup_admin
    - Fix replication races in Dogtag admin code
    - Use common replication wait timeout of 5min
    - Improve and fix timeout bug in wait_for_entry()
  - Resolves: #1591824 Installation of replica against a specific master
    - Always set ca_host when installing replica
  - Resolves: #1591647 Increase WSGI worker process count
    - Increase WSGI process count to 5 on 64bit
  - Resolves: #1394034 Custom SELinux User Map order is changed after updating IPA
    - Use replace instead of add to set new default ipaSELinuxUserMapOrder
  - Resolves: #1381535 ipa config-mod returns "Configured size limit exceeded"
    - ipaserver config plugin: Increase search records minimum limit


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.4-3.el7
changelog:
  - Resolves: #1603514 Replica install fails with "Certificate issuance failed (CA_REJECTED)" - ACIError


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-4.el7
changelog:
  - Resolves: #1600525 ipa-client-install --uninstall fails to uninstall client.
    - ipa client uninstall: clean the state store when restoring hostname
  - Resolves: #1598117 client uninstall fails when installed using non-existing hostname
    - ipa client uninstall: clean the state store when restoring hostname
  - Resolves: #1596168 ipa help topics displays 'ipa: ERROR: an internal error has occurred'
    - Fix regression: Handle unicode where str is expected
  - Resolves: #1591824 Installation of replica against a specific master
    - Query for server role IPA master
    - Only create DNS SRV records for ready server
    - Delay enabling services until end of installer
    - replicainstall: DS SSL replica install pick right certmonger host
    - Fix CA topology warning
    - Fix race condition in get_locations_records()
    - Fix DNSSEC install regression
    - Handle races in replica config
  - Resolves: #1591647 Increase WSGI worker process count
    - Use 4 WSGI workers on 64bit systems
  - Resolves: #1565633 nsds5ReplicaReleaseTimeout should be set by default.
    - Tune DS replication settings
  - Resolves: #1607616 Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
    - Removing filesystem encoding check
  - Resolves: #1598044  plugable.py:491:bootstrap:SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported.
    - Removing filesystem encoding check


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-5.el7
changelog:
  - Resolves: #1607616 Traceback in messages file during ipa-server-install: File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 541, in <module>#012
    - Removing filesystem encoding check
  - Resolves: #1598044  plugable.py:491:bootstrap:SystemEncodingError: System encoding must be UTF-8, 'ANSI_X3.4-1968' is not supported.
    - Removing filesystem encoding check


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-6.el7
changelog:
  - Resolves: #1590647 ldapmodify userPassword reflects on krblastpwdchange on RHEL6 but not RHEL7
    - In IPA 4.4 when updating userpassword with ldapmodify does not update krbPasswordExpiration nor krbLastPwdChange
  - Resolves: #1600074 ipa-server-upgrade displays 'DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated'
    - Re-open the ldif file to prevent error message
  - Resolves: #1608783 ipa trust-add fails in FIPS mode.
    - Move fips_enabled to a common library to share across different plugins
    - ipasam: do not use RC4 in FIPS mode


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-7.el7
changelog:
  - Resolves: #1609882 ipaserver/plugins/cert.py: Add reason to raise of errors.NotFound
    - ipaserver/plugins/cert.py: Added reason to raise of errors.NotFound
  - Resolves: #1598662 Replica installation fails with connection refused error 
    - Do not set ca_host when --setup-ca is used
  - Resolves: #1577108 Improve Custodia client and key distribution handling
    - Fix KRA replica installation from CA master
  - Resolves: #1515314 ipa-replica-install fails with PIN error [ CA-less environment ]
    - Fix ipa-replica-install when key not protected by PIN
  - Resolves: #1480502 ipa server uninstall with -v option displays "IOError: [Errno 9] Bad file descriptor Logged from file ipautil.py, line 442"
    - uninstall -v: remove Tracebacks
  - Resolves: #1368345 Replace ERROR: cannot connect to 'http://localhost:8888/ipa/json': [Errno 111] Connection refused with 'IPA is not configured on this system'
    - ipa commands: print 'IPA is not configured' when ipa is not setup
    - Disable message about log in ipa-backup if IPA is not configured
  - Resolves: #1591824 Installation of replica against a specific master
    - Do not set ca_host when --setup-ca is used
  - Resolves: #1594141 Replication races in DogtagInstance.setup_admin
    - Catch ACIError instead of invalid credentials
  - Resolves: #1623112  ipa-replica-install defines nsds5replicabinddngroup before the group contains the DN of the replication manager
    - DS replication settings: fix regression with <3.3 master
  - Resolves: #1623113 Replica install: certmonger sometimes fails
    - Wait for client certificates
    - Auto-retry failed certmonger requests


author: Tibor Dudlák <tdudlak@redhat.com> - 4.6.4-8.el7
changelog:
  - Resolves #1508498 Authn/TOTP defined users periodically prompt for just password credentials to access resources
    - Clear next field when returnining list elements in queue.c
    - Add cmocka unit tests for ipa otpd queue code
  - Resolves #1622168 ipa-otpd: fix potential double-free and infinite loop in queue code
    - Clear next field when returnining list elements in queue.c
    - Add cmocka unit tests for ipa otpd queue code
  - Resolves #1603444 ipa-server-install script is failing when using the "--no-dnssec-validation" parameter combined with the "--forwarder"
    - ipa-server-install: do not perform forwarder validation with --no-dnssec-validation


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-9.el7
changelog:
  - Resolves: #1624755 Re-installing replica on the same system displays 'WARNING: cannot check if port 443 is already configured'
    - ipa-replica-install: properly use the file store
  - Resolves: #1623486 PKINIT configuration did not succeed message is received during Replica-install
    - ipa-replica-install: fix pkinit setup
  - Related: #1624289 AVC denials noticed during test execution for SUB-CA test-suite in FIPS mode
    - Update minimum selinux-policy to 3.13.1-224


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7
changelog:
  - Resolves: 1630361 PKINIT fails in FIPS mode
    - Ensure that public cert and CA bundle are readable
    - Always make ipa.p11-kit world-readable
    - Make /etc/httpd/alias world readable & executable
    - Fix permission of public files in upgrader


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-11.el7
changelog:
  - Resolves: 1651834 searching for ipa users by certificate fails
    - ipaldap.py: fix method creating a ldap filter for IPACertificate
    - ipatests: add xmlrpc test for user|host-find --certificate
  - Resolves: 1644874 IPA Upgrade failed with "unable to convert the attribute u'cACertificate;binary'"
    - ipa upgrade: handle double-encoded certificates
    - ipatests: add upgrade test for double-encoded cacert
    - ipatests: fix TestUpgrade::test_double_encoded_cacert
  - Resolves: 1599939 'ipa vault-retrieve' is failing with "ipa: ERROR: an internal error has occurred"
    - Add a shared-vault-retrieve test
    - Add a "Find enabled services" ACI in 20-aci.update so that all users can find IPA servers and services. ACI suggested by Christian Heimes.
  - Resolves: 1493541 ipa-pkinit-manage reports a switch from local pkinit to full pkinit configuration was successful although it was not.
    - ipatest: add test for ipa-pkinit-manage enable|disable
    - PKINIT: fix ipa-pkinit-manage enable|disable
  - Resolves: 1390757 automember-rebuild crashes
    - Find orphan automember rules
  - Resolves: 1658701 ipa-replica-install fails migrating RHEL 6 to 7
    - replication: check remote ds version before editing attributes


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-12.el7
changelog:
  - Resolves: 1672180 pki spawn fails for IPA replica install from RHEL6 IPA master
    - Update mod_nss cipher list so there is overlap with a 4.x master
  - Resolves: 1672184 Fix compile issue with new 389-ds
    - ipa-sidgen: make internal fetch_attr helper really internal
  - Resolves: 1669012 host_del and host_disable fails, ra.find() search for every certificates instead of the host's certificate by subject
    - Add workaround for slow host/service del
    - Optimize cert remove case
  - Resolves: 1533228 The ipa-replica-install command failed, exception: ValidationError: invalid 'dnszoneidnsname': only master zones can contain record
    - replica installation: add master record only if in managed zone
    - ipatests: add test for replica in forward zone


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-1.el7
changelog:
  - Resolves: 1677197 Rebase IPA to latest 4.6.x version
  - Resolves: 1690037[RFE] Add utility to promote CA replica to CRL master
  - Resolves: 1689585 Cannot install ipa-server on rhel7.7
  - Resolves: 1672184 Fix compile issue with new 389-ds
  - Resolves: 1672180 pki spawn fails for IPA replica install from RHEL6 IPA master
  - Resolves: 1669012 host_del and host_disable fails, ra.find() search for every certificates instead of the host's certificate by subject
  - Resolves: 1658701 ipa-replica-install fails migrating RHEL 6 to 7
  - Resolves: 1651834 searching for ipa users by certificate fails
  - Resolves: 1644874 IPA Upgrade failed with "unable to convert the attribute u'cACertificate;binary'"
  - Resolves: 1638545 ipa-advise command points to old URL's.
  - Resolves: 1637717 RFE: Validation and better error messages when novajoin fails because of SSL errors
  - Resolves: 1599939 'ipa vault-retrieve' is failing with "ipa: ERROR: an internal error has occurred"
  - Resolves: 1593454 In IPA WebUI, a warning appears in the background(warning message behind the dialog box).
  - Resolves: 1586268 [RFE] Red Hat Identity Manager IP SANs
  - Resolves: 1579037 Adding 3rd Party CAs to IPA results in SmartCard preparation script failure
  - Resolves: 1577967 Users with user creation/modification privileges fail to add the "--radius-username" option when creating users
  - Resolves: 1572674 ipa-cacert-manage cannot import PKCS#7 files
  - Resolves: 1562422 [RFE] Allow IPA Services to Start After the IPA Backup Has Completed
  - Resolves: 1562396 IPA numeric username breaks sudo and getent
  - Resolves: 1533228 The ipa-replica-install command failed, exception: ValidationError: invalid 'dnszoneidnsname': only master zones can contain records
  - Resolves: 1497334 ipa-server-install should prevent installations with single label domains
  - Resolves: 1493541 ipa-pkinit-manage reports a switch from local pkinit to full pkinit configuration was successful although it was not.
  - Resolves: 1485217 [RFE] Warn or adjust umask if it is too restrictive to break installation
  - Resolves: 1428690 ipa-backup does not create log file at /var/log/
  - Resolves: 1408439 ipa idoverrideuser-find view --anchor fails to return output
  - Resolves: 1390757 automember-rebuild crashes
  - Resolves: 1376024 During one step replica install the command accepts both OTP and Admin password simultaneously
  - Resolves: 1245626 ipa-client-install modifies /etc/openldap/ldap.conf in a way which is unhandy for openldap-clients


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-2.el7
changelog:
  - Resolves: 1691334 New defect found in ipa-4.6.5-1.el7
    - Coverity: fix issue in ipa_extdom_extop.c
  - Resolves: 1666843 ipa-replica-manage force-sync --from keeps prompting "No status yet"
    - ipa-replica-manage: fix force-sync
  - Resolves: 1594245 [RFE] sysadm_r should be included in default SELinux user map order
    - Add sysadm_r to default SELinux user map order
  - Resolves: 1527215 RFE: ipa client should setup openldap for GSSAPI
    - RFE: ipa client should setup openldap for GSSAPI
  - Resolves: 1518939 RFE: Extend IPA to support unadvertised replicas
    - Unify and simplify LDAP service discovery
    - Use api.env.container_masters
    - Consolidate container_masters queries
    - Add hidden replica feature
    - ipatests: Exercise hidden replica feature
    - Simplify and improve tests
    - Implement server-state --state=enabled/hidden
    - Consider hidden servers as role provider
    - Improve config-show to show hidden servers
    - More test fixes
    - Don't allow to hide last server for a role
    - Synchronize hidden state from IPA master role
    - Test replica installation from hidden replica
    - Add design draft
    - Don't fail if config-show does not return servers
  - Resolves: 1517886 double ca acl provoke console error.
    - Add uniqueness constraint on CA ACL name
  - Resolves: 1498110 Using --auto-reverse and --allow-zone-overlap does not skip zone overlap check
    - Extend CALessBase::installer_server to accept extra_args
    - Skip zone overlap check with auto-reverse
  - Resolves: 1496963 [RFE] Provide an option to include FQDN in IDM topology graph
    - Web UI (topology graph): Show FQDN for nodes if they have no common DNS zone
  - Resolves: 1345975 [RFE] Support One-Way Trust authenticated by trust secret
    - Replace hard-coded paths with path constants
    - Support Samba 4.9
    - Add design page for one-way trust to AD with shared secret
    - trust: allow trust agents to read POSIX identities of trust
    - trusts: add support for one-way shared secret trust
    - upgrade: upgrade existing trust agreements to new layout
    - upgrade: add trust upgrade to actual upgrade code
  - Resolves: 1690191 [RFE] Offline Certificate Renewal System
    - Extract ca_renewal cert update subroutine
    - cainstance: add function to determine ca_renewal nickname
    - constants: add ca_renewal container
    - Add ipa-cert-fix tool
    - ipa-cert-fix: add man page
    - ipa-cert-fix: use customary exit statuses
  - Resolves: 1631826 Create a warning that SSSD needs restart after idrange-mod
    - Show a notification that sssd needs restarting after idrange-mod


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-3.el7
changelog:
  - Resolves: 1694623 ipa-kra-install failing with invalid 'role_servrole': must be Unicode text error
    - ipa-setup-kra: fix python2 parameter
  - Resolves: 1694596 ipa-server-upgrade fails with ConversionError: invalid 'cn': must be Unicode text
    - ipa-server-upgrade: fix add_systemd_user_hbac


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-4.el7
changelog:
  - Resolves: 1686302 ipa trust fetch-domains, server parameter ignored
    - oddjob: allow to pass options to trust-fetch-domains
  - Resolves: 1695481 ipa trust-add failing with CIFS server communication error
    - adtrust: define Guests mapping after creating cifs/ principal
    - net groupmap: force using empty config when mapping Guests


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-5.el7
changelog:
  - Resolves: 1697242 Communication with oddjob helper fails
    - Bypass D-BUS interface definition deficiences for trust-fetch-domains


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-7.el7
changelog:
  - Resolves: 1704227 - Wrong logic in ipactl restart leads to start instead of restart pki-tomcatd
    - ipactl restart: fix wrong logic when checking service list


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-8.el7
changelog:
  - Resolves: 1702651 - Command ipa conole is broken
    - ipa console: catch proper exception when history file can not be open
  - Resolves: 1704796 - Wrong CA replication topology created with two replicas
    - replica install: acknowledge ca_host override
  - Resolves: 1708873 - Unable to upgrade ipa data: IPA version error: data needs to be upgraded (expected version '4.7.90.pre1-3.fc30', current version '4.7.2-8.fc30')
    - upgrade: adtrust - catch empty result when retrieving list of trusts


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-9.el7
changelog:
  - Resolves: 1712794 - ERROR: invalid 'PKINIT enabled server': all masters must have IPA master role enabled
    - Consider configured servers as valid


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-10.el7
changelog:
  - Resolves: 1723473 - ipa upgrade fails with trust entry already exists
    - adtrust upgrade: fix wrong primary principal name


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7
changelog:
  - Resolves: 1723473 - ipa upgrade fails with trust entry already exists
    - adtrust upgrade: fix wrong primary principal name, part 2
  - Resolves: 1686302 - ipa trust fetch-domains, server parameter ignored
    - trust-fetch-domains: make sure we use right KDC when --server is specified


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-1.el7
changelog:
  - Resolves: 1733075 - Rebase IPA to latest 4.6.x version
  - Resolves: 1512952 - cert renewal is failing when ipa ca cert is renewed from self-signed > external ca > self-sign
  - Resolves: 1544470 - cn=cacert could show expired certificate
  - Resolves: 1581583 - Error message should be more useful while ipa-backup fails for insufficient space
  - Resolves: 1632351 - remove "last init status" from ipa-replica-manage list <node> if it's None.
  - Resolves: 1691939 - False error is shown when options are added to an existing sudo rule using 'sudooption'
  - Resolves: 1695685 - IPA Web UI is slow to display user details page
  - Resolves: 1702426 - ipa-server-common expected file permissions in package don't match runtime permissions
  - Resolves: 1711172 - Removing TLSv1.0, TLSv1.1 from nss.conf
  - Resolves: 1714076 - Issue with adding multiple RHEL 7 IPA replica to RHEL 6 IPA master
  - Resolves: 1714921 - x509.Name -> ipapython.dn.DN does not handle multi-valued RDNs
  - Resolves: 1720952 - Cannot modify TTL with ipa dnsrecord-mod --ttl alone on command line
  - Resolves: 1721550 - Staged user is not being recognized if the user entry doesn't have an objectClass "posixaccount"
  - Resolves: 1727304 - Restrict cipher lists used by openssl connections
  - Resolves: 1733209 - ipa-client-automount needs option to specify domain
  - Resolves: 1733265 - IPA webgui incorrectly display number of entries in ID views


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.6-3.el7
changelog:
  - Resolves: 1717008 - User incorrectly added to negative cache when backend is reconnecting to IPA service / timed out: error code 32 'No such object'


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.6.6-4.el7
changelog:
  - Resolves: 1744926 - rebuild against Samba 4.10 to solve undefined symbol: DEBUGLEVEL_CLASS
  - Backport patches to compile against Samba 4.10
  - Fix Python 2 compatibility in adtrustinstance


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-5.el7
changelog:
  - Resolves: #1749788 - ipa host-find --pkey-only includes SSH keys in output
    - Don't return SSH keys with ipa host-find --pkey-only
  - Resolves: #1745108 - Bug 1497334 invalidating single-label domains introduces regression of usage for customers
    - check for single-label domains only during server install
  - Resolves: #1583950 - IPA: IDM drops all custom attributes when moving account from preserved to stage
    - user-stage: transfer all attributes from preserved to stage user
    - xmlrpc test: add test for preserved > stage user


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-6.el7
changelog:
  - Resolves: #1752005 - Keyrings should not be used in containerized environment
    - Don't configure KEYRING ccache in containers
  - Resolves: #1751951 - When master's IP address does not resolve to its name, ipa-replica-install fails
    - Add container environment check to replicainstall
  - Resolves: #1750700 - when migrating trusted domain object structure, add default access control definitions, if they were missing in old trust objects
    - add default access control when migrating trust objects
    - adtrust: add default read_keys permission for TDO objects
    - Disable deprecated-lambda check in adtrust upgrade code


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-7.el7
changelog:
  - Resolves: #1754494 - ipa-replica-install does not enforce --server option
    - replica install: enforce --server arg
  - Resolves: #1729638 - ipa_kdb: assertion failure from NULL lcontext pointer to ldap_get_values_len()
    - Fix segfault in ipadb_parse_ldap_entry()
    - Log INFO message when LDAP connection fails on startup
    - Fix NULL pointer dereference in maybe_require_preauth()
  - Resolves: #1636765 - ipa-restore set wrong file permissions and ownership for /var/log/dirsrv/slapd- directory
    - ipa-restore: Restore ownership and perms on 389-ds log directory


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-8.el7
changelog:
  - Resolves: #1755223 - Sub-CA key replication failure
    - Handle missing LWCA certificate or chain
    - Fix CustodiaClient ccache handling
    - CustodiaClient: use ldapi when ldap_uri not specified
    - CustodiaClient: fix IPASecStore config on ipa-4-7
    - Bump krb5 min version


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-9.el7
changelog:
  - Resolves: #1762317 - ipa-backup command is failing on rhel-7.8
    -  ipa-backup: fix python2 issue with os.mkdir


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-10.el7
changelog:
  - Resolves: #1728123 - EMBARGOED CVE-2019-10195 ipa: FreeIPA: batch API logging user passwords to /var/log/httpd/error_log [rhel-7]
    - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
  - Resolves: #1773550 - IPA upgrade fails for latest ipa package when adtrust is installed
    - Do not run trust upgrade code if master lacks Samba bindings
  - Resolves: #1767302 - EMBARGOED CVE-2019-14867 ipa: Denial of service in IPA server due to wrong use of ber_scanf() [rhel-7.8]
    - Make sure to have storage space for tag


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-11.el7
changelog:
  - Resolves: #1778777 - After upgrade AD Trust Agents were removed from LDAP
    - trust upgrade: ensure that host is member of adtrust agents


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-12.el7
changelog:
  - Resolves: #1754902 - Running ipa-server-install fails when RHEL 7.7 packages are installed on RHEL 7.6
  - Resolves: #1404770 - ID Views: do not allow custom Views for the masters
    - idviews: prevent applying to a master
  - Resolves: #1801791 - Compatibility Schema difference in functionality for systems following RHEL 7.5 -> 7.6 upgrade path as opposed to new RHEL 7.6 systems
    - install/updates: move external members past schema compat update
  - Resolves: #1795890 - ipa-pkinit-manage enable fails on replica if it doesn't host the CA
    - pkinit setup: fix regression on master install
    - pkinit enable: use local dogtag only if host has CA
  - Resolves: #1788907 - Renewed certs are not picked up by IPA CAs
    - Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
  - Resolves: #1780548 - Man page ipa-cacert-manage does not display correctly on RHEL
    - ipa-cacert-manage man page: fix indentation
  - Resolves: #1782587 - add "systemctl restart sssd" to warning message when adding trust agents to replicas
    - adtrust.py: mention restarting sssd when adding trust agents
  - Resolves: #1771356 - Default client configuration breaks ssh in FIPS mode
    - Use default ssh host key algorithms
  - Resolves: #1755535 - ipa-advise on a RHEL7 IdM server is not able to generate a configuration script for a RHEL8 IdM client
    - smartcard: make the ipa-advise script compatible with authselect/authconfig
  - Resolves: #1758406 - KRA authentication fails when IPA CA has custom Subject DN
    - upgrade: fix ipakra people entry 'description' attribute
    - krainstance: set correct issuer DN in uid=ipakra entry
  - Resolves: #1756568 - ipa-server-certinstall man page does not match built-in help
    - ipa-server-certinstall manpage: add missing options
  - Resolves: #1206690 - UPG not being enforced properly
    - ipa user_add: do not check group if UPG is disabled
  - Resolves: #1811982 - CVE-2018-14042 ipa: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip.
  - Resolves: #1811978 - CVE-2018-14040 ipa: bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
  - Resolves: #1811972 - CVE-2016-10735 ipa: bootstrap: XSS in the data-target attribute
  - Resolves: #1811969 -CVE-2018-20676 ipa: bootstrap: XSS in the tooltip data-viewport attribute
  - Resolves: #1811966 - CVE-2018-20677 ipa: bootstrap: XSS in the affix configuration target property
  - Resolves: #1811962 - CVE-2019-8331 ipa: bootstrap: XSS in the tooltip or popover data-template attribute
    - Web UI: Upgrade Bootstrap version 3.3.7 -> 3.4.1
  - Resolves: #1769791 - Invisible part of notification area in Web UI intercepts clicks of some page elements
    - WebUI: Fix notification area layout
  - Resolves: #1545755 - ipa-replica-prepare should not update pki admin password
    - Fix indentation levels
    - ipa-pwd-extop: use SLAPI_BIND_TARGET_SDN
    - ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
    - Don't save password history on non-Kerberos accounts


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-1.el7
changelog:
  - Resolves: #1819725 - Rebase IPA to latest 4.6.x version
  - Resolves: #1817927 - host-add --password logs cleartext userpassword to Apache error log
  - Resolves: #1817923 - IPA upgrade is failing with error "Failed to get request: bus, object_path and dbus_interface must not be None."
  - Resolves: #1817922 - covscan memory leaks report
  - Resolves: #1817919 - Enable compat tree to provide information about AD users and groups on trust agents
  - Resolves: #1817918 - Secure tomcat AJP connector
  - Resolves: #1817886 - ipa group-add-member: prevent adding IPA objects as external members
  - Resolves: #1788718 - ipa-server-install incorrectly setting slew mode (-x) when setting up ntpd


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-2.el7
changelog:
  - Resolves: #1802408 CVE-2020-1722 ipa: No password length restriction leads to denial of service
    - Add interactive prompt for the LDAP bind password to ipa-getkeytab
    - CVE-2020-1722: prevent use of too long passwords


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-3.el7
changelog:
  - Resolves: #1834385 Man page syntax issue detected by rpminspect
    - Man pages: fix syntax issues
  - Resolves: #1829787 ipa service-del deletes the required principal when specified in lower/upper case
    - Make check_required_principal() case-insensitive
  - Resolves: #1825829 ipa-advise on a RHEL7 IdM server generate a configuration script for client having hardcoded python3
    - ipa-advise: fallback to /usr/libexec/platform-python if python3 not found
  - Resolves: #1812020 CVE-2015-9251 ipa: js-jquery: Cross-site scripting via cross-domain ajax requests
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1
  - Resolves: #1713487 CVE-2019-11358 ipa: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-4.el7
changelog:
  - Resolves: #1842950 ipa-adtrust-install fails when replica is offline
    - ipa-adtrust-install: avoid failure when replica is offline
  - Resolves: #1831856 CVE-2020-11022 ipa: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
    - WebUI: Apply jQuery patch to fix htmlPrefilter issue


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7
changelog:
  - Resolves: #1826659 IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp
    -  ipa-pwd-extop: use timegm() instead of mktime() to preserve timezone offset


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.4
changelog:
  - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing
    - wgi/plugins.py: ignore empty plugin directories
  - Resolves: #1895197 improve IPA PKI susbsystem detection by other means than a directory presence, use pki-server subsystem-find
    - Improve PKI subsystem detection
    - ipatests: add test for PKI subsystem detection
    - ipatest: fix test_upgrade.py::TestUpgrade::()::test_kra_detection
  - Resolves: #1892793 Authentication and login times are over several seconds due to unindexed ipaExternalMember
    - Add more indices
  - Resolves: #1884819 IdM Web UI shows users as disabled
    - fix cert-find errors in CA-less deployment
  - Resolves: #1863619 CA-less install does not set required permissions on KDC certificate
    - CAless installation: set the perms on KDC cert file
    - ipatests: check KDC cert permissions in CA less install
  - Resolves: #1859248 CVE-2020-11023 ipa: jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
    - WebUI: Fix jQuery DOM manipulation issues
  - Resolves: #1846349 cannot issue certs with multiple IP addresses corresponding to different hosts
    - fix iPAddress cert issuance for >1 host/service


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.5
changelog:
  - Resolves: #1931405 krb5kdc crash - Segmentation fault in ldap_first_entry().
    - ipa-kdb: fix compiler warnings
    - ipa-kdb: add missing prototypes
    - ipa-kdb: reformat ipa_kdb_certauth
    - ipa-kdb: mark test functions as static
    - ipa-kdb: do not use OpenLDAP functions with NULL LDAP context
  - Resolves: #1835741 krb5kdc crashing on ipa server
  - Resolves: #1929372 krb5kdc is crashing intermittently on IPA server.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.7
changelog:
  - Resolves: #1956550 - IPA server installation fails when cert contains non-ASCII character
    - CA less installation: non ASCII chars in CA subject
    - ipatests: use non-ascii chars in CA-less install
  - Resolves: #1974328 - Revise PKINIT upgrade code
    - Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.9
changelog:
  - Resolves: #2000261 - extdom: LDAP_INVALID_SYNTAX returned instead of LDAP_NO_SUCH_OBJECT
    - extdom: return LDAP_NO_SUCH_OBJECT if domains differ


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.10
changelog:
  - Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server 
    - Fix cert_request for KDC cert
  - Resolves: 2021444 - CVE-2020-25719 ipa: samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets
    - SMB: switch IPA domain controller role


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.11
changelog:
  - Resolves: 2082272 - [RFE] Require confirmation to change "Default host group" in IdM automember rules
    - WebUI: Add confirmation dialog for changing default user/host group


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.12
changelog:
  - Resolves: 2084223 - 'ipa idview-show idviewname' & IPA WebUI takes longer time to return the results
    - idviews: use cached ipaOriginalUid value when resolving ID override
  - Resolves: 2124369 - OTP token sync always returns OK even with random numbers
    - ipa otptoken-sync: return error when sync fails
    - ipatests: add negative test for otptoken-sync
    - ipatests: python2 does not support f-strings
    - Fix otptoken_sync plugin


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.13
changelog:
  - Resolves: 2148249 - ipa-client-install does not maintain server affinity during installation
    - Defer creating the final krb5.conf on clients
    - Move client certificate request after krb5.conf is created
    - server install: remove error log about missing bkup file


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.14
changelog:
  - Resolves: 2180919 [rhel-7] Sequence processing failures for group_add using server context
    - ipaserver: deepcopy objectclasses list from IPA config


author: Julien Rische <jrische@redhat.com> - 4.6.8-5.el7_9.17
changelog:
  - Resolves: RHEL-29926 ipa: user can obtain a hash of the passwords of all domain users and perform offline brute force


author: Michal Ruprich <mruprich@redhat.com> - 3.1.7-1
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding latest version before including iperf3 in RHEL-7


author: Michal Ruprich - 3.1.7-2
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding requires to spec file for devel package


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-17
changelog:
  - 1518367 boot from iSCSI not establishing all sessions persistently
  - 1667965 A manual restart of iscsi.service modifies records node.startup value


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-18
changelog:
  - 1809945 backport new CHAP modes for FIPS environments (SHA1 and SHA256 only, no SHA3 in OpenSSL-1.0.2)


author: Ben Skeggs <bskeggs@redhat.com> 20090106-2
changelog:
  - Add firmware needed for nouveau to operate correctly (this is Fedora
    only - do not upstream yet - we just moved it here from Fedora kernel)


author: Josh Boyer <jwboyer@redhat.com> 20120510-0.3.git375e954
changelog:
  - Fix location of BuildRequires so git is inclued in the buildroot
  - Create iwlXXXX-firmware subpackages (rhbz 828050)


author: Josh Boyer <jwboyer@redhat.com>
changelog:
  - Consolidate rt61pci-firmware and rt73usb-firmware packages (rhbz 864959)
  - Consolidate netxen-firmware and ql2[123]xx-firmware packages (rhbz 864959)


author: Kyle McMartin <kyle@redhat.com> - 20130418-0.2.gitb584174
changelog:
  - UsrMove: move firmware to /usr/lib/firmware
  - Remove duplicate /usr/lib/firmware/updates entry (already in linux-firmware.dirs)
  - Simplify sed by using '!' instead of '/' as regexp delimiter
  - Fix date error (commited on Mon Feb 04, so change that entry)


author: Kyle McMartin <kyle@redhat.com> - 20130418-25.gitb584174
changelog:
  - Use a common version number for both the iwl*-firmware packages and
    linux-firmware itself.
  - Don't reference old kernel-firmware package in %description


author: Josh Boyer <jwboyer@redhat.com> - 20130724-28.git31f6b30
changelog:
  - Temporarily remove AMD microcode (rhbz 988263)
  - Remove Creative CA0132 HD-audio files as they're in alsa-firmware


author: Josh Boyer <jwboyer@fedoraproject.org> - 20140131-35.gitd7f8a7c8
changelog:
  - Update to new snapshot
  - Updates for Intel 3160/7260, radeon HAWAII GPUs, and some rtlwifi chips
  - Fixes bugs 815579 1046935


author: Josh Boyer <jwboyer@fedoraproject.org> - 20140605-38.gita4f3bc03
changelog:
  - Updates for Intel 3160/7260/7265 firmware (1087717)
  - Add firmware for rtl8723be (rhbz 1091753)
  - Updates for radeon CIK, SI/CI, and Mullins/Beema GPUs (rhbz 1094153)
  - Various other firmware updates


author: Josh Boyer <jwboyer@fedoraproject.org>
changelog:
  - Update to latest upstream git snapshot for new radeon firmware (rhbz 1130738)
  - Fix versioning after mass rebuild and for iwl5000-firmware (rhbz 1130979)


author: Josh Boyer <jwboyer@fedoraproject.org> 20150521-52.git3161bfa4
changelog:
  - Update to latest upstream git snapshot
  - Updated iwlwifi 316x/726x firmware
  - Add cx18-firmware Obsoletes from David Ward (rhbz 1222164)


author: Josh Boyer <jwboyer@fedoraproject.org> 20150715-54.git69640304
changelog:
  - Update to latest upstream git snapshot
  - New iwlwifi firmware for 726x/316x/8000 devices
  - New firmware for i915 skylake and radeon devices
  - Various other updates


author: Josh Boyer <jwboyer@fedoraproject.org> 20151130-59.gita109a8ff
changelog:
  - Update to latest upstream snapshot
  - Includes -16 ucode for iwlwifi, skylake dmc and audio updates, brcm updates
    bnx2x, and others


author: Josh Boyer <jwboyer@fedoraproject.org> 20160316-62.gitdeb1d836
changelog:
  - Update to latest upstream snapshot
  - New firmware for iwlwifi 3168, 7265D, 8000C, and 8265 devices


author: Josh Boyer <jwboyer@fedoraproject.org> 20160609-66.gita4bbc811
changelog:
  - Update to the latest upstream snapshot
  - Intel bluetooth, radeon smc, Intel braswell/broxton audio, cxgb4 updates


author: Josh Boyer <jwboyer@fedoraproject.org> 20160816-67.git7c3dfc0b
changelog:
  - Update to the latest upstream snapshot (rhbz 1367203)
  - Intel audio, rockchip, amdgpu, iwlwifi, nvidia pascal updates


author: Josh Boyer <jwboyer@fedoraproject.org> - 20170313-72.git695f2d6d
changelog:
  - Update to the latest upstream snapshot
  - New nvidia, AMD, and i915 GPU firmware
  - Updated iwlwifi and intel bluetooth firmware


author: Josh Boyer <jwboyer@fedoraproject.org> - 20170419-73.gitb1413458
changelog:
  - Update to the latest upstream snapshot
  - New nvidia, netronome, and marvell firmware
  - Updated intel audio firmware


author: Josh Boyer <jwboyer@fedoraproject.org> - 20170828-76.gitb78acc9
changelog:
  - Update to latest upstream snapshot
  - ath10k, iwlwifi, kabylake, liquidio, amdgpu, and cavium crypot updates


author: Peter Robinson <pbrobinson@fedoraproject.org> 20171009-78.gitbf04291
changelog:
  - Updated cxgb4, QCom gpu, Intel OPA IB, amdgpu, rtlwifi
  - Ship the license in %license for all sub packages
  - Modernise spec


author: Peter Robinson <pbrobinson@fedoraproject.org> 20171123-79.git90436ce
changelog:
  - Updated Intel GPU, amdgpu, iwlwifi, mvebu wifi, liquidio, QCom a530 & Venus, mlxsw, qed
  - Add iwlwifi 9000 series


author: Josh Boyer <jwboyer@fedoraproject.org> 20171126-80.git17e62881
changelog:
  - Updated bcm 4339 4354 4356 4358 firmware, new bcm 43430
  - Fixes CVE-2016-0801 CVE-2017-0561 CVE-2017-9417


author: Josh Boyer <jwboyer@fedoraproject.org> 20171215-81.git2451bb22
changelog:
  - Updated skl DMC, cnl audio, netronome SmartNIC, amdgpu vega10 and raven,
    intel bluetooth, brcm CYW4373, and liquidio vswitch firmwares


author: Herton R. Krzesinski <herton@redhat.com> - 20180524-84.git2a9b2cf5
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update Intel Omni-Path Architecture (OPA) Firmware (rhbz 1483737)
  - Drop separate microcode_amd_fam17h.bin, same file is now included in linux-firmware
    upstream


author: Herton R. Krzesinski <herton@redhat.com> - 20180524-85.git2a9b2cf5
changelog:
  - Add Obsoletes for conflicting ivtv-firmware versions (rhbz 1589055)
  - Add Obsoletes for iwl7265-firmware which is shipped with RHEL 7 (rhbz 1589056)


author: Herton R. Krzesinski <herton@redhat.com> - 20180706-86.gitd1147327
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - qed: Add firmware 8.37.2.0 (rhbz 1584853)


author: Herton R. Krzesinski <herton@redhat.com> - 20180717-87.git8d69bab7
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: update firmware to revision 1.20.8.0 (rhbz 1503622)


author: Herton R. Krzesinski <herton@redhat.com> - 20181011-88.gitc6b6265d
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include latest firmware for Nvidia Graphics (rhbz 1504667)


author: Herton R. Krzesinski <herton@redhat.com> - 20181015-89.gitc6b6265d
changelog:
  - Remove liquidio/lio_23xx_vsw.bin from linux-firmware until GPL violation is
    fully resolved (rhbz 1637694)


author: Herton R. Krzesinski <herton@redhat.com> - 20181109-90.git1baa3486
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include BPF version of Netronome firmware (rhbz 1637558)


author: Herton R. Krzesinski <herton@redhat.com> - 20190516-94.git711d3297
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update iwlwifi firmware to support the Cyclone Peak Dual Band 2x2 802.11ax (rhbz 1622442)
  - Pull new version of Netronome firmware (rhbz 1663989)
  - Update firmware for Chelsio T4/T5/T6 adapters (rhbz 1664678)
  - Update Netronome firmware that include bug fixes (rhbz 1673890)
  - Include firmware support for Intel Bluetooth 22261 (rhbz 1678095)


author: Bruno Meneguele <bmeneg@redhat.com> - 20191202-95.gite8a0f4c9
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update qed zipped/unzipped firmware to latest upstream (rhbz 1720394)
  - Update bnx2x firmware to latest upstream (rhbz 1720395)
  - AX200(Cyclone Peak 2 or CcP2) Bluetooth support (rhbz 1722693)
  - Firmware for Chelsio T4/T5/T6 adapters (rhbz 1725821)
  - Include to support Intel AX201 Harrison Peak(CNVi) on CML-U (rhbz 1725873)
  - Icelake Bluetooth firmware update (AX201, Harrison Peak, or HrP2) (rhbz 1726182)
  - DDP Package to support Columbiaville NIC (rhbz 1726454)
  - Add iwlwifi-cc-a0-48.ucode to linux-firmware (rhbz 1753962)
  - Change install section to use usptream installation process


