# changelog

author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3.1-20
changelog:
  - add support for SAS disks on SPARC (local disks)
    stop reporting luns which are in use
    add setup check to verify that mpxio is enabled
    add makefile rule for parfait
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3.1-17
changelog:
  - add support for FC disks on SPARC
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.3.1-16
changelog:
  - Add network discovery, and configurations for infiniband devices (IPoIB)
    - Bonding, Only active-back mode is supported.
    - Add remove bond ports
    - Assign IP address, static/DHC
    - Change MTU


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3.1-15
changelog:
  - Add parameter to configure LDoms VM with cpu cores instead of cpu threads
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3.1-14
changelog:
  - move generic api cluster methods to base class
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3.1-13
changelog:
  - Bug 16441398 - IMPORT VM DOES NOT WORK ON SPARC - "GET NO SUCH API:"
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3.1-12
changelog:
  - Bug 16409242 - LDOMS CONFIGURATION ERROR - AGENT NEVER CAME ONLINE; SET TO MAINTENANCE MODE
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3.1-11
changelog:
  - LDoms reports inactive VM as running locally
    Fix support for LDoms dependencies
    Improve LDoms XML requests debugging
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3.1-10
changelog:
  - Bug 16297871 - SPARC SERVER DISCOVERY FAILS - OVS AGENT NEEDS TO HAVE PACKAGE DEPENDENCY ON NTP
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3.1-9
changelog:
  - Bug 16383869 - SPARC M5 SERVERS ARE NOT CORRECTLY IDENTIFIED
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.3.1-8
changelog:
  - fix SMBIOS 2.6+ UUID swap
    SMBIOS spec change in v2.6::
    836  Although RFC 4122 recommends network byte order for all fields, the PC industry (including the ACPI,
    837  UEFI, and Microsoft specifications) has consistently used little-endian byte encoding for the first three
    838  fields: time_low, time_mid, time_hi_and_version. The same encoding, also known as wire format, should
    839  also be used for the SMBIOS representation of the UUID.
    840  The UUID {00112233-4455-6677-8899-AABBCCDDEEFF} would thus be represented as:
    841      33 22 11 00 55 44 77 66 88 99 AA BB CC DD EE FF.
    Before this patch, we only swap the first 4 bytes.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Jingjie Jiang <jingjie.jiang@oracle.com> [bug 14511018] [bug 16221689]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.3.1-7
changelog:
  - Get correct system uuid from SMBIOS 2.7
    dmidecode-2.10-3.el5 in ovm server 3.2.1 only officially supports SMBIOS up to
    2.6. For Server with SMBIOS 2.7 it will print out:
          E021F0D0-0010-FFFF-FFFF-FFFFFF200008
    This patch ignores the warning and gets the real system UUID.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Jingjie Jiang <jingjie.jiang@oracle.com> [bug 16221689]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3.1-6
changelog:
  - add ipmi lanplus support for SPARC
    update SPARC package version to 3.3.1
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.3.1-5
changelog:
  - Change the call getModelManager() to read the manager's server object
    from the creating state instead of the in-use state, in order to avoid
    race condition where the the server object comes back NULL. [bug 16029834]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.3.1-4
changelog:
  - report VM cpu_time for statistics
    This patch will report VM CPU time to Manager as statistic in format:
    vmCpuTime float VM accumulated CPU time in seconds (as shown in `xm list`).
    Also in this patch: when VM is starting, sometime we cannot get stats for this
    VM for one time (because this VM is under construction). After this patch, we
    will ignore this VM only and report stats for other VMs. Before this patch we
    stop reporting stats for all VMs for this time.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com> [bug 15964895] [bug 15996693]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.3.1-3
changelog:
  - add ipmi lanplus support
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Chuang Cao <chuang.cao@oracle.com> [bug 14777351]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3.1-2
changelog:
  - Bug 14517284 - sparc: wrong log files collected
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
    Signed-off-by: Eric Sharakan <eric.sharakan@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-180
changelog:
  - fix license copyright year
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com> [bug 15949647]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-179
changelog:
  - Bug 15931916 - ovs-agent-setup prints confusing message about oracle user
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Jingjie Jiang <jingjie.jiang@oracle.com> - 3.2.1-178
changelog:
  - Fix the server uuid changing due to vlan configuration.
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Jingjie Jiang <jingjie.jiang@oracle.com> [bug 15920008]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-177
changelog:
  - Bug 14201160 - agent should have command to properly configure new sparc server
    Bug 13610648 - sparc agent installer should populate etc/host
    (configuration file support)
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-176
changelog:
  - Bug 15833928 - ovm for sparc: ovs-agent-passwd - "import sha" deprecation warning
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-175
changelog:
  - fix error when virtualnetwork not exist in agent.ini
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Jingjie Jiang <jingjie.jiang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com> [bug 15917707]