author: Frantisek Hrbata <fhrbata@redhat.com> - 20200512-98.gitb2cad6a2
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update qed zipped/unzipped firmware to latest upstream (rhbz 1791030)
  - Update bnx2x firmware to latest upstream (rhbz 1791031)
  - Firmware - nvidia: add TU102/TU104/TU106 / TU116/117 signed firmware (rhbz 1801025)
  - Update latest Signed FW for AMD NAVI 10 Graphic (rhbz 1809846)


author: Jan Stancek <jstancek@redhat.com> - 20201022-100.gitdae4b4cd
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - ice: Pull Comms Market Segment Package (rhbz 1861491)
  - ice: Update to the Default OS DDP Package for ice driver (rhbz 1879278)


author: Jan Stancek <jstancek@redhat.com> - 20201118-101.git7455a360
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include to support Intel AX210 Typhoon Peak - Bluetooth firmware support (rhbz 1897069)
  - Include support for the Qualcomm AX500-DBS (QCA6390) 802.11ax Wireless - firmware support (rhbz 1725913)


author: Jarod Wilson <jarod@redhat.com> - 20130820-0.3.git600caef
changelog:
  - Put in proper URL and URL-less Source0 location, and a note about how
    we generate the tarball by hand from a git tree


author: Jarod Wilson <jarod@redhat.com> - 20131106-0.1.git7d0c7a8
changelog:
  - Update to latest upstream linux-firmware to pick up bfa firmware (rhbz 1013426)
  - Fix up Obsoletes to all use <= comparisons


author: Jarod Wilson <jarod@redhat.com> - 20140911-0.1.git365e80c
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Adds Intel Quick Assist Technology firmware (rhbz 1127338)
  - Updates bnx2x adapter firmware to version 7.10.51 (rhbz 1089403)
  - Updates myri10ge adapter firmware to version 1.4.57 (rhbz 1063702)
  - Removes firmware for drivers not shipped with Red Hat Enterprise Linux 7 (rhbz 1016595)


author: Rafael Aquini <aquini@redhat.com> - 20150612-37.git3161bfa
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: Update firmware to revision 1.13.32.0 (rhbz 1189256)
  - qat: Update to the latest upstream firmware (rhbz 1173792)
  - Use a common version number for both the iwl*-firmware packages and linux-firmware itself


author: Rafael Aquini <aquini@redhat.com> - 20150904-42.git6ebf5d5
changelog:
  - Add Intel Omni-Path Architecture hfi1 Firmware (rhbz 1194910)
  - Update skl firmware for gpu (rhbz 1210012)


author: Jarod Wilson <jarod@redhat.com> - 20150904-43.git6ebf5d5
changelog:
  - Add more old chelsio firmwares, they nuked the one the driver in
    RHEL7.2 is expecting from upstream (rhbz 1262128)
  - Remove amd-ucode again, it simply breaks too many systems (rhbz 1246393)


author: Rafael Aquini <aquini@redhat.com> - 20160223-44.git8d1fd61
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update Intel Omni-Path Architecture hfi1 Firmware (rhbz 1267015)


author: Rafael Aquini <aquini@redhat.com> - 20160426-45.git986a5a8
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Restore AMD-ucode firmware blob again (rhbz 866700)
  - qat: Update to the latest upstream firmware (rhbz 1173792)
  - WiFi on Windstorm Peak Wireless Adapter 8265 - firmware support (rhbz 1315534)
  - WiFi on Sandy Peak Wireless Adapter 3168 - firmware support (rhbz 1315536)


author: Rafael Aquini <aquini@redhat.com> - 20160615-46.gita4bbc81
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Nuke old cxgb4 firmware blobs tarball (rhbz 1336906)
  - Update to latest Chelsio firmware release version (rhbz 1336906)


author: Rafael Aquini <aquini@redhat.com> - 20160728-47.git0daeaf3
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Core14 firmware release for 7265, 7260, 3160 wireless devices (rhbz 1358566)
  - Core19 firmware release for 7265D, 8260, 8265, 3168 wireless devices (rhbz 1358568)


author: Rafael Aquini <aquini@redhat.com> - 20160830-49.git7534e19
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update QCA6174/hw3.0/board-2.bin file to support ath10k devices (rhbz 1368159)


author: Rafael Aquini <aquini@redhat.com> - 20170217-50.git6d3bc88
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - chelsio: Update to the latest firmware released version (rhbz 1395322)
  - iwlwifi: Update to the latest firmware released version (rhbz 1385749)
  - ath10k: Update to the latest firmware released version (rhbz 1385743)
  - hfi1: Update to the latest firmware released version (rhbz 1382805)


author: Rafael Aquini <aquini@redhat.com> - 20170307-51.git87714d8
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - chelsio: Update to the latest firmware released version (rhbz 1385911)
  - drm: Update for radeon and amdgpu latest firmware released version (rhbz 1425197)


author: Rafael Aquini <aquini@redhat.com> - 20170328-52.git44d8e8d
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - nfp: add firmware for Netronome Ethernet Driver (rhbz 1432592)


author: Rafael Aquini <aquini@redhat.com> - 20170530-54.gitdf40d15
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - opa: HFI firmware problems with new OPA switch firmware (rhbz 1452253)


author: Rafael Aquini <aquini@redhat.com> - 20171011-57.gitbf04291
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - ath10k: Update to the latest firmware released version (rhbz 1457363)
  - opa: update Intel Omni-Path Architecture firmware (rhbz 1452785)
  - chelsio: Pull in the latest firmware 1.16.63.0 (rhbz 1458328)
  - qla2xxx: Update firmware version to 8.07.00 (rhbz 1427148)


author: Rafael Aquini <aquini@redhat.com> - 20171127-58.git17e6288
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - iwlwifi: Firmware update for 3160, 3168, 7260, 7265 and 7265D WIFI devices (rhbz 1508709)
  - iwlwifi: Firmware update for 8260 and 8265 WIFI devices (rhbz 1508711)
  - iwlwifi: Firmware update for 9260 and 9560 WIFI devices (rhbz 1501166)
  - Fixes CVE-2016-0801 CVE-2017-0561 CVE-2017-9417


author: Rafael Aquini <aquini@redhat.com> - 20180113-60.git65b1c68
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - netr: Add Netronome TC flower firmware (rhbz 1518900)
  - Revert amd-ucode for fam17h (rhbz 1533945)


author: Rafael Aquini <aquini@redhat.com> - 20180220-62.git6d51311
changelog:
  - nfp: NIC stops transmitting for small MSS values when TSO is enabled (rhbz 1542263)
  - chelsio: pull in latests firmware 1.17.14.0 (rhbz 1538590)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180518-63.git2a9b2cf
changelog:
  - Update to latest upstream linux-firmware image for assorted netdrv updates
  - amd: add microcode for family 17h and update for family 15h (rhbz 1574575)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180529-65.git7518922
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - amd: update microcode for family 15h (rhbz 1574575)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180717-67.git8d69bab
changelog:
  - Update to latest upstream linux-firmware image for assorted netdrv updates
  - chelsio: update firmware to revision 1.20.8.0 (rhbz 1523202)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180911-68.git85c5d90
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - nvidia: update firmware for Pascal GPUs (rhbz 1625514)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190225-70.git80dee31
changelog:
  - cxgb4: update firmware to revision 1.22.9.0 (rhbz 1671610)
  - nfp: update Agilio SmartNIC flower firmware to rev AOTC-2.10.A.13 (rhbz 1637996)
  - linux-firmware: Update firmware patch for Intel Bluetooth 8260 (rhbz 1649148)
  - qed: Add 8.37.7.0 firmware image (rhbz 1654809)
  - liquidio: fix GPL compliance issue (rhbz 1622521)
  - Update Intel OPA hfi1 firmware (rhbz 1637240)
  - qed: Add firmware 8.37.7.0 (rhbz 1643554)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190318-71.git283373f
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: update firmware to revision 1.23.3.0 (rhbz 1642422)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190429-72.gitddde598
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: update firmware to revision 1.23.4.0 (rhbz 1690727)
  - linux-firmware: Add firmware file for Intel Bluetooth 22161 (rhbz 1622438)


author: Jan Stancek <jstancek@redhat.com> - 20190815-73.git07b925b
changelog:
  - Update to latest upstream linux-firmware image for assorted updates (rhbz 1741356)
  - iwlwifi- Update to support the Cyclone Peak Dual Band 2x2 802.11ax
  - iwl7265-firmware sub-package merged into iwl7260-firmware sub-package


author: Jan Stancek <jstancek@redhat.com> - 20190918-74.git6c6918a
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update bnx2x firmware to latest upstream (rhbz 1720386)


author: Jan Stancek <jstancek@redhat.com> - 20191203-75.gite8a0f4c
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update qed zipped/unzipped firmware to latest upstream (rhbz 1720385)


author: Rado Vrbovsky <rvrbovsk@redhat.com> - 20200421-80.git78c0348
changelog:
  - Cross-Process Information Leak (RHEL-8938)
  - Return Address Predictor velunerability leading to information disclosure (RHEL-9250)


author: Rado Vrbovsky <rvrbovsk@redhat.com> - 20200421-80.git78c0348
changelog:
  - AMD: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem (RHEL-13985)


author: Denys Vlasenko <dvlasenk@redhat.com> - 20200421-83.git78c0348
changelog:
  - hw: intel: Fix protection mechanism failure for some Intel(R) PROSet/Wireless WiFi
  Resolves: RHEL-4010, RHEL-4013, RHEL-4016, RHEL-4018, RHEL-4021


author: Omair Majid <omajid@redhat.com> 1:1.8.0.0-0.5.b87
changelog:
  - Update to b87
  - Remove all rhino support; use nashorn instead
  - Remove upstreamed/unapplied patches


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.0-0.11.b89
changelog:
  - prelink dependence excluded also for aaech64
  - arm64 added to jitarches
  - added source100 config.guess to repalce the outdated one in-tree
  - added source101 config.sub  to repalce the outdated one in-tree
  - added patch2011 system-libjpegAARCH64.patch (as aarch64-port is little bit diferent)
  - added patch2031 system-lcmsAARCH64.patch (as aarch64-port is little bit diferent)
  - added gcc-c++ build depndece so builddep will  result to better situation


author: Deepak Bhole <dbhole@redhat.com> - 1:1.8.0.0-0.15.b89
changelog:
  - Added a missing includes patch (#302/%{name}-arm64-missing-includes.patch)
  - Added --disable-precompiled-headers for arm64 build


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.0-0.26.b129
changelog:
  - Add -headless subpackage based on java-1.7.0-openjdk
  - Add abrt connector support
  - Add -accessibility subpackage


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.0-0.31.b132
changelog:
  - updated to rc4 aarch64 tarball
  - outdated removed: patch2031 system-lcmsAARCH64.patch patch2011 system-libjpeg-aarch64.patch
    patch2021 system-libpng-aarch64.patch


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.0-2.b132
changelog:
  - Include version information in desktop files
  - Move desktop files from tarball to top level source


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-11.b12
changelog:
  - backporting old fixes:
  - get rid of jre-abrt, uniquesuffix, parallel install, jsa files,
    config(norepalce) bug, -fstack-protector-strong, OrderWithRequires,
    nss config, multilib arches, provides/requires excludes
  - some additional cosmetic changes


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-12.b12
changelog:
  - bumped release to build by previous release.
  - forcing rebuild by jdk8
  - uncommenting forgotten comment on tzdb link


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-17.b12
changelog:
  - added build requires and requires for headles  _datadir/javazi-1.8/tzdb.dat
  - restriction of tzdata provider, so we will be aware of another possible failure


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-1.b01
changelog:
  - updated to u40-b01
  - adapted  rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
  - adapted  jdk8042159-allow_using_system_installed_lcms2.patch
  - removed patch8 set-active-window.patch
  - removed patch9 javadoc-error-jdk-8029145.patch
  - removed patch10 javadoc-error-jdk-8037484.patch
  - removed patch99 applet-hole.patch - itw 1.5.1 is able to ive without it


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-1.b02
changelog:
  - adapted aarch64 patch
  - removed upstreamed patch  0001-PPC64LE-arch-support-in-openjdk-1.8.patch
  - added patch666 stackoverflow-ppc32_64-20140828.patch
  - commented out patch2 1015432.patch (does nearly the same as new patch666)
  - Resolves: rhbz#1125260


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.40-5.b26
changelog:
  - Update aarch64 hotspot to jdk7u40-b02 to match the rest of the JDK
  - Do not obsolete java-1.7.0-openjdk
  - Resolves: rhbz#1125260


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.20-2.b26
changelog:
  - moving all ppc64 to jit arches
  - using cpp interpreter for ppc64le
  - removing requirement on datadir/javazi-1.8/tzdb.dat
  - Resolves: rhbz#1125260


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.20-5.b26
changelog:
  - Update aarch64 hotspot to latest upstream version
  - Depend on java-1.7.0-openjdk to work around self-building issues
  - Resolves: rhbz#1125260


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.20-8.b26
changelog:
  - Add patches for PPC zero build.
  - Fixes stack overflow problem. See RHBZ#1015432.
  - Fixes missing memory barrier in Atomic::xchg*
  - Fixes missing PPC32/PPC64 defines for Zero builds on power.
  - Resolves: rhbz#1125260


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.20-9.b26
changelog:
  - Add hotspot compiler flag -fno-tree-vectorize which fixes the segfault in
    the bytecode verifier on ppc/ppc64.
  - Resolves: rhbz#1125260


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.20-10.b26
changelog:
  - Remove LIBDIR and funny definition of _libdir.
  - Fix rpmlint warnings about macros in comments.
  - Resolves: rhbz#1125260


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.25-3.b17
changelog:
  - added patch12,removeSunEcProvider-RH1154143
  - xdump excluded from ppc64le (rh1156151)
  - Add check for src.zip completeness. See RH1130490 (by sgehwolf@redhat.com)
  - Resolves: rhbz#1125260


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Fix configure script to use ppc64le, not ppc64.
  - Add ppc64le support to LIBJSOUND_CFLAGS.
  - Add a jvm.cfg for ppc64le
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Print contents of spec.gmk to see what is being passed to the HotSpot build.
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Set OPENJDK_TARGET_CPU_LEGACY to ppc64 so as not to mess up HotSpot build.
  - Add -DABI_ELFv2 to CFLAGS on ppc64le to match OpenJDK 7.
  - Print contents of hotspot-spec.gmk
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Override ppc64le as ppc64 only in hotspot-spec.gmk so as not to disrupt JDK build.
  - Add property test case from java-1.7.0-openjdk build.
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-6.b13
changelog:
  - Adjust ppc64le HotSpot patch for OpenJDK 8.
  - Enable AArch64 configure/JDK patch on all archs to minimise patching issues.
  - Adjust ppc64le patches to apply after the enableAArch64 patch.
  - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Resolves: rhbz#1194378


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-27.b13
changelog:
  - updated to security u45
  - minor sync with 7.2
   - generate_source_tarball.sh
   - adapted java-1.8.0-openjdk-s390-java-opts.patch and java-1.8.0-openjdk-size_t.patch
   - reworked (synced) zero patches (removed 103,11 added 204, 400-403)
   - family of 5XX patches renamed to 6XX
   - added upstreamed patch 501 and 505
   - included removeSunEcProvider-RH1154143.patch
  - returned java (jre only) provides
  - repacked policies (source20)
  - removed duplicated NVR provides
  - added automated test for priority (length7)
  - Resolves: RHBZ#1209077


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.45-34.b13
changelog:
  - Omit jsa files from power64 file list as well, as they are never generated
  - Resolves: rhbz#1202726


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-35.b13
changelog:
  - Make use of system timezone data for OpenJDK 8.
  - moved to boot build by openjdk8
  - priority set  gcj < lengthOffFour < otherJdks (RH1175457)
  - misusing already fixed bug
  - Resolves: rhbz#1189530


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.45-36.b13
changelog:
  - Correctly fix system timezone data issue by depending on correct tzdata version.
  - Remove reference to tz.properties which is no longer used.
  - Resolves: rhbz#1212571


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-0.b16
changelog:
  - July 2015 security update to u51b16.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Add patches for RH issues fixed in IcedTea 2.x and/or the upcoming u60.
  - Use 'openjdk' as directory prefix to allow patch interchange with IcedTea.
  - Re-generate EC disablement patch following CPU DH changes.
  - Resolves: rhbz#1235163


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-1.b16
changelog:
  - Re-introduce handling of java.security updates, with new md5sum of Jan 2015 version.
  - Resolves: rhbz#1235163


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-0.b17
changelog:
  - October 2015 security update to u65b17.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Update RH1191652 patch to build against current AArch64 tree.
  - Use appropriate source ID to avoid unpacking both tarballs on AArch64.
  - Add MD5 checksums for java.security from 8u51 and 8u60 RPMs.
  - Resolves: rhbz#1257657


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-4.b17
changelog:
  - moved to integration forest 
  - sync with fedora (all but extracted luas and family)
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - October 2015 security update to u71b15.
  - Improve verbosity and helpfulness of tarball generation script.
  - Remove RH1290936 workaround as RHEL does not have the hardened flags nor ARM32.
  - Update patch documentation using version originally written for Fedora.
  - Drop prelink requirement as we no longer use execstack.
  - Drop ifdefbugfix patch as this is fixed upstream.
  - Temporarily enable a full bootcycle to ensure flag changes don't break anything.
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - Turn off additional CFLAGS/LDFLAGS on AArch64 as bootstrapping failed.
  - Add patch for size_t formatting on s390 as size_t != intptr_t there.
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - Add additional fixes for s390 warnings in arguments.cpp
  - Temporarily turn off -Werror on s390 to make progress
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - Make bootstrap build optional and turn it off by default.
  - Fix remaining warnings in s390 fix and re-enable -Werror
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - Change correct specifier in src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-2.b15
changelog:
  - Restore upstream version of system LCMS patch removed by 'sync with Fedora'
  - Add patch to turn off strict overflow on IndicRearrangementProcessor{,2}.cpp
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-4.b15
changelog:
  - Remove -fno-tree-vectorize now a GCC is available with this bug fixed.
  - Add build requirement on a GCC with working tree vectorization.
  - Enable bootstrap temporarily to ensure the JDK is functional.
  - Resolves: rhbz#1146897


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-5.b15
changelog:
  - Backport S8148351: Only display resolved symlink for compiler, do not change path
  - Resolves: rhbz#1256464


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-6.b15
changelog:
  - Define EXTRA_CPP_FLAGS again, after it was removed in the fix for 1146897.
  - Resolves: rhbz#1146897


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-0.b15
changelog:
  - Replace s390 Java options patch with general version from IcedTea.
  - Apply s390 patches unconditionally to avoid arch-specific patch failures.
  - Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-0.b15
changelog:
  - Remove fragment of s390 size_t patch that unnecessarily removes a cast, breaking ppc64le.
  - Remove aarch64-specific suffix as update/build version are now the same as for other archs.
  - Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-0.b15
changelog:
  - Remove unnecessary AArch64 port divergence on parsing jvm.cfg, broken by 9399aa7ef558
  - Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-1.b15
changelog:
  - Add backport of 8147805: aarch64: C1 segmentation fault due to inline Unsafe.getAndSetObject
  - Resolves: rhbz#1300630


author: jvanek <jvanek@redhat.com> - 1:1.8.0.72-3.b15
changelog:
  - returning accidentlay removed hunk from renamed and so wrongly merged remove_aarch64_jvm.cfg_divergence.patch
  - Resolves: rhbz#1300630


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-4.b15
changelog:
  - Add patches to allow the SunEC provider to be built with the system NSS install.
  - Re-generate source tarball so it includes ecc_impl.h.
  - Adjust tarball generation script to allow ecc_impl.h to be included.
  - Bring over NSS changes from java-1.7.0-openjdk spec file (NSS_CFLAGS/NSS_LIBS)
  - Remove patch which disables the SunEC provider as it is now usable.
  - Correct spelling mistakes in tarball generation script.
  - Resolves: rhbz#1245810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-5.b16
changelog:
  - Update to u72b16.
  - Drop 8147805 and jvm.cfg fix which are applied upstream.
  - Resolves: rhbz#1307108


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.72-12.b15
changelog:
  - Use a simple backport for PR2462/8074839.
  - Don't backport the crc check for pack.gz. It's not tested well upstream.
  - Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-13.b16
changelog:
  - When using a compositing WM, the overlay window should be used, not the root window.
  - Resolves: rhbz#1176206


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-2.b03
changelog:
  - Avoid WithSeed versions of NSS functions as they do not fully process the seed
  - List current java.security md5sum so that java.security is replaced and ECC gets enabled.
  - Resolves: rhbz#1245810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Use basename of test file to avoid misinterpretation of full path as a package
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Enable a full bootstrap on JIT archs. Full build held back by Zero archs anyway.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Add 8132051 port to Zero.
  - Turn on bootstrap build for all to ensure we are now good to go.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Revert settings to production defaults so we can at least get a build.
  - Switch to a slowdebug build to try and unearth remaining issue on s390x.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Turn off -Werror so s390 can build in slowdebug mode.
  - Add fix for formatting issue found by previous s390 build.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Temporarily remove power64 from JIT arches to see if endian issue appears on Zero.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Add additional fix to Zero patch to properly handle result on 64-bit big-endian
  - Revert debugging options (aarch64 back to JIT, product build, no -Wno-error)
  - Enable full bootstrap on all architectures to check we are good to go.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Roll back release number as release 1 never succeeded, even with tests disabled.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-1.b14
changelog:
  - Update to u92b14.
  - Remove upstreamed patches for AArch64 byte behaviour and template issue.
  - Remove upstreamed patches for Zero build failures 8087120 & 8143855.
  - Replace 8132051 Zero fix with version upstreamed as 8154210 in 8u112.
  - Add upstreamed patch 6961123 from u102 to fix application name in GNOME Shell.
  - Add upstreamed patches 8044762 & 8049226 from u112 to fix JDI issues.
  - Regenerate java-1.8.0-openjdk-rh1191652-root.patch against u92
  - Resolves: rhbz#1335322


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-2.b14
changelog:
  - Add fix for PKCS#10 output regression, adding -systemlineendings option.
  - Move S8150954/RH1176206/PR2866 fix to correct section, as not in 9 yet.
  - Resolves: rhbz#1337583


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.92-4.b14
changelog:
  - added requires for copy-jdk-configs, to help with https://projects.engineering.redhat.com/browse/RCM-3654
  - Resolves: rhbz#1296442


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.92-5.b14
changelog:
  - added --family option with chkconfig version full dependence
  - added nss restricting requires
  - added zipped javadoc subpackage
  - extracted lua scripts
  - Resolves: rhbz#1296442
  - Resolves: rhbz#1296414


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-9.b14
changelog:
  - Add additional fixes (S6260348, S8159244) for u92 update.
  - Add bug ID to Javadoc patch.
  - Resolves: rhbz#1335322


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-1.b13
changelog:
  - Update to u101b13.
  - Document REPOS option in generate_source_tarball.sh
  - Drop a leading zero from the priority as the update version is now three digits
  - Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-3.b13
changelog:
  - Add missing hunk from 8147771, missed due to inclusion of unneeded 8138811
  - Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-4.b13
changelog:
  - Replace bad 8159244 patch from upstream 8u with fresh backport from OpenJDK 9.
  - Resolves: rhbz#1335322


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.101-7.b13
changelog:
  - added patch532 hotspot-1358661.patch - to fix performance of bimorphic inlining may be bypassed by type speculation
  - rhbz1358661
  - added patch301 bz1204159_java8.patch - to fix systemtap on multiple jdks
  - rhbz1204159
  - added patch531 hotspot-8157306.changeset - to fix rare NPE injavac on aarch64
  - rhbz1360863
  - added all virtual provides of java-devel
  - Resolves: rhbz#1216018


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-8.b13
changelog:
  - Replace patch for S8157306 with upstream version, documented & applied on all archs with conditional in patch
  - Resolves: rhbz#1360863


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-8.b13
changelog:
  - Replace patch for S8162384 with upstream version. Document correctly along with SystemTap RH1204159 patch.
  - Resolves: rhbz#1358661


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-9.b15
changelog:
  - Update to aarch64-jdk8u101-b15.
  - Rebase SystemTap tarball on IcedTea 3.1.0 versions so as to avoid patching.
  - Drop additional hunk for 8147771 which is now applied upstream.
  - Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-0.b14
changelog:
  - Update to aarch64-jdk8u102-b14.
  - Drop 8140620, 8148752 and 6961123, all of which appear upstream in u102.
  - Move 8159244 to 8u111 section as it only appears to be in unpublished u102 b31.
  - Move 8158260 to 8u112 section following its backport to 8u.
  - Resolves: rhbz#1359857


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - @prefix@ in tapsetfiles substitued by prefix as necessary to work with systemtap3 (rhbz1371005)
  - Resolves: rhbz#1295754


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-3.b14
changelog:
  - Rebuild java-1.8.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372750)
  - Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-4.b14
changelog:
  - Runtime native library requirements need to match the architecture of the JDK
  - Resolves: rhbz#1375224


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b14
changelog:
  - Update to aarch64-jdk8u111-b14.
  - Add latest md5sum for java.security file due to jar signing property addition.
  - Drop S8157306 and the CORBA typo fix, both of which appear upstream in u111.
  - Add LCMS 2 patch to fix Red Hat security issue RH1367357 in the local OpenJDK copy.
  - Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-3.b15
changelog:
  - Add MD5 checksum from RHEL 7.2 security update so the 7.3 one overwrites it.
  - Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
  - Update to aarch64-jdk8u111-b18, synced with upstream u111, S8170873 and new AArch64 fixes
  - Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
  - Replace our correct version of 8159244 with the amendment to the 8u version from 8160122.
  - Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-5.b18
changelog:
  - Use java-1.7.0-openjdk to bootstrap on RHEL to allow us to use main build target
  - Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.112-1.b16
changelog:
  - Update to aarch64-jdk8u112-b16.
  - Drop upstreamed patches for 8044762, 8049226, 8154210, 8158260 and 8160122.
  - Re-generate size_t and key size (RH1163501) patches against u112.
  - Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-1.b13
changelog:
  - Update to aarch64-jdk8u121-b13.
  - Add MD5 checksum for the new java.security file (EC < 224, DSA < 1024 restricted)
  - Update PR1834/RH1022017 fix to reduce curves reported by SSL to apply against u121.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-2.b13
changelog:
  - Backport "S8153711: [REDO] JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command"
  - Resolves: rhbz#1284948


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-3.b13
changelog:
  - Backport "8170888: [linux] Experimental support for cgroup memory limits in container (ie Docker) environments"
  - Resolves: rhbz#1390708


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-4.b14
changelog:
  - added shenandoah hotspot
  - sync with fedora
  - Resolves: rhbz#1400306
  - Resolves: rhbz#1390708
  - Resolves: rhbz#1388520
  - Resolves: rhbz#1403992


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-6.b14
changelog:
  - Regenerate tarball with correct version of PR2126 patch.
  - Update generate_source_tarball.sh script to download correct version.
  - Resolves: rhbz#1400306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-6.b14
changelog:
  - Patch OpenJDK to check the system cacerts database directly
  - Remove unneeded symlink to the system cacerts database
  - Drop outdated openssl dependency from when the RPM built the cacerts database
  - Resolves: rhbz#1319875


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-7.b14
changelog:
  - updated to aarch64-shenandoah-jdk8u121-b14-shenandoah-merge-2017-03-08 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u121-b14-shenandoah-merge-2017-03-09.tar.xz as new sources for hotspot
  - Resolves: rhbz#1400306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-9.b14
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Update jstack tapset to handle AArch64
  - Resolves: rhbz#1373848


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-10.b14
changelog:
  - Move unprocessed nss.cfg to nss.cfg.in and add missing substitution to create nss.cfg for install
  - Resolves: rhbz#1429774


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-10.b14
changelog:
  - Add backports from 8u131 and 8u152 ahead of April CPU.
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-1.b11
changelog:
  - Update to aarch64-jdk8u131-b11 and aarch64-shenandoah-jdk8u131-b11.
  - Drop upstreamed patches for 8147910, 8161993, 8170888 and 8173783.
  - Update generate_source_tarball.sh to remove patch remnants.
  - Cleanup Shenandoah tarball referencing and document how to create it.
  - Add MD5 checksum for the new java.security file (MD5 disabled for JAR signing)
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-2.b11
changelog:
  - Update tapset tarball to include the better error handling in PR3348
  - http://icedtea.classpath.org/hg/icedtea8/rev/14fc67a5d5a3
  - Resolves: rhbz#1438514


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-4.b11
changelog:
  - Rename SystemTap tapset tarball to avoid conflicts with previous version.
  - Resolves: rhbz#1438514


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-6.b12
changelog:
  - Update to aarch64-jdk8u131-b12 and aarch64-shenandoah-jdk8u131-b12 for AArch64 8168699 fix
  - Resolves: rhbz#1443417


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-8.b12
changelog:
  - Restore cacerts symlink as some broken apps hardcode the path (see RH1448802)
  - Resolves: rhbz#1319875


author: Zhengyu Gu <zgu@redhat.com> - 1:1.8.0.131-10.b12
changelog:
  - Added 8181055-pr3394-rh1448880.patch to fix a corner case of previous change
  - Resolves: rhbz#1448880


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-11.b12
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-12.b12
changelog:
  - Add backports from 8u152 (8179084/RH1455694, 8181419/RH1463144, 8175887) ahead of July CPU.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b15
changelog:
  - Update to aarch64-jdk8u141-b15 and aarch64-shenandoah-jdk8u141-b15.
  - Update location of OpenJDK system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
  - Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-2.b16
changelog:
  - Update to aarch64-jdk8u141-b16 and aarch64-shenandoah-jdk8u141-b16.
  - Revert change to remove-intree-libraries.sh following backout of 8173207
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.144-1.b01
changelog:
  - Update to aarch64-jdk8u144-b01 and aarch64-shenandoah-jdk8u144-b01.
  - Exclude 8175887 from Shenandoah builds as it has been included in that repo.
  - Resolves: rhbz#1477855


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.144-2.b01
changelog:
  - Switch to IBM-supplied Montgomery backport and add remaining ppc64 fixes & CFF fix
  - Resolves: rhbz#1498309
  - Resolves: rhbz#1498319
  - Resolves: rhbz#1498320
  - Resolves: rhbz#1498321
  - Resolves: rhbz#1484079


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.144-2.b01
changelog:
  - Switch AArch64 to using java-1.8.0-openjdk to bootstrap until RH1482244 is fixed in bootstrap
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.144-2.b01
changelog:
  - Reverted completely unnecessary patch addition which broke the RPM build.
  - Resolves: rhbz#1484079


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - Update to aarch64-jdk8u151-b12 and aarch64-shenandoah-jdk8u151-b12.
  - Update location of OpenJDK zlib system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 8179084 and RH1367357 (part of 8183028).
  - Update RH1191652 (root) and PR2842 to accomodate 8151841 (GCC 6 support).
  - Update PR2964/RH1337583 to accomodate 8171319 (keytool warning output)
  - Update RH1163501 to accomodate 8181048 (crypto refactoring)
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - Add 8075484/PR3473/RH1490713 which is listed as being in 8u151 but not supplied by Oracle.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - Update SystemTap tapsets to version in IcedTea 3.6.0pre02 to fix RH1492139.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - Correct fix to RH1191652 root patch so existing COMMON_CCXXFLAGS_JDK is not lost.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - 8188030 is not yet upstream, so it should be listed under upstreamable fixes.
  - 8181055, 8181419, 8145913, 8168318, 8170328 & 8181810 all now in 8u162.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-2.b12
changelog:
  - repack policies adapted to new counts and paths
  - note that also c-j-c is needed to make this apply in next update
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-3.b12
changelog:
  - Switch bootstrap back to java-1.7.0-openjdk on all architectures, depending on RH1482244 fix
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-3.b12
changelog:
  - Backport "8180048: Interned string and symbol table leak memory during parallel unlinking"
  - Resolves: rhbz#1490260


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-5.b13
changelog:
  - Update to aarch64-jdk8u151-b13 and aarch64-shenandoah-jdk8u151-b13.
  - Drop upstreamed patch for 8075484.
  - Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
  - Update to aarch64-jdk8u152-b16 and aarch64-shenandoah-jdk8u152-b16.
  - Update 8145913/PR3466/RH1498309 patch following upstream addition of 8152172 (AES for PPC)
  - Add new file cmsalpha.c to %{name}-remove-intree-libraries.sh
  - Remove upstreamed patches for 8153711/PR3313/RH1284948, 8162384/PR3122/RH1358661, 8173941/PR3226,
  -    8175813/PR3394/RH1448880, 8175887/PR3415, 8146086/PR3439/RH1478402, 8180048/PR3411/RH1449870 and
  -    8164293/PR3412/RH1459641
  - Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
  - Update to tzdata2017c (8190258/PR3499) to resolve TCK failure due to mismatch with system version.
  - Resolves: rhbz#1508017


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.152-1.b16
changelog:
  - Backport 8191137 and add updates to the translations (8191840 in OpenJDK 7)
  - Resolves: rhbz#1512647


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.161-1.b12
changelog:
  - Update to aarch64-jdk8u161-b12 and aarch64-shenandoah-jdk8u161-b12 (mbalao)
  - Drop upstreamed patches for 8075484 (RH1490713), 8153711 (RH1284948),
    8162384 (RH1358661), 8164293 (RH1459641), 8173941, 8175813 (RH1448880),
    8175887 and 8180048 (RH1449870).(mbalao)
  - drop more of usptreamed patches 565,566,567,568
    ( 8184673-pr3475-rh1487266.patch  8191840-pr3503-rh1512647.patch  8191137-pr3503-rh1512647.patch 8190258-pr3499-tzdata2017c.patch)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-1.b12
changelog:
  - Replace tarballs with version including AArch64 fix for 8174962 (S8194686)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-1.b13
changelog:
  - Update to b13 including Zero fix for 8174962 (S8194739) and restoring tzdata2017c update
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.162-0.b12
changelog:
  - Update to aarch64-jdk8u162-b12 and aarch64-shenandoah-jdk8u162-b12.
  - Remove upstreamed patches for 8181055/PR3394/RH1448880,
  -  8181419/PR3413/RH1463144, 8145913/PR3466/RH1498309,
  -  8168318/PR3466/RH1498320, 8170328/PR3466/RR1498321 and
  -  8181810/PR3466/RH1498319.
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Bump release for RHEL 7.6 now branch is available.
  - Resolves: rhbz#1538772
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Backported from fedora: aarch64BuildFailure.patch, rhbz_1536622-JDK8197429-jdk8.patch, rhbz_1540242.patch
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-4.b10
changelog:
  - Cleanup from previous commit.
  - Remove unused upstream patch 8167200.hotspotAarch64.patch.
  - Resolves: rhbz#1559766
  - Resolves: rhbz#1536623


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-6.b10
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-9.b12
changelog:
  - Update to aarch64-jdk8u171-b12 and aarch64-shenandoah-jdk8u171-b12.
  - Remove patch for 8200556/PR3566 as applied upstream.
  - Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-3.b11
changelog:
  - Sync with IcedTea 3.8.0.
  - Label architecture-specific fixes with architecture concerned
  - x86: S8199936, PR3533: HotSpot generates code with unaligned stack, crashes on SSE operations (-mstackrealign workaround)
  - PR3539, RH1548475: Pass EXTRA_LDFLAGS to HotSpot build
  - 8171000, PR3542, RH1402819: Robot.createScreenCapture() crashes in wayland mode
  - 8197546, PR3542, RH1402819: Fix for 8171000 breaks Solaris + Linux builds
  - 8185723, PR3553: Zero: segfaults on Power PC 32-bit
  - 8186461, PR3557: Zero's atomic_copy64() should use SPE instructions on linux-powerpcspe
  - PR3559: Use ldrexd for atomic reads on ARMv7.
  - 8187577, PR3578: JVM crash during gc doing concurrent marking
  - 8201509, PR3579: Zero: S390 31bit atomic_copy64 inline assembler is wrong
  - 8165489, PR3589: Missing G1 barrier in Unsafe_GetObjectVolatile
  - PR3591: Fix for bug 3533 doesn't add -mstackrealign to JDK code
  - 8184309, PR3596: Build warnings from GCC 7.1 on Fedora 26
  - Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-4.b11
changelog:
  - Update Shenandoah tarball to include 2018-05-15 merge.
  - Split PR3458/RH1540242 fix into AArch64 & Zero sections, so former can be skipped on Shenandoah builds.
  - Drop PR3573 patch applied upstream.
  - Restrict 8187577 fix to non-Shenandoah builds, as it's included in the new tarball.
  - Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-5.b11
changelog:
  - Fix a number of bad bug identifiers (PR3546 should be PR3578, PR3456 should be PR3546)
  - Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-5.b11
changelog:
  - Read jssecacerts file prior to trying either cacerts file (system or local) (PR3575)
  - Resolves: rhbz#1567204


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-6.b11
changelog:
  - Remove build flags exemption for aarch64 now the platform is more mature and can bootstrap OpenJDK with these flags.
  - Remove duplicate -fstack-protector-strong; it is provided by the RHEL cflags.
  - Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-7.b11
changelog:
  - Sync with IcedTea 3.8.0 patches to use -Wreturn-type.
  - Add backports of 8141570, 8143245, 8197981 & 8062808.
  - Drop pr3458-rh1540242-zero.patch which is covered by 8143245.
  - Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-7.b11
changelog:
  - Bring in PR3519 from IcedTea 3.7.0 to fix remaining -Wreturn-type failure on AArch64.
  - Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-7.b11
changelog:
  - Add additional fix (PR3601) to fix -Wreturn-type failures introduced by 8061651
  - Resolves: rhbz#1573700


author: Jiri Vanek <jvanek@redhat.com> - 11:1.8.0.172-10.b11
changelog:
  - jsa files changed to 444 to pass rpm verification
  - Fix reg-ex for filtering private libraries' provides/requires.
  - Resolves: rhbz#1573700


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-1.b03
changelog:
  - Update to aarch64-jdk8u181-b03 and aarch64-shenandoah-jdk8u181-b03.
  - Remove AArch64 patch for PR3458/RH1540242 as applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-3.b04
changelog:
  - Mark bugs that have been pushed to 8u upstream and are scheduled for a release.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-4.b04
changelog:
  - Backport "8075942, PR3602: ArrayIndexOutOfBoundsException in sun.java2d.pisces.Dasher.goTo"
  - Resolves: rhbz#1582032


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-4.b04
changelog:
  - Backport "8203182, PR3603: Release session if initialization of SunPKCS11 Signature fails"
  - Resolves: rhbz#1568033


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-5.b04
changelog:
  - Add "8206406, PR3610, RH1597825: StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list"
  - Resolves: rhbz#1597825


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-6.b04
changelog:
  - Add "8146115, PR3508, RH1463098: Improve docker container detection and resource configuration usage"
  - Resolves: rhbz#1463098


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-7.b13
changelog:
  - Update to aarch64-jdk8u181-b13 and aarch64-shenandoah-jdk8u181-b13.
  - Remove 8187577/PR3578 now applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
  - Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
  - Update to aarch64-shenandoah-jdk8u181-b15.
  - Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
  - Move buildver to where it should be in the OpenJDK version.
  - Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
  - Update pr3539-rh1548475.patch to apply after 8187045.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
  - Update to aarch64-shenandoah-jdk8u181-b16.
  - Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
  - Resolves: rhbz#1633822


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b10.
  - Drop 8146115/PR3508/RH1463098 applied upstream.
  - Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-2
changelog:
  - made rhpkg and srpm or rebuild working on fedora again
  - cosmetic changes - using macros where possible
  - fixed issues in desktop files (missing vendor, unexpandedmacros, missing information)
  - README.src renamed to README.md
  - Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-3
changelog:
  - cups moved to headful package
  - enabled gtk2 in headful package (RH1598152)
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.191.b12-4
changelog:
  - Update(s) from upstreamed patches:
    - jdk8036003-add_with_native_debug_symbols_configure_flag.patch
    - jdk8150954-pr2866-rh1176206-screenshot_xcomposite_jdk.patch =>
      jdk8150954-pr2866-rh1176206-screenshot_xcomposite_jdk.patch
      Deleted rh1176206-root.patch as thats no longer needed with
      upstream 8150954.
    - 8207057-pr3613-hotspot-assembler-debuginfo.patch =>
      jdk8207057-pr3613-no_debug_info_for_assembler_files_hotspot.patch and
      jdk8207057-pr3613-no_debug_info_for_assembler_files_root.patch. From JDK 8u
      backport.
  - Use --with-native-debug-symbols=internal which JDK-8036003 adds.
  - Remove comment for make invocation since it's no longer valid.
    --with-native-debug-symbols=internal will do everything we need.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.191.b12-5
changelog:
  - Removed patch, rh1214835.patch, since it's invalid:
    See https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2304#c3
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.191.b12-6
changelog:
  - Add fixes for optimization gaps (annocheck issues):
    - 8210761: libjsig is being compiled without optimization
    - 8210647: libsaproc is being compiled without optimization
    - 8210416: [linux] Poor StrictMath performance due to non-optimized compilation
    - 8210425: [x86] sharedRuntimeTrig/sharedRuntimeTrans compiled without optimization
               8u upstream and aarch64/jdk8u upstream versions.
  - Resolves: rhbz#1633817


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.191.b12-7
changelog:
  - Add patch jdk8210425-rh1632174-03-compile_with_o2_and_ffp_contract_off_as_for_fdlibm_zero.patch:
    - Annother fix for optimization gaps (annocheck issues)
    - Zero 8u version fix was missing. Hence, only shows up on Zero arches.
  - Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-8
changelog:
  - added Patch583 jdk8172850-rh1640127-01-register_allocator_crash.patch
  - added Patch584 jdk8209639-rh1640127-02-coalesce_attempted_spill_non_spillable.patch
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-9
changelog:
  - Fix patch organisation in the spec file:
  -   * Move ECC patches back to upstreamable section
  -   * Move system cacerts patches to upstreamable section
  -   * Merge "Local fixes" and "RPM fixes" which amount to the same thing
  -   * Move system libpng & lcms patches back to 8u upstreamable section
  -   * Make it clearer that "Non-OpenJDK fixes" is currently empty
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-9
changelog:
  - Note why PR1834/RH1022017 is not suitable to go upstream in its current form.
  - Resolves: rhbz#1633817


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-11
changelog:
  - Renamed all patches to new convention
  -   bug1-bug2-..-bugN-XY-lowercase_comment_suffix_or_jdkpart.patch
  - Resolves: rhbz#1633817


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-13
changelog:
  - Add backport of JDK-8029661 which adds TLSv1.2 support to the PKCS11 provider.
  - Resolves: rhbz#1477159


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-15
changelog:
  - Fix jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_jdk.patch paths to pass git apply
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b13-1
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b13.
  - Update tarball generation script in preparation for PR3667/RH1656676 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-1
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b14.
  - Adjust JDK-8073139/PR1758/RH1191652 to apply following 8155627 backport.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-2
changelog:
  - Add 8131048 & 8164920 (PR3574/RH1498936) to provide a CRC32 intrinsic for PPC64.
  - Resolves: rhbz#1498936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-1
changelog:
  - Update to aarch64-shenandoah-jdk8u192-b12.
  - Remove patches included upstream
    - JDK-8031668/PR2842
    - JDK-8148351/PR2842
    - JDK-6260348/PR3066
    - JDK-8061305/PR3335/RH1423421
    - JDK-8188030/PR3459/RH1484079
    - JDK-8205104/PR3539/RH1548475
    - JDK-8185723/PR3553
    - JDK-8186461/PR3557
    - JDK-8201509/PR3579
    - JDK-8075942/PR3602
    - JDK-8203182/PR3603
    - JDK-8206406/PR3610/RH1597825
    - JDK-8206425
    - JDK-8036003
    - JDK-8201495/PR2415
    - JDK-8150954/PR2866/RH1176206
  - Re-generate patches (mostly due to upstream build changes)
    - JDK-8073139/PR1758/RH1191652
    - JDK-8143245/PR3548 (due to JDK-8202600)
    - JDK-8197429/PR3546/RH1536622 (due to JDK-8189170)
    - JDK-8199936/PR3533
    - JDK-8199936/PR3591
    - JDK-8207057/PR3613
    - JDK-8210761/RH1632174 (due to JDK-8207402)
    - PR3559 (due to JDK-8185723/JDK-8186461/JDK-8201509)
    - PR3593 (due to JDK-8081202)
    - RH1566890/CVE-2018-3639 (due to JDK-8189170)
    - RH1649664 (due to JDK-8196516)
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-1
changelog:
  - Add port of 8189170 to AArch64 which is missing from upstream 8u version.
  - Resolves: rhbz#1661577


author: Jiri Vanek jvanek@redhat.com - 1:1.8.0.201.b09-2
changelog:
  - Replaced pcsc-lite-devel (which is in optional channel) with pcsc-lite-libs.
  - added rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch to make jdk work with pcsc


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b09-3
changelog:
  - Sync SystemTap & desktop files with upstream IcedTea release using new script
  - Resolves: rhbz#1434241


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.201.b09-5
changelog:
  - Update patch for RH1566890.
    - Renamed rh1566890_speculative_store_bypass_so_added_more_per_task_speculation_control_CVE_2018_3639 to
      rh1566890-CVE_2018_3639-speculative_store_bypass.patch
    - Added dependent patch,
      rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b13-1
changelog:
  - Update to aarch64-shenandoah-jdk8u201-b13.
  - Drop JDK-8160748 & JDK-8189170 AArch64 patches now applied upstream.
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.202.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u202-b08.
  - Remove patches included upstream
    - JDK-8211387/PR3559
    - JDK-8207057/PR3613
    - JDK-8165852/PR3468
    - JDK-8073139/PR1758/RH1191652
    - JDK-8044235
    - JDK-8172850/RH1640127
    - JDK-8209639/RH1640127
    - JDK-8131048/PR3574/RH1498936
    - JDK-8164920/PR3574/RH1498936
  - Re-generate patches
    - JDK-8210647/RH1632174
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-1
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b02.
  - Remove patches included upstream
    - JDK-8197429/PR3546/RH153662{2,3}
    - JDK-8184309/PR3596
    - JDK-8210647/RH1632174
    - JDK-8029661/PR3642/RH1477159
  - Re-generate patches
    - JDK-8203030
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-1
changelog:
  - Add missing part of JDK-8213419 for AArch64 removing duplicate uabs definitions
  - Yet another cast to resolve s390 ambiguity in call to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b01-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b01.
  - Refactor PR2888 after inclusion of 8129988 upstream. Now includes PR3575.
  - Drop 8171000, 8197546 & PR3634 as applied upstream.
  - Adjust 8214206 fix for S390 as BinaryMagnitudeSeq moved to shenandoahNumberSeq.cpp
  - Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b02-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b02.
  - Drop 8064786/PR3599 & 8210416/RH1632174 as applied upstream (8064786 silently in 8176100).
  - Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b03.
  - Set milestone to "ea" as this is not the final release.
  - Drop 8210425 patches applied upstream. Still need to add AArch64 version in aarch64/shenandoah-jdk8u.
  - Re-generate JDK-8141570 & JDK-8143245 patches due to 8210425 zeroshark.make changes.
  - Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-1
changelog:
  - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
  - Drop unused use_shenandoah_hotspot variable.
  - Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b04-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b04.
  - Drop remaining JDK-8210425/RH1632174 patch now AArch64 part is upstream.
  - Resolves: rhbz#1705328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
  - Resolves: rhbz#1724452


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.222.b07-2
changelog:
  - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
  - Don't perform a bootcycle build for the debug variant build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b08-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b08.
  - Adjust PR3083/RH134640 to apply after JDK-8182999
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-1
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-2
changelog:
  - Provide Javadoc debug subpackages for now, but populate them from the normal build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-2
changelog:
  - Use normal_suffix for Javadoc zip filename to copy, as there is is no debug version.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b01.
  - Switch to EA mode.
  - Drop JDK-8210761/RH1632174 as now upstream.
  - Resolves: rhbz#1498932


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05.
  - Drop upstreamed patch JDK-8141570/PR3548.
  - Adjust context of JDK-8143245/PR3548 to apply against upstream JDK-8141570.
  - Resolves: rhbz#1737109


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05-shenandoah-merge-2019-09-09.
  - Update version logic to handle -shenandoah* tag suffix.
  - Resolves: rhbz#1737109


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-1
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b09.
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-3
changelog:
  - Mark net.properties as a config file (based on Fedora patch by James Cassell)
  - Resolves: rhbz#1710928


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-4
changelog:
  - Update generate_source_tarball.sh script to use the PR3756 patch and retain the secp256k1 curve.
  - Regenerate source tarball using the updated script and add the -'4curve' suffix.
  - Resolves: rhbz#1746874


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-5
changelog:
  - Replace JDK-8231991 backport with upstream version and include JDK-8234107 fixup.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b05.
  - Attempt to fix Shenandoah formatting failures on S390, introduced by JDK-8232102.
  - Revise b05 snapshot to include JDK-8236178.
  - Add additional Shenandoah formatting fixes revealed by successful -Wno-error=format run
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b07.
  - Switch to GA mode for final release.
  - Remove Shenandoah S390 patch which is now included upstream as JDK-8236829.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b08.
  - Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions.
  - Fix paths in jdk8231991-mouse_wheel_focus.patch after git apply --stat complaints.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b01.
  - Switch to EA mode.
  - Adjust JDK-8199936/PR3533 patch following JDK-8227397 configure change
  - Remove local copies of JDK-8231991 & JDK-8234107 as replaced by upstream versions.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u252-b03.
  - Adjust PR2974/RH1337583 & PR3083/RH1346460 following context changes in JDK-8230978
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-3
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-4
changelog:
  - Add backports of JDK-8227269 & JDK-8241750 to resolve slow class loading with JDWP enabled.
  - Resolves: rhbz#1751985


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b01.
  - Switch to EA mode.
  - Adjust JDK-8143245/PR3548 patch following context changes due to JDK-8203287 for JFR
  - Adjust RH1648644 following context changes due to introduction of JFR packages
  - Add recently added binaries to alternatives set (clhsdb, hsdb, jfr)
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b02-0.2.ea
changelog:
  - Enable JFR in our builds, ahead of upstream default.
  - Only enable JFR for JIT builds, as it is not supported with Zero.
  - Turn off JFR on x86 for now due to assert(SerializePageShiftCount == count) crash.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b05.
  - Remove backports of JDK-8227269 & JDK-8241750 included upstream in 8u262-b05.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b05-0.2.ea
changelog:
  - Backport JDK-8243541 & require tzdata 2020a as latest tzdata package needs resource updates
  - Resolves: rhbz#1838229


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b06-0.2.ea
changelog:
  - Sync SystemTap & desktop files with upstream IcedTea release 3.15.0, removing previous workarounds
  - Sync stapinstall handling with RHEL 8 implementation
  - Need to support noarch for creating source RPMs for non-scratch builds.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b07-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b07.
  - Drop JDK-8243541 backport now applied upstream.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.4.ea
changelog:
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.5.ea
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Introduce jfr_arches for architectures which support JFR.
  - Introduce sa_arches for architectures which support the serviceability agent.
  - Introduce share_arches for architectures which support class sharing (-Xshare:dump).
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-1
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-0
changelog:
  - Update to aarch64-shenandoah-jdk8u265-b01.
  - Update release notes for 8u265 release.
  - Resolves: rhbz#1860456


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.265.b01-1
changelog:
  - ASSEMBLY_EXCEPTION LICENSE THIRD_PARTY_README moved to fully versioned dirs
  - Resolves: rhbz#1861222


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b01.
  - Switch to EA mode.
  - Add debugging output for build.
  - JFR must now be explicitly disabled when unwanted (e.g. x86), following switch of upstream default.
  - Remove ZipConstants change from JDK-8186464 backport, now provided upstream by JDK-8075774
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b02.
  - Remove JDK-8154313 backport now applied upstream.
  - Change target from 'zip-docs' to 'docs-zip', which is the naming used upstream.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b04.
  - Update tarball generation script to use PR3795, following inclusion of JDK-8177334
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b05.
  - Fix context in JDK-8186464/RH1433262 patch, following JDK-8078334 @randomness tag addition.
  - Add additional s390 size_t case in g1ConcurrentMarkObjArrayProcessor.cpp introduced by JDK-8057003
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b05-shenandoah-merge-2020-08-28.
  - Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.2.ea
changelog:
  - Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b06.
  - Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Delay tzdata 2020b dependency until tzdata update has shipped.
  - Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-1
changelog:
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.275.b01-0
changelog:
  - Update to aarch64-shenandoah-jdk8u275-b01 (GA)
  - Update release notes for 8u275.
  - Resolves: rhbz#1895062


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b01 (EA)
  - Update release notes for 8u282-b01.
  - Switch to EA mode.
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Remove PR3601, covered upstream by JDK-8062808.
  - Remove upstreamed JDK-8197981/PR3548, JDK-8062808/PR3548, JDK-8254177 & JDK-8215727.
  - Resolves: rhbz#1903903


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
  - Added patch600: rh1750419-redhat_alt_java.patch
  - Replaced alt-java placeholder with real patched alt-java
  - Removed patch529: rh1566890-CVE_2018_3639-speculative_store_bypass.patch
  - Removed patch531: rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - Both surpassed by new patch
  - Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
  - Extend RH1750419 alt-java fix to include external debuginfo, following JDK-8252395 in 8u282-b01
  - Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b02 (EA)
  - Update release notes for 8u282-b02.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b03 (EA)
  - Update release notes for 8u282-b03.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b04 (EA)
  - Update release notes for 8u282-b04.
  - Remove upstreamed patch PR3519
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b05 (EA)
  - Update release notes for 8u282-b05 and make some minor corrections.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b06 (EA)
  - Update release notes for 8u282-b06.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b07 (EA)
  - Update release notes for 8u282-b07.
  - Fix placement issue in release notes, caught by comparing with vanilla version.
  - Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b08 (GA)
  - Update release notes for 8u282-b08.
  - This tarball is embargoed until 2021-01-19 @ 1pm PT.
  - Resolves: rhbz#1908963


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b01 (EA)
  - Update release notes for 8u292-b01.
  - Switch to EA mode.
  - Update tarball generation script to use PR3822 which handles
      JDK-8233228 & JDK-8035166 changes
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b02 (EA)
  - Update release notes for 8u292-b02.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b03 (EA)
  - Update release notes for 8u292-b03.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b04 (EA)
  - Update release notes for 8u292-b04.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05 (EA)
  - Update release notes for 8u292-b05.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.1.ea
changelog:
  - Re-organise S/390 patches for upstream submission, separating 8u upstream from Shenandoah fixes.
  - Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11 (EA)
  - Update release notes for 8u292-b05-shenandoah-merge-2021-03-11.
  - Extend s390 patch to fix issue caused by JDK-8252660 backport and lack of JDK-8188813 in 8u.
  - Revise JDK-8252660 s390 failure to make _soft_max_size a jlong so pointer types are accurate.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b06 (EA)
  - Update release notes for 8u292-b06.
  - Require tzdata 2020f due to JDK-8259048
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b07 (EA)
  - Update release notes for 8u292-b07.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b08-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b08 (EA)
  - Update release notes for 8u292-b08.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b09 (EA)
  - Update release notes for 8u292-b09.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b10 (GA)
  - Update release notes for 8u292-b10.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1938201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b01-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b01 (EA)
  - Update release notes for 8u302-b01.
  - Switch to EA mode.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b02-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b02 (EA)
  - Update release notes for 8u302-b02.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03 (EA)
  - Update release notes for 8u302-b03.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23 (EA)
  - Update release notes for 8u302-b03-shenandoah-merge-2021-06-23.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b04-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b04 (EA)
  - Update release notes for 8u302-b04.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b05 (EA)
  - Update release notes for 8u302-b05.
  - Remove JDK-8266929/RH1960024 as now upstream.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b06 (EA)
  - Update release notes for 8u302-b06.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b07 (EA)
  - Update release notes for 8u302-b07.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b08 (EA)
  - Update release notes for 8u302-b08.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b01-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b01 (EA)
  - Update release notes for 8u312-b01.
  - Switch to EA mode.
  - Remove "-clean" suffix as no 8u312 builds are unclean.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b02-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b02 (EA)
  - Update release notes for 8u312-b02.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b03 (EA)
  - Update release notes for 8u312-b03.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b04 (EA)
  - Update release notes for 8u312-b04.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05 (EA)
  - Update release notes for 8u312-b05.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
  - Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
  - Resolves: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.3.ea
changelog:
  - Add patch to improve performance of common separators in Scanner.useLocale
  - Move alt-java patch to correct section.
  - Resolves: rhbz#1862929


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b07 (EA)
  - Update release notes for 8u312-b07.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b04 (EA)
  - Update release notes for 8u322-b04.
  - Require tzdata 2021c as of JDK-8274407.
  - Switch to EA mode.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Related: rhbz#2022809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-1
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b06 (EA)
  - Update release notes for 8u322-b06.
  - Switch to GA mode for final release.
  - Require tzdata 2021e as of JDK-8275766.
  - Update tarball generation script to use git following shenandoah-jdk8u's move to github
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b01 (EA)
  - Update release notes for shenandoah-8u332-b01.
  - Switch to EA mode.
  - Related: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b06 (EA)
  - Update release notes for shenandoah-8u332-b06.
  - Resolves: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-1
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-04-19 @ 1pm PT.
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-1
changelog:
  - Update to shenandoah-jdk8u342-b07
  - Update release notes for shenandoah-8u342-b07.
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Remove redundant "REPOS" variable from tarball script
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Rebase JDK-8186464 patch so it applies after JDK-8190753
  - Resolves: rhbz#2106502


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-1
changelog:
  - Update to shenandoah-jdk8u345-b01 (GA)
  - Update release notes for 8u345-b01.
  - Resolves: rhbz#2112383


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-1
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - * This tarball is embargoed until 2022-10-18 @ 1pm PT. *
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Add test to ensure timezones can be translated
  - Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b07-0.1.ea
changelog:
  - Update to shenandoah-jdk8u362-b07 (EA)
  - Update release notes for shenandoah-8u362-b07.
  - Switch to EA mode for 8u362 pre-release builds.
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Drop tzdata patches for 2022d & 2022e (JDK-8294357 & JDK-8295173) which are now upstream
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150191


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b08-1
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Fix broken links and missing release notes in older releases.
  - Drop RH1163501 patch which is not upstream or in 11, 17 & 19 packages and seems obsolete
    - Patch was broken by inclusion of "JDK-8293554: Enhanced DH Key Exchanges"
    - Patch was added for a specific corner case of a 4096-bit DH key on a Fedora host that no longer exists
    - Fedora now appears to be using RSA and the JDK now supports ECC in preference to large DH keys
  - Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-1
changelog:
  - Update to shenandoah-jdk8u372-b07 (GA)
  - Update release notes for shenandoah-8u372-b07.
  - Require tzdata 2023c due to inclusion of JDK-8305113 in 8u372-b07
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Include JDK-8271199 backport early ahead of 8u382 (RH2175317)
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2159458


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b01 (EA)
  - Update release notes for shenandoah-8u382-b01.
  - Switch to EA mode.
  - Remove JDK-8271199 patch which is now upstream.
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b04-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b04 (EA)
  - Update release notes for shenandoah-8u382-b04.
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u372-b05 (GA)
  - Update release notes for shenandoah-8u372-b05.
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u382-b05 (GA)
  - Update release notes for shenandoah-8u382-b05.
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-11319


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - Update to shenandoah-jdk8u392-b08 (GA)
  - Update release notes for shenandoah-8u392-b08.
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Regenerate PR2462 patch following JDK-8315135
  - Add backport of JDK-8312489 heading upstream for 8u402 (see OPENJDK-2095)
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12212
  - Resolves: RHEL-13574
  - Resolves: RHEL-13575
  - Resolves: RHEL-13576
  - Resolves: RHEL-11319
  - Resolves: RHEL-13577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-3
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19630


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u402-b01 (EA)
  - Update release notes for shenandoah-8u402-b01.
  - Switch to EA mode.
  - Sync NEWS with vanilla branch version.
  - Related: RHEL-17914


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u402-b06 (GA)
  - Update release notes for shenandoah-8u402-b06.
  - Drop local copy of JDK-8312489 which is now included upstream
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-17914
  - Resolves: RHEL-20965


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u412-b01 (EA)
  - Update release notes for shenandoah-8u412-b01.
  - Switch to EA mode.
  - Related: RHEL-30926


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Invoke xz in multi-threaded mode
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Remove -T0 argument from systemtap tar invocation
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Turn off xz multi-threading on i686 as it fails with an out of memory error
  - Normalise whitespace
  - Move to upstream tag style (shenandoah8ux-by) in preparation for eventually moving back to official sources
  - generate_source_tarball.sh: Rename JCONSOLE_JS_PATCH{,_DEFAULT} to JCONSOLE_PATCH{,_DEFAULT} for brevity
  - generate_source_tarball.sh: Adapt OPENJDK_LATEST logic to work with 8u Shenandoah fork
  - generate_source_tarball.sh: Adapt version logic to work with 8u
  - generate_source_tarball.sh: Add quoting for SCRIPT_DIR and JCONSOLE_PATCH (SC2086)
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - Move maintenance scripts to a scripts subdirectory
  - icedtea_sync.sh: Update with a VCS mode that retrieves sources from a Mercurial repository
  - jconsole.desktop.in: Restored by running icedtea_sync.sh
  - policytool.desktop.in: Likewise.
  - Restore IcedTea sources correctly in spec file
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - generate_source_tarball.sh: Handle an existing checkout
  - generate_source_tarball.sh: Sync indentation with java-21-openjdk version
  - generate_source_tarball.sh: Support using a subdirectory via TO_COMPRESS
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b07-0.1.ea
changelog:
  - Update to shenandoah-jdk8u412-b07 (EA)
  - Update release notes for shenandoah-8u412-b07.
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - Resolves: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-1
changelog:
  - Update to shenandoah-jdk8u412-b08 (GA)
  - Update release notes for shenandoah-8u412-b08.
  - Complete release note for Certainly roots
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Related: RHEL-30926


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.22-5
changelog:
  - Initial Load
  - removed -fno-lifetime-dse; rhel7 gcc to old (4.8.5)
  - lib/classlist do not exists s390, ifarch-ed via jit_arches out
  - Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.22-8
changelog:
  - Adjust system NSS patch, pr1983-rh1565658-support_using_the_system_installation_of_nss_with_the_sunec_provider_jdk11.patch, so
    as to filter -Wl,--as-needed from linker flags. Fixes FTBFS issue.
  - Resolves: rhbz#1570856


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.28-2
changelog:
  - jfr/*jfc files listed for all arches
  - lib/classlist do not exists s390, ifarch-ed via jit_arches out
  - specfile slightly improved to allow srpm rebuild on rhel8/fedoras
  - Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.22-6
changelog:
  - Add patch, JDK-8210416-RHBZ-1624122-fdlibm-opt-fix.patch, so as to
    optimize compilation of fdlibm library.
  - Add patch, JDK-8210425-RHBZ-1624122-sharedRuntimeTrig-opt-fix.patch, so
    as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
  - Add patch, JDK-8210647-RHBZ-1624122-libsaproc-opt-fix.patch, so as to
    optimize compilation of libsaproc (extra c flags won't override
    optimization).
  - Add patch, JDK-8210703-RHBZ-1624122-vmStructs-opt-fix.patch, so as to
    optimize compilation of vmStructs.cpp (part of libjvm.so).
  - No longer filter -O flags from C flags coming from
    redhat-rpm-config.
  - Resolves: RHBZ#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-5
changelog:
  - Add patch, RHBZ-1628612-JDK-8210461-workaround-disable-aarch64-intrinsic.patch,
    so as to disable dsin/dcos math intrinsics on aarch64. Work-around for
    JDK-8210461.
  - Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-6
changelog:
  - Add patch, RHBZ-1630996-JDK-8210858-workaround-disable-aarch64-intrinsic-log.patch,
    so as to disable log math intrinsic on aarch64. Work-around for
    JDK-8210858
  - Resolves: rhbz#1570856


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.ea.28-8
changelog:
  - removed version less provides
  - javadocdir moved to arched dir as it is no longer noarch
  - Resolves: rhbz#1570856


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.ea.28-9
changelog:
  - Rework changes from 1:11.0.ea.22-6. RHBZ#1632174 supercedes
    RHBZ-1624122.
  - Add patch, jdk8210416-rh1632174-compile_fdlibm_with_o2_ffp_contract_off_on_gcc_clang_arches.patch, so as to
    optimize compilation of fdlibm library.
  - Add patch, jdk8210425-rh1632174-sharedRuntimeTrig_sharedRuntimeTrans_compiled_without_optimization.patch, so
    as to optimize compilation of sharedRuntime{Trig,Trans}.cpp
  - Add patch, jdk8210647-rh1632174-libsaproc_is_being_compiled_without_optimization.patch, so as to
    optimize compilation of libsaproc (extra c flags won't override
    optimization).
  - Add patch, jdk8210761-rh1632174-libjsig_is_being_compiled_without_optimization.patch, so as to
    optimize compilation of libjsig.
  - Add patch, jdk8210703-rh1632174-vmStructs_cpp_no_longer_compiled_with_o0, so as to
    optimize compilation of vmStructs.cpp (part of libjvm.so).
  - Reinstate filtering of opt flags coming from redhat-rpm-config.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.0.28-1
changelog:
  - Identify as GA version and no longer as early access (EA).
  - JDK 11 has been released for GA on 2018-09-25.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.1.13-3
changelog:
  - Use upstream's version of Aarch64 intrinsics disable patch:
    - Removed:
      RHBZ-1628612-JDK-8210461-workaround-disable-aarch64-intrinsic.patch
      RHBZ-1630996-JDK-8210858-workaround-disable-aarch64-intrinsic-log.patch
    - Superceded by:
      jdk8211105-aarch64-disable_cos_sin_and_log_intrinsics.patch


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.1.13-6
changelog:
  - fixed tck failures of arraycopy and process exec with shenandoah on
  - added patch585 rh1648995-shenandoah_array_copy_broken_by_not_always_copy_forward_for_disjoint_arrays.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.1.13-8
changelog:
  - Update to shenandoah-jdk-11.0.1+13-20190101
  - Update tarball generation script in preparation for PR3681/RH1656677 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Add missing RH1022017 patch to reduce curves reported by SSL to those we support.
  - Drop upstream Shenandoah patch RH1648995.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.1.13-8
changelog:
  - Fix remove-intree-libraries.sh to not exit early and skip SunEC handling.
  - Fix PR1983 SunEC patch so that ecc_impl.h is patched rather than added
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.2.7-1
changelog:
  - Update to shenandoah-jdk-11.0.2+7 (January 2019 CPU)
  - Make tagsuffix optional and comment it out while unused.
  - Drop JDK-8211105/RH1628612/RH1630996 applied upstream.
  - Drop JDK-8209639/RH1640127 applied upstream.
  - Re-generate JDK-8210416/RH1632174 following JDK-8209786
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.2.7-4
changelog:
  - Replace pcsc-lite-devel with pcsc-lite-libs so deps can be resolved without optional repository
  - Add JDK-8009550/RH910107 patch so OpenJDK checks for libpcsclite.so.1 (in pcsc-lite-libs)
  - Add missing ISA to cups-libs requirement
  - Remove duplicate lksctp-tools requirement
  - Resolves: rhbz#1684617


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.3.6-1
changelog:
  - Update to shenandoah-jdk-11.0.3+6 (April 2019 EA)
  - Drop JDK-8210416/RH1632174 applied upstream.
  - Drop JDK-8210425/RH1632174 applied upstream.
  - Drop JDK-8210647/RH1632174 applied upstream.
  - Drop JDK-8210761/RH1632174 applied upstream.
  - Drop JDK-8210703/RH1632174 applied upstream.
  - Resolves: rhbz#1677516


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.3.7-2
changelog:
  - Don't build the test images needlessly.
  - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
  - Don't perform a bootcycle build for the debug variant build.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.3.7-3
changelog:
  - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.4.11-1
changelog:
  - Update to shenandoah-jdk-11.0.4+11 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.1-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.5+1 (EA)
  - Switch to EA mode for 11.0.5 pre-release builds.
  - Resolves: rhbz#1737117


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.2-0.2.ea
changelog:
  - Update generate_source_tarball.sh script to use the PR3751 patch and retain the secp256k1 curve.
  - Regenerate source tarball using the updated script and add the -'4curve' suffix.
  - PR3751 includes the changes in the PR1834/RH1022017 patch which is removed.
  - Resolves: rhbz#1699068


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.3-0.1.ea
changelog:
  - Use 'release' rather than 'rpmrelease' for the release variable so rpmdev-bumpspec works again.
  - Resolves: rhbz#1737117


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.4-0.1.ea
changelog:
  - Revert rpmdev-bumpspec workaround as it has consequences for RPM installation.
  - Resolves: rhbz#1737117


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.10-1
changelog:
  - Update to shenandoah-jdk-11.0.5+10 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.1-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.6+1 (EA)
  - Switch to EA mode for 11.0.6 pre-release builds.
  - Add support for jfr binary.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-1
changelog:
  - Update to shenandoah-jdk-11.0.6+10 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-3
changelog:
  - Add JDK-8237396 backport to resolve Shenandoah TCK breakage in traversal mode.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.7.1-0.0.ea
changelog:
  - Update to shenandoah-jdk-11.0.7+1 (EA)
  - Switch to EA mode for 11.0.7 pre-release builds.
  - Drop JDK-8236039 backport now applied upstream.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.7.10-5
changelog:
  - Update to shenandoah-jdk-11.0.7+10 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.7.10-6
changelog:
  - Sync SystemTap & desktop files with upstream IcedTea release 3.11.0 using new script
  - Resolves: rhbz#1737114


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.7.10-6
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Need to support noarch for creating source RPMs for non-scratch builds.
  - Resolves: rhbz#1737114


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.7.10-7
changelog:
  - Add backports of JDK-8227269 & JDK-8241750 to resolve slow class loading with JDWP enabled.
  - Resolves: rhbz#1826915


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.1-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+1 (EA)
  - Switch to EA mode for 11.0.8 pre-release builds.
  - Drop JDK-8237396 & JDK-8228407 backports now applied upstream.
  - Resolves: rhbz#1838811


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.8.2-0.2.ea
changelog:
  - Build static-libs-image and add resulting files via -static-libs sub-package.
  - Resolves: rhbz#1839091


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.2-0.2.ea
changelog:
  - Use RHEL 7 format for handling the debug argument to the files_static_libs macro.
  - Fix warning about macro in comment.
  - Resolves: rhbz#1839091


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.4-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+4 (EA)
  - Require tzdata 2020a due to resource changes in JDK-8243541
  - Resolves: rhbz#1838811


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.8.5-0.2.ea
changelog:
  - Disable stripping of debug symbols for static libraries part of
    the -static-libs sub-package.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.7-0.2.ea
changelog:
  - java-11-openjdk doesn't have a JRE tree, so don't try and copy alt-java there...
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.9-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+9 (EA)
  - Update release notes for 11.0.8 release.
  - This tarball is embargoed until 2020-07-14 @ 1pm PT.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-1
changelog:
  - Update to shenandoah-jdk-11.0.8+10 (GA)
  - Switch to GA mode for final release.
  - Update release notes with last minute fix (JDK-8248505).
  - This tarball is embargoed until 2020-07-14 @ 1pm PT.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-2
changelog:
  - Add JDK-8252258 to return default vendor to the original value of 'Oracle Corporation'
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.1-0.0.ea
changelog:
  - Update to shenandoah-jdk-11.0.9+1 (EA)
  - Switch to EA mode for 11.0.9 pre-release builds.
  - Drop JDK-8227269, JDK-8241750 & JDK-8245714 backports now applied upstream.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.1-0.0.ea
changelog:
  - Cleanup architecture and JVM feature handling in preparation for using upstreamed Shenandoah.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.1-0.0.ea
changelog:
  - JDK-8245832 increases the set of static libraries, so try and include them all with a wildcard.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.2-0.0.ea
changelog:
  - Update to jdk-11.0.9+2 (EA)
  - With Shenandoah now upstream in OpenJDK 11, we can use jdk-updates/jdk11 directly
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.2-0.1.ea
changelog:
  - Following JDK-8005165, class data sharing can be enabled on all JIT architectures
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.6-0.0.ea
changelog:
  - Update to jdk-11.0.9+6 (EA)
  - Update tarball generation script to use PR3802, handling JDK-8233228 & JDK-8177334
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.8-0.0.ea
changelog:
  - Update to jdk-11.0.9+8 (EA)
  - Remove JDK-8252258/RH1868406 now applied upstream.
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.10-0.1.ea
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Moved vendor_version_string to a better place
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-0
changelog:
  - Update to jdk-11.0.9+11
  - Update release notes for 11.0.9 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-1
changelog:
  - Move all license files to NVR-specific JVM directory.
  - This bad placement was killing parallel installability and thus having a bad impact on leapp, if used.
  - Resolves: rhbz#1896609


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.9.11-1
changelog:
  - Update to jdk-11.0.9.1+1
  - RPM version stays at 11.0.9.11 so as to not break upgrade path.
  - Adds a single patch for JDK-8250861.
  - Resolves: rhbz#1895275


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-2
changelog:
  - Add backport of JDK-8222537 so the Host header is sent when using proxies.
  - Resolves: rhbz#1869530


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-3
changelog:
  - Removed patch6: rh1566890-CVE_2018_3639-speculative_store_bypass.patch, surpassed by new patch
  - Added patch600: rh1750419-redhat_alt_java.patch, surpassing removed patch
  - No longer copy java->alt-java as it is created by patch600
  - Resolves: rhbz#1901695


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-5
changelog:
  - Redefined linux -> __linux__ and __x86_64 -> __x86_64__ in RH1750419 patch
  - Resolves: rhbz#1901695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-5
changelog:
  - Introduced ssbd_arches to denote architectures with SSBD mitigation (currently only x86_64)
  - Introduced nm-based check to verify alt-java on ssbd_arches is patched, and no other alt-java or java binaries are patched
  - RH1750419 patch amended to emit a warning on architectures where alt-java is the same as java
  - Resolves: rhbz#1901695


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.1-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+1
  - Update release notes to 11.0.10.0+1
  - Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly.
  - Still use 11.0.x rather than 11.0.x.0 for file naming, as the trailing zero is omitted from tags.
  - Revert configure and built_doc_archive hacks to build 11.0.9.1 from 11.0.9.0 sources, and synced with Fedora version.
  - Cleanup debug package descriptions and version number placement.
  - Switch to EA mode for 11.0.10 pre-release builds.
  - Drop JDK-8222286 & JDK-8254177 as applied upstream
  - Explicitly request bundled Harfbuzz (too risky to change this so late in the RHEL 7 lifecycle)
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.2-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+2
  - Update release notes to 11.0.10.0+2
  - Update tarball generation script to use PR3818 which handles JDK-8171279 changes
  - Drop JDK-8250861 as applied upstream.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.2-0.0.ea
changelog:
  - Completely revert hacks from previous release, using buildver in configure and tzdata 2020b
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.5-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+5
  - Update release notes to 11.0.10.0+5
  - Drop JDK-8222527 as applied upstream.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.8-0.0.ea
changelog:
  - Update to jdk-11.0.10.0+8
  - Update release notes to 11.0.10.0+8 and add missing JDK-8245051 from b04.
  - Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-0
changelog:
  - Update to jdk-11.0.10.0+9
  - Update release notes to 11.0.10.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-01-19 @ 1pm PT.
  - Resolves: rhbz#1908970