author: <> - 3.2.1-174
changelog:
  - 14780815 - SPARC OVS-AGENT SHOULD SOLELY DEPEND ON LDOMS 3.0 (remove dead code)
    Signed-off-by: William Roche <william.roche@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-173
changelog:
  - Bug 14201160 - agent should have command to properly configure new sparc server
    Bug 13610648 - sparc agent installer should populate etc/host
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: William Roche <william.roche@oracle.com>
    Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-172
changelog:
  - log error when dd failed.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 15892623]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-170
changelog:
  - fix > 1.0 serverCpuUtil issue
    When we do cpu over provisioning (nr_vcpus > nr_pcpus), we can get > 1.0
    serverCpuUtil.
    This patch fixes this issue by checking the ceiling every time.
    This patch also makes the debugging code easier to use.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Jingjie Jiang <jingjie.jiang@oracle.com> [bug 14805645]


author: Jingjie Jiang <jingjie.jiang@oracle.com> - 3.2.1-169
changelog:
  - Add recursive checking and scrubing for the password in log message.
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com> [bug 15866336]


author: William Roche <william.roche@oracle.com> - 3.2.1-168
changelog:
  - BUG 15859517 - OVS-AGENT SERVICES MONITORING FOR SMF
    BUG 14780307 - LOST CONNECTION WITH LDOMS MGR AFTER SERVER REBOOT
    BUG 14780815 - SPARC OVS-AGENT SHOULD SOLELY DEPEND ON LDOMS 3.0


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-167
changelog:
  - fix run_cmd() log password issue
    run_cmd() will log ipmi password in log. This patch fixes this issue by
    regenerating new exception contents.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Jingjie Jiang <jingjie.jiang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com> [bug 15862926]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-166
changelog:
  - fix mixing tab and space
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 15864719]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-165
changelog:
  - fix cpu util calculation for stats
    We have two issues:
    1. The total_cpu_load should be initialized outside of the for loop.
    2. cpu_time_delta may > time_delta when the domain has more than one vcpus. We
    use cpu_load_ceiling to make sure it never exceed vcpu_count * 100
    This patch fixes the logic for total cpu utilization calculation.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 14805645]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-164
changelog:
  - adjust max stats queue length
    The calculated the max queue length wrong: each collection will get: 11 *
    number-of-vms + 17 items, which may exceed the max_queue_len we calculated
    before. Then the result is losing stats: new stats pushed to the queue will pop
    other stats.
    This patch adjusts the max queue len to a reasonable value.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Jingjie Jiang <jingjie.jiang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com> [bug 14575794]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-163
changelog:
  - delay reboot/shutdown command
    If reboot/shutdown happens to fast, Manager cannot get a response. This patch
    delays execution of reboot and shutdown command for 5 seconds and run the
    commands in a daemon.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Jingjie Jiang <jingjie.jiang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com> [bug 14830130]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-161
changelog:
  - Bug 13439610 - warnings when removing the ovs-agent package
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-159
changelog:
  - Bug 14803944 - ovm sparc: cannot start vm after it is stopped by command "poweroff" in console
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-158
changelog:
  - fix logging password masking for tuple
    The problem is because log record.args could be:
    ('call start', 'import_ISO', ('http://a:b@c.com',))
    When we do mask_passowrd(('http://a:b@c.com',)), we get an exception (and we
    silently ignored all exceptions).
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 14811987]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-157
changelog:
  - Bug 14799313 - sparc agent notification issue
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-156
changelog:
  - add suspend/resume support to statistics
    Currently if users set the interval to a very big number, e.g. 1000,
    then after switch to 20, the process will sleep there for 1000s.
    Our new solution also handles this case.
    After this patch, the API behaves like this:
    function:: set_statistic_interval(interval)
    Set statistic interval.
    Args:
    - interval (int): the interval between each statistic collection and sending.
    The value should be greater or equal to `-1`.
    Special value `0` means using using system default, which is 20 seconds for
    now.
    Special value `-1` means suspend statistic collection and sending.
    You should set another value to resume statistic collection and sending.
    Raises:
    