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.1-0.0.ea
changelog:
  - Update to jdk-11.0.11.0+1
  - Update release notes to 11.0.11.0+1
  - Switch to EA mode for 11.0.11 pre-release builds.
  - Require tzdata 2020f to match upstream change JDK-8259048
  - Resolves: rhbz#1938082


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.2-0.0.ea
changelog:
  - Update to jdk-11.0.11.0+2
  - Update release notes to 11.0.11.0+2
  - Remove local backport of JDK-8258836 which is now available upstream.
  - Resolves: rhbz#1938082


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.2-0.1.ea
changelog:
  - Perform static library build on a separate source tree with bundled image libraries
  - Make static library build optional
  - Based on initial work by Severin Gehwolf
  - Resolves: rhbz#1930527


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.2-0.1.ea
changelog:
  - Debug builds need to find their documentation from the release build.
  - RHEL 7 builds still include a doc package for debug builds, though debug builds do not build docs.
  - Resolves: rhbz#1930527


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:11.0.11.0.3-0.1.ea
changelog:
  - Fix issue where CheckVendor.java test erroneously passes when it should fail.
  - Add proper quoting so '&' is not treated as a special character by the shell.
  - Resolves: rhbz#1938082


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.9-0
changelog:
  - Update to jdk-11.0.11.0+9
  - Update release notes to 11.0.11.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1940228


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.1-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+1
  - Update release notes to 11.0.12.0+1
  - Switch to EA mode for 11.0.12 pre-release builds.
  - Update ECC patch following JDK-8226374 (bug ID yet to be confirmed)
  - Remove local JDK-8187450 backport as now included upstream.
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.4-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+4
  - Update release notes to 11.0.12.0+4
  - Correct bug ID JDK-8264846 to intended ID of JDK-8264848
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.6-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+6
  - Update release notes to 11.0.12.0+6
  - Skip 11.0.12.0+5 as 11.0.12.0+6 only adds a test change
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-0
changelog:
  - Update to jdk-11.0.12.0+7
  - Update release notes to 11.0.12.0+7
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-3
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Related: rhbz#1999936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.13.0+1
  - Update release notes to 11.0.13.0+1
  - Update tarball generation script to use git following OpenJDK 11u's move to github
  - Switch to EA mode for 11.0.13 pre-release builds.
  - Remove non-Free test from source tarball.
  - Related: rhbz#1999936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-1
changelog:
  - Update to jdk-11.0.12.0+8
  - Update release notes to 11.0.12.0+8
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2012332


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Replaced hardcoded 11 by featurever where appropriate
  - Fixed comment of `for slowdebug` to correct `any debug`
  - Related: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.14.0+8
  - Update release notes to 11.0.14.0+8
  - Switch to EA mode for 11.0.14 pre-release builds.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Rename blacklisted.certs to blocked.certs following JDK-8253866
  - Resolves: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-1
changelog:
  - Update to jdk-11.0.14.0+9
  - Update release notes to 11.0.14.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-01-18 @ 1pm PT.
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.15.0+1
  - Update release notes to 11.0.15.0+1
  - Switch to EA mode for 11.0.15 pre-release builds.
  - Related: rhbz#2047531


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-1
changelog:
  - Update to jdk-11.0.15.0+9
  - Update release notes to 11.0.15.0+9
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-2
changelog:
  - Remove security items from release notes that were only in 17u and N/A for 11u
  - Related: rhbz#2073422


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Add additional patch during tarball generation to align tests with ECC changes
  - Related: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Update to jdk-11.0.16+8
  - Update release notes to 11.0.16+8
  - Use same tarball naming style as java-17-openjdk and java-latest-openjdk
  - Drop JDK-8284920 patch now upstreamed
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-1
changelog:
  - Update to jdk-11.0.16.1+1
  - Update release notes to 11.0.16.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2119512


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.17+1
  - Update release notes to 11.0.17+1
  - Switch to EA mode for 11.0.17 pre-release builds.
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Include Aleksey's patch for JDK-8291053 to try and get HarfBuzz to build again
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Try to build using system HarfBuzz to avoid build failures with 4.4.1 & gcc 4.8.5
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-1
changelog:
  - Update to jdk-11.0.17+8 (GA)
  - Update release notes to 11.0.17+8
  - Switch to GA mode for release
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
  - Remove unneeded JDK-8291053 patch as we no longer build in-tree HarfBuzz
  - Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.18+1
  - Update release notes to 11.0.18+1
  - Switch to EA mode for 11.0.18 pre-release builds.
  - Drop local copies of JDK-8294357 & JDK-8295173 now upstream contains tzdata 2022e
  - Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.2.ea
changelog:
  - Update to jdk-11.0.18+9
  - Update release notes to 11.0.18+9
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-1
changelog:
  - Update to jdk-11.0.18+10 (GA)
  - Update release notes to 11.0.18+10
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
  - Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-1
changelog:
  - Update to jdk-11.0.19.0+7
  - Update release notes to 11.0.19.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Rebase RH1750419 alt-java patch against 11.0.19+6
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.20+1 (EA)
  - Update release notes to 11.0.20+1
  - Switch to EA mode
  - Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 11.0.20+1
  - Add missing Swing release note
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-1
changelog:
  - Update to jdk-11.0.20.0+8 (GA)
  - Update release notes to 11.0.20.0+8
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
changelog:
  - Update to jdk-11.0.20.1+1 (GA)
  - Update release notes to 11.0.20.1+1
  - Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
  - Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Synchronise runtime and buildtime tzdata requirements
  - Update README.md to match the version in later RHEL releases
  - Resolves: rhbz#2236229


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.21.0.9-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-11320


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-1
changelog:
  - Update to jdk-11.0.21+9 (GA)
  - Update release notes to 11.0.21+9
  - Remove system crypto policy patch which doesn't belong on RHEL 7 with no system policies
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Apply all patches using -p1
  - Drop local backport of JDK-8243210 which is upstream from 11.0.21+2
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
  - Disable the serviceability agent on Zero architectures even when the architecture itself is supported
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12217
  - Resolves: RHEL-12910
  - Resolves: RHEL-12913
  - Resolves: RHEL-11320
  - Resolves: RHEL-13227
  - Resolves: RHEL-13217


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-2
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19642


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.6-0.1.ea
changelog:
  - Update to jdk-11.0.22+6 (EA)
  - Update release notes to 11.0.22+6
  - Switch to EA mode
  - Drop local copy of JDK-8312489 which is now included upstream
  - Resolves: RHEL-21031


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.7-1
changelog:
  - Update to jdk-11.0.22+7 (GA)
  - Update release notes to 11.0.22+7
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-20966


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.23+1 (EA)
  - Update release notes to 11.0.23+1
  - Switch to EA mode
  - Speed up PPC build by removing ppc64le --with-jobs=1 workaround


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-1
changelog:
  - Update to jdk-11.0.23+9 (GA)
  - Update release notes to 11.0.23+9
  - Switch to GA mode for release
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: RHEL-30914


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-2
changelog:
  - Fix 11.0.22 release date in NEWS
  - Restore ppc64le --with-jobs=1 workaround to avoid flaky ppc builds


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-8
changelog:
  - Fix vlock doesn't perform PAM account management or credential reinitialization
    Resolves: #1032140


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-14
changelog:
  - Replace CtrlL_Lock with Caps_Lock in generated us.map
    Resolves: #1441411
  - Improve man pages and usage messages quality and consistency
    Resolves: #949015


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-8
changelog:
  - Powerdevil: do not notify about a non existent action
    Resolves: bz#1289149
  - Plasma taskmanager: close context menu when task is closed
    Resolves: bz#1262603


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-10
changelog:
  - Fix grouping of tasks in taskmanager applet
    Resolves: bz#1348917
  - Fix unlocking of kscreenlocker, unlock it just once
    Resolves: bz#1333441


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-13
changelog:
  - Sanitise notification HTML
    Resolves: bz#1568853

  - Increase cpu buffer size in ksysguard
    Resolves: bz#1611762


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-14
changelog:
  - Do not show disabled buttons in Plastik decoration theme
    Resolves: bz#1677641

  - Taskmanager: dismiss group when application is closed and there is enough space
    Resolve: bz#1698048


author: Jarod Wilson <jarod@redhat.com> [3.10.0-1.el7]
changelog:
  - [x86] fix !CONFIG_HYPERVISOR_GUEST compile (Andrew Jones)
  - [s390x] crash: Fuzzy live dump for Linux on System z (Hendrik Brueckner) [805120]
  - [xen] xenfv: fix hangs when kdumping (Andrew Jones) [845471]
  - [libata] export ata_port port_no attribute via /sys (David Milburn) [951181]
  - [s390x] kdump: Use 4 GiB for KEXEC_AUTO_THRESHOLD (Hendrik Brueckner) [953044]
  - [x86] hpet: allow user controlled mmap for user processes (Prarit Bhargava) [788727]
  - [mm] add memory tracking hooks (James Paradis) [725860]
  - [kernel] clocksource, fix !CONFIG_CLOCKSOURCE_WATCHDOG compile (Prarit Bhargava) [914709]
  - [x86] disable clocksource watchdog (Prarit Bhargava) [914709]
  - [kdump] x86, fix kdump and unsupported HW check (Prarit Bhargava) [923256]
  - [x86] support single cpu on guests only (Prarit Bhargava) [873806]
  - [kernel] Mark power5, power6, !Intel, and !AMD systems as unsupported (Prarit Bhargava) [870129]
  - [kernel] Backport RH specific TAINT flags (Prarit Bhargava) [870129]
  - [s390x] zfcpdump: Add user space tool (Hendrik Brueckner) [825189]
  - [kdump] crashkernel=auto fixes and cleanup (Dave Young) [804077]
  - [fedora] /dev/crash driver (Kyle McMartin) [808839]
  - [kdump] forward port crashkernel auto reservation code (Dave Young) [804077]
  - [block] Change scheduler to CFQ for ATA/SATA (Vivek Goyal) [811016]
  - [kernel] kbuild: AFTER_LINK (Roland McGrath)
  - [ppc64] disable INFINIBAND_EHCA temporarily, it ftbfs (Kyle McMartin)
  - [kernel] Add RHEL_{MAJOR,MINOR,RELEASE} to top level Makefile (Kyle McMartin)


author: Jarod Wilson <jarod@redhat.com> [3.10.0-2.el7]
changelog:
  - [scsi] sd: fix crash when UA received on DIF enabled device (Ewan Milne) [979440]
  - [md] dm-cache: add call to mark_tech_preview (Mike Snitzer) [982752]
  - [fs] nfs: have NFSv3 try server-specified auth flavors in turn (Jeff Layton) [977649]
  - [fs] nfs: have nfs_mount fake up a auth_flavs list when the server didn't provide it (Jeff Layton) [977649]
  - [fs] nfs: move server_authlist into nfs_try_mount_request (Jeff Layton) [977649]
  - [fs] nfs: refactor "need_mount" code out of nfs_try_mount (Jeff Layton) [977649]
  - [pci] ear: Reset link for devices below Root Port or Downstream Port (Myron Stowe) [797485]
  - [acpi] apei: Force fatal AER severity when component has been reset (Myron Stowe) [797485]
  - [pci] aer: Remove "extern" from function declarations (Myron Stowe) [797485]
  - [pci] aer: Move AER severity defines to aer.h (Myron Stowe) [797485]
  - [pci] aer: Set dev->__aer_firmware_first only for matching devices (Myron Stowe) [797485]
  - [pci] aer: Factor out HEST device type matching (Myron Stowe) [797485]
  - [pci] aer: Don't parse HEST table for non-PCIe devices (Myron Stowe) [797485]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-3.el7]
changelog:
  - [powerpc] mm/numa: Do not update sysfs cpu registration from invalid context (Steve Best) [967447]
  - [misc] MAINTAINERS: Add ACPI folks for ACPI-related things under drivers/pci (Myron Stowe) [984759]
  - [pci] Add CircuitCo vendor ID and subsystem ID (Myron Stowe) [984759]
  - [pci] Use pdev->pm_cap instead of pci_find_capability(.., PCI_CAP_ID_PM) (Myron Stowe) [984759]
  - [pci] Return early on allocation failures to unindent mainline code (Myron Stowe) [984759]
  - [pci] Simplify IOV implementation and fix reference count races (Myron Stowe) [984759]
  - [pci] Drop redundant setting of bus->is_added in virtfn_add_bus() (Myron Stowe) [984759]
  - [pci] pci-acpi: Use correct power state strings in messages (Myron Stowe) [984759]
  - [pci] Fix comment typo for pcie_pme_remove() (Myron Stowe) [984759]
  - [pci] Rename pci_release_bus_bridge_dev() to pci_release_host_bridge_dev() (Myron Stowe) [984759]
  - [pci] Fix refcount issue in pci_create_root_bus() error recovery path (Myron Stowe) [984759]
  - [pci] Convert alloc_pci_dev(void) to pci_alloc_dev(bus) (Myron Stowe) [984759]
  - [pci] Hide remove and rescan sysfs interfaces for SR-IOV virtual functions (Myron Stowe) [984759]
  - [pci] Add pcibios_release_device() (Myron Stowe) [984759]
  - [iommu] irq_remapping: Conserve interrupt resources when using multiple-MSIs (Myron Stowe) [984759]
  - [i2c] i2c-piix4: Add AMD CZ SMBus device ID (Myron Stowe) [984759]
  - [ata] ahci: Add AMD CZ SATA device ID (Myron Stowe) [984759]
  - [pci] Put Hudson-2 device IDs together (Myron Stowe) [984759]
  - [pci] Replace strict_strtoul() with kstrtoul() (Myron Stowe) [984759]
  - [pci] Finish SR-IOV VF setup before adding the device (Myron Stowe) [984759]
  - [pci] Fix comment typo for PCI_EXP_LNKCAP_CLKPM (Myron Stowe) [984759]
  - [acpi] pci_root: Use dev_printk(), acpi_handle_print(), pr_xxx() when possible (Myron Stowe) [984759]
  - [acpi] pci_root: Remove unused global list acpi_pci_roots (Myron Stowe) [984759]
  - [acpi] pci_root: Introduce "handle" local for economy of expression (Myron Stowe) [984759]
  - [acpi] pci_root: Combine duplicate adjacent "if" tests (Myron Stowe) [984759]
  - [pci] Allocate only as many MSI vectors as requested by driver (Myron Stowe) [984759]
  - [pci] Replace printks with appropriate pr_*() (Myron Stowe) [984759]
  - [pci] Fix kerneldoc for pci_disable_link_state() (Myron Stowe) [984759]
  - [x86] pci: Increase info->res_num before checking pci_use_crs (Myron Stowe) [984759]
  - [pci] Fix INTC comment typo for pci_swizzle_interrupt_pin() (Myron Stowe) [984759]
  - [pci] Convert ioapic.c to module_pci_driver (Myron Stowe) [984759]
  - [pci] Introduce pci_alloc_dev(struct pci_bus*) to replace alloc_pci_dev() (Myron Stowe) [984759]
  - [pci] Introduce pci_bus_{get|put}() to manage PCI bus reference count (Myron Stowe) [984759]
  - [pci] Unset resource if initial BAR value is invalid (Myron Stowe) [984759]
  - [pci] Consolidate calls to pcibios_bus_to_resource() in __pci_read_base() (Myron Stowe) [984759]
  - [pci] Add 0x prefix to BAR register position in __pci_read_base() (Myron Stowe) [984759]
  - [pci] aspm: Warn when driver asks to disable ASPM, but we can't do it (Myron Stowe) [984759]
  - [powerpc] pci: Use PCI_UNKNOWN for unknown power state (Myron Stowe) [984759]
  - [acpi] pci_root: Check acpi_resource_to_address64() return value (Myron Stowe) [984759]
  - [pci] Work around Ivytown NTB BAR size issue (Myron Stowe) [984759]
  - [net] sunrpc: Fix another issue with rpc_client_register() (Jeff Layton) [924649]
  - [net] sunrpc: Fix a deadlock in rpc_client_register() (Jeff Layton) [924649]
  - [net] sunrpc: PipeFS MOUNT notification optimization for dying clients (Jeff Layton) [924649]
  - [net] sunrpc: split client creation routine into setup and registration (Jeff Layton) [924649]
  - [net] sunrpc: fix races on PipeFS UMOUNT notifications (Jeff Layton) [924649]
  - [net] sunrpc: fix races on PipeFS MOUNT notifications (Jeff Layton) [924649]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-4.el7]
changelog:
  - [x86] signals: Merge EFLAGS bit clearing into a single statement (Jiri Olsa) [986216]
  - [x86] signals: Clear RF EFLAGS bit for signal handler (Jiri Olsa) [986216]
  - [x86] signals: Propagate RF EFLAGS bit through the signal restore call (Jiri Olsa) [986216]
  - [kernel] perf: Fix perf_lock_task_context() vs RCU (Jiri Olsa) [986216]
  - [kernel] perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid scenario (Jiri Olsa) [986216]
  - [kernel] perf: Clone child context from parent context pmu (Jiri Olsa) [986216]
  - [kernel] perf: Fix interrupt handler timing harness (Jiri Olsa) [986216]
  - [kernel] perf: Drop sample rate when sampling is too slow (Jiri Olsa) [986216]
  - [kernel] hw_breakpoint: Introduce "struct bp_cpuinfo" (Jiri Olsa) [986216]
  - [kernel] hw_breakpoint: Simplify *register_wide_hw_breakpoint() (Jiri Olsa) [986216]
  - [kernel] hw_breakpoint: Introduce cpumask_of_bp() (Jiri Olsa) [986216]
  - [kernel] hw_breakpoint: Simplify the "weight" usage in toggle_bp_slot() paths (Jiri Olsa) [986216]
  - [kernel] hw_breakpoint: Simplify list/idx mess in toggle_bp_slot() paths (Jiri Olsa) [986216]
  - [kernel] perf: Add simple Haswell PMU support (Jiri Olsa) [986216]
  - [kernel] perf: Add const qualifier to perf_pmu_register's 'name' arg (Jiri Olsa) [986216]
  - [kernel] perf: Fix hypervisor branch sampling permission check (Jiri Olsa) [986216]
  - [kernel] perf: Check branch sampling priv level in generic code (Jiri Olsa) [986216]
  - [kernel] perf: Add sysfs entry to adjust multiplexing interval per PMU (Jiri Olsa) [986216]
  - [kernel] perf: Use hrtimers for event multiplexing (Jiri Olsa) [986216]
  - [kernel] perf: Fix hw breakpoints overflow period sampling (Jiri Olsa) [986216]
  - [tools] perf/tests: Check proper prev_state size for sched_switch tp (Jiri Olsa) [984998]
  - [tools] perf/tests: Omit end of the symbol check failure for test 1 (Jiri Olsa) [984998]
  - [tools] perf/script: Fix broken include in Context.xs (Jiri Olsa) [984998]
  - [tools] perf: Fix -ldw/-lelf link test when static linking (Jiri Olsa) [984998]
  - [tools] perf: Fix perf version generation (Jiri Olsa) [984998]
  - [tools] perf/stat: Fix per-socket output bug for uncore events (Jiri Olsa) [984998]
  - [tools] perf/symbols: Fix vdso list searching (Jiri Olsa) [984998]
  - [tools] perf/evsel: Fix missing increment in sample parsing (Jiri Olsa) [984998]
  - [tools] perf: Update symbol_conf.nr_events when processing attribute events (Jiri Olsa) [984998]
  - [tools] perf: Fix new_term() missing free on error path (Jiri Olsa) [984998]
  - [tools] perf: Fix parse_events_terms() segfault on error path (Jiri Olsa) [984998]
  - [tools] perf/evsel: Fix count parameter to read call in event_format__new (Jiri Olsa) [984998]
  - [tools] perf: Fix -x/--exclude-other option for report command (Jiri Olsa) [984998]
  - [tools] perf/evlist: Enhance perf_evlist__start_workload() (Jiri Olsa) [984998]
  - [tools] perf/record: Remove -f/--force option (Jiri Olsa) [984998]
  - [tools] perf/record: Remove -A/--append option (Jiri Olsa) [984998]
  - [tools] perf/stat: Avoid sending SIGTERM to random processes (Jiri Olsa) [984998]
  - [tools] perf: Include termios.h explicitly (Jiri Olsa) [984998]
  - [tools] perf/bench: Fix memory allocation fail check in mem{set, cpy} workloads (Jiri Olsa) [984998]
  - [tools] perf: Fix build errors with O and DESTDIR make vars set (Jiri Olsa) [984998]
  - [tools] perf: Fix output directory of Documentation/ (Jiri Olsa) [984998]
  - [tools] perf: Get only verbose output with V=1 (Jiri Olsa) [984998]
  - [tools] perf: Add missing liblk.a dependency for python/perf.so (Jiri Olsa) [984998]
  - [tools] perf: Remove '?=' Makefile STRIP assignment (Jiri Olsa) [984998]
  - [tools] perf: Replace multiple line assignment with multiple statements (Jiri Olsa) [984998]
  - [tools] perf: Replace tabs with spaces for all non-commands statements (Jiri Olsa) [984998]
  - [tools] perf: Add NO_BIONIC variable to confiure bionic setup (Jiri Olsa) [984998]
  - [tools] perf: Switch to full path C include directories (Jiri Olsa) [984998]
  - [tools] perf: Merge all *LDFLAGS* make variable into LDFLAGS (Jiri Olsa) [984998]
  - [tools] perf: Merge all *CFLAGS* make variable into CFLAGS (Jiri Olsa) [984998]
  - [tools] perf/evlist: Reset SIGTERM handler in workload child process (Jiri Olsa) [984998]
  - [tools] perf: Remove cwdlen from struct perf_session (Jiri Olsa) [984998]
  - [tools] perf: Remove frozen from perf_header struct (Jiri Olsa) [984998]
  - [tools] perf/tests: Fix exclude_guest|exclude_host checking for attr tests (Jiri Olsa) [984998]
  - [tools] perf/tests: Fix attr test for record -d option (Jiri Olsa) [984998]
  - [tools] perf: Final touches for CHK config move (Jiri Olsa) [984998]
  - [tools] perf: Move paths config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libnuma check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move stdlib check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libbfd check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libpython check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libperl check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move gtk2 check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move slang check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libaudit check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libunwind check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libdw check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libelf check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move compiler and linker flags check into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move programs check into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move arch check into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Add automated make test suite (Jiri Olsa) [984998]
  - [tools] perf: Save parent pid in thread struct (Jiri Olsa) [984998]
  - [tools] perf/stats: Fix divide by 0 in variance (Jiri Olsa) [984998]
  - [tools] perf/kvm: Handle realloc failures (Jiri Olsa) [984998]
  - [tools] perf/evsel: Fix printing of perf_event_paranoid message (Jiri Olsa) [984998]
  - [tools] perf/test: Fix typo (Jiri Olsa) [984998]
  - [tools] perf/hists: Rename hist_entry__add_pair arguments (Jiri Olsa) [984998]
  - [tools] perf/diff: Use internal rb tree for hists__precompute (Jiri Olsa) [984998]
  - [tools] perf/report: Add report.percent-limit config variable (Jiri Olsa) [984998]
  - [tools] perf/top: Add --percent-limit option (Jiri Olsa) [984998]
  - [tools] perf/report: Add --percent-limit option (Jiri Olsa) [984998]
  - [tools] perf/report: Don't bother locking when adding hist entries (Jiri Olsa) [984998]
  - [tools] perf/hists: Move locking to its call-sites (Jiri Olsa) [984998]
  - [tools] perf/top: Get rid of *_threaded() functions (Jiri Olsa) [984998]
  - [tools] perf/top: Fix percent output when no samples collected (Jiri Olsa) [984998]
  - [tools] perf/top: Fix -E option behavior (Jiri Olsa) [984998]
  - [tools] perf/record: handle death by SIGTERM (Jiri Olsa) [984998]
  - [tools] perf: Handle JITed code in shared memory (Jiri Olsa) [984998]
  - [tools] perf/tests: Fix compile errors in bp_signal files (Jiri Olsa) [984998]
  - [tools] perf: Fix tab vs spaces issue in Makefile ifdef/endif (Jiri Olsa) [984998]
  - [tools] perf/hists browser: Use sort__has_sym (Jiri Olsa) [984998]
  - [tools] perf/top: Use sort__has_sym (Jiri Olsa) [984998]
  - [tools] perf/sort: Cleanup sort__has_sym setting (Jiri Olsa) [984998]
  - [tools] perf/sort: Reorder HISTC_SRCLINE index (Jiri Olsa) [984998]
  - [tools] perf/archive: Fix typo on Documentation (Jiri Olsa) [984998]
  - [tools] perf/sort: Consolidate sort_entry__setup_elide() (Jiri Olsa) [984998]
  - [tools] perf/sort: Separate out memory-specific sort keys (Jiri Olsa) [984998]
  - [tools] perf/sort: Factor out common code in sort_dimension__add() (Jiri Olsa) [984998]
  - [tools] perf/sort: Introduce sort__mode variable (Jiri Olsa) [984998]
  - [tools] perf/report: Fix alignment of symbol column when -v is given (Jiri Olsa) [984998]
  - [tools] perf/hists: Free unused mem info of a matched hist entry (Jiri Olsa) [984998]
  - [tools] perf/hists: Fix an invalid memory free on he->branch_info (Jiri Olsa) [984998]
  - [tools] perf: Fix bug in isupper() and islower() (Jiri Olsa) [984998]
  - [mm] thp: define HPAGE_PMD_* constants as BUILD_BUG() if !THP (Steve Best) [947166]
  - [powerpc] mm: Fix build warnings with CONFIG_TRANSPARENT_HUGEPAGE disabled (Steve Best) [947166]
  - [powerpc] mm: Optimize hugepage invalidate (Steve Best) [947166]
  - [powerpc] thp: Enable THP on PPC64 (Steve Best) [947166]
  - [powerpc] mm: split hugepage when using subpage protection (Steve Best) [947166]
  - [powerpc] mm: disable assert_pte_locked for collapse_huge_page (Steve Best) [947166]
  - [powerpc] mm: Prevent gcc to re-read the pagetables (Steve Best) [947166]
  - [powerpc] mm: Make linux pagetable walk safe with THP enabled (Steve Best) [947166]
  - [powerpc] thp: Add code to handle HPTE faults for hugepages (Steve Best) [947166]
  - [powerpc] mm: Update gup_pmd_range to handle transparent hugepages (Steve Best) [947166]
  - [powerpc] kvm: Handle transparent hugepage in KVM (Steve Best) [947166]
  - [powerpc] mm: Replace find_linux_pte with find_linux_pte_or_hugepte (Steve Best) [947166]
  - [powerpc] mm: Update find_linux_pte_or_hugepte to handle transparent hugepages (Steve Best) [947166]
  - [powerpc] mm: move find_linux_pte_or_hugepte and gup_hugepte to common code (Steve Best) [947166]
  - [powerpc] thp: Implement transparent hugepages for ppc64 (Steve Best) [947166]
  - [powerpc] thp: Double the PMD table size for THP (Steve Best) [947166]
  - [powerpc] mm: handle hugepage size correctly when invalidating hpte entries (Steve Best) [947166]
  - [mm] thp: deposit the transpare huge pgtable before set_pmd (Steve Best) [947166]
  - [mm] thp: don't use HPAGE_SHIFT in transparent hugepage code (Steve Best) [947166]
  - [mm] thp: withdraw the pgtable after pmdp related operations (Steve Best) [947166]
  - [mm] thp: add pmd args to pgtable deposit and withdraw APIs (Steve Best) [947166]
  - [mm] thp: use the correct function when updating access flags (Steve Best) [947166]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-5.el7]
changelog:
  - [fs] cifs: fix bad error handling in crypto code (Jeff Layton) [988398]
  - [fs] cifs: Fix a deadlock when a file is reopened (Sachin Prabhu) [988398]
  - [fs] cifs: Reopen the file if reconnect durable handle failed (Sachin Prabhu) [988398]
  - [fs] cifs: Fix minor endian error in durable handle patch series (Sachin Prabhu) [988398]
  - [fs] cifs: Reconnect durable handles for SMB2 (Sachin Prabhu) [988398]
  - [fs] cifs: Make SMB2_open use cifs_open_parms struct (Sachin Prabhu) [988398]
  - [fs] cifs: Introduce cifs_open_parms struct (Sachin Prabhu) [988398]
  - [fs] cifs: Request durable open for SMB2 opens (Sachin Prabhu) [988398]
  - [fs] cifs: Simplify SMB2 create context handling (Sachin Prabhu) [988398]
  - [fs] cifs: Simplify SMB2_open code path (Sachin Prabhu) [988398]
  - [fs] cifs: Respect create_options in smb2_open_file (Sachin Prabhu) [988398]
  - [fs] cifs: Fix lease context buffer parsing (Sachin Prabhu) [988398]
  - [fs] cifs: use sensible file nlink values if unprovided (Sachin Prabhu) [988398]
  - [fs] cifs: Limit allocation of crypto mechanisms to dialect which requires (Sachin Prabhu) [988398]
  - [fs] cifs: Don't pass inode to ->d_hash() and ->d_compare() (Sachin Prabhu) [988398]
  - [fs] cifs: fill TRANS2_QUERY_FILE_INFO ByteCount fields (Sachin Prabhu) [988398]
  - [fs] cifs: fix SMB2 signing enablement in cifs_enable_signing (Sachin Prabhu) [988398]
  - [fs] cifs: Fix build warning (Sachin Prabhu) [988398]
  - [fs] cifs: SMB3 Signing enablement (Sachin Prabhu) [988398]
  - [fs] cifs: Do not set DFS flag on SMB2 open (Sachin Prabhu) [988398]
  - [fs] cifs: fix static checker warning (Sachin Prabhu) [988398]
  - [fs] cifs: try to handle the MUST SecurityFlags sanely (Sachin Prabhu) [988398]
  - [fs] cifs: When server doesn't provide SecurityBuffer on SMB2Negotiate pick default (Sachin Prabhu) [988398]
  - [fs] cifs: Handle big endianness in NTLM (ntlmv2) authentication (Sachin Prabhu) [988398]
  - [fs] cifs: revalidate directories instiantiated via FIND_* in order to handle DFS referrals (Sachin Prabhu) [988398]
  - [fs] cifs: SMB2 FSCTL and IOCTL worker function (Sachin Prabhu) [988398]
  - [fs] cifs: Charge at least one credit, if server says that it supports multicredit (Sachin Prabhu) [988398]
  - [fs] cifs: Remove typo (Sachin Prabhu) [988398]
  - [fs] cifs: Some missing share flags (Sachin Prabhu) [988398]
  - [fs] cifs: using strlcpy instead of strncpy (Sachin Prabhu) [988398]
  - [fs] cifs: Update headers to update various SMB3 ioctl definitions (Sachin Prabhu) [988398]
  - [fs] cifs: Update cifs version number (Sachin Prabhu) [988398]
  - [fs] cifs: Add ability to dipslay SMB3 share flags and capabilities for debugging (Sachin Prabhu) [988398]
  - [fs] cifs: Add some missing SMB3 and SMB3.02 flags (Sachin Prabhu) [988398]
  - [fs] cifs: Add SMB3.02 dialect support (Sachin Prabhu) [988398]
  - [fs] cifs: Fix endian error in SMB2 protocol negotiation (Sachin Prabhu) [988398]
  - [fs] cifs: clean up the SecurityFlags write handler (Sachin Prabhu) [988398]
  - [fs] cifs: update the default global_secflags to include "raw" NTLMv2 (Sachin Prabhu) [988398]
  - [fs] move sectype to the cifs_ses instead of TCP_Server_Info (Sachin Prabhu) [988398]
  - [fs] cifs: track the enablement of signing in the TCP_Server_Info (Sachin Prabhu) [988398]
  - [fs] add new fields to smb_vol to track the requested security flavor (Sachin Prabhu) [988398]
  - [fs] cifs: add new fields to cifs_ses to track requested security flavor (Sachin Prabhu) [988398]
  - [fs] cifs: track the flavor of the NEGOTIATE reponse (Sachin Prabhu) [988398]
  - [fs] cifs: add new "Unspecified" securityEnum value (Sachin Prabhu) [988398]
  - [fs] cifs: factor out check for extended security bit into separate function (Sachin Prabhu) [988398]
  - [fs] cifs: move handling of signed connections into separate function (Sachin Prabhu) [988398]
  - [fs] cifs: break out lanman NEGOTIATE handling into separate function (Sachin Prabhu) [988398]
  - [fs] cifs: break out decoding of security blob into separate function (Sachin Prabhu) [988398]
  - [fs] cifs: remove the cifs_ses->flags field (Sachin Prabhu) [988398]
  - [fs] cifs: throw a warning if negotiate or sess_setup ops are passed NULL server or session pointers (Sachin Prabhu) [988398]
  - [fs] cifs: make decode_ascii_ssetup void return (Sachin Prabhu) [988398]
  - [fs] cifs: remove useless memset in LANMAN auth code (Sachin Prabhu) [988398]
  - [fs] cifs: remove protocolEnum definition (Sachin Prabhu) [988398]
  - [fs] cifs: add a "nosharesock" mount option to force new sockets to server to be created (Sachin Prabhu) [988398]
  - [fs] fuse: readdirplus cleanup (Niels de Vos) [988312]
  - [fs] fuse: readdirplus change attributes once (Niels de Vos) [988312]
  - [fs] fuse: readdirplus fix instantiate (Niels de Vos) [988312]
  - [fs] fuse: readdirplus sanity checks (Niels de Vos) [988312]
  - [fs] fuse: fix readdirplus dentry leak (Niels de Vos) [988312]
  - [powerpc] hw_brk: Fix off by one error when validating DAWR region end (Steve Best) [843485]
  - [powerpc] hw_brk: Fix clearing of extraneous IRQ (Steve Best) [843485]
  - [powerpc] hw_brk: Fix setting of length for exact mode breakpoints (Steve Best) [843485]
  - [powerpc] perf: Add power8 EBB support (Steve Best) [969176]
  - [powerpc] perf: Core EBB support for 64-bit book3s (Steve Best) [969176]
  - [powerpc] perf: Don't enable if we have zero events (Steve Best) [969176]
  - [powerpc] powerpc/perf: Use existing out label in power_pmu_enable() (Steve Best) [969176]
  - [powerpc] perf: Freeze PMC5/6 if we're not using them (Steve Best) [969176]
  - [powerpc] powerpc/perf: Rework disable logic in pmu_disable() (Steve Best) [969176]
  - [powerpc] perf: Check that events only include valid bits on Power8 (Steve Best) [969176]
  - [ipc] sem: rename try_atomic_semop() to perform_atomic_semop(), docu update (Rik van Riel) [881820]
  - [ipc] sem: replace shared sem_otime with per-semaphore value (Rik van Riel) [881820]
  - [ipc] sem: always use only one queue for alter operations (Rik van Riel) [881820]
  - [ipc] sem: separate wait-for-zero and alter tasks into seperate queues (Rik van Riel) [881820]
  - [ipc] sem: cacheline align the semaphore structures (Rik van Riel) [881820]
  - [fs] gfs2: Add atomic_open support (Steven Whitehouse) [983098]
  - [fs] gfs2: Only do one directory search on create (Steven Whitehouse) [983098]
  - [fs] pstore: Add hsize argument in write_buf call of pstore_ftrace_call (Steve Best) [947161]
  - [powerpc] pseries: Support compression of oops text via pstore (Steve Best) [947161]
  - [powerpc] pseries: Re-organise the oops compression code (Steve Best) [947161]
  - [powerpc] pstore: Pass header size in the pstore write callback (Steve Best) [947161]
  - [powerpc] pseries: Read common partition via pstore (Steve Best) [947161]
  - [powerpc] pseries: Read of-config partition via pstore (Steve Best) [947161]
  - [powerpc] pseries: Distinguish between a os-partition and non-os partition (Steve Best) [947161]
  - [powerpc] pseries: Read rtas partition via pstore (Steve Best) [947161]
  - [powerpc] pseries: Read/Write oops nvram partition via pstore (Steve Best) [947161]
  - [powerpc] pseries: Introduce generic read function to read nvram-partitions (Steve Best) [947161]
  - [powerpc] pseries: Add version and timestamp to oops header (Steve Best) [947161]
  - [powerpc] pseries: Remove syslog prefix in uncompressed oops text (Steve Best) [947161]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-6.el7]
changelog:
  - [fs] locks: move file_lock_list to a set of percpu hlist_heads and convert file_lock_lock to an lglock (Jeff Layton) [976876]
  - [fs] seq_file: add seq_list_*_percpu helpers (Jeff Layton) [976876]
  - [fs] locks: give the blocked_hash its own spinlock (Jeff Layton) [976876]
  - [fs] locks: add a new "lm_owner_key" lock operation (Jeff Layton) [976876]
  - [fs] locks: turn the blocked_list into a hashtable (Jeff Layton) [976876]
  - [fs] locks: convert fl_link to a hlist_node (Jeff Layton) [976876]
  - [fs] locks: avoid taking global lock if possible when waking up blocked waiters (Jeff Layton) [976876]
  - [fs] locks: protect most of the file_lock handling with i_lock (Jeff Layton) [976876]
  - [fs] locks: encapsulate the fl_link list handling (Jeff Layton) [976876]
  - [fs] locks: make "added" in __posix_lock_file a bool (Jeff Layton) [976876]
  - [fs] locks: comment cleanups and clarifications (Jeff Layton) [976876]
  - [fs] locks: make generic_add_lease and generic_delete_lease static (Jeff Layton) [976876]
  - [fs] cifs: use posix_unblock_lock instead of locks_delete_block (Jeff Layton) [976876]
  - [fs] locks: drop the unused filp argument to posix_unblock_lock (Jeff Layton) [976876]
  - [scsi] ipr: IOA Status Code(IOASC) update (Steve Best) [731129]
  - [scsi] ipr: qc_fill_rtf() method should not store alternate status register (Steve Best) [731129]
  - [scsi] ipr: possible irq lock inversion dependency detected (Steve Best) [731129]
  - [fs] nfsd: when dentry_open returns an error do not propagate as struct file (Steve Dickson) [987090]
  - [net] sunrpc: underflow issue in decode_write_list() (Steve Dickson) [987090]
  - [fs] nfsd: fix minorversion support interface (Steve Dickson) [987090]
  - [fs] lockd: protect nlm_blocked access in nlmsvc_retry_blocked (Steve Dickson) [987090]
  - [fs] nfsd: support minorversion 1 by default (Steve Dickson) [987090]
  - [fs] nfsd: allow destroy_session over destroyed session (Steve Dickson) [987090]
  - [net] sunrpc: fix failures to handle -1 uid's (Steve Dickson) [987090]
  - [net] sunrpc: Don't schedule an upcall on a replaced cache entry (Steve Dickson) [987090]
  - [net] sunrpc: xpt_auth_cache should be ignored when expired (Steve Dickson) [987090]
  - [net] sunrpc/cache: ensure items removed from cache do not have pending upcalls (Steve Dickson) [987090]
  - [net] sunrpc/cache: use cache_fresh_unlocked consistently and correctly (Steve Dickson) [987090]
  - [net] sunrpc/cache: remove races with queuing an upcall (Steve Dickson) [987090]
  - [fs] nfsd: return delegation immediately if lease fails (Steve Dickson) [987090]
  - [fs] nfsd: do not throw away 4.1 lock state on last unlock (Steve Dickson) [987090]
  - [fs] nfsd: delegation-based open reclaims should bypass permissions (Steve Dickson) [987090]
  - [net] sunrpc: don't error out on small tcp fragment (Steve Dickson) [987090]
  - [net] sunrpc: fix handling of too-short rpc's (Steve Dickson) [987090]
  - [fs] nfsd: minor read_buf cleanup (Steve Dickson) [987090]
  - [fs] nfsd: fix decoding of compounds across page boundaries (Steve Dickson) [987090]
  - [fs] nfsd: clean up nfs4_open_delegation (Steve Dickson) [987090]
  - [fs] nfsd: Don't give out read delegations on creates (Steve Dickson) [987090]
  - [fs] nfsd: allow client to send no cb_sec flavors (Steve Dickson) [987090]
  - [fs] nfsd: fail attempts to request gss on the backchannel (Steve Dickson) [987090]
  - [fs] nfsd: implement minimal SP4_MACH_CRED (Steve Dickson) [987090]
  - [net] sunrpc: store gss mech in svc_cred (Steve Dickson) [987090]
  - [net] sunrpc: introduce init_svc_cred (Steve Dickson) [987090]
  - [fs] nfsd: avoid undefined signed overflow (Steve Dickson) [987090]
  - [net] sunrpc: the cache_detail in cache_is_valid is unused any more (Steve Dickson) [987090]
  - [net] sunrpc: server back channel needs no rpcbind method (Steve Dickson) [987090]
  - [fs] nfsd: fix compile in !CONFIG_NFSD_V4_SECURITY_LABEL case (Steve Dickson) [987090]
  - [fs] nfsd: Server implementation of MAC Labeling (Steve Dickson) [987090]
  - [fs] nfsd: Add NFS v4.2 support to the NFS server (Steve Dickson) [987090]
  - [security] fix cap_inode_getsecctx returning garbage (Steve Dickson) [987090]
  - [fs] nfsd: store correct client minorversion for >=4.2 (Steve Dickson) [987090]
  - [fs] nfsd: get rid of the unused functions in vfs (Steve Dickson) [987090]
  - [fs] nfs: Fix brainfart in attribute length calculation (Steve Dickson) [987090]
  - [fs] nfs: Fix a regression against the FreeBSD server (Steve Dickson) [987090]
  - [net] sunrpc/rpc_pipe: rpc_dir_inode_operations can be static (Steve Dickson) [987090]
  - [fs] nfs: Allow nfs_updatepage to extend a write under additional circumstances (Steve Dickson) [987090]
  - [fs] nfs: Make nfs_readdir revalidate less often (Steve Dickson) [987090]
  - [fs] nfs: Make nfs_attribute_cache_expired() non-static (Steve Dickson) [987090]
  - [net] sunrpc/rpc_pipe: set dentry operations at d_alloc time (Steve Dickson) [987090]
  - [fs] nfs: set verifier on existing dentries in nfs_prime_dcache (Steve Dickson) [987090]
  - [fs] nfs: Set NFS_CS_MIGRATION for NFSv4 mounts (Steve Dickson) [987090]
  - [fs] nfs: Refactor nfs4_init_session and nfs4_init_channel_attrs (Steve Dickson) [987090]
  - [fs] nfs: use pnfs_device maxcount for the objectlayout gdia_maxcount (Steve Dickson) [987090]
  - [fs] nfs: use pnfs_device maxcount for the blocklayout gdia_maxcount (Steve Dickson) [987090]
  - [fs] nfs: Fix gdia_maxcount calculation to fit in ca_maxresponsesize (Steve Dickson) [987090]
  - [fs] nfs: Improve legacy idmapping fallback (Steve Dickson) [987090]
  - [fs] nfs: end back channel session draining (Steve Dickson) [987090]
  - [fs] nfs: Apply v4.1 capabilities to v4.2 (Steve Dickson) [987090]
  - [fs] nfs: Clean up layout segment comparison helper names (Steve Dickson) [987090]
  - [fs] nfs: layout segment comparison helpers should take 'const' parameters (Steve Dickson) [987090]
  - [fs] nfs: Move the DNS resolver into the NFSv4 module (Steve Dickson) [987090]
  - [net] sunrpc/rpc_pipefs: only set rpc_dentry_ops if d_op isn't already set (Steve Dickson) [987090]
  - [fs] nfs: SETCLIENTID add the format string for the NETID (Steve Dickson) [987090]
  - [fs] nfs: Add in v4.2 callback operation (Steve Dickson) [987090]
  - [fs] nfs: Make callbacks minor version generic (Steve Dickson) [987090]
  - [fs] nfs: Add Kconfig entry for Labeled NFS V4 client (Steve Dickson) [987090]
  - [fs] nfs: Extend NFS xattr handlers to accept the security namespace (Steve Dickson) [987090]
  - [fs] nfs: Client implementation of Labeled-NFS (Steve Dickson) [987090]
  - [fs] nfs: Add label lifecycle management (Steve Dickson) [987090]
  - [fs] nfs: Add labels to client function prototypes (Steve Dickson) [987090]
  - [fs] nfs: Extend fattr bitmaps to support all 3 words (Steve Dickson) [987090]
  - [fs] nfs: Introduce new label structure (Steve Dickson) [987090]
  - [fs] nfs: Add label recommended attribute and NFSv4 flags (Steve Dickson) [987090]
  - [fs] nfs: Added NFS v4.2 support to the NFS client (Steve Dickson) [987090]
  - [security] selinux: Add new labeling type native labels (Steve Dickson) [987090]
  - [security] lsm: Add flags field to security_sb_set_mnt_opts for in kernel mount data (Steve Dickson) [987090]
  - [security] Add Hook to test if the particular xattr is part of a MAC model (Steve Dickson) [987090]
  - [security] Add hook to calculate context based on a negative dentry (Steve Dickson) [987090]
  - [fs] nfs: Close another NFSv4 recovery race (Steve Dickson) [987090]
  - [fs] nfs: Move dentry instantiation into the NFSv4-specific atomic open code (Steve Dickson) [987090]
  - [fs] nfs: Refactor _nfs4_open_and_get_state to set ctx->state (Steve Dickson) [987090]
  - [fs] nfs: pass the nfs_open_context to nfs4_do_open (Steve Dickson) [987090]
  - [fs] nfs: Remove redundant check for FMODE_EXEC in nfs_finish_open (Steve Dickson) [987090]
  - [net] sunrpc: Remove redundant call to rpc_set_running() in __rpc_execute() (Steve Dickson) [987090]
  - [net] sunrpc: Remove unused functions rpc_task_set/has_priority (Steve Dickson) [987090]
  - [net] sunrpc: Remove the unused helpers task_for_each() and task_for_first() (Steve Dickson) [987090]
  - [net] sunrpc: Remove unused function rpc_queue_empty (Steve Dickson) [987090]
  - [net] sunrpc: Fix a potential race in rpc_execute (Steve Dickson) [987090]
  - [fs] nfs: Simplify setting the layout header credential (Steve Dickson) [987090]
  - [fs] nfs: Enable state protection (Steve Dickson) [987090]
  - [fs] nfs: Use layout credentials for get_deviceinfo calls (Steve Dickson) [987090]
  - [fs] nfs: Ensure that test_stateid and free_stateid use correct credentials (Steve Dickson) [987090]
  - [fs] nfs: Ensure that reclaim_complete uses the right credential (Steve Dickson) [987090]
  - [fs] nfs: Ensure that layoutreturn uses the correct credential (Steve Dickson) [987090]
  - [fs] nfs: Ensure that layoutget is called using the layout credential (Steve Dickson) [987090]
  - [fs] nfs: Add NFSv4.2 protocol constants (Steve Dickson) [987090]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-7.el7]
changelog:
  - [vfio] type1: Fix leak on error path (Alex Williamson) [984081]
  - [vfio] Limit group opens (Alex Williamson) [984081]
  - [vfio] type1: Fix missed frees and zero sized removes (Alex Williamson) [984081]
  - [vfio] Provide module option to disable vfio_iommu_type1 hugepage support (Alex Williamson) [984081]
  - [vfio] hugepage support for vfio_iommu_type1 (Alex Williamson) [984081]
  - [vfio] Convert type1 iommu to use rbtree (Alex Williamson) [984081]
  - [iommu] Use pa and zx instead of casting (Alex Williamson) [984081]
  - [iommu] amd: Only unmap large pages from the first pte (Alex Williamson) [984081]
  - [iommu] Fix compiler warning on pr_debug (Alex Williamson) [984081]
  - [iommu] amd: Fix memory leak in free_pagetable (Alex Williamson) [984081]
  - [iommu] Split iommu_unmaps (Alex Williamson) [984081]
  - [iommu] intel, amd: Remove multifunction assumption around grouping (Alex Williamson) [984081]
  - [x86] spinlock: make ticket lock increment 2, unconditionally (Rik van Riel) [970737]
  - [virt] pvticketlock: When paravirtualizing ticket locks, increment by 2 (Rik van Riel) [970737]
  - [scsi] isci: Fix a race condition in the SSP task management path (David Milburn) [990201]
  - [netdrv] bnx2x: Wait for MCP validity during AER (Michal Schmidt) [797460]
  - [virt] virtio_scsi: Fix virtqueue affinity setup (Asias He) [971826]
  - [fs] nfs: fix open(O_RDONLY|O_TRUNC) in NFS4.0 (Jeff Layton) [987615]
  - [watchdog] hpwdt: Add check for UEFI bits (Linda Knippers) [985195]
  - [powerpc] mm/numa: VPHN topology change updates all siblings (Steve Best) [973594]
  - [powerpc] powernv: Fix iommu initialization again (Steve Best) [979523]
  - [firmware] efivars: If pstore_register fails, free unneeded pstore buffer (Lenny Szubowicz) [983597]
  - [acpi] Eliminate console msg if pstore.backend excludes ERST (Lenny Szubowicz) [983597]
  - [fs] pstore: Return unique error if backend registration excluded by kernel param (Lenny Szubowicz) [983597]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-8.el7]
changelog:
  - [net] ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size (Francesco Fusco) [994346] {CVE-2013-4163}
  - [net] ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data (Francesco Fusco) [988355] {CVE-2013-4162}
  - [kernel] sysctl: range checking in do_proc_dointvec_ms_jiffies_conv (Francesco Fusco) [972393]
  - [net] neigh: prevent overflowing params in /proc/sys/net/ipv4/neigh/ (Francesco Fusco) [972393]
  - [net] vhost-net: fix use-after-free in vhost_net_flush (Thomas Graf) [984723] {CVE-2013-4127}
  - [powerpc] tm: Fix return of active 64bit signals (Steve Best) [731886]
  - [powerpc] tm: Fix return of 32bit rt signals to active transactions (Steve Best) [731886]
  - [powerpc] tm: Fix restoration of MSR on 32bit signal return (Steve Best) [731886]
  - [powerpc] tm: Fix 32 bit non-rt signals (Steve Best) [731886]
  - [powerpc] tm: Fix writing top half of MSR on 32 bit signals (Steve Best) [731886]
  - [fs] nfs: verify open flags before allowing an atomic open (Jeff Layton) [984823]
  - [s390] zfcp: module parameter dbflevel for early debugging (Hendrik Brueckner) [994597]
  - [virt] virtio_net: fix the race between channels setting and refill (Jason Wang) [978153]
  - [kernel] audit: restore order of tty and ses fields in log output (Richard Guy Briggs) [983157]
  - [kernel] time/tick: Make oneshot broadcast robust vs. CPU offlining (Prarit Bhargava) [967464]
  - [virt] virtio_net: fix race in RX VQ processing (Jason Wang) [989409]
  - [virt] virtio: support unlocked queue poll (Jason Wang) [989409]
  - [powerpc] mm: Use the correct SLB(LLP) encoding in tlbie instruction (Steve Best) [993448]
  - [net] tuntap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS (Jason Wang) [982513]
  - [net] tuntap: correctly linearize skb when zerocopy is used (Jason Wang) [982513]
  - [virt] macvtap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS (Jason Wang) [990786]
  - [virt] macvtap: do not assume 802.1Q when send vlan packets (Jason Wang) [990786]
  - [virt] macvtap: fix the missing ret value of TUNSETQUEUE (Jason Wang) [990786]
  - [virt] macvtap: correctly linearize skb when zerocopy is used (Jason Wang) [982513]
  - [virt] macvtap: Perform GSO on forwarding path (Jason Wang) [895484]
  - [virt] macvtap: Let TUNSETOFFLOAD actually controll offload features (Jason Wang) [895484]
  - [virt] macvtap: Consistently use rcu functions (Jason Wang) [895484]
  - [virt] macvtap: Convert to using rtnl lock (Jason Wang) [895484]
  - [virt] macvtap: fix uninitialized return value macvtap_ioctl_set_queue() (Jason Wang) [731550]
  - [virt] macvtap: slient sparse warnings (Jason Wang) [731550]
  - [virt] macvtap: enable multiqueue flag (Jason Wang) [731550]
  - [virt] macvtap: add TUNSETQUEUE ioctl (Jason Wang) [731550]
  - [virt] macvtap: eliminate linear search (Jason Wang) [731550]
  - [virt] macvtap: introduce macvtap_get_vlan() (Jason Wang) [731550]
  - [virt] macvtap: do not add self to waitqueue if doing a nonblock read (Jason Wang) [731550]
  - [virt] macvtap: fix a possible race between queue selection and changing queues (Jason Wang) [731550]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-9.el7]
changelog:
  - [kernel] sched: disable autogroups by default (Josh Poimboeuf) [989741]
  - [powerpc] pseries: Add backward compatibilty to read old kernel oops-log (Steve Best) [991831]
  - [powerpc] pseries: Fix buffer overflow when reading from pstore (Steve Best) [991831]
  - [crypto] nx: saves chaining value from co-processor (Steve Best) [972656]
  - [crypto] nx: fix limits to sg lists for SHA-2 (Steve Best) [972656]
  - [crypto] nx: fix physical addresses added to sg lists (Steve Best) [972656]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-10.el7]
changelog:
  - [block] blk-mq: blk-mq should free bios in pass through case (Mike Snitzer) [960150]
  - [block] blk-mq: add missing percpu_counter_destroy for mq_usage_counter (Mike Snitzer) [960150]
  - [fs] direct-io: only inc_dec inode->i_dio_count for file systems (Mike Snitzer) [960150]
  - [lib] percpu_counter: make APIs irq safe (Mike Snitzer) [960150]
  - [block] null_blk: multi queue aware block test driver (Mike Snitzer) [960150]
  - [kernel] smp: Export __smp_call_function_single() (Mike Snitzer) [960150]
  - [block] blk-mq: change sw <-> hw queue mappings on hotplug events (Mike Snitzer) [960150]
  - [block] blk-mq: re-initialize queue data structure after CPU hotplug (Mike Snitzer) [960150]
  - [block] blk-mq: add queue freeze/unfreeze support (Mike Snitzer) [960150]
  - [block] blk-mq: fix timer infinite loop after first timeout event (Mike Snitzer) [960150]
  - [block] blk-mq: timeout fixes (Mike Snitzer) [960150]
  - [block] blk-mq: cpu hot plug_unplug fixes (Mike Snitzer) [960150]
  - [block] blk-mq: flush handling (Mike Snitzer) [960150]
  - [block] blk-mq: new multi-queue block IO queueing mechanism (Mike Snitzer) [960150]
  - [block] make rq->cmd_flags be 64-bit (Mike Snitzer) [960150]
  - [kernel] smp: don't warn about csd->flags having CSD_FLAG_LOCK cleared for !wait (Mike Snitzer) [960150]
  - [mm] sched: Allow uaccess in atomic with pagefault_disable() (Michael S. Tsirkin) [988029]
  - [mm] sched: Drop voluntary schedule from might_fault() (Michael S. Tsirkin) [988029]
  - [x86] uaccess s/might_sleep/might_fault/ (Michael S. Tsirkin) [988029]
  - [powerpc] uaccess s/might_sleep/might_fault/ (Michael S. Tsirkin) [988029]
  - [misc] asm-generic: uaccess s/might_sleep/might_fault/ (Michael S. Tsirkin) [988029]
  - [x86] efi: Disable secure boot if shim is in insecure mode (Lenny Szubowicz) [903815]
  - [kernel] modsign: Import certificates from UEFI Secure Boot (Lenny Szubowicz) [903815]
  - [kernel] keys: Add a system blacklist keyring (Lenny Szubowicz) [903815]
  - [crypto] asymmetric_keys: Add an EFI signature blob parser and key loader (Lenny Szubowicz) [903815]
  - [kernel] modsign: Fix including certificate twice when the signing_key.x509 already exists (Lenny Szubowicz) [903815]
  - [kernel] keys: Add a 'trusted' flag and a 'trusted only' flag (Lenny Szubowicz) [903815]
  - [kernel] modsign: Separate the kernel signature checking keyring from module signing (Lenny Szubowicz) [903815]
  - [kernel] modsign: Load *.x509 files into kernel keyring (Lenny Szubowicz) [903815]
  - [efi] Add EFI signature data types (Lenny Szubowicz) [903815]
  - [kernel] modsign: Always enforce module signing in a Secure Boot environment (Lenny Szubowicz) [903815]
  - [kernel] hibernate: Disable in a Secure Boot environment (Lenny Szubowicz) [903815]
  - [kernel] kexec: Disable in a secure boot environment (Lenny Szubowicz) [903815]
  - [x86] Lock down MSR writing in secure boot (Lenny Szubowicz) [903815]
  - [acpi] Ignore acpi_rsdp kernel parameter in a secure boot environment (Lenny Szubowicz) [903815]
  - [char] mem: Restrict /dev/mem and /dev/kmem in secure boot setups (Lenny Szubowicz) [903815]
  - [platform] asus-wmi: Restrict debugfs interface (Lenny Szubowicz) [903815]
  - [acpi] Limit access to custom_method (Lenny Szubowicz) [903815]
  - [x86] Lock down IO port access in secure boot environments (Lenny Szubowicz) [903815]
  - [pci] Lock down BAR access in secure boot environments (Lenny Szubowicz) [903815]
  - [x86] efi: Enable secure boot lockdown automatically when enabled in firmware (Lenny Szubowicz) [903815]
  - [kernel] Add a kernel parameter that will force on Secure Boot mode (Lenny Szubowicz) [903815]