    - Exception on error.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com> [bug 14798704]


author: Junjie Wei <junjie.wei@oracle.com> - 3.2.1-155
changelog:
  - ovs-agent-dlm: differentiate exit status of local/dlm lock errors.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Oracle-bug: 14753739


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-154
changelog:
  - Bug 14514677 - ovm sparc: cannot boot a vm from cdrom
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-153
changelog:
  - Bug 14793869 - error discovering network with vlan on aggregate
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-152
changelog:
  - Bug 14781896 - ovm sparc: shareable vdisk cannot be added to the second vm.
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-151
changelog:
  - Bug 14782148 - OVM SPARC: CANNOT CHANGE ISO IN CDROM WHEN VM IS RUNNING.
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-150
changelog:
  - Bug 14781954 - OVMSPARC: FAIL TO ADD 2 VNICS WHEN VM IS RUNNING
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-149
changelog:
  - Bug 14760448 - SETNTPSERVERS() WOULD NOT CHANGE THE NTP SERVER ORDER IN /ETC/NTP.CONF
    This is the fix for 14760448 for the sparc ovs-agent
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-148
changelog:
  - Bug 14769855 - OVS-AGENT NEEDS TO RECOVER IF LDMD IS STOPPED/STARTED
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-147
changelog:
  - respect NTP servers order
    This patch will first clear all NTP servers and write the new ones again using
    the passed in order.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com> [bug 14760448]


author: Bijan Mottahedeh <bijan.mottahedeh@oracle.com> - 3.2.1-146
changelog:
  - Bug 14407448 - MIGRATION WITH BRIDGE OVER ON SPARC FAIL IN PARTICULAR CONFIGURATION
    Bug 14674188 - CAN'T HOT ADD A VNIC USING A LOCAL BRIDGE