  - [security] selinux: define mapping for new Secure Boot capability (Lenny Szubowicz) [903815]
  - [uapi] Add new secure boot capability (Lenny Szubowicz) [903815]
  - [kernel] audit: fix mq_open and mq_unlink to add the MQ root as a hidden parent audit_names record (Jeff Layton) [908885 953186]
  - [kernel] audit: log the audit_names record type (Jeff Layton) [908885 953186]
  - [kernel] audit: add child record before the create to handle case where create fails (Jeff Layton) [908885 953186]
  - [md] dm-raid: silence compiler warning on rebuilds_per_group (Jonathan E Brassow) [970782]
  - [md] dm-raid: Fix raid_resume not reviving failed devices in all cases (Jonathan E Brassow) [970782]
  - [md] dm-raid: Break-up untidy function (Jonathan E Brassow) [970782]
  - [s390] zfcp: block queue limits with data router (Hendrik Brueckner) [976657]
  - [scsi] scsi_lib: Fix race between starved list and device removal (Ewan Milne) [986037]
  - [md] dm-switch: add switch target (Mike Snitzer) [983188]
  - [wireless] disable WiMAX support (John Linville) [915650]
  - [fs] gfs2: don't overrun reserved revokes (Benjamin Marzinski) [950622]
  - [fs] gfs2: Reserve journal space for quota change in do_grow (Robert S Peterson) [979131]
  - [x86] setup: Add cpu_has_hypervisor check to rh_check_supported() (Prarit Bhargava) [986048]
  - [x86] sched: Optimize switch_mm() for multi-threaded workloads (Rik van Riel) [990747]
  - [crypto] nx: fix concurrency issue (Steve Best) [996565]
  - [powerpc] mm: Fix fallthrough bug in hpte_decode (Steve Best) [993326]
  - [misc] Kconfig: enable building user namespace with xfs (Dave Chinner) [987255]
  - [fs] xfs: add capability check to free eofblocks ioctl (Dave Chinner) [987255]
  - [fs] xfs: create internal eofblocks structure with kuid_t types (Dave Chinner) [987255]
  - [fs] xfs: convert kuid_t to/from uid_t for internal structures (Dave Chinner) [987255]
  - [fs] xfs: ioctl check for capabilities in the current user namespace (Dave Chinner) [987255]
  - [fs] xfs: convert kuid_t to/from uid_t in ACLs (Dave Chinner) [987255]
  - [fs] xfs: create wrappers for converting kuid_t to/from uid_t (Dave Chinner) [987255]
  - [md] raid5: fix interaction of 'replace' and 'recovery' (Jes Sorensen) [978055]
  - [md] raid10: remove use-after-free bug (Jes Sorensen) [978055]
  - [md] raid1: fix bio handling problems in process_checks() (Jes Sorensen) [978055]
  - [md] Remove recent change which allows devices to skip recovery (Jes Sorensen) [978055]
  - [md] raid10: fix two problems with RAID10 resync (Jes Sorensen) [978055]
  - [md] raid10: fix bug which causes all RAID10 reshapes to move no data (Jes Sorensen) [978055]
  - [md] raid5: allow 5-device RAID6 to be reshaped to 4-device (Jes Sorensen) [978055]
  - [md] raid10: fix two bugs affecting RAID10 reshape (Jes Sorensen) [978055]
  - [md] Remember the last sync operation that was performed (Jes Sorensen) [978055]
  - [md] raid0: fix buglet in RAID5 -> RAID0 conversion (Jes Sorensen) [978055]
  - [md] raid10: check In_sync flag in 'enough()' (Jes Sorensen) [978055]
  - [md] raid10: locking changes for 'enough()' (Jes Sorensen) [978055]
  - [md] replace strict_strto*() with kstrto*() (Jes Sorensen) [978055]
  - [md] Wait for md_check_recovery before attempting device removal (Jes Sorensen) [978055]
  - [md] dm-raid: Add ability to restore transiently failed devices on resume (Jes Sorensen) [978055]
  - [net] ipv6: resend MLD report if a link-local address completes DAD (Flavio Leitner) [889455]
  - [net] ipv6: introduce per-interface counter for dad-completed ipv6 addresses (Flavio Leitner) [889455]
  - [net] ipv6: split duplicate address detection and router solicitation timer (Flavio Leitner) [889455]
  - [net] tcp: introduce a per-route knob for quick ack (Amerigo Wang) [984504]
  - [net] nlmon: use standard rtnetlink link api for add/del devices (Daniel Borkmann) [957721]
  - [net] nlmon: fix comparison in nlmon_is_valid_mtu (Daniel Borkmann) [957721]
  - [net] packet: nlmon: virtual netlink monitoring device for packet sockets (Daniel Borkmann) [957721]
  - [net] netlink: virtual tap device management (Daniel Borkmann) [957721]
  - [net] if_arp: add ARPHRD_NETLINK type (Daniel Borkmann) [957721]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-12.el7]
changelog:
  - [acpi] memhotplug: Fix a stale pointer in error path (Lenny Szubowicz) [995322]
  - [powerpc] Add second POWER8 PVR entry (Steve Best) [995355]
  - [acpi] power: add missing newline to debug messages (Myron Stowe) [998633]
  - [tools] cpupower: Add Haswell family 0x45 specific idle monitor to show PC8, 9, 10 states (Myron Stowe) [998633]
  - [tools] cpupower: Haswell also supports the C-states introduced with SandyBridge (Myron Stowe) [998633]
  - [tools] cpupower: Introduce idle-set subcommand and C-state enabling/disabling (Myron Stowe) [998633]
  - [tools] cpupower: Implement disabling of cstate interface (Myron Stowe) [998633]
  - [tools] cpupower: Make idlestate usage unsigned (Myron Stowe) [998633]
  - [acpi] fan: Initialize acpi_state variable (Myron Stowe) [998633]
  - [acpi] scan: remove unused LIST_HEAD(acpi_device_list) (Myron Stowe) [998633]
  - [acpi] dock: Actually define acpi_dock_init() as void (Myron Stowe) [998633]
  - [acpi] pm: Fix corner case in acpi_bus_update_power() (Myron Stowe) [998633]
  - [cpufreq] Fix serialization of frequency transitions (Myron Stowe) [998633]
  - [cpufreq] Fix cpufreq regression after suspend/resume (Myron Stowe) [991615]
  - [acpi] pm: Fix possible NULL pointer deref in acpi_pm_device_sleep_state() (Myron Stowe) [991615]
  - [kernel] power: Warn about system time after resume with pm_trace (Myron Stowe) [991615]
  - [cpufreq] don't leave stale policy pointer in cdbs->cur_policy (Myron Stowe) [991615]
  - [cpufreq] acpi-cpufreq: Add new sysfs attribute freqdomain_cpus (Myron Stowe) [991615]
  - [cpufreq] make sure frequency transitions are serialized (Myron Stowe) [991615]
  - [acpi] implement acpi_os_get_timer() according the spec (Myron Stowe) [991615]
  - [acpi] ec: Add HP Folio 13 to ec_dmi_table in order to skip DSDT scan (Myron Stowe) [991615]
  - [acpi] Add CMOS RTC Operation Region handler support (Myron Stowe) [991615]
  - [acpi] processor: Drop unused variable from processor_perflib.c (Myron Stowe) [991615]
  - [cpufreq] powernow-k8: call CPUFREQ_POSTCHANGE notfier in error cases (Myron Stowe) [991615]
  - [cpufreq] pcc: call CPUFREQ_POSTCHANGE notfier in error cases (Myron Stowe) [991615]
  - [cpufreq] acpi-cpufreq: call CPUFREQ_POSTCHANGE notfier in error cases (Myron Stowe) [991615]
  - [Documentation] power: Add pm_qos and dev_pm_qos to events-power.txt (Myron Stowe) [991615]
  - [base] power/qos: Add dev_pm_qos_request tracepoints (Myron Stowe) [991615]
  - [kernel] power/qos: Add pm_qos_request tracepoints (Myron Stowe) [991615]
  - [kernel] power/qos: Add pm_qos_update_target/flags tracepoints (Myron Stowe) [991615]
  - [acpi] processor: Remove unused macros in processor_driver.c (Myron Stowe) [991615]
  - [Documentation] power: Update Documentation/power/pm_qos_interface.txt (Myron Stowe) [991615]
  - [Documentation] cpu-hotplug: Rephrase the outdated description for MADT entries (Myron Stowe) [991615]
  - [cpufreq] make __cpufreq_notify_transition() static (Myron Stowe) [991615]
  - [cpufreq] Fix minor formatting issues (Myron Stowe) [991615]
  - [cpufreq] Fix governor start/stop race condition (Myron Stowe) [991615]
  - [kernel] power: Print last wakeup source on failed wakeup_count write (Myron Stowe) [991615]
  - [kernel] power/qos: correct the valid range of pm_qos_class (Myron Stowe) [991615]
  - [Documentation] video: update video_extension.txt for backlight control (Myron Stowe) [991615]
  - [Documentation] video: move video_extension.txt to Documentation/acpi (Myron Stowe) [991615]
  - [Documentation] video: add description for brightness_switch_enabled (Myron Stowe) [991615]
  - [Documentation] Add ACPI namespace documentation (Myron Stowe) [991615]
  - [Documentation] Add sysfs ABI documentation (Myron Stowe) [991615]
  - [Documentation] MAINTAINERS: include Documentation/acpi (Myron Stowe) [991615]
  - [acpi] acpica: Update version to 20130517 (Myron Stowe) [991615]
  - [acpi] acpica: _CST repair, handle null package entries (Myron Stowe) [991615]
  - [acpi] acpica: Add several repairs for _CST predefined name (Myron Stowe) [991615]
  - [acpi] acpica: Move _PRT repair into the standard complex repair module (Myron Stowe) [991615]
  - [acpi] scan: Do not bind ACPI drivers to objects with scan handlers (Myron Stowe) [991615]
  - [acpi] pm: Rework and clean up acpi_dev_pm_get_state() (Myron Stowe) [991615]
  - [acpi] pm: Replace ACPI_STATE_D3 with ACPI_STATE_D3_COLD in device_pm.c (Myron Stowe) [991615]
  - [acpi] pm: Rename function acpi_device_power_state() and make it static (Myron Stowe) [991615]
  - [acpi] pm: acpi_processor_suspend() can be static (Myron Stowe) [991615]
  - [virt] xen/acpi: Register an acpi_suspend_lowlevel callback (Myron Stowe) [991615]
  - [x86] acpi/sleep: Provide registration for acpi_suspend_lowlevel (Myron Stowe) [991615]
  - [acpi] Remove unused flags in acpi_device_flags (Myron Stowe) [991615]
  - [acpi] Remove useless initializers (Myron Stowe) [991615]
  - [acpi] battery: Make sure all spaces are in correct places (Myron Stowe) [991615]
  - [acpi] add _STA evaluation at do_acpi_find_child() (Myron Stowe) [991615]
  - [acpi] ec: access user space with get_user()/put_user() (Myron Stowe) [991615]
  - [cpufreq] Simplify userspace governor (Myron Stowe) [991615]
  - [acpi] lpss: override SDIO private register space size from ACPI tables (Myron Stowe) [991615]
  - [acpi] lpss: mask the UART TX completion interrupt (Myron Stowe) [991615]
  - [acpi] lpss: add support for Intel BayTrail (Myron Stowe) [991615]
  - [acpi] Do not use CONFIG_ACPI_HOTPLUG_MEMORY_MODULE (Myron Stowe) [991615]
  - [cpufreq] x86: make X86_AMD_FREQ_SENSITIVITY select CPU_FREQ_TABLE (Myron Stowe) [991615]
  - [cpufreq] powerpc: make CBE_RAS select CPU_FREQ_TABLE (Myron Stowe) [991615]
  - [cpufreq] blackfin: enable driver for CONFIG_BFIN_CPU_FREQ (Myron Stowe) [991615]
  - [acpi] acpica: Clear events initialized flag upon event component termination (Myron Stowe) [991615]
  - [acpi] acpica: Fix possible memory leak in GPE init error path (Myron Stowe) [991615]
  - [acpi] acpica: on termination, delete global lock pending lock (Myron Stowe) [991615]
  - [acpi] acpica: Update interface to acpi_ut_valid_acpi_name() (Myron Stowe) [991615]
  - [acpi] acpica: Do not use extended sleep registers unless HW-reduced bit is set (Myron Stowe) [991615]
  - [acpi] acpica: Split table print utilities to a new a separate file (Myron Stowe) [991615]
  - [acpi] acpica: Add option to disable loading of SSDTs from the RSDT/XSDT (Myron Stowe) [991615]
  - [acpi] acpica: Standardize all switch() blocks (Myron Stowe) [991615]
  - [acpi] acpica: Split internal error msg routines to a separate file (Myron Stowe) [991615]
  - [acpi] acpica: Split buffer dump routines into separate file (Myron Stowe) [991615]
  - [acpi] scan: Simplify ACPI driver probing (Myron Stowe) [991615]
  - [base] power/wakeup: Adjust messaging for wake events during suspend (Myron Stowe) [991615]
  - [cpuidle] Fix ARCH_NEEDS_CPU_IDLE_COUPLED dependency warning (Myron Stowe) [991615]
  - [cpuidle] Comment the driver's framework code (Myron Stowe) [991615]
  - [cpuidle] simplify multiple driver support (Myron Stowe) [991615]
  - [cpufreq] powerpc: move cpufreq driver to drivers/cpufreq (Myron Stowe) [991615]
  - [cpufreq] acpi-cpufreq: Add ACPI processor device IDs to acpi-cpufreq (Myron Stowe) [991615]
  - [cpufreq] remove unnecessary cpufreq_cpu_{get,put}() calls (Myron Stowe) [991615]
  - [Documentation] MAINTAINERS: Add git tree path for ARM specific updates to cpufreq (Myron Stowe) [991615]
  - [cpufreq] rename index as driver_data in cpufreq_frequency_table (Myron Stowe) [991615]
  - [Documentation] power: Update .runtime_idle() callback documentation (Myron Stowe) [991615]
  - [kernel] power: Rework the "runtime idle" helper routine (Myron Stowe) [991615]
  - [kernel] power: print physical addresses consistently with other parts of kernel (Myron Stowe) [991615]
  - [cpuidle] improve governor Kconfig options (Myron Stowe) [991615]
  - [Documentation] MAINTAINERS: update mailing list for devfreq(DVFS) (Myron Stowe) [991615]
  - [devfreq] fix typo "CPU_EXYNOS4.12" twice (Myron Stowe) [991615]
  - [devfreq] add comments and Documentation (Myron Stowe) [991615]
  - [devfreq] account suspend/resume for stats (Myron Stowe) [991615]
  - [mm] memory_hotplug: Move alternative function definitions to header (Myron Stowe) [991615]
  - [acpi] processor: Fix potential NULL pointer dereference in acpi_processor_add() (Myron Stowe) [991615]
  - [acpi] acpica: Update version to 20130418 (Myron Stowe) [991615]
  - [acpi] acpica: Update for "orphan" embedded controller _REG method support (Myron Stowe) [991615]
  - [acpi] acpica: Remove unused macros, no functional change (Myron Stowe) [991615]
  - [acpi] acpica: Predefined name support, remove unused local variable (Myron Stowe) [991615]
  - [acpi] acpica: Add argument typechecking for all predefined ACPI names (Myron Stowe) [991615]
  - [acpi] acpica: Add BIOS error interface for predefined name validation support (Myron Stowe) [991615]
  - [acpi] acpica: Change an exception code for the ASL UnLoad() operator (Myron Stowe) [991615]
  - [acpi] memhotplug: Simplify memory removal (Myron Stowe) [991615]
  - [acpi] scan: Add second pass of companion offlining to hot-remove code (Myron Stowe) [991615]
  - [base] memory: Drop offline_memory_block() (Myron Stowe) [991615]
  - [acpi] processor: Pass processor object handle to acpi_bind_one() (Myron Stowe) [991615]
  - [acpi] Drop removal_type field from struct acpi_device (Myron Stowe) [991615]
  - [base] memory: Simplify __memory_block_change_state() (Myron Stowe) [991615]
  - [acpi] processor: Initialize per_cpu(processors, pr->id) properly (Myron Stowe) [991615]
  - [base] cpu: Fix sysfs cpu/online of offlined CPUs (Myron Stowe) [991615]
  - [cpufreq] Don't create empty /sys/devices/system/cpu/cpufreq directory (Myron Stowe) [991615]
  - [cpufreq] Move get_cpu_idle_time() to cpufreq.c (Myron Stowe) [991615]
  - [cpufreq] governors: Move get_governor_parent_kobj() to cpufreq.c (Myron Stowe) [991615]
  - [cpufreq] Add EXPORT_SYMBOL_GPL for have_governor_per_policy (Myron Stowe) [991615]
  - [pnp] restore automatic resolution of DMA conflicts (Myron Stowe) [991615]
  - [net] af_unix: use freezable blocking calls in read (Myron Stowe) [991615]
  - [kernel] sigtimedwait: use freezable blocking call (Myron Stowe) [991615]
  - [kernel] nanosleep: use freezable blocking call (Myron Stowe) [991615]
  - [kernel] futex: use freezable blocking call (Myron Stowe) [991615]
  - [fs] select: use freezable blocking call (Myron Stowe) [991615]
  - [fs] epoll: use freezable blocking call (Myron Stowe) [991615]
  - [kernel] freezer: add new freezable helpers using freezer_do_not_count() (Myron Stowe) [991615]
  - [kernel] freezer: convert freezable helpers to static inline where possible (Myron Stowe) [991615]
  - [kernel] freezer: convert freezable helpers to freezer_do_not_count() (Myron Stowe) [991615]
  - [kernel] freezer: skip waking up tasks with PF_FREEZER_SKIP set (Myron Stowe) [991615]
  - [kernel] power: shorten freezer sleep time using exponential backoff (Myron Stowe) [991615]
  - [kernel] lockdep: check that no locks held at freeze time (Myron Stowe) [991615]
  - [kernel] lockdep: remove task argument from debug_check_no_locks_held (Myron Stowe) [991615]
  - [fs] cifs: add unsafe versions of freezable helpers for CIFS (Myron Stowe) [991615]
  - [fs] nfs: add unsafe versions of freezable helpers for NFS (Myron Stowe) [991615]
  - [base] memory: Introduce offline/online callbacks for memory blocks (Myron Stowe) [991615]
  - [acpi] memhotplug: Bind removable memory blocks to ACPI device nodes (Myron Stowe) [991615]
  - [acpi] processor: Use common hotplug infrastructure (Myron Stowe) [991615]
  - [acpi] hotplug: Use device offline/online for graceful hot-removal (Myron Stowe) [991615]
  - [base] cpu: Use generic offline/online for CPU offline/online (Myron Stowe) [991615]
  - [base] core: Add offline/online device operations (Myron Stowe) [991615]
  - [scsi] bnx2i: Fix bug on some bnx2x devices that don't support iSCSI (Tomas Henzl) [957024]
  - [x86] tracing: Add irq_enter/exit() in smp_trace_reschedule_interrupt() (Seiji Aguchi) [741673]
  - [x86] trace: Add config option checking to the definitions of mce handlers (Seiji Aguchi) [741673]
  - [x86] trace: Do not call local_irq_save() in load_current_idt() (Seiji Aguchi) [741673]
  - [x86] trace: Move creation of irq tracepoints from apic.c to irq.c (Seiji Aguchi) [741673]
  - [x86] trace: Add irq vector tracepoints (Seiji Aguchi) [741673]
  - [x86] trace: Rename variables for debugging (Seiji Aguchi) [741673]
  - [x86] trace: Introduce entering/exiting_irq() (Seiji Aguchi) [741673]
  - [tracing] Add DEFINE_EVENT_FN() macro (Seiji Aguchi) [741673]
  - [fs] pstore: Fail to unlink if a driver has not defined pstore_erase (Steve Best) [996930]
  - [powerpc] pseries: Inform the hypervisor we are using EBB regs (Steve Best) [997646]
  - [powerpc] perf: Export PERF_EVENT_CONFIG_EBB_SHIFT to userspace (Steve Best) [997646]
  - [powerpc] perf: Set PPC_FEATURE2_EBB when we register the power8 PMU (Steve Best) [997646]
  - [powerpc] Fix hypervisor facility unavaliable vector number (Steve Best) [995354]
  - [powerpc] Fix context switch DSCR on POWER8 (Steve Best) [995354]
  - [powerpc] Rework setting up H/FSCR bit definitions (Steve Best) [995354]
  - [powerpc] Wire up the HV facility unavailable exception (Steve Best) [995354]
  - [powerpc] Rename and flesh out the facility unavailable exception handler (Steve Best) [995354]
  - [powerpc] Remove KVMTEST from RELON exception handlers (Steve Best) [995354]
  - [powerpc] tm: Fix context switching TAR, PPR and DSCR SPRs (Steve Best) [988340]
  - [powerpc] Save the TAR register earlier (Steve Best) [988340]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-13.el7]
changelog:
  - [powerpc] pseries: Drop "select HOTPLUG" (Myron Stowe) [999178]
  - [misc] Finally eradicate CONFIG_HOTPLUG (Myron Stowe) [999178]
  - [vfio] vfio-pci: Avoid deadlock on remove (Alex Williamson) [912293]
  - [vfio] Ignore sprurious notifies (Alex Williamson) [912293]
  - [vfio] Don't overreact to DEL_DEVICE (Alex Williamson) [912293]
  - [s390] qeth: Fix crash on initial MTU size change (Hendrik Brueckner) [997607]
  - [s390] qeth: change default standard blkt settings for OSA (Hendrik Brueckner) [997635]
  - [s390] dasd: fix hanging devices after path events (Hendrik Brueckner) [996178]
  - [s390] zcrypt: Alias for new zcrypt device driver base module (Hendrik Brueckner) [996731]
  - [s390] zfcp: status read buffers on first adapter open with link down (Hendrik Brueckner) [976636]
  - [s390] zfcp: fix adapter (re)open recovery while link to SAN is down (Hendrik Brueckner) [889079]
  - [netdrv] be2net: Fix to avoid hardware workaround when not needed (Ivan Vecera) [982900]
  - [fs] gfs2: Take glock reference in examine_bucket() (Steven Whitehouse) [999897]
  - [fs] gfs2: Check for glock already held in gfs2_getxattr (Steven Whitehouse) [997604]
  - [crypto] nx: fix nx-aes-gcm verification (Steve Best) [997057]
  - [s390] zfcp: remove access control tables interface (Hendrik Brueckner) [994519]
  - [s390] zfcp: cfdc fops add owner (Hendrik Brueckner) [994519]
  - [scsi] fcoe: cleanup return codes from fcoe_rcv (Neil Horman) [984876]
  - [scsi] fcoe: make sure fcoe frames are unshared prior to manipulating them (Neil Horman) [984876]
  - [scsi] fcoe: ensure that skb placed on the fip_recv_list are unshared (Neil Horman) [984876]
  - [mm] zswap: add documentation (Steve Best) [731499]
  - [mm] zswap: add to mm (Steve Best) [731499]
  - [mm] zbud: add to mm (Steve Best) [731499]
  - [misc] MAINTAINERS: add zswap and zbud maintainer (Steve Best) [731499]
  - [fs] debugfs: add get/set for atomic types (Steve Best) [731499]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-14.el7]
changelog:
  - [net] openvswitch: optimize flow compare and mask functions (Thomas Graf) [1002051]
  - [net] openvswitch: Rename key_len to key_end (Thomas Graf) [1002051]
  - [net] openvswitch: Add SCTP support (Thomas Graf) [1002051]
  - [net] ipv6: Add NEXTHDR_SCTP to ipv6.h (Thomas Graf) [1002051]
  - [net] sctp: Refactor SCTP skb checksum computation (Thomas Graf) [1002051]
  - [net] sctp: prevent checksum.h from double inclusion (Thomas Graf) [1002051]
  - [net] openvswitch: Mega flow implementation (Thomas Graf) [1002051]
  - [net] openvswitch: Fix argument descriptions in vport.c (Thomas Graf) [1002051]
  - [net] openvswitch: link upper device for port devices (Thomas Graf) [1002051]
  - [net] openvswitch: Use non rcu hlist_del() flow table entry (Thomas Graf) [1002051]
  - [net] openvswitch: Use RCU lock for dp dump operation (Thomas Graf) [1002051]
  - [net] openvswitch: Use RCU lock for flow dump operation (Thomas Graf) [1002051]
  - [net] ipv6: prevent race between address creation and removal (Jiri Benc) [991392]
  - [net] ipv6: move peer_addr init into ipv6_add_addr() (Jiri Benc) [991392]
  - [net] ipv6: use ipv6_addr_scope() helper (Jiri Benc) [991392]
  - [net] ipv6: add support of peer address (Jiri Benc) [991392]
  - [net] rtm_to_ifaddr: free ifa if ifa_cacheinfo processing fails (Daniel Borkmann) [992908]
  - [net] net_sched: restore "linklayer atm" handling (Jesper Brouer) [998588]
  - [net] net_sched: psched_ratecfg_precompute() improvements (Jesper Brouer) [998588]
  - [net] ip_tunnel: Do not use inner ip-header-id for tunnel ip-header-id (Amerigo Wang) [989522]
  - [net] openvswitch: Add vxlan tunneling support (Amerigo Wang) [989522]
  - [net] vxlan: Add tx-vlan offload support (Amerigo Wang) [989522]
  - [net] vxlan: Improve vxlan headroom calculation (Amerigo Wang) [989522]
  - [net] vxlan: Factor out vxlan send api (Amerigo Wang) [989522]
  - [net] vxlan: Extend vxlan handlers for openvswitch (Amerigo Wang) [989522]
  - [net] vxlan: Add vxlan recv demux (Amerigo Wang) [989522]
  - [net] vxlan: Restructure vxlan receive (Amerigo Wang) [989522]
  - [net] vxlan: Restructure vxlan socket apis (Amerigo Wang) [989522]
  - [net] openvswitch: Reset tunnel key between input and output (Amerigo Wang) [989522]
  - [net] openvswitch: Use correct type while allocating flex array (Amerigo Wang) [989522]
  - [net] openvswitch: Fix bad merge resolution (Amerigo Wang) [989522]
  - [net] rtnetlink: Fix inverted check in ndo_dflt_fdb_del() (Amerigo Wang) [989522]
  - [net] rtnetlink: allow using zero MAC address in rtnl_fdb_{add, del} (Amerigo Wang) [989522]
  - [net] vxlan: fix a soft lockup in vxlan module removal (Amerigo Wang) [989522]
  - [net] vxlan: fix a regression of igmp join (Amerigo Wang) [989522]
  - [net] vxlan: fix rcu related warning (Amerigo Wang) [989522]
  - [net] vxlan: fdb: replace an existing entry (Amerigo Wang) [989522]
  - [net] vxlan: fix igmp races (Amerigo Wang) [989522]
  - [net] vxlan: unregister on namespace exit (Amerigo Wang) [989522]
  - [net] vxlan: add necessary locking on device removal (Amerigo Wang) [989522]
  - [net] vxlan: Fix kernel crash on rmmod (Amerigo Wang) [989522]
  - [net] vxlan: fix function name spelling (Amerigo Wang) [989522]
  - [net] vxlan: fdb: allow specifying multiple destinations for zero MAC (Amerigo Wang) [989522]
  - [net] vxlan: allow removal of single destination from fdb entry (Amerigo Wang) [989522]
  - [net] vxlan: introduce vxlan_fdb_parse (Amerigo Wang) [989522]
  - [net] vxlan: introduce vxlan_fdb_find_rdst (Amerigo Wang) [989522]
  - [net] vxlan: add implicit fdb entry for default destination (Amerigo Wang) [989522]
  - [net] vxlan: Fix sparse warnings (Amerigo Wang) [989522]
  - [net] vxlan: cosmetic cleanup's (Amerigo Wang) [989522]
  - [net] vxlan: Use initializer for dummy structures (Amerigo Wang) [989522]
  - [net] vxlan: port module param should be ushort (Amerigo Wang) [989522]
  - [net] vxlan: convert remotes list to list_rcu (Amerigo Wang) [989522]
  - [net] vxlan: make vxlan_xmit_one void (Amerigo Wang) [989522]
  - [net] vxlan: move cleanup to uninit (Amerigo Wang) [989522]
  - [net] vxlan: fix race caused by dropping rtnl_unlock (Amerigo Wang) [989522]
  - [net] vxlan: send notification when MAC migrates (Amerigo Wang) [989522]
  - [net] vxlan: move IGMP join/leave to work queue (Amerigo Wang) [989522]
  - [net] vxlan: fix crash from work pending on module removal (Amerigo Wang) [989522]
  - [net] vxlan: fix out of order operation on module removal (Amerigo Wang) [989522]
  - [net] vxlan: defer vxlan init as late as possible (Amerigo Wang) [989522]
  - [net] vxlan: use unsigned int instead of unsigned (Amerigo Wang) [989522]
  - [net] vxlan: remove the unused rcu head from struct vxlan_rdst (Amerigo Wang) [989522]
  - [net] vxlan: listen on multiple ports (Amerigo Wang) [989522]
  - [rhel] Kconfig: enable CONFIG_OPENVSWITCH_GRE (Amerigo Wang) [992917]
  - [net] ip_tunnel: embed hash list head (Amerigo Wang) [992917]
  - [net] sit: fix tunnel update via netlink (Amerigo Wang) [992917]
  - [net] ipv6: only apply anti-spoofing checks to not-pointopoint tunnels (Amerigo Wang) [992917]
  - [net] gre: Fix MTU sizing check for gretap tunnels (Amerigo Wang) [992917]
  - [net] ip_tunnels: Use skb-len to PMTU check (Amerigo Wang) [992917]
  - [net] gso: Update tunnel segmentation to support Tx checksum offload (Amerigo Wang) [992917]
  - [net] gre: move GSO functions to gre_offload (Amerigo Wang) [992917]
  - [net] gre: fix a regression in ioctl (Amerigo Wang) [992917]
  - [net] sit: add support of x-netns (Amerigo Wang) [992917]
  - [net] dev: introduce skb_scrub_packet() (Amerigo Wang) [992917]
  - [net] dev: remove duplicate 'skb->dev = dev' in dev_forward_skb() (Amerigo Wang) [992917]
  - [net] sit: fix an oops when IFLA_IPTUN_PROTO is not set (Amerigo Wang) [992917]
  - [net] sit: fix 4in4 + IPsec scenario (Amerigo Wang) [992917]
  - [net] openvswitch: Add Kconfig dependency on GRE-DEMUX (Amerigo Wang) [992917]
  - [net] ip_tunnel: Protect tunnel functions with CONFIG_INET guard (Amerigo Wang) [992917]
  - [net] openvswitch: Use correct config guard (Amerigo Wang) [992917]
  - [net] openvswitch: Add gre tunnel support (Amerigo Wang) [992917]
  - [net] openvswitch: Optimize flow key match for non tunnel flows (Amerigo Wang) [992917]
  - [net] openvswitch: Expand action buffer size (Amerigo Wang) [992917]
  - [net] openvswitch: Add tunneling interface (Amerigo Wang) [992917]
  - [net] openvswitch: Copy individual actions (Amerigo Wang) [992917]
  - [net] ip_tunnel: Add dont fragment flag (Amerigo Wang) [992917]
  - [net] ip_tunnel: push generic protocol handling to ip_tunnel module (Amerigo Wang) [992917]
  - [net] ip_tunnel: extend iptunnel_xmit() (Amerigo Wang) [992917]
  - [net] gre: export gre_handle_offloads() function (Amerigo Wang) [992917]
  - [net] gre: export gre_build_header() function (Amerigo Wang) [992917]
  - [net] gre: Allow multiple protocol listener for gre protocol (Amerigo Wang) [992917]
  - [net] gre: Simplify gre protocol registration locking (Amerigo Wang) [992917]
  - [net] openvswitch: make skb->csum consistent with rest of networking stack (Amerigo Wang) [992917]
  - [net] openvswitch: Simplify interface ovs_flow_metadata_from_nlattrs() (Amerigo Wang) [992917]
  - [net] openvswitch: Fix misspellings in comments and docs (Amerigo Wang) [992917]
  - [net] openvswitch: Unify vport error stats handling (Amerigo Wang) [992917]
  - [net] openvswitch: fix variable names in comment (Amerigo Wang) [992917]
  - [net] openvswitch: Immediately exit on error in ovs_vport_cmd_set() (Amerigo Wang) [992917]
  - [net] openvswitch: Remove unused get_config vport op (Amerigo Wang) [992917]
  - [net] iptunnel: specify protocol outside IP header (Amerigo Wang) [992917]
  - [net] sit: add IPv4 over IPv4 support (Amerigo Wang) [992917]
  - [net] export physical port id via sysfs (Jiri Pirko) [991026]
  - [net] rtnl: export physical port id via RT netlink (Jiri Pirko) [991026]
  - [net] add ndo to get id of physical port of the device (Jiri Pirko) [991026]
  - [net] busy_poll: revert unsupported bits from creation of BUSY_POLL socket option (Neil Horman) [958330]
  - [net] busy_poll: rename busy poll socket op and globals (Neil Horman) [958330]
  - [net] busy_poll: rename ll methods to busy-poll (Neil Horman) [958330]
  - [net] busy_poll: rename include/net/ll_poll.h to include/net/busy_poll.h (Neil Horman) [958330]
  - [net] busy_poll: change busy poll time accounting (Neil Horman) [958330]
  - [net] busy_poll: rename low latency sockets functions to busy poll (Neil Horman) [958330]
  - [net] busy_poll: lls fix build with allnoconfig (Neil Horman) [958330]
  - [net] busy_poll: convert lls to use time_in_range() (Neil Horman) [958330]
  - [net] busy_poll: avoid calling sched_clock when LLS is off (Neil Horman) [958330]
  - [net] busy_poll: fix LLS debug_smp_processor_id() warning (Neil Horman) [958330]
  - [net] busy_poll: poll/select low latency socket support (Neil Horman) [958330]
  - [net] busy_poll: add socket option for low latency polling (Neil Horman) [958330]
  - [net] busy_poll: remove NET_LL_RX_POLL config menu (Neil Horman) [958330]
  - [net] busy_poll: convert low latency sockets to sched_clock() (Neil Horman) [958330]
  - [net] busy_poll: change sysctl_net_ll_poll into an unsigned int (Neil Horman) [958330]
  - [netdrv] ixgbe: add extra stats for ndo_ll_poll (Neil Horman) [958330]
  - [netdrv] ixgbe: add support for ndo_ll_poll (Neil Horman) [958330]
  - [net] tcp: add low latency socket poll support (Neil Horman) [958330]
  - [net] udp: add low latency socket poll support (Neil Horman) [958330]
  - [net] busy_poll: add low latency socket poll (Neil Horman) [958330]
  - [net] add napi_id and hash (Neil Horman) [958330]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-15.el7]
changelog:
  - [drm] qxl: backport updates from v3.11-rc1 (Dave Airlie) [979176]
  - [drm] add hotspot support for cursors (Dave Airlie) [983312]
  - [virt] x86: Correctly detect hypervisor (Jason Wang) [985743]
  - [virt] kvm: Switch to use hypervisor_cpuid_base() (Jason Wang) [985743]
  - [virt] xen: Switch to use hypervisor_cpuid_base() (Jason Wang) [985743]
  - [virt] x86: Introduce hypervisor_cpuid_base() (Jason Wang) [985743]
  - [net] sunrpc: prepare NFS for 2038 (Harshula Jayasuriya) [847926]
  - [netdrv] macvtap: Ignore tap features when VNET_HDR is off (Vlad Yasevich) [1001053]
  - [netdrv] macvtap: Correctly set tap features when IFF_VNET_HDR is disabled (Vlad Yasevich) [1001053]
  - [netdrv] macvtap: simplify usage of tap_features (Vlad Yasevich) [1001053]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-16.el7]
changelog:
  - [powerpc] Avoid link stack corruption for MMU on exceptions (Steve Best) [999556]
  - [virt] net/hyperv: Fix the NETIF_F_SG flag setting in netvsc (Jason Wang) [984810]
  - [pci] Retry allocation of only the resource type that failed (Myron Stowe) [1001217]
  - [pci] pciehp: Convert pciehp to be builtin only, not modular (Myron Stowe) [1001217]
  - [pci] hotplug: Convert to be builtin only, not modular (Myron Stowe) [1001217]
  - [pci] pciehp: Fix null pointer deref when hot-removing SR-IOV device (Myron Stowe) [1001217]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-17.el7]
changelog:
  - [fs] lockd: Don't call utsname()->nodename from nlmclnt_setlockargs (Jan Stancek) [999289]
  - [scsi] ipr: Add sereral new CCIN definitions for new adapters support (Steve Best) [1002200]
  - [virt] x86/xen: Sync the CMOS RTC as well as the Xen wallclock (Radim Krcmar) [1003683]
  - [virt] x86/xen: Sync the wallclock when the system time is set (Radim Krcmar) [1003683]
  - [virt] x86: Increase precision of x86_platform.get/set_wallclock() (Radim Krcmar) [1003683]
  - [powerpc] Don't Oops when accessing /proc/powerpc/lparcfg without hypervisor (Steve Best) [1002206]
  - [virt] xen/smp: initialize IPI vectors before marking CPU online (Radim Krcmar) [1003683]
  - [virt] xen/events: mask events when changing their VCPU binding (Radim Krcmar) [1003683]
  - [virt] xen/events: initialize local per-cpu mask for all possible events (Radim Krcmar) [1003683]
  - [virt] x86/xen: do not identity map UNUSABLE regions in the machine E820 (Radim Krcmar) [1003683]
  - [virt] xen/evtchn: avoid a deadlock when unbinding an event channel (Radim Krcmar) [1003683]
  - [virt] xenbus: frontend resume cleanup (Radim Krcmar) [1003683]
  - [virt] xen-netfront: pull on receive skb may need to happen earlier (Radim Krcmar) [1003683]
  - [virt] xen: Use more current logging styles (Radim Krcmar) [1003683]
  - [virt] xen/time: remove blocked time accounting from xen "clockchip" (Radim Krcmar) [1003683]
  - [virt] xen: Convert printks to pr_<level> (Radim Krcmar) [1003683]
  - [virt] xen: ifdef CONFIG_HIBERNATE_CALLBACKS xen_*_suspend (Radim Krcmar) [1003683]
  - [virt] xen-blkfront: set blk_queue_max_hw_sectors correctly (Radim Krcmar) [1003683]
  - [virt] xen/io: new macro to detect whether there are too many requests on the ring (Radim Krcmar) [1003683]
  - [virt] xen-netfront: use skb_partial_csum_set() to simplify the codes (Radim Krcmar) [1003683]
  - [virt] xen/time: Free onlined per-cpu data structure if we want to online it again (Radim Krcmar) [1003683]
  - [virt] xen/time: Check that the per_cpu data structure has data before freeing (Radim Krcmar) [1003683]
  - [virt] xen/time: Don't leak interrupt name when offlining (Radim Krcmar) [1003683]
  - [virt] xen/time: Encapsulate the struct clock_event_device in another structure (Radim Krcmar) [1003683]
  - [virt] xen/spinlock: Don't leak interrupt name when offlining (Radim Krcmar) [1003683]
  - [virt] xen/smp: Don't leak interrupt name when offlining (Radim Krcmar) [1003683]
  - [virt] xen/smp: Set the per-cpu IRQ number to a valid default (Radim Krcmar) [1003683]
  - [virt] xen/smp: Introduce a common structure to contain the IRQ name and interrupt line (Radim Krcmar) [1003683]
  - [virt] xen/smp: Coalesce the free_irq calls in one function (Radim Krcmar) [1003683]
  - [virt] xen-blkback: Use physical sector size for setup (Radim Krcmar) [1003683]
  - [virt] xen-blkfront: Introduce a 'max' module parameter to alter the amount of indirect segments (Radim Krcmar) [1003683]
  - [virt] xen/netif: document feature-split-event-channels (Radim Krcmar) [1003683]
  - [virt] xen-netfront: split event channels support for Xen frontend driver (Radim Krcmar) [1003683]
  - [virt] xen-netfront: avoid leaking resources when setup_netfront fails (Radim Krcmar) [1003683]
  - [virt] xen-blkfront: use a different scatterlist for each request (Radim Krcmar) [1003683]
  - [virt] xen-block: implement indirect descriptors (Radim Krcmar) [1003683]
  - [acpi] Try harder to resolve _ADR collisions for bridges (Myron Stowe) [1003183]
  - [cpufreq] rename ignore_nice as ignore_nice_load (Myron Stowe) [1003183]
  - [acpi] processor: move try_offline_node() after acpi_unmap_lsapic() (Myron Stowe) [1003183]
  - [acpi] Drop physical_node_id_bitmap from struct acpi_device (Myron Stowe) [1003183]
  - [acpi] pm: Walk physical_node_list under physical_node_lock (Myron Stowe) [1003183]
  - [acpi] video: improve quirk check in acpi_video_bqc_quirk() (Myron Stowe) [1003183]
  - [kernel] freezer: set PF_SUSPEND_TASK flag on tasks that call freeze_processes (Myron Stowe) [1003183]
  - [acpi] battery: Fix parsing _BIX return value (Myron Stowe) [1003183]
  - [cpufreq] Fix cpufreq driver module refcount balance after suspend/resume (Myron Stowe) [1003183]
  - [cpufreq] intel_pstate: Change to scale off of max P-state (Myron Stowe) [1003183]
  - [acpi] video: ignore BIOS initial backlight value for Fujitsu E753 (Myron Stowe) [1003183]
  - [pnp] acpi: avoid garbage in resource name (Myron Stowe) [1003183]
  - [power] sleep: Fix comment typo in pm_wakeup.h (Myron Stowe) [1003183]
  - [power] sleep: avoid 'autosleep' in shutdown progress (Myron Stowe) [1003183]
  - [acpi] scan: Always call acpi_bus_scan() for bus check notifications (Myron Stowe) [1003183]
  - [acpi] scan: Do not try to attach scan handlers to devices having them (Myron Stowe) [1003183]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-18.el7]
changelog:
  - [net] ipv4: make snmp_mib_free static inline (Amerigo Wang) [970585]
  - [net] vxlan: include net/ip6_checksum.h for csum_ipv6_magic() (Amerigo Wang) [970585]
  - [net] vxlan: fix flowi6_proto value (Amerigo Wang) [970585]
  - [net] udp: unify skb_udp_tunnel_segment() and skb_udp6_tunnel_segment() (Amerigo Wang) [970585]
  - [net] ipv6: Add generic UDP Tunnel segmentation (Amerigo Wang) [970585]
  - [net] vxlan: add ipv6 proxy support (Amerigo Wang) [970585]
  - [net] ipv6: move in6_dev_finish_destroy() into core kernel (Amerigo Wang) [970585]
  - [net] ipv6: add include file to suppress sparse warnings (Amerigo Wang) [970585]
  - [net] vxlan: add ipv6 route short circuit support (Amerigo Wang) [970585]
  - [net] vxlan: add ipv6 support (Amerigo Wang) [970585]
  - [net] ipv6: do not call ndisc_send_rs() with write lock (Amerigo Wang) [970585]
  - [net] ipv6: export in6addr_loopback to modules (Amerigo Wang) [970585]
  - [net] ipv6: export a stub for IPv6 symbols used by vxlan (Amerigo Wang) [970585]
  - [net] ipv6: Remove extern function prototypes (Amerigo Wang) [970585]
  - [net] ipv6: always hold idev->lock before mca_lock (Amerigo Wang) [970585]
  - [net] ipv6: move ip6_local_out into core kernel (Amerigo Wang) [970585]
  - [net] ipv6: move ip6_dst_hoplimit() into core kernel (Amerigo Wang) [970585]
  - [net] udp: move GSO functions to udp_offload (Amerigo Wang) [970585]
  - [net] tcp: move GRO/GSO functions to tcp_offload (Amerigo Wang) [970585]
  - [net] tcp: use tcp_skb_mss helper in tcp_tso_segment (Amerigo Wang) [970585]
  - [scsi] csgb4i: convert skb->transport_header into skb_transport_header(skb) (Amerigo Wang) [970585]
  - [net] pass correct parameter to skb_headers_offset_update() (Amerigo Wang) [970585]
  - [netdrv] cxgb3: Correct comparisons and calculations using skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [net] clean up skb headers code (Amerigo Wang) [970585]
  - [net] Fix build warnings after mac_header and transport_header became __u16 (Amerigo Wang) [970585]
  - [net] netfilter: Correct calculation using skb->tail and skb-network_header (Amerigo Wang) [970585]
  - [net] Correct assignment of skb->network_header to skb->tail (Amerigo Wang) [970585]
  - [net] sctp: Correct access to skb->{network, transport}_header (Amerigo Wang) [970585]
  - [net] ipv4: Correct comparisons and calculations using skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [net] ipv6: Correct comparisons and calculations using skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [net] Correct comparisons and calculations using skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [netdrv] cxgb3: Correct comparisons and calculations using skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [netdrv] isdn: Correct comparison of skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [net] Copy inner_protocol in copy_skb_header() (Amerigo Wang) [970585]
  - [net] mpls: Add limited GSO support (Amerigo Wang) [970585]
  - [net] Use 16bits for *_headers fields of struct skbuff (Amerigo Wang) [970585]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-19.el7]
changelog:
  - [crypto] nx: fix SHA-2 for chunks bigger than block size (Steve Best) [999606]
  - [crypto] nx: fix GCM for zero length messages (Steve Best) [999606]
  - [crypto] nx: fix XCBC for zero length messages (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-CCM (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-XCBC (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-GCM (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-CTR (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-CBC (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-ECB (Steve Best) [999606]
  - [crypto] nx: add offset to nx_build_sg_lists() (Steve Best) [999606]
  - [virt] virtio_console: prevent use-after-free of port name in port unplug (Amit Shah) [990419]
  - [virt] virtio_console: fix locking around send_sigio_to_port() (Amit Shah) [986968]
  - [virt] virtio_console: add locking in port unplug path (Amit Shah) [990419]
  - [virt] virtio_console: add locks around buffer removal in port unplug path (Amit Shah) [990419]
  - [virt] virtio_console: return -ENODEV on all read operations after unplug (Amit Shah) [975716]
  - [virt] virtio_console: fix raising SIGIO after port unplug (Amit Shah) [986968]
  - [virt] virtio_console: clean up port data immediately at time of unplug (Amit Shah) [990419]
  - [virt] virtio_console: fix race in port_fops_open() and port unplug (Amit Shah) [990419]
  - [virt] virtio_console: fix race with port unplug and open/close (Amit Shah) [990419]
  - [virt] virtio_console: Add pipe_lock/unlock for splice_write (Amit Shah) [987722]
  - [virt] virtio_console: Quit from splice_write if pipe->nrbufs is 0 (Amit Shah) [987722]
  - [scsi] Generate uevents on certain unit attention codes (Ewan Milne) [740795]
  - [virt] kvm: update masterclock when kvmclock_offset is calculated (Marcelo Tosatti) [978425]
  - [acpi] pci_root: Fix _OSC ordering to allow PCIe hotplug use when available (Neil Horman) [990078]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-20.el7]
changelog:
  - [fs] gfs2: dirty inode correctly in gfs2_write_end (Benjamin Marzinski) [1004054]
  - [netdrv] bnx2x: Convert dma_alloc_coherent(...__GFP_ZERO) to dma_zalloc_coherent (Michal Schmidt) [819849]
  - [netdrv] bnx2x: clean up unnecessary MSI/MSI-X capability find (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Revising locking scheme for MAC configuration (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix VF stats sync (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix VF memory leak unload (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix functionality of configuring vlan list (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix move FP memory deallocations (Michal Schmidt) [819849]
  - [netdrv] bnx2x: vf mark stats started (Michal Schmidt) [819849]
  - [netdrv] bnx2x: set VF DMAE when first function has 0 supported VFs (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Protect against VFs' ndos when SR-IOV is disabled (Michal Schmidt) [819849]
  - [netdrv] bnx2x: prevent VF benign attentions (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Consider DCBX remote error (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Change DCB context handling (Michal Schmidt) [819849]
  - [netdrv] bnx2x: dropless flow control not always functional (Michal Schmidt) [819849]
  - [netdrv] bnx2x: prevent crash in shutdown flow with CNIC (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fix PTE write access error (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fix memory leak in VF (Michal Schmidt) [819849]
  - [netdrv] bnx2x: update fairness parameters following DCB negotiation (Michal Schmidt) [819849]
  - [netdrv] bnx2x: protect different statistics flows (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fix tunneling CSUM calculation (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fill in sane dump flag information (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fix dump flag handling (Michal Schmidt) [819849]
  - [netdrv] bnx2x: remove zeroing of dump data buffer (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Remove sparse and coccinelle warnings (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix compilation with no IOV support (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix 20G KR2 support claims (Michal Schmidt) [819849]
  - [netdrv] bnx2x: improve VF timings (Michal Schmidt) [819849]
  - [netdrv] bnx2x: VF ndo sanity (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Improve PF behaviour toward VF (Michal Schmidt) [819849]
  - [netdrv] bnx2x: remove redundant D0 power state set (Michal Schmidt) [819849]
  - [netdrv] bnx2x: replace mechanism to check for next available packet (Michal Schmidt) [819849]
  - [netdrv] bnx2x: add support for busy-poll (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fix a power state test (Michal Schmidt) [819849]
  - [netdrv] bnx2x: semi-Semantic changes (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Revise prints (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Semantic removal and beautification (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Revise comments and alignment (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Semantic change of empty lines (Michal Schmidt) [819849]
  - [netdrv] bnx2x: use XPS if possible for bnx2x_select_queue instead of pure hash (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Change to D3hot only on removal (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Implement PCI shutdown (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Count number of possible FCoE interfaces (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Ack unknown VF messages (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Add and correct PCI link speed prints (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Zero VFs starting MACs (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Enable `set_phys_id' for all functions (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Link-flap avoidance in switch dependent mode (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Add Private Flags Support (Michal Schmidt) [819849]
  - [netdrv] bnx2x: dont reload on GRO change (Michal Schmidt) [819849]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-21.el7]
changelog:
  - [net] net_sched: fix a typo in htb_change_class() (Jesper Brouer) [998588]
  - [net] tcp_probe: adapt tbuf size for recent changes (Daniel Borkmann) [1000470]
  - [net] tcp_probe: allow more advanced ingress filtering by mark (Daniel Borkmann) [1000470]
  - [net] tcp_probe: add IPv6 support (Daniel Borkmann) [1000470]
  - [net] tcp_probe: kprobes: adapt jtcp_rcv_established signature (Daniel Borkmann) [1000470]
  - [net] tcp_probe: also include rcv_wnd next to snd_wnd (Daniel Borkmann) [1000470]
  - [lib] vsprintf: add IPv4/v6 generic p[Ii]S[pfs] format specifier (Daniel Borkmann) [1000470]
  - [net] ipv6: fix potential use after free in tcp_v6_do_rcv (Jiri Benc) [1004165]
  - [net] netlabel: use domain based selectors when address based selectors are not available (Paul Moore) [983949]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-22.el7]
changelog:
  - [netdrv] bnx2: Convert dma_alloc_coherent(...__GFP_ZERO) to dma_zalloc_coherent (Neil Horman) [725061]
  - [netdrv] bnx2: clean up unnecessary MSI/MSI-X capability find (Neil Horman) [725061]
  - [netdrv] bnx2: Update version to 2.2.4 (Neil Horman) [725061]
  - [netdrv] bnx2: Add pci shutdown handler (Neil Horman) [725061]
  - [netdrv] bnx2: Use SIMPLE_DEV_PM_OPS (Neil Horman) [725061]
  - [netdrv] bnx2: Refactor WoL setup into a separate function (Neil Horman) [725061]
  - [netdrv] bnx2: Use kernel APIs for WoL and power state changes (Neil Horman) [725061]
  - [netdrv] bnx2: Handle error condition in ->slot_reset() (Neil Horman) [725061]
  - [netdrv] bnx2: use pdev->pm_cap instead of pci_find_capability(.., PCI_CAP_ID_PM) (Neil Horman) [725061]
  - [netdrv] bnx2: Use module_pci_driver to register driver (Neil Horman) [725061]
  - [netdrv] igb: Update version number (Stefan Assmann) [726817]
  - [netdrv] igb: Implementation to report advertised/supported link on i354 devices (Stefan Assmann) [726817]
  - [netdrv] igb: Get speed and duplex for 1G non_copper devices (Stefan Assmann) [726817]
  - [netdrv] igb: Support to get 2_5G link status for appropriate media type (Stefan Assmann) [726817]
  - [netdrv] igb: No PHPM support in i354 devices (Stefan Assmann) [726817]
  - [netdrv] igb: M88E1543 PHY downshift implementation (Stefan Assmann) [726817]
  - [netdrv] igb: New PHY_ID for i354 device (Stefan Assmann) [726817]
  - [netdrv] igb: Implementation of 1-sec delay for i210 devices (Stefan Assmann) [726817]
  - [netdrv] igb: Don't look for a PBA in the iNVM when flashless (Stefan Assmann) [726817]
  - [netdrv] igb: Expose RSS indirection table for ethtool (Stefan Assmann) [726817]
  - [netdrv] igb: Add macro for size of RETA indirection table (Stefan Assmann) [726817]
  - [netdrv] igb: Fix get_fw_version function for all parts (Stefan Assmann) [726817]
  - [netdrv] igb: Add device support for flashless SKU of i210 device (Stefan Assmann) [726817]
  - [netdrv] igb: Refactor NVM read functions to accommodate devices with no flash (Stefan Assmann) [726817]
  - [netdrv] igb: Refactor of init_nvm_params (Stefan Assmann) [726817]
  - [netdrv] igb: Update MTU so that it is always at least a standard frame size (Stefan Assmann) [726817]
  - [netdrv] igb: don't allow SR-IOV without MSI-X (Stefan Assmann) [726817]
  - [netdrv] igb: Added rcu_lock to avoid race (Stefan Assmann) [726817]
  - [netdrv] igb: Read register for latch_on without return value (Stefan Assmann) [726817]
  - [netdrv] igb: Reset the link when EEE setting changed (Stefan Assmann) [726817]
  - [netdrv] igb: fix vlan filtering in promisc mode when not in VT mode (Stefan Assmann) [726817]
  - [netdrv] igb: relase -> release (Stefan Assmann) [726817]
  - [netdrv] igb: Removed unused i2c function (Stefan Assmann) [726817]
  - [netdrv] igb: Implementation of i210/i211 LED support (Stefan Assmann) [726817]
  - [netdrv] igb: Fix possible panic caused by Rx traffic arrival while interface is down (Stefan Assmann) [726817]
  - [netdrv] igb: Fix set_ethtool function to call update nvm for entire image (Stefan Assmann) [726817]
  - [netdrv] igb: SerDes flow control setting (Stefan Assmann) [726817]
  - [netdrv] igb: Support for SFP modules discovery (Stefan Assmann) [726817]
  - [netdrv] igb: Add update to last_rx_timestamp in Rx rings (Stefan Assmann) [726817]
  - [netdrv] igb: Changed LEDs blink mechanism to include designs using cathode (Stefan Assmann) [726817]
  - [virt] kvm/mmu: avoid fast page fault fixing mmio page fault (Gleb Natapov) [981979]
  - [virt] kvm/vmx: mark unusable segment as nonpresent (Gleb Natapov) [981979]
  - [virt] kvm: get rid of $(addprefix ../../../virt/kvm/, ...) in Makefiles (Gleb Natapov) [981979]
  - [virt] kvm: Fix RTC interrupt coalescing tracking (Gleb Natapov) [981979]
  - [virt] kvm: Add a tracepoint write_tsc_offset (Gleb Natapov) [981979]
  - [virt] kvm: Inform users of mmio generation wraparound (Gleb Natapov) [981979]
  - [virt] kvm: document fast invalidate all mmio sptes (Gleb Natapov) [981979]
  - [virt] kvm: document fast invalidate all pages (Gleb Natapov) [981979]
  - [virt] kvm: document fast page fault (Gleb Natapov) [981979]
  - [virt] kvm: document mmio page fault (Gleb Natapov) [981979]
  - [virt] kvm: document write_flooding_count (Gleb Natapov) [981979]
  - [virt] kvm: document clear_spte_count (Gleb Natapov) [981979]
  - [virt] kvm: drop kvm_mmu_zap_mmio_sptes (Gleb Natapov) [981979]
  - [virt] kvm: init kvm generation close to mmio wrap-around value (Gleb Natapov) [981979]
  - [virt] kvm: add tracepoint for check_mmio_spte (Gleb Natapov) [981979]
  - [virt] kvm: fast invalidate all mmio sptes (Gleb Natapov) [981979]
  - [virt] kvm: make return value of mmio page fault handler more readable (Gleb Natapov) [981979]
  - [virt] kvm: store generation-number into mmio spte (Gleb Natapov) [981979]
  - [virt] kvm: retain more available bits on mmio spte (Gleb Natapov) [981979]
  - [virt] kvm: update the documentation for reverse mapping of parent_pte (Gleb Natapov) [981979]
  - [Documentation] kvm: fix section numbers (Gleb Natapov) [981979]
  - [virt] kvm: handle idiv overflow at kvm_write_tsc (Gleb Natapov) [981979]
  - [virt] kvm: reduce KVM_REQ_MMU_RELOAD when root page is zapped (Gleb Natapov) [981979]
  - [virt] kvm: reclaim the zapped-obsolete page first (Gleb Natapov) [981979]
  - [virt] kvm: collapse TLB flushes when zap all pages (Gleb Natapov) [981979]
  - [virt] kvm: zap pages in batch (Gleb Natapov) [981979]
  - [virt] kvm: do not reuse the obsolete page (Gleb Natapov) [981979]
  - [virt] kvm: add tracepoint for kvm_mmu_invalidate_all_pages (Gleb Natapov) [981979]
  - [virt] kvm: show mmu_valid_gen in shadow page related tracepoints (Gleb Natapov) [981979]
  - [virt] kvm: use the fast way to invalidate all pages (Gleb Natapov) [981979]
  - [virt] kvm: fast invalidate all pages (Gleb Natapov) [981979]
  - [virt] kvm: drop unnecessary kvm_reload_remote_mmus (Gleb Natapov) [981979]
  - [virt] kvm: drop calling kvm_mmu_zap_all in emulator_fix_hypercall (Gleb Natapov) [981979]
  - [virt] kvm: exclude ioeventfd from counting kvm_io_range limit (Gleb Natapov) [981979]
  - [virt] kvm: convert XADD to fastop (Gleb Natapov) [981979]
  - [virt] kvm: drop unused old-style inline emulation (Gleb Natapov) [981979]
  - [virt] kvm: convert DIV/IDIV to fastop (Gleb Natapov) [981979]
  - [virt] kvm: convert single-operand MUL/IMUL to fastop (Gleb Natapov) [981979]
  - [virt] kvm: Switch fastop src operand to RDX (Gleb Natapov) [981979]
  - [virt] kvm: switch MUL/DIV to DstXacc (Gleb Natapov) [981979]
  - [virt] kvm: decode extended accumulator explicity (Gleb Natapov) [981979]
  - [virt] kvm: add support for writing back the source operand (Gleb Natapov) [981979]
  - [virt] kvm: clenaup locking in mmu_free_roots() (Gleb Natapov) [981979]
  - [virt] kvm: limit difference between kvmclock updates (Gleb Natapov) [981979]
  - [virt] kvm: Remove support for reporting coalesced APIC IRQs (Gleb Natapov) [981979]
  - [virt] kvm: Use kvm_mmu_sync_roots() in kvm_mmu_load() (Gleb Natapov) [981979]
  - [virt] kvm: add missing misc_deregister() on error in kvm_init() (Gleb Natapov) [981979]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-24.el7]
changelog:
  - [Documentation] kvm: Add documentation on Hypercalls and features used for PV spinlock (Andrew Jones) [981581]
  - [virt] kvm: Simplify kvm_for_each_vcpu with kvm_irq_delivery_to_apic (Andrew Jones) [981581]
  - [virt] kvm: Add a hypercall to KVM hypervisor to support pv-ticketlocks (Andrew Jones) [981581]
  - [virt] kvm: Paravirtual ticketlocks support for linux guests running on KVM hypervisor (Andrew Jones) [981581]
  - [virt] kvm: Add configuration support to enable debug information for KVM Guests (Andrew Jones) [981581]
  - [virt] kvm: Add KICK_CPU and PV_UNHALT definition to uapi (Andrew Jones) [981581]
  - [virt] pvticketlock: Allow interrupts to be enabled while blocking (Andrew Jones) [981581]
  - [virt] ticketlock: Add slowpath logic (Andrew Jones) [981581]
  - [kernel] jump_label: Split jumplabel ratelimit (Andrew Jones) [981581]
  - [virt] pvticketlock: Use callee-save for lock_spinning (Andrew Jones) [981581]
  - [virt] pvticketlocks: Add xen_nopvspin parameter to disable xen pv ticketlocks (Andrew Jones) [981581]
  - [virt] pvticketlock: Xen implementation for PV ticket locks (Andrew Jones) [981581]
  - [virt] xen: Defer spinlock setup until boot CPU setup (Andrew Jones) [981581]
  - [virt] ticketlock: Collapse a layer of functions (Andrew Jones) [981581]
  - [virt] ticketlock: Don't inline _spin_unlock when using paravirt spinlocks (Andrew Jones) [981581]
  - [virt] spinlock: Replace pv spinlocks with pv ticketlocks (Andrew Jones) [981581]
  - [fs] proc/vmcore: support mmap() on /proc/vmcore (Nigel Croxon) [990298]
  - [fs] proc/vmcore: calculate vmcore file size from buffer size and total size of vmcore objects (Nigel Croxon) [990298]
  - [fs] proc/vmcore: allow user process to remap ELF note segment buffer (Nigel Croxon) [990298]
  - [fs] proc/vmcore: allocate ELF note segment in the 2nd kernel vmalloc memory (Nigel Croxon) [990298]
  - [mm] vmalloc: introduce remap_vmalloc_range_partial (Nigel Croxon) [990298]
  - [mm] vmalloc: make find_vm_area check in range (Nigel Croxon) [990298]
  - [fs] proc/vmcore: treat memory chunks referenced by PT_LOAD program header entries in page-size boundary in vmcore_list (Nigel Croxon) [990298]
  - [fs] proc/vmcore: allocate buffer for ELF headers on page-size alignment (Nigel Croxon) [990298]
  - [fs] proc/vmcore: clean up read_vmcore() (Nigel Croxon) [990298]
  - [mm] add PAGE_ALIGNED() helper (Nigel Croxon) [990298]
  - [fs] nfs Fix up nfs4_proc_lookup_mountpoint (Jeff Layton) [1007357]
  - [fs] nfs: Don't check lock owner compatability unless file is locked (part 2) (Jeff Layton) [1007035]
  - [fs] nfs: Don't check lock owner compatibility in writes unless file is locked (Jeff Layton) [1007035]
  - [pci] Remove pcie_cap_has_devctl() (Myron Stowe) [1005229]
  - [pci] Support PCIe Capability Slot registers only for ports with slots (Myron Stowe) [1005229]
  - [pci] Remove PCIe Capability version checks (Myron Stowe) [1005229]
  - [pci] Allow PCIe Capability link-related register access for switches (Myron Stowe) [1005229]
  - [pci] Add offsets of PCIe capability registers (Myron Stowe) [1005229]
  - [pci] Tidy bitmasks and spacing of PCIe capability definitions (Myron Stowe) [1005229]
  - [pci] Remove obsolete comment reference to pci_pcie_cap2() (Myron Stowe) [1005229]
  - [pci] Clarify PCI_EXP_TYPE_PCI_BRIDGE comment (Myron Stowe) [1005229]
  - [pci] Rename PCIe capability definitions to follow convention (Myron Stowe) [1005229]
  - [pci] Warn if unsafe MPS settings detected (Myron Stowe) [1005229]
  - [pci] Fix MPS peer-to-peer DMA comment syntax (Myron Stowe) [1005229]
  - [pci] Disable decoding for BAR sizing only when it was actually enabled (Myron Stowe) [1005229]
  - [pci] Add comment about needing pci_msi_off() even when CONFIG_PCI_MSI=n (Myron Stowe) [1005229]
  - [pci] Add pcibios_pm_ops for optional arch-specific hibernate functionality (Myron Stowe) [1005229]
  - [pci] Don't restrict MPS for slots below Root Ports (Myron Stowe) [1005229]
  - [pci] Simplify MPS test for Downstream Port (Myron Stowe) [1005229]
  - [pci] Remove unnecessary check for pcie_get_mps() failure (Myron Stowe) [1005229]
  - [pci] Simplify pcie_bus_configure_settings() interface (Myron Stowe) [1005229]
  - [pci] Drop "PCI-E" prefix from Max Payload Size message (Myron Stowe) [1005229]
  - [pci] Add pci_probe_reset_slot() and pci_probe_reset_bus() (Myron Stowe) [1005229]
  - [pci] Remove aer_do_secondary_bus_reset() (Myron Stowe) [1005229]
  - [pci] Tune secondary bus reset timing (Myron Stowe) [1005229]
  - [pci] Wake-up devices before saving config space for reset (Myron Stowe) [1005229]
  - [pci] Add pci_reset_slot() and pci_reset_bus() (Myron Stowe) [1005229]
  - [pci] Split out pci_dev lock/unlock and save/restore (Myron Stowe) [1005229]
  - [pci] Add slot reset option to pci_dev_reset() (Myron Stowe) [1005229]
  - [pci] pciehp: Add reset_slot() method (Myron Stowe) [1005229]
  - [pci] Add hotplug_slot_ops.reset_slot() (Myron Stowe) [1005229]
  - [pci] quirks: Use pci_wait_for_pending_transaction() instead of for loop (Myron Stowe) [1005229]
  - [netdrv] bnx2x: Use pci_wait_for_pending_transaction() instead of for loop (Myron Stowe) [1005229]
  - [pci] quirks: Enable Bus Master during Function-Level Reset on Chelsio (Myron Stowe) [1005229]
  - [pci] Add pci_wait_for_pending_transaction() (Myron Stowe) [1005229]
  - [pci] Add pci_reset_bridge_secondary_bus() (Myron Stowe) [1005229]
  - [pci] Align bridge I/O windows as required by downstream devices & bridges (Myron Stowe) [1005229]
  - [pci] Fix types in pbus_size_io() (Myron Stowe) [1005229]
  - [pci] Add comments for pbus_size_mem() parameters (Myron Stowe) [1005229]
  - [pci] Enumerate subordinate buses, not devices, in pci_bus_get_depth() (Myron Stowe) [1005229]
  - [pci] Fix comment typo for pci_add_cap_save_buffer() (Myron Stowe) [1005229]
  - [pci] Return -ENOSYS for SR-IOV operations on non-SR-IOV devices (Myron Stowe) [1005229]
  - [pci] Update NumVFs register when disabling SR-IOV (Myron Stowe) [1005229]
  - [pci] mmconfig: Check earlier for MMCONFIG region at address zero (Myron Stowe) [1005229]
  - [pci] Assign resources for hot-added host bridge more aggressively (Myron Stowe) [1005229]
  - [pci] Move resource reallocation code to non-__init (Myron Stowe) [1005229]
  - [pci] Delay enabling bridges until they're needed (Myron Stowe) [1005229]
  - [pci] Assign resources on a per-bus basis (Myron Stowe) [1005229]
  - [pci] Enable unassigned resource reallocation on per-bus basis (Myron Stowe) [1005229]
  - [pci] Turn on reallocation for unassigned resources with host bridge offset (Myron Stowe) [1005229]
  - [pci] Look for unassigned resources on per-bus basis (Myron Stowe) [1005229]
  - [pci] Drop temporary variable in pci_assign_unassigned_resources() (Myron Stowe) [1005229]
  - [pci] Claim ACS support for AMD southbridge devices (Myron Stowe) [1005229]
  - [pci] Differentiate ACS controllable from enabled (Myron Stowe) [1005229]
  - [pci] Check all ACS features for multifunction downstream ports (Myron Stowe) [1005229]
  - [pci] Convert class code to use dev_groups (Myron Stowe) [1005229]
  - [pci] mrst: Cleanup checkpatch.pl warnings (Myron Stowe) [1005229]
  - [pci] Rename "PCI Express support" kconfig title (Myron Stowe) [1005229]
  - [pci] Fix comment typo in iov.c (Myron Stowe) [1005229]
  - [fs] sysfs: use file mode defines from stat.h (Myron Stowe) [1005229]
  - [fs] sysfs: add more helper macro's for (bin_)attribute(_groups) (Myron Stowe) [1005229]
  - [misc] device: add default groups to struct class (Myron Stowe) [1005229]
  - [misc] device: Introduce device_create_groups (Myron Stowe) [1005229]
  - [fs] sysfs: prevent warning when only using binary attributes (Myron Stowe) [1005229]
  - [fs] sysfs: add support for binary attributes in groups (Myron Stowe) [1005229]
  - [misc] device: add RW and RO attribute macros (Myron Stowe) [1005229]
  - [misc] sysfs: add BIN_ATTR macro (Myron Stowe) [1005229]
  - [misc] sysfs: add ATTRIBUTE_GROUPS() macro (Myron Stowe) [1005229]
  - [misc] sysfs: add __ATTR_RW() macro (Myron Stowe) [1005229]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-25.el7]
changelog:
  - [scsi] mpt2sas: Bump driver version to v16.100.00.00 (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Remove phys on topology change (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Fix for kernel panic when driver loads with HBA connected to non LUN 0 configured expander (Tomas Henzl) [736230]
  - [scsi] mpt2sas: when Async scanning is enabled then while scanning, devices are removed but their transport layer entries are not removed (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Infinite loop can occur if MPI2_IOCSTATUS_CONFIG_INVALID_PAGE is not returned (Tomas Henzl) [736230]
  - [scsi] mpt2sas: The copyright in driver sources is updated for the year 2013 (Tomas Henzl) [736230]
  - [scsi] mpt2sas: MPI2 Rev X (2.00.16) specifications (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Change in MPI2_RAID_ACTION_SYSTEM_SHUTDOWN_INITIATED notification methodology (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Null pointer deference possibility in mpt2sas_ctl_event_callback function (Tomas Henzl) [736230]
  - [scsi] mpt2sas: fix cleanup on controller resource mapping failure (Tomas Henzl) [736230]
  - [scsi] mpt2sas: fix for unused variable 'event_data' warning (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Calulate the Reply post queue depth calculation as per the MPI spec (Tomas Henzl) [736230]
  - [scsi] mpt2sas: fix firmware failure with wrong task attribute (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Fix for device scan following host reset could get stuck in a infinite loop (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Update the timing requirements for issuing a Hard Reset (Tomas Henzl) [736230]
  - [scsi] mpt2sas: MPI2 Rev W (2.00.15) specification (Tomas Henzl) [736230]
  - [powerpc] Fix possible deadlock on page fault (Steve Best) [999374]
  - [scsi] qla2xxx: Update driver version to 8.06.00.08.07.0-k (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Select link initialization option bits from current operating mode (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add loopback IDC-TIME-EXTEND aen handling support (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Set default critical temperature value in cases when ISPFX00 firmware doesn't provide it (Chad Dupuis) [725014]
  - [scsi] qla2xxx: QLAFX00 make over temperature AEN handling informational, add log for normal temperature AEN (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Correct Interrupt Register offset for ISPFX00 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove handling of Shutdown Requested AEN from qlafx00_process_aen() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Send all AENs for ISPFx00 to above layers (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add changes in initialization for ISPFX00 cards with BIOS (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add changes to support extended IOs for ISPFX00 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add missing FCP statistics to sysfs interface (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Make log message that prints when a completion status requires a port down more readable (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add critical temperature handling for ISPFX00 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Notify ISPFX00 firmware when driver is unloaded or system is shut down (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Reconfigure thermal temperature (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add setting of driver version string for vendor application (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove QL_DEBUG_LEVEL_17 defines from qla_nx.c (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add ISPFX00 specific bus reset routine (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Perform warm reset every 2 minutes if firmware load fails for ISPFX00 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Set factory reset recovery timeout to 10 min. for ISPFX00 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Correct multiqueue offset calculations (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Fix incorrect test after list_for_each_entry() exits (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add support for ISP8044 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Print some variables to hexadecimal string via *phN format (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Fix sparse warnings in qlafx00_fxdisc_iocb function (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Properly set the tagging for commands (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Fix a memory leak in an error path of qla2x00_process_els() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove an unused variable from qla2x00_remove_one() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Fix qla2xxx_check_risc_status() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Help Coverity with analyzing ct_sns_pkt initialization (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove redundant assignments (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove a dead assignment in qla24xx_build_scsi_crc_2_iocbs() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove two superfluous tests (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove dead code in qla2x00_configure_hba() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Clean up qla84xx_mgmt_cmd() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Clean up qla24xx_iidma() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Fix sparse warning from qla_mr.c and qla_iocb.c (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Do not take a second firmware dump when intentionally generating one (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Do not query FC statistics during chip reset (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Move qla2x00_free_device to the correct location (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Set the index in outstanding command array to NULL when cmd is aborted when the request timeout (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Clear the MBX_INTR_WAIT flag when the mailbox time-out happens (Chad Dupuis) [725014]
  - [scsi] mpt3sas: Bump driver version to v02.100.00.00 (Tomas Henzl) [889435]
  - [scsi] mpt3sas: Added a driver module parameter max_msix_vectors (Tomas Henzl) [889435]
  - [scsi] mpt3sas: fix cleanup on controller resource mapping failure (Tomas Henzl) [889435]
  - [scsi] mpt3sas: when async scanning is enabled then while scanning, devices are removed but their transport layer entries are not removed (Tomas Henzl) [889435]
  - [scsi] mpt3sas: MPI2.5 Rev F v2.5.1.1 specification (Tomas Henzl) [889435]
  - [scsi] mpt3sas: Infinite loops can occur if MPI2_IOCSTATUS_CONFIG_INVALID_PAGE is not returned (Tomas Henzl) [889435]
  - [scsi] mpt3sas: fix for kernel panic when driver loads with HBA conected to non LUN 0 configured expander (Tomas Henzl) [889435]
  - [scsi] mpt3sas: Updated the Hardware timing requirements (Tomas Henzl) [889435]
  - [scsi] mpt3sas: 2013 source code copyright (Tomas Henzl) [889435]
  - [netdrv] ixgbe: add support for older QSFP active DA cables (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: include QSFP PHY types in ixgbe_is_sfp() (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: add 1Gbps support for QSFP+ (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix SFF data dumps of SFP+ modules from an offset (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: cleanup some log messages (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: zero out mailbox buffer on init (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix link test when connected to 1Gbps link partner (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix incorrect limit value in ring transverse (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: Check return value on eeprom reads (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: disable link when adapter goes down (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: add support for quad-port x520 adapter (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: clear semaphore bits on timeouts (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: rename LL_EXTENDED_STATS to use queue instead of q (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix lockdep annotation issue for ptp's work item (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: call pcie_get_mimimum_link to check if device has enough bandwidth (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix SFF data dumps of SFP+ modules (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix semaphore lock for I2C read/writes on 82598 (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: bump version number (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: add new media type (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix fc autoneg ethtool reporting (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: Use pci_vfs_assigned instead of ixgbe_vfs_are_assigned (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: Retain VLAN filtering in promiscuous + VT mode (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: Fix Tx Hang issue with lldpad on 82598EB (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: Set the SW prio_tc values at initialization to the HW setting (Andy Gospodarek) [726818]
  - [pci] expose pcie_link_speed and pcix_bus_speed arrays (Andy Gospodarek) [726818]
  - [pci] move enum pcie_link_width into pci.h (Andy Gospodarek) [726818]
  - [pci] Add function to obtain minimum link width and speed (Andy Gospodarek) [726818]
  - [netdrv] cnic: Update version to 2.5.18 (Tomas Henzl) [725064]
  - [netdrv] cnic: Eliminate local copy of pfid (Tomas Henzl) [725064]
  - [netdrv] cnic: Eliminate CNIC_PORT macro and port_mode in local struct (Tomas Henzl) [725064]
  - [netdrv] cnic: Redefine BNX2X_HW_CID using existing bnx2x macros (Tomas Henzl) [725064]
  - [netdrv] cnic: Use CHIP_NUM macros from bnx2x.h (Tomas Henzl) [725064]
  - [netdrv] cnic: Convert mac address uses of 6 to ETH_ALEN (Tomas Henzl) [725064]
  - [netdrv] cnic: Update version to 2.5.17 and copyright year (Tomas Henzl) [725064]
  - [netdrv] cnic: Add missing error checking for RAMROD_CMD_ID_CLOSE (Tomas Henzl) [725064]
  - [netdrv] cnic: Update TCP options setup for iSCSI (Tomas Henzl) [725064]
  - [netdrv] cnic: Reset tcp_flags during cnic_cm_create() (Tomas Henzl) [725064]
  - [netdrv] cnic: Simplify cnic_release() (Tomas Henzl) [725064]
  - [netdrv] cnic: Simplify netdev events handling (Tomas Henzl) [725064]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-26.el7]
changelog:
  - [net] tuntap: correctly handle error in tun_set_iff() (Jiri Benc) [1007739] {CVE-2013-4343}
  - [net] sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit (Daniel Borkmann) [998398] {CVE-2013-4350}
  - [net] netlink: filter particular protocols from analyzers (Daniel Borkmann) [957721]
  - [net] ipv6: accept tlv which includes only padding (Jiri Pirko) [990968]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-27.el7]
changelog:
  - [netdrv] i40e: include i40e in kernel proper (Stefan Assmann) [726825]
  - [netdrv] i40e: debugfs interface (Stefan Assmann) [726825]
  - [netdrv] i40e: init code and hardware support (Stefan Assmann) [726825]
  - [netdrv] i40e: implement virtual device interface (Stefan Assmann) [726825]
  - [netdrv] i40e: driver core headers (Stefan Assmann) [726825]
  - [netdrv] i40e: driver ethtool core (Stefan Assmann) [726825]
  - [netdrv] i40e: transmit, receive, and NAPI (Stefan Assmann) [726825]
  - [netdrv] i40e: main driver core (Stefan Assmann) [726825]
  - [netdrv] e1000e: balance semaphore put/get for 82573 (Dean Nelson) [726816]
  - [netdrv] e1000e: resolve checkpatch JIFFIES_COMPARISON warning (Dean Nelson) [726816]
  - [netdrv] e1000e: Avoid kernel crash during shutdown (Dean Nelson) [726816]
  - [netdrv] e1000e: Add code to check for failure of pci_disable_link_state call (Dean Nelson) [726816]
  - [netdrv] e1000e: cleanup whitespace in recent commit (Dean Nelson) [726816]
  - [netdrv] e1000e: fix I217/I218 PHY initialization flow (Dean Nelson) [726816]
  - [netdrv] e1000e: do not resume device from RPM suspend to read PHY status registers (Dean Nelson) [726816]
  - [netdrv] e1000e: enable support for new device IDs (Dean Nelson) [726816]
  - [netdrv] e1000e: ethtool unnecessarily takes device out of RPM suspend (Dean Nelson) [726816]
  - [netdrv] e1000e: Tx hang on I218 when linked at 100Half and slow response at 10Mbps (Dean Nelson) [726816]
  - [netdrv] e1000e: low throughput using 4K jumbos on I218 (Dean Nelson) [726816]
  - [netdrv] e1000e: iAMT connections drop on driver unload when jumbo frames enabled (Dean Nelson) [726816]
  - [netdrv] e1000e: disable ASPM L1 on 82583 (Dean Nelson) [726816]
  - [netdrv] e1000e: Use marco instead of digit for defining e1000_rx_desc_packet_split (Dean Nelson) [726816]
  - [netdrv] e1000e: Remove duplicate assignment of default rx/tx ring size (Dean Nelson) [726816]
  - [netdrv] e1000e: restore call to pci_clear_master() (Dean Nelson) [726816]
  - [netdrv] e1000e: Release mutex lock only if it has been initially acquired (Dean Nelson) [726816]
  - [netdrv] e1000e: prevent warning from -Wunused-parameter (Dean Nelson) [726816]
  - [netdrv] e1000e: cleanup whitespace (Dean Nelson) [726816]
  - [netdrv] bna: Staticize local functions (Ivan Vecera) [978045]
  - [netdrv] bna: switch to fixed_size_llseek() (Ivan Vecera) [978045]
  - [fs] read_write: new helper, fixed_size_llseek() (Ivan Vecera) [978045]
  - [netdrv] bna: Driver and Firmware Updated (Ivan Vecera) [978045]
  - [netdrv] bna: Enahncement to Identify Default IOC Function (Ivan Vecera) [978045]
  - [netdrv] bna: Fix Ucast Failure Handling (Ivan Vecera) [978045]
  - [netdrv] bna: Clear Driver Config Flags When HW Resets (Ivan Vecera) [978045]
  - [netdrv] tg3: Don't turn off led on 5719 serdes port 0 (Ivan Vecera) [1006987]
  - [netdrv] tg3: Convert dma_alloc_coherent(...__GFP_ZERO) to dma_zalloc_coherent (Ivan Vecera) [1006987]
  - [netdrv] tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset (Ivan Vecera) [1006987]
  - [netdrv] tg3: clean up unnecessary MSI/MSI-X capability find (Ivan Vecera) [1006987]
  - [netdrv] tg3: Fix warning from pci_disable_device() (Ivan Vecera) [1006987]
  - [netdrv] tg3: Fix kernel crash (Ivan Vecera) [1006987]
  - [netdrv] tg3: Update version to 3.133 (Ivan Vecera) [1006987]
  - [netdrv] tg3: Fix UDP fragments treated as RMCP (Ivan Vecera) [1006987]
  - [netdrv] tg3: Enable support for timesync gpio output (Ivan Vecera) [1006987]
  - [netdrv] tg3: Implement the shutdown handler (Ivan Vecera) [1006987]
  - [netdrv] tg3: Allow NVRAM programming when interface is down (Ivan Vecera) [1006987]
  - [netdrv] tg3: Remove incorrect switch to aux power (Ivan Vecera) [1006987]
  - [netdrv] tg3: Prevent system hang during repeated EEH errors (Ivan Vecera) [1006987]
  - [netdrv] tg3: remove redundant pm init code (Ivan Vecera) [1006987]
  - [netdrv] tg3: Remove unnecessary lock around tg3_flag_set (Ivan Vecera) [1006987]
  - [netdrv] tg3: Fix misplaced empty line (Ivan Vecera) [1006987]
  - [netdrv] tg3: Use descriptive label names in tg3_start (Ivan Vecera) [1006987]
  - [netdrv] tg3: Make tg3_rings_reset() more concise (Ivan Vecera) [1006987]
  - [netdrv] tg3: Simplify ring control block setup (Ivan Vecera) [1006987]
  - [netdrv] tg3: Split APE driver state change out of boot reset signature update (Ivan Vecera) [1006987]
  - [netdrv] tg3: Use module_pci_driver to register driver (Ivan Vecera) [1006987]
  - [netdrv] tg3: Implement set/get_eee handlers (Ivan Vecera) [1006987]
  - [netdrv] tg3: Simplify tg3_phy_eee_config_ok() by reusing tg3_eee_pull_config() (Ivan Vecera) [1006987]
  - [netdrv] tg3: Add tg3_eee_pull_config() function (Ivan Vecera) [1006987]
  - [netdrv] tg3: Add ethtool_eee struct and tg3_setup_eee() (Ivan Vecera) [1006987]
  - [netdrv] be2net: set and query VEB/VEPA mode of the PF interface (Ivan Vecera) [726160]
  - [netdrv] be2net: Convert dma_alloc_coherent(...__GFP_ZERO) to dma_zalloc_coherent (Ivan Vecera) [726160]
  - [netdrv] be2net: implement ethtool set/get_channel hooks (Ivan Vecera) [726160]
  - [netdrv] be2net: refactor be_setup() to consolidate queue creation routines (Ivan Vecera) [726160]
  - [netdrv] be2net: Fix be_cmd_if_create() to use MBOX if MCCQ is not created (Ivan Vecera) [726160]
  - [netdrv] be2net: refactor be_get_resources() code (Ivan Vecera) [726160]
  - [netdrv] be2net: Fixup profile management routines (Ivan Vecera) [726160]
  - [netdrv] be2net: use EQ_CREATEv2 for SH-R (Ivan Vecera) [726160]
  - [netdrv] be2net: Check for POST state in suspend-resume sequence (Ivan Vecera) [726160]
  - [netdrv] be2net: fix disabling TX in be_close() (Ivan Vecera) [726160]
  - [netdrv] be2net: Clear any capability flags that driver is not interested in (Ivan Vecera) [726160]
  - [netdrv] be2net: update driver version (Ivan Vecera) [726160]
  - [netdrv] be2net: Initialize "status" in be_cmd_get_die_temperature() (Ivan Vecera) [726160]
  - [netdrv] be2net: fixup log msgs for async events (Ivan Vecera) [726160]
  - [netdrv] be2net: Fix displaying supported speeds for BE2 (Ivan Vecera) [726160]
  - [netdrv] be2net: don't limit max MAC and VLAN counts (Ivan Vecera) [726160]
  - [netdrv] be2net: Do not call get_die_temperature cmd for VF (Ivan Vecera) [726160]
  - [netdrv] be2net: Adding more speeds reported by get_settings (Ivan Vecera) [726160]
  - [netdrv] be2net: Staticize local functions (Ivan Vecera) [726160]
  - [netdrv] be2net: don't use dev_err when AER enabling fails (Ivan Vecera) [726160]
  - [netdrv] be2net: delete primary MAC address while unloading (Ivan Vecera) [726160]
  - [netdrv] be2net: use SET/GET_MAC_LIST for SH-R (Ivan Vecera) [726160]
  - [netdrv] be2net: refactor MAC-addr setup code (Ivan Vecera) [726160]
  - [netdrv] be2net: fix pmac_id for BE3 VFs (Ivan Vecera) [726160]
  - [netdrv] be2net: allow VFs to program MAC and VLAN filters (Ivan Vecera) [726160]
  - [netdrv] be2net: fix MAC address modification for VF (Ivan Vecera) [726160]
  - [netdrv] be2net: replace numeric with standard PM state macros (Ivan Vecera) [726160]
  - [netdrv] be2net: use pci_vfs_assigned()/pci_num_vf() instead of be_find_vfs() (Ivan Vecera) [726160]
  - [netdrv] be2net: Implement initiate FW dump feature for Lancer (Ivan Vecera) [726160]
  - [netdrv] be2net: Trim padded packets for Lancer (Ivan Vecera) [726160]
  - [netdrv] be2net: Pad skb to meet min Tx pkt size in lancer (Ivan Vecera) [726160]
  - [netdrv] be2net: cleanup be_get_drvinfo() (Ivan Vecera) [726160]
  - [netdrv] be2net: refactor HW workarounds in be_xmit() (Ivan Vecera) [726160]
  - [netdrv] mlx5: remove unused MLX5_DEBUG param in Kconfig (Amir Vadai) [864578]
  - [netdrv] mlx5: Support MANAGE_PAGES and QUERY_PAGES firmware command changes (Amir Vadai) [864578]
  - [netdrv] mlx5: remove health handler plugin (Amir Vadai) [864578]
  - [infiniband] mlx5: Variable may be used uninitialized (Amir Vadai) [864578]
  - [netdrv] mlx5: Implement new initialization sequence (Amir Vadai) [864578]
  - [infiniband] mlx5: Fix stack info leak in mlx5_ib_alloc_ucontext() (Amir Vadai) [864578]
  - [infiniband] mlx5: Fix error return code in init_one() (Amir Vadai) [864578]
  - [netdrv] mlx5: fix error return code in mlx5_alloc_uuars() (Amir Vadai) [864578]
  - [netdrv] mlx5: use after free in mlx5_cmd_comp_handler() (Amir Vadai) [864578]
  - [netdrv] mlx5: Fix __udivdi3 when compiling for 32 bit arches (Amir Vadai) [864578]
  - [netdrv] mlx5: Return -EFAULT instead of -EPERM (Amir Vadai) [864578]
  - [netdrv] mlx5: Adjust hca_cap.uar_page_sz to conform to Connect-IB spec (Amir Vadai) [864578]
  - [netdrv] mlx5: Fixes for sparse warnings (Amir Vadai) [864578]
  - [infiniband] mlx5: Make profile[] static in main.c (Amir Vadai) [864578]
  - [infiniband] mlx5: Add driver for Mellanox Connect-IB adapters (Amir Vadai) [864578]
  - [infiniband] core: Add reserved values to enums for low-level driver use (Amir Vadai) [864578]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-28.el7]
changelog:
  - [fs] namei: Add missing unlocks to error paths of mountpoint_last (Jeff Layton) [980172]
  - [fs] autofs4: fix device ioctl mount lookup (Jeff Layton) [980172]
  - [fs] namei: introduce kern_path_mountpoint() (Jeff Layton) [980172]
  - [fs] namei: rename user_path_umountat() to user_path_mountpoint_at() (Jeff Layton) [980172]
  - [fs] namei: take unlazy_walk() into umount_lookup_last() (Jeff Layton) [980172]
  - [fs] vfs: allow umount to handle mountpoints without revalidating them (Jeff Layton) [980172]
  - [acpi] apei: Soft-offline a page on firmware GHES notification (Janet Morgan) [984133]
  - [acpi] apei: Add a boot option to disable ff mode for corrected errors (Janet Morgan) [984133]
  - [mcheck] mce: Honour Firmware First for MCA banks listed in APEI HEST CMC (Janet Morgan) [984133]
  - [fs] cifs: Respect epoch value from create lease context v2 (Sachin Prabhu) [1007981]
  - [fs] cifs: Add create lease v2 context for SMB3 (Sachin Prabhu) [1007981]
  - [fs] cifs: Move parsing lease buffer to ops struct (Sachin Prabhu) [1007981]
  - [fs] cifs: Move creating lease buffer to ops struct (Sachin Prabhu) [1007981]
  - [fs] cifs: Store lease state itself rather than a mapped oplock value (Sachin Prabhu) [1007981]
  - [fs] cifs: Replace clientCanCache* bools with an integer (Sachin Prabhu) [1007981]
  - [fs] cifs: quiet sparse compile warning (Sachin Prabhu) [1007981]
  - [fs] cifs: Start using per session key for smb2/3 for signature generation (Sachin Prabhu) [1007981]
  - [fs] cifs: Add a variable specific to NTLMSSP for key exchange (Sachin Prabhu) [1007981]
  - [fs] cifs: Process post session setup code in respective dialect functions (Sachin Prabhu) [1007981]
  - [fs] cifs: convert to use le32_add_cpu() (Sachin Prabhu) [1007981]
  - [fs] cifs: Fix missing lease break (Sachin Prabhu) [1007981]
  - [fs] cifs: Fix a memory leak when a lease break comes (Sachin Prabhu) [1007981]
  - [fs] cifs: convert case-insensitive dentry ops to use new case conversion routines (Sachin Prabhu) [1007981]
  - [fs] cifs: add new case-insensitive conversion routines that are based on wchar_t's (Sachin Prabhu) [1007981]
  - [fs] cifs: Move and expand MAX_SERVER_SIZE definition (Sachin Prabhu) [1007981]
  - [fs] cifs: Expand max share name length to 256 (Sachin Prabhu) [1007981]
  - [fs] cifs: Move string length definitions to uapi (Sachin Prabhu) [1007981]
  - [fs] cifs: Implement follow_link for nounix CIFS mounts (Sachin Prabhu) [1007981]
  - [fs] cifs: Implement follow_link for SMB2 (Sachin Prabhu) [1007981]
  - [fs] cifs: display iocharset= option in /proc/mounts (Sachin Prabhu) [1007981]
  - [fs] cifs: create a new Documentation/ directory and move docfiles into it (Sachin Prabhu) [1007981]
  - [fs] cifs: ensure that srv_mutex is held when dealing with ssocket pointer (Sachin Prabhu) [1007981]
  - [fs] cifs: don't instantiate new dentries in readdir for inodes that need to be revalidated immediately (Sachin Prabhu) [1007981]
  - [fs] cifs: set sb->s_d_op before calling d_make_root() (Sachin Prabhu) [1007981]
  - [fs] cifs: file, initialize oparms.reconnect before using it (Sachin Prabhu) [1007981]
  - [fs] cifs: Do not attempt to do cifs operations reading symlinks with SMB2 (Sachin Prabhu) [1007981]
  - [fs] cifs: extend the buffer length enought for sprintf() using (Sachin Prabhu) [1007981]
  - [fs] dlm: log an error for unmanaged lockspaces (David Teigland) [1008005]
  - [acpi] acpi_ipmi, replace mutex with spin_lock_irqsave (Tony Camuso) [1007574]
  - [kernel] sched: Micro-optimize the smart wake-affine logic (Larry Woodman) [947186]
  - [kernel] sched: Implement smarter wake-affine logic (Larry Woodman) [947186]
  - [net] sunrpc: rpcauth_create needs to know about rpc_clnt clone status (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Share all credential caches on a per-transport basis (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Share rpc_pipes when an rpc_clnt owns multiple rpcsec auth caches (Jeff Layton) [1002576]
  - [net] sunrpc: Add a helper to allow sharing of rpc_pipefs directory objects (Jeff Layton) [1002576]
  - [net] sunrpc: Remove the rpc_client->cl_dentry (Jeff Layton) [1002576]
  - [fs] nfs: Convert idmapper to use the new framework for pipefs dentries (Jeff Layton) [1002576]
  - [net] sunrpc: Remove the obsolete auth-only interface for pipefs dentry management (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Switch auth_gss to use the new framework for pipefs dentries (Jeff Layton) [1002576]
  - [net] sunrpc: Add a framework to clean up management of rpc_pipefs directories (Jeff Layton) [1002576]
  - [fs] nfs: Fix a potentially Oopsable condition in __nfs_idmap_unregister (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Fix an Oopsable condition when creating/destroying pipefs objects (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Further cleanups (Jeff Layton) [1002576]
  - [net] sunrpc: Replace clnt->cl_principal (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Clean up upcall message allocation (Jeff Layton) [1002576]
  - [net] sunrpc: Cleanup rpc_setup_pipedir (Jeff Layton) [1002576]
  - [net] sunrpc: Remove unused struct rpc_clnt field cl_protname (Jeff Layton) [1002576]
  - [net] sunrpc: Deprecate rpc_client->cl_protname (Jeff Layton) [1002576]
  - [net] sunrpc/rpc_pipe: convert back to simple_dir_inode_operations (Jeff Layton) [1002576]
  - [fs] libfs: make simple_lookup() usable for filesystems that set ->s_d_op (Jeff Layton) [1002576]
  - [net] sunrpc: __rpc_lookup_create_exclusive, pass string instead of qstr (Jeff Layton) [1002576]
  - [net] sunrpc: rpc_create_*_dir, don't bother with qstr (Jeff Layton) [1002576]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-29.el7]
changelog:
  - [s390] zfcp: remove access control tables interface (keep sysfs files) (Hendrik Brueckner) [1006516]
  - [s390] zfcp: fix lock imbalance by reworking request queue locking (Hendrik Brueckner) [1006525]
  - [s390] zfcp: fix schedule-inside-lock in scsi_device list loops (Hendrik Brueckner) [1006524]
  - [x86] setup: avoid remapping data in parse_setup_data() (Nigel Croxon) [1004428]
  - [hid] validate HID report id size (Frantisek Hrbata) [1000454] {CVE-2013-2888}
  - [kernel] userns: prevent the use of user namespaces (Aristeu Rozanski) [993320]
  - [crypto] x509: don't reject not-yet-valid keys (kyle mcmartin) [905910]
  - [kernel] perf: Prevent race in unthrottling code (Jiri Olsa) [992941]
  - [s390] pci: use adapter interrupt vector helpers (Hendrik Brueckner) [1005896]
  - [s390] pci: cleanup function names (Hendrik Brueckner) [1005896]
  - [s390] airq: introduce adapter interrupt vector helper (Hendrik Brueckner) [1005896]
  - [s390] pci: use virtual memory for iommu bitmap (Hendrik Brueckner) [1005896]
  - [s390] cio: fix unlocked access of global bitmap (Hendrik Brueckner) [1005896]
  - [s390] pci: update function handle after resume from hibernate (Hendrik Brueckner) [1005896]
  - [s390] pci: try harder to modify a function (Hendrik Brueckner) [1005896]
  - [s390] pci: split lpf (Hendrik Brueckner) [1005896]
  - [s390] hibernate: add early resume function (Hendrik Brueckner) [1005896]
  - [s390] pci: add recover sysfs knob (Hendrik Brueckner) [1005896]
  - [s390] pci: use claim_resource (Hendrik Brueckner) [1005896]
  - [s390] pci/hotplug: convert to be builtin only (Hendrik Brueckner) [1005896]
  - [s390] airq: simplify adapter interrupt code (Hendrik Brueckner) [1005896]
  - [s390] qdio: cleanup chsc SADC usage (Hendrik Brueckner) [1005896]
  - [s390] qdio: cleanup chsc SSQD usage (Hendrik Brueckner) [1005896]
  - [s390] pci: remove per device debug attribute (Hendrik Brueckner) [1005896]
  - [s390] pci: sysfs remove strlen (Hendrik Brueckner) [1005896]
  - [s390] pci: remove pdev during unplug (Hendrik Brueckner) [1005896]
  - [s390] pci: cleanup hotplug code (Hendrik Brueckner) [1005896]
  - [s390] pci: implement pcibios_release_device (Hendrik Brueckner) [1005896]
  - [s390] pci: use to_pci_dev (Hendrik Brueckner) [1005896]
  - [netdrv] sfc: check for allocation failure (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Update copyright banners (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add support for Solarflare SFC9100 family (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Make efx_mcdi_{init, fini}() call efx_mcdi_drv_attach() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Allocate NVRAM partition ID range for PHY images (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add EF10 register and structure definitions (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Extend struct efx_tx_buffer to allow pushing option descriptors (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Use a global count of active queues instead of pending drains (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Prepare for RX scatter on EF10 (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Initialise IRQ moderation for all NIC types from efx_init_eventq() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Allow efx_nic_type::dimension_resources to fail (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Allow event queue initialisation to fail (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Document conditions for multicast replication vs filter replacement (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Implement asynchronous MCDI requests (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove unnecessary use of atomic_t (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Refactor efx_mcdi_rpc_start() and efx_mcdi_copyin() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add support for new board sensors (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Use extended MC_CMD_SENSOR_INFO and MC_CMD_READ_SENSORS (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Return an error code when a sensor is busy (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add support for reading packet length from prefix (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add TX merged completion counter (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Generalise packet hash lookup to support EF10 RX prefix (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rename EFX_PAGE_BLOCK_SIZE to EFX_VI_PAGE_SIZE and adjust comments (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove early call to efx_nic_type::reconfigure_mac in efx_reset_up() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: use MCDI epoch flag to improve MC reboot detection in the driver (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add EF10 support for TX/RX DMA error events handling (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add a function pointer to abstract write of host time into NIC shared memory (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: PTP MCDI requests need to initialise periph ID field (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Delegate MAC/NIC statistic description to efx_nic_type (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove driver-local struct ethtool_string (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove more left-overs from Falcon GMAC support (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move MTD operations into efx_nic_type (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move NIC-type-specific MTD partition date into separate structures (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Eliminate struct efx_mtd (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rename SPI stuff to show that it is Falcon-specific (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Cleanup Falcon-arch simple MAC filter state (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Define and use MCDI_POPULATE_DWORD_{1, 2, 3, 4, 5, 6, 7} (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add flag for stack-owned RX MAC filters (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Refactor Falcon-arch filter removal (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Make most filter operations NIC-type-specific (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Refactor Falcon-arch search limit reset (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Split Falcon-arch-specific and common filter state (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Extend and abstract efx_filter_spec to cover Huntington/EF10 (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Name the RX drop queue ID (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rename Falcon-arch filter implementation types and functions (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove unused filter_flags variables and efx_farch_filter_id_flags() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Do not assume efx_nic_type::ev_fini is idempotent (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: EFX_WORKAROUND_ALWAYS is really specific to Falcon-architecture (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Get rid of per-NIC-type phys_addr_channels and mem_map_size (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Update and improve kernel-doc for efx_mcdi_state & efx_mcdi_iface (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fix race in completion handling (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add support for MCDI v2 (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Update MCDI protocol definitions for EF10 (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Translate MCDI error numbers received in events (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move and rename Falcon/Siena common NIC operations (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Refactor queue teardown sequence to allow for EF10 flush behaviour (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove bogus call to efx_release_tx_buffers() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Stop RX refill before flushing RX queues (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Limit scope of a Falcon A1 IRQ workaround (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rework IRQ enable/disable (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove efx_process_channel_now() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rename Falcon-architecture register definitions (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Make struct efx_special_buffer less special (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add GFP flags to efx_nic_alloc_buffer() and make most callers allow blocking (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Make MCDI independent of Siena (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Make efx_mcdi_init() call efx_mcdi_handle_assertion() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Collect all MCDI port functions into mcdi_port.c (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move efx_mcdi_mac_reconfigure() to siena.c and rename (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move siena_reset_hw() and siena_map_reset_reason() into MCDI module (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add and use MCDI_SET_QWORD() and MCDI_SET_ARRAY_QWORD() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Ensure MCDI buffers, but not lengths, are dword aligned (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Use proper macros to declare and access MCDI arrays (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Introduce and use MCDI_CTL_SDU_LEN_MAX_V1 macro for Siena-specific code (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fill out the set of MCDI accessors (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rationalise MCDI buffer accessors (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Introduce and use MCDI_DECLARE_BUF macro (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move more Falcon-specific code and definitions into falcon.c (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move details of a Falcon bug workaround out of ethtool.c (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Use efx_mcdi_mon() to find efx_mcdi_mon structure from efx_nic (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: const-qualify source pointers for MMIO write functions (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fix lookup of default RX MAC filters when steered using ethtool (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Enable RX scatter for flows steered by RFS (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fix memory leak when discarding scattered packets (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Improve test for IOMMU in use (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fix IRQ cleanup in case of a probe failure (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Do not pass non-TCP packets into GRO code (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Define and set RX buffer flag for packets parsed as TCP (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Enable accelerated RFS on vlans (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Report software timestamping capabilities (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Increase size of RX SKB header area (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Enable RX checksum offload for packets not handled by GRO (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fix EEH with legacy interrupts (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Store port number in private data, not net_device::dev_id (Nikolay Aleksandrov) [1005248]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-30.el7]
changelog:
  - [drm] qxl: add delayed fb operations (Dave Airlie) [1002056]
  - [edac] Fix lockdep splat (Aristeu Rozanski) [967459]
  - [mm] vmalloc: fix memleak in __vunmap (Jan Stancek) [1012358]
  - [x86] perf_event_amd: Rework AMD PMU init code (Prarit Bhargava) [1000672]
  - [md] dm: add reserved_bio_based_ios module parameter (Mike Snitzer) [1010450]
  - [md] dm: add reserved_rq_based_ios module parameter (Mike Snitzer) [1010450]
  - [md] dm: lower bio-based mempool reservation (Mike Snitzer) [1010450]
  - [block] Add nr_bios to block_rq_remap tracepoint (Mike Snitzer) [1010450]
  - [md] dm-mpath: disable WRITE SAME if it fails (Mike Snitzer) [987454]
  - [md] dm-mpath: do not fail path on -ENOSPC (Mike Snitzer) [1010437]
  - [scsi] Return ENODATA on medium error (Mike Snitzer) [1010437]
  - [scsi] return ENOSPC on thin provisioning failure (Mike Snitzer) [1010437]
  - [scsi] Set hostbyte status in scsi_check_sense() (Mike Snitzer) [1010437]
  - [scsi] Document enhanced error codes (Mike Snitzer) [1010437]
  - [md] dm-thin: do not expose non-zero discard limits if discards disabled (Mike Snitzer) [998421]
  - [md] dm-snapshot: fix performance degradation due to small hash size (Mike Snitzer) [1010437]
  - [md] dm-snapshot: workaround for a false positive lockdep warning (Mike Snitzer) [1010437]
  - [md] dm-stripe: silence a couple sparse warnings (Mike Snitzer) [1010437]
  - [md] dm-stats: fix possible counter corruption on 32-bit systems (Mike Snitzer) [1010437]
  - [md] dm: add statistics support (Mike Snitzer) [1010437]
  - [lib] math64: New separate div64_u64_rem helper (Mike Snitzer) [1010437]
  - [md] dm-thin: always return -ENOSPC if no_free_space is set (Mike Snitzer) [1010437]
  - [md] dm-ioctl: cleanup error handling in table_load (Mike Snitzer) [1010437]
  - [md] dm-ioctl: increase granularity of type_lock when loading table (Mike Snitzer) [1010437]
  - [md] dm-ioctl: prevent rename to empty name or uuid (Mike Snitzer) [1010437]
  - [md] dm-thin: set pool read-only if breaking_sharing fails block allocation (Mike Snitzer) [1010437]
  - [md] dm-thin: prefix pool error messages with pool device name (Mike Snitzer) [1010437]
  - [md] dm: allow error target to replace bio-based and request-based targets (Mike Snitzer) [1010437]
  - [md] dm-space-map: optimise sm_ll_dec and sm_ll_inc (Mike Snitzer) [1010437]
  - [md] dm-btree: prefetch child nodes when walking tree for a dm_btree_del (Mike Snitzer) [1010437]
  - [md] dm-btree: use pop_frame in dm_btree_del to cleanup code (Mike Snitzer) [1010437]
  - [md] dm-cache: eliminate holes in cache structure (Mike Snitzer) [1010437]
  - [md] dm-cache: fix stacking of geometry limits (Mike Snitzer) [1010437]
  - [md] dm-thin: fix stacking of geometry limits (Mike Snitzer) [1010437]
  - [md] dm-cache: add data block size limits to code and Documentation (Mike Snitzer) [1010437]
  - [md] dm: stop using WQ_NON_REENTRANT (Mike Snitzer) [1010437]
  - [md] dm-cache: avoid conflicting remove_mapping() in mq policy (Mike Snitzer) [1010437]
  - [md] dm: optimize reorder structure (Mike Snitzer) [1010437]
  - [md] dm: optimize use SRCU and RCU (Mike Snitzer) [1010437]
  - [md] dm-bufio: submit writes outside lock (Mike Snitzer) [1010437]
  - [md] dm-cache: fix arm link errors with inline (Mike Snitzer) [1010437]
  - [md] dm-verity: use __ffs and __fls (Mike Snitzer) [1010437]
  - [md] dm-flakey: correct ctr alloc failure mesg (Mike Snitzer) [1010437]
  - [md] dm-verity: remove pointless comparison (Mike Snitzer) [1010437]
  - [md] dm: use __GFP_HIGHMEM in __vmalloc (Mike Snitzer) [1010437]
  - [md] dm-verity: fix inability to use a few specific devices sizes (Mike Snitzer) [1010437]
  - [md] dm-ioctl: set noio flag to avoid __vmalloc deadlock (Mike Snitzer) [1010437]
  - [md] dm-mpath: fix ioctl deadlock when no paths (Mike Snitzer) [1010437]
  - [powerpc] Default arch idle could cede processor on pseries (Steve Best) [1008895]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-31.el7]
changelog:
  - [watchdog] hpwdt: Patch to ignore auxilary iLO devices (Nigel Croxon) [996605]
  - [s390] tx: allow program interruption filtering in user space (Hendrik Brueckner) [1006517]
  - [block] add padding for kabi to block_device_operations (Don Zickus) [988500]
  - [fs] gfs2: Don't flag consistency error if first mounter is a spectator (Robert S Peterson) [1004448]
  - [tty] disassociate_ctty() sends the extra SIGCONT (Oleg Nesterov) [1011820]
  - [x86] mm: Add memory tracking support for 1G hugepages (David Bulkow) [1000149]
  - [tty] hvc_iucv: Disconnect IUCV connection when lowering DTR (Hendrik Brueckner) [1007571]
  - [tty] hvc_console: Add DTR/RTS callback to handle HUPCL control (Hendrik Brueckner) [1007571]
  - [netdrv] enic: update enic maintainers and driver (Stefan Assmann) [747385]
  - [netdrv] enic: Exposing symbols for Cisco's low latency driver (Stefan Assmann) [747385]
  - [netdrv] enic: Try DMA 64 first, then failover to DMA (Stefan Assmann) [747385]
  - [netdrv] enic: record q_number and rss_hash for skb (Stefan Assmann) [747385]
  - [netdrv] enic: Add multi tx support for enic (Stefan Assmann) [747385]
  - [netdrv] enic: Generate notification of hardware crash (Stefan Assmann) [747385]
  - [netdrv] enic: Add an interface for USNIC to interact with firmware (Stefan Assmann) [747385]
  - [netdrv] enic: Adding support for Cisco Low Latency NIC (Stefan Assmann) [747385]
  - [netdrv] enic: Move ethtool code to a separate file (Stefan Assmann) [747385]
  - [netdrv] enic: release rtnl_lock on error-path (Stefan Assmann) [747385]
  - [powerpc] perf: Power7 Update testing ABI to list CPI-stack events (Steve Best) [1009105]
  - [powerpc] perf: Make Power7 events available for perf (Steve Best) [1009105]
  - [powerpc] perf: fix a typo of a Power7 event name (Steve Best) [1009105]
  - [tools] perf/tests: Add parse events tests for leader sampling (Jiri Olsa) [1011533]
  - [tools] perf/tests: Add attr record group sampling test (Jiri Olsa) [1011533]
  - [tools] perf: Add 'S' event/group modifier to read sample value (Jiri Olsa) [1011533]
  - [tools] perf/evsel: Add PERF_SAMPLE_READ sample related processing (Jiri Olsa) [1011533]
  - [tools] perf/evlist: Add perf_evlist__id2sid method to get event ID related data (Jiri Olsa) [1011533]
  - [tools] perf/evlist: Fix event ID retrieval for group format read case (Jiri Olsa) [1011533]
  - [tools] perf: Add support for parsing PERF_SAMPLE_READ sample type (Jiri Olsa) [1011533]
  - [kernel] perf/evlist: Use PERF_EVENT_IOC_ID perf ioctl to read event id (Jiri Olsa) [1011533]
  - [kernel] perf: Do not get values from disabled counters in group format read (Jiri Olsa) [1011533]
  - [kernel] perf: Add PERF_EVENT_IOC_ID ioctl to return event ID (Jiri Olsa) [1011533]
  - [kernel] add support for init_array constructors fix (Frantisek Hrbata) [824466]
  - [kernel] add support for init_array constructors (Frantisek Hrbata) [824466]
  - [kernel] gcov: compile specific gcov implementation based on gcc version (Frantisek Hrbata) [824466]
  - [kernel] gcov: add support for gcc 47 gcov format fix 3 (Frantisek Hrbata) [824466]
  - [kernel] gcov: add support for gcc 47 gcov format checkpatch fixes (Frantisek Hrbata) [824466]
  - [kernel] gcov: add support for gcc 47 gcov format fix fix (Frantisek Hrbata) [824466]
  - [kernel] gcov: add support for gcc 47 gcov format fix (Frantisek Hrbata) [824466]
  - [kernel] gcov: add support for gcc 4.7 gcov format (Frantisek Hrbata) [824466]
  - [kernel] gcov: move gcov structs definitions to a gcc version specific file (Frantisek Hrbata) [824466]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-32.el7]
changelog:
  - [net] netfilter: SYNPROXY: let unrelated packets continue (Jesper Brouer) [1007439]
  - [net] netfilter: synproxy_core: fix warning in __nf_ct_ext_add_length() (Jesper Brouer) [1007439]
  - [net] netfilter: more strict TCP flag matching in SYNPROXY (Jesper Brouer) [1007439]
  - [net] netfilter: add IPv6 SYNPROXY target (Jesper Brouer) [1007439]
  - [net] syncookies: export cookie_v6_init_sequence/cookie_v6_check (Jesper Brouer) [1007439]
  - [net] netfilter: add SYNPROXY core/target (Jesper Brouer) [1007439]
  - [net] syncookies: export cookie_v4_init_sequence/cookie_v4_check (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: make sequence number adjustments usuable without NAT (Jesper Brouer) [1007439]
  - [net] netfilter: nf_defrag_ipv6.o included twice (Jesper Brouer) [1007439]
  - [net] netfilter: ip[6]t_REJECT, tcp-reset using wrong MAC source if bridged (Jesper Brouer) [1007439]
  - [net] netfilter: export xt_HMARK.h to userland (Jesper Brouer) [1007439]
  - [net] netfilter: export xt_rpfilter.h to userland (Jesper Brouer) [1007439]
  - [net] netfilter: ctnetlink: fix uninitialized variable (Jesper Brouer) [1007439]
  - [net] netfilter: nfnetlink_queue: allow to attach expectations to conntracks (Jesper Brouer) [1007439]
  - [net] netfilter: ctnetlink: refactor ctnetlink_create_expect (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: fix tcp_in_window for Fast Open (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: don't send destroy events from iterator (Jesper Brouer) [1007439]
  - [net] netfilter: nfnetlink_{log, queue}, fix information leaks in netlink message (Jesper Brouer) [1007439]
  - [net] netfilter: xt_TCPMSS: correct return value in tcpmss_mangle_packet (Jesper Brouer) [1007439]
  - [net] netfilter: xt_TCPOPTSTRIP: fix possible off by one access (Jesper Brouer) [1007439]
  - [net] netfilter: xt_TCPMSS: fix handling of malformed TCP header and options (Jesper Brouer) [1007439]
  - [net] netfilter: nf_nat: use per-conntrack locking for sequence number adjustments (Jesper Brouer) [1007439]
  - [net] netfilter: nf_nat: change sequence number adjustments to 32 bits (Jesper Brouer) [1007439]
  - [net] netfilter: nf_nat: fix locking in nf_nat_seq_adjust() (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: remove duplicate code in ctnetlink (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: constify sk_buff argument to nf_ct_attach() (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: remove net_ratelimit() for LOG_INVALID() (Jesper Brouer) [1007439]
  - [net] netfilter: ctnetlink: fix incorrect NAT expectation dumping (Jesper Brouer) [1007439]
  - [net] netfilter: Fix build errors with xt_socket.c (Jesper Brouer) [1007439]
  - [net] netfilter: xt_socket: fix broken v0 support (Jesper Brouer) [1007439]
  - [net] netfilter: xt_socket: add XT_SOCKET_NOWILDCARD flag (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: avoid large timeout for mid-stream pickup (Jesper Brouer) [1007439]
  - [net] netfilter: check return code from nla_parse_tested (Jesper Brouer) [1007439]
  - [net] Convert uses of typedef ctl_table to struct ctl_table (Jesper Brouer) [1007439]
  - [net] netfilter: Implement RFC 1123 for FTP conntrack (Jesper Brouer) [1007439]
  - [net] netfilter: nfnetlink_queue: avoid peer_portid test (Jesper Brouer) [1007439]
  - [net] netfilter: don't panic on error while walking through the init path (Jesper Brouer) [1007439]
  - [net] netfilter: xt_socket: use IP early demux (Jesper Brouer) [1007439]
  - [net] netfilter: xt_CT: optimize XT_CT_NOTRACK (Jesper Brouer) [1007439]
  - [net] qdisc: fix build with !CONFIG_NET_SCHED (Jesper Brouer) [1000395]
  - [net] qdisc: make args to qdisc_create_default const (Jesper Brouer) [1000395]
  - [net] qdisc: allow setting default queuing discipline (Jesper Brouer) [1000395]
  - [net] Remove extern from include/net/ scheduling prototypes (Jesper Brouer) [1000395]
  - [net] htb: fix sign extension bug (Jesper Brouer) [1000395]
  - [net] htb: refactor struct htb_sched fields for performance (Jesper Brouer) [1000395]
  - [net] htb: reorder struct htb_class fields for performance (Jesper Brouer) [1000395]
  - [net] htb: do not setup default rate estimators (Jesper Brouer) [1000395]
  - [net] net_sched: add 64bit rate estimators (Jesper Brouer) [1000395]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-33.el7]
changelog:
  - [fs] nfs: Give "flavor" an initial value to fix a compile warning (Jeff Layton) [1009119]
  - [fs] nfs: try SECINFO_NO_NAME flavs until one works (Jeff Layton) [1009119]
  - [fs] nfs: Ensure memory ordering between nfs4_ds_connect and nfs4_fl_prepare_ds (Jeff Layton) [1009119]
  - [fs] nfs: nfs4_fl_prepare_ds, fix bugs when the connect attempt fails (Jeff Layton) [1009119]
  - [fs] nfs: Honour the 'opened' parameter in the atomic_open() filesystem method (Jeff Layton) [1009119]
  - [net] sunrpc: rpcsec_gss, fix crash on destroying gss auth (Jeff Layton) [1009119]
  - [net] sunrpc: No, I did not intend to create a 256KiB hashtable (Jeff Layton) [1009119]
  - [net] sunrpc: Add missing kuids conversion for printing (Jeff Layton) [1009119]
  - [fs] nfs: sp4_mach_cred, WARN_ON -> WARN_ON_ONCE (Jeff Layton) [1009119]
  - [fs] nfs: sp4_mach_cred, no need to ref count creds (Jeff Layton) [1009119]
  - [fs] nfs: fix SECINFO* use of put_rpccred (Jeff Layton) [1009119]
  - [fs] nfs: sp4_mach_cred: ask for WRITE and COMMIT (Jeff Layton) [1009119]
  - [fs] nfs: fix decode_free_stateid (Jeff Layton) [1009119]
  - [fs] nfs: use mach cred for SECINFO_NO_NAME w/ integrity (Jeff Layton) [1009119]
  - [fs] nfs: nfs_compare_super shouldn't check the auth flavour unless 'sec=' was set (Jeff Layton) [1009119]
  - [fs] nfs: Allow security autonegotiation for submounts (Jeff Layton) [1009119]
  - [fs] nfs: Disallow security negotiation for lookups when 'sec=' is specified (Jeff Layton) [1009119]
  - [fs] nfs: Fix security auto-negotiation (Jeff Layton) [1009119]
  - [fs] nfs: Clean up nfs_parse_security_flavors() (Jeff Layton) [1009119]
  - [fs] nfs: Clean up the auth flavour array mess (Jeff Layton) [1009119]
  - [fs] nfs: Use MDS auth flavor for data server connection (Jeff Layton) [1009119]
  - [fs] nfs: Map NFS4ERR_WRONG_CRED to EPERM (Jeff Layton) [1009119]
  - [fs] nfs: Add SP4_MACH_CRED write and commit support (Jeff Layton) [1009119]
  - [fs] nfs: Add SP4_MACH_CRED stateid support (Jeff Layton) [1009119]
  - [fs] nfs: Add SP4_MACH_CRED secinfo suppor (Jeff Layton) [1009119]
  - [fs] nfs: Add SP4_MACH_CRED cleanup support (Jeff Layton) [1009119]
  - [fs] nfs: Add state protection handler (Jeff Layton) [1009119]
  - [fs] nfs: Minimal SP4_MACH_CRED implementation (Jeff Layton) [1009119]
  - [net] sunrpc: Replace pointer values with task->tk_pid and rpc_clnt->cl_clid (Jeff Layton) [1009119]
  - [net] sunrpc: Add an identifier for struct rpc_clnt (Jeff Layton) [1009119]
  - [net] sunrpc: Ensure rpc_task->tk_pid is available for tracepoints (Jeff Layton) [1009119]
  - [fs] nfs: Document the recover_lost_locks kernel parameter (Jeff Layton) [1009119]
  - [fs] nfs: Don't try to recover NFSv4 locks when they are lost (Jeff Layton) [1009119]
  - [net] sunrpc: Add tracepoints to help debug socket connection issues (Jeff Layton) [1009119]
  - [fs] nfs: Fix warning introduced by NFSv4.0 transport blocking patches (Jeff Layton) [1009119]
  - [fs] nfs: fix CONFIG_NFS_V4_1 not enabled "make C=2" warning (Jeff Layton) [1009119]
  - [fs] nfs: Update session draining barriers for NFSv4.0 transport blocking (Jeff Layton) [1009119]
  - [fs] nfs: Add nfs4_sequence calls for OPEN_CONFIRM (Jeff Layton) [1009119]
  - [fs] nfs: Add nfs4_sequence calls for RELEASE_LOCKOWNER (Jeff Layton) [1009119]
  - [fs] nfs: Enable nfs4_setup_sequence() for DELEGRETURN (Jeff Layton) [1009119]
  - [fs] nfs: NFSv4.0 transport blocking (Jeff Layton) [1009119]
  - [fs] nfs: Add a slot table to struct nfs_client for NFSv4.0 transport blocking (Jeff Layton) [1009119]
  - [fs] nfs: Add global helper for releasing slot table resources (Jeff Layton) [1009119]
  - [fs] nfs: Add global helper to set up a stand-along nfs4_slot_table (Jeff Layton) [1009119]
  - [fs] nfs: Enable slot table helpers for NFSv4.0 (Jeff Layton) [1009119]
  - [fs] nfs: Remove unused call_sync minor version op (Jeff Layton) [1009119]
  - [fs] nfs: Add RPC callouts to start NFSv4.0 synchronous requests (Jeff Layton) [1009119]
  - [fs] nfs: Common versions of sequence helper functions (Jeff Layton) [1009119]
  - [fs] nfs: Clean up nfs4_setup_sequence() (Jeff Layton) [1009119]
  - [fs] nfs: Rename nfs41_call_sync_data as a common data structure (Jeff Layton) [1009119]
  - [fs] nfs: When displaying session slot numbers, use "u" consistently (Jeff Layton) [1009119]
  - [fs] nfs: Ensure that rmdir() waits for sillyrenames to complete (Jeff Layton) [1009119]
  - [fs] nfs: use the mach cred for SECINFO w/ integrity (Jeff Layton) [1009119]
  - [net] sunrpc: refactor rpcauth_checkverf error returns (Jeff Layton) [1009119]
  - [fs] nfs: avoid expired credential keys for buffered writes (Jeff Layton) [1009119]
  - [net] sunrpc: new rpc_credops to test credential expiry (Jeff Layton) [1009119]
  - [net] sunrpc: don't map EKEYEXPIRED to EACCES in call_refreshresult (Jeff Layton) [1009119]
  - [fs] nfs: Fix up two use-after-free issues with the new tracing code (Jeff Layton) [1009119]
  - [fs] nfs: remove incorrect "Lock reclaim failed!" warning (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging test_stateid events (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging slot table operations (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging layoutget/return/commit (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging reads and writes (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging getattr (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging the idmapper (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging delegations (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging rename (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging inode manipulations (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging lookup/create operations (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging file locking (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging file open (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging state management problems (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging NFS hard links (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging NFS rename and sillyrename issues (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging directory changes (Jeff Layton) [1009119]
  - [fs] nfs: Add tracepoints for debugging generic file create events (Jeff Layton) [1009119]
  - [fs] nfs: Add event tracing for generic NFS lookups (Jeff Layton) [1009119]
  - [fs] nfs: Pass in lookup flags from nfs_atomic_open to nfs_lookup (Jeff Layton) [1009119]
  - [fs] nfs: Add event tracing for generic NFS events (Jeff Layton) [1009119]
  - [fs] nfs: refactor code for calculating the crc32 hash of a filehandle (Jeff Layton) [1009119]
  - [fs] nfs: Clean up nfs_sillyrename() (Jeff Layton) [1009119]
  - [fs] nfs: Fix an incorrect pointer declaration in decode_first_pnfs_layout_type (Jeff Layton) [1009119]
  - [fs] nfs: Deal with a sparse warning in nfs_idmap_get_key() (Jeff Layton) [1009119]
  - [fs] nfs: Deal with some more sparse warnings (Jeff Layton) [1009119]
  - [fs] nfs: Deal with a sparse warning in nfs4_opendata_alloc (Jeff Layton) [1009119]
  - [fs] nfs: Deal with a sparse warning in nfs3_proc_create (Jeff Layton) [1009119]
  - [fs] nfs: Remove the NFSv4 "open optimisation" from nfs_permission (Jeff Layton) [1009119]
  - [fs] nfs: Use clientid management rpc_clnt for secinfo_no_name (Jeff Layton) [1009119]
  - [fs] nfs: Use clientid management rpc_clnt for secinfo (Jeff Layton) [1009119]
  - [fs] nfs: Increase NFS4_DEF_SLOT_TABLE_SIZE (Jeff Layton) [1009119]
  - [fs] nfs: Remove unused authflavour parameter from init_client (Jeff Layton) [1009119]
  - [fs] nfs: Never use user credentials for lease renewal (Jeff Layton) [1009119]
  - [fs] nfs: Use root's credential for lease management when keytab is missing (Jeff Layton) [1009119]
  - [fs] nfs: Refuse mount attempts with proto=udp (Jeff Layton) [1009119]
  - [fs] nfs: Fix nfs4_init_uniform_client_string for net namespaces (Jeff Layton) [1009119]
  - [fs] nfs: Use the mount point rpc_clnt for layoutreturn (Jeff Layton) [1009119]
  - [fs] nfs: Fix return type of nfs4_end_drain_session() stub (Jeff Layton) [1009119]
  - [fs] nfs: encode_attrs should not backfill the bitmap and attribute length (Jeff Layton) [1009119]
  - [net] sunrpc: Fix memory corruption issue on 32-bit highmem systems (Jeff Layton) [1009119]
  - [fs] nfs: Remove unnecessary call to nfs_setsecurity in nfs_fhget() (Jeff Layton) [1009119]
  - [fs] nfs: Fix the sync mount option for nfs4 mounts (Jeff Layton) [1009119]
  - [fs] nfs: Fix writeback performance issue on cache invalidation (Jeff Layton) [1009119]
  - [net] sunrpc: If the rpcbind channel is disconnected, fail the call to unregister (Jeff Layton) [1009119]
  - [net] sunrpc: Don't auto-disconnect from the local rpcbind socket (Jeff Layton) [1009119]
  - [hid] zeroplus: validate output report details (Frantisek Hrbata) [999907] {CVE-2013-2889}
  - [hid] provide a helper for validating hid reports (Frantisek Hrbata) [999907] {CVE-2013-2889}
  - [s390] zfcp: enable FCP hardware data router by default (Hendrik Brueckner) [980146]
  - [scsi] csiostor: fix failure to communicate with firmware, error -110 (Jay Fenlason) [917907]
  - [block] mtip32xx: add SRSI support (David Milburn) [842533]
  - [misc] hpilo: Correct panic when an AUX iLO is detected (Nigel Croxon) [996603]
  - [Documentation] add write up on module signing (Kyle McMartin) [905495]
  - [net] netfilter: SYNPROXY: let unrelated packets continue (Jesper Brouer) [1007439]
  - [net] netfilter: synproxy_core: fix warning in __nf_ct_ext_add_length() (Jesper Brouer) [1007439]
  - [net] netfilter: more strict TCP flag matching in SYNPROXY (Jesper Brouer) [1007439]
  - [net] netfilter: add IPv6 SYNPROXY target (Jesper Brouer) [1007439]
  - [net] syncookies: export cookie_v6_init_sequence/cookie_v6_check (Jesper Brouer) [1007439]
  - [net] netfilter: add SYNPROXY core/target (Jesper Brouer) [1007439]
  - [net] syncookies: export cookie_v4_init_sequence/cookie_v4_check (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: make sequence number adjustments usuable without NAT (Jesper Brouer) [1007439]
  - [net] netfilter: nf_defrag_ipv6.o included twice (Jesper Brouer) [1007439]
  - [net] netfilter: ip[6]t_REJECT, tcp-reset using wrong MAC source if bridged (Jesper Brouer) [1007439]
  - [net] netfilter: export xt_HMARK.h to userland (Jesper Brouer) [1007439]
  - [net] netfilter: export xt_rpfilter.h to userland (Jesper Brouer) [1007439]
  - [net] netfilter: ctnetlink: fix uninitialized variable (Jesper Brouer) [1007439]
  - [net] netfilter: nfnetlink_queue: allow to attach expectations to conntracks (Jesper Brouer) [1007439]
  - [net] netfilter: ctnetlink: refactor ctnetlink_create_expect (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: fix tcp_in_window for Fast Open (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: don't send destroy events from iterator (Jesper Brouer) [1007439]
  - [net] netfilter: nfnetlink_{log, queue}, fix information leaks in netlink message (Jesper Brouer) [1007439]
  - [net] netfilter: xt_TCPMSS: correct return value in tcpmss_mangle_packet (Jesper Brouer) [1007439]
  - [net] netfilter: xt_TCPOPTSTRIP: fix possible off by one access (Jesper Brouer) [1007439]
  - [net] netfilter: xt_TCPMSS: fix handling of malformed TCP header and options (Jesper Brouer) [1007439]
  - [net] netfilter: nf_nat: use per-conntrack locking for sequence number adjustments (Jesper Brouer) [1007439]
  - [net] netfilter: nf_nat: change sequence number adjustments to 32 bits (Jesper Brouer) [1007439]
  - [net] netfilter: nf_nat: fix locking in nf_nat_seq_adjust() (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: remove duplicate code in ctnetlink (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: constify sk_buff argument to nf_ct_attach() (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: remove net_ratelimit() for LOG_INVALID() (Jesper Brouer) [1007439]
  - [net] netfilter: ctnetlink: fix incorrect NAT expectation dumping (Jesper Brouer) [1007439]
  - [net] netfilter: Fix build errors with xt_socket.c (Jesper Brouer) [1007439]
  - [net] netfilter: xt_socket: fix broken v0 support (Jesper Brouer) [1007439]
  - [net] netfilter: xt_socket: add XT_SOCKET_NOWILDCARD flag (Jesper Brouer) [1007439]
  - [net] netfilter: nf_conntrack: avoid large timeout for mid-stream pickup (Jesper Brouer) [1007439]
  - [net] netfilter: check return code from nla_parse_tested (Jesper Brouer) [1007439]
  - [net] Convert uses of typedef ctl_table to struct ctl_table (Jesper Brouer) [1007439]
  - [net] netfilter: Implement RFC 1123 for FTP conntrack (Jesper Brouer) [1007439]
  - [net] netfilter: nfnetlink_queue: avoid peer_portid test (Jesper Brouer) [1007439]
  - [net] netfilter: don't panic on error while walking through the init path (Jesper Brouer) [1007439]
  - [net] netfilter: xt_socket: use IP early demux (Jesper Brouer) [1007439]
  - [net] netfilter: xt_CT: optimize XT_CT_NOTRACK (Jesper Brouer) [1007439]
  - [net] qdisc: fix build with !CONFIG_NET_SCHED (Jesper Brouer) [1000395]
  - [net] qdisc: make args to qdisc_create_default const (Jesper Brouer) [1000395]
  - [net] qdisc: allow setting default queuing discipline (Jesper Brouer) [1000395]
  - [net] Remove extern from include/net/ scheduling prototypes (Jesper Brouer) [1000395]
  - [net] htb: fix sign extension bug (Jesper Brouer) [1000395]
  - [net] htb: refactor struct htb_sched fields for performance (Jesper Brouer) [1000395]
  - [net] htb: reorder struct htb_class fields for performance (Jesper Brouer) [1000395]
  - [net] htb: do not setup default rate estimators (Jesper Brouer) [1000395]
  - [net] net_sched: add 64bit rate estimators (Jesper Brouer) [1000395]