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-145
changelog:
  - Bug 14734657 - OVM SPARC: DISCOVER_NETWORK: KEYERROR: 'BROADCAST'
    Bug 14525910 - ERROR DURING ADDING PORT INTO VLAN GROUP ON OVM/SPARC
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-144
changelog:
  - Bug 14756593 - SPARC AGENT ISSUE ON SERVER REBOOT - LOSES MOUNT POINT
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-143
changelog:
  - Bug 14763512 - SPARC AGENT SHOULD SUPPORT NEW SPARC PROCESSOR
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-142
changelog:
  - Assembly: tolerant missing <Info> when parsing OVF.
    Although <Info> is required in the spec, some shipped OVF templates from OVAB
    are missing it. We don't want to fail for this trivial info thing.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>
    Signed-off-by: Srinivas Maturi <srinivas.maturi@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-141
changelog:
  - empty agent/storage/__init__.py
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-140
changelog:
  - add missing agent/storage/__init__.py
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.2.1-137
changelog:
  - Added support for openvswitch
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-136
changelog:
  - Bug 14740478 - SPARC MGR .ISO EXPORTED WITH "RO,SLICE" AND FAILS SOLARIS INSTALL
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-135
changelog:
  - Bug 14739916 - SPARC MGR CREATE VM W/ VIRTUAL DISK AND .ISO GETS "INVALID VDISK DRIVER 'HDA'"
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-134
changelog:
  - add concurrent migration related capabilities
    We need to surface two new capabilities (integers) to the manager:
    1. concurrent live migrations allowed as a source node
    2. concurrent live migrations allowed as a destination node
    3. whether concurrent live migration is allowed
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>
    Signed-off-by: Wiekus Beukes <wiekus.beukes@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-133
changelog:
  - Solaris package does not need to depend on PyXML anymore
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-132
changelog:
  - remove dependency on PyXML
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-131
changelog:
  - sparc agent should support unauthentication migration
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-130
changelog:
  - Bug 14726094 - INITIAL DISCOVER OF SERVER (SVS003) - HANGS.. RESOURCE TEMPORARILY UNAVAILABLE
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-129
changelog:
  - sparc agent should get platform information using the platinfo command
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-128
changelog:
  - Bug 14711845 - SPARC AGENT MUST FILTER OUT LOCAL TIME SOURCE DURING GETNTPSERVERS
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-127
changelog:
  - Change Solaris package FMRI regexp to handle optional sequences
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-126
changelog:
  - Bug 14701075 - SPARC SERVER NOT RETURNING ALL EXPECTED STATS
    Bug 14679882 - STAT CHECKING WE ARE SEEING NEGATIVE CPU UTILIZATION
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-125
changelog:
  - support for sending WOL packets on Solaris
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-123
changelog:
  - Solaris build and package support
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.2.1-122
changelog:
  - Implement WOL in Python by broadcasting a magic packet.
    Note:
    Python socket library doesn't have SO_BINDTODEVICE defined, however,
    it is available through <sys/socket.h> on Linux:
      Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Alex Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-121
changelog:
  - remove dependency with bsddb on Solaris
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-120
changelog:
  - Bug 14679882 - STAT CHECKING WE ARE SEEING NEGATIVE CPU UTILIZATION
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-119
changelog:
  - Bug 14142262 - SHOULD IMPLEMENT AGENT REMOTE API ON SPARC
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Liam Merwick <liam.merwick@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-118
changelog:
  - fix parse error for empty string in set_vif()
    The root cause of this bug is: when there's no VIF attached to the VM, xm
    network-list will return empty string and sxp.all_from_string() will return None
    (which is a bad design: return empty list [] is the desired result).
    With this patch, we will check the return value of sxp.all_from_string().
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com> [bug 14611925]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-117
changelog:
  - [un]export_fs API for sparc
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-116
changelog:
  - Bug 14643340 - VNIC HOT ADD DOES NOT WORK
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.2.1-115
changelog:
  - HA: concurrently start VMs to improve performance.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Oracle-bug: 14637509


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-114
changelog:
  - Bug 14517368 - SPARC: OVS SERVER IS OWNED BUT NTPD SEVICE IS OFFLINE
    migration group should be based on cpu frequency
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-113
changelog:
  - add YUM_PACKAGE_MANAGEMENT capability
    As YUM is not available in Solaris, we introduce YUM_PACKAGE_MANAGEMENT
    capability. Then Manager will use this capability to determine whether to call
    yum related APIs.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com> [bug 14636063]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-112
changelog:
  - stats should not be returned for vsw interfaces
    ldmxml requests should not be logged for stats
    ldmxml requests should include namespaces definition
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-111
changelog:
  - Bug 14630507 - SPARC STATS RETURN MEMORY SIZE IN BYTES INSTEAD OF MB
    stats should ignore vswitches not on the control domain
    stats sometimes fail when a domain gets bound
    stats fail if there is an inactive domain
    network stats should not return strings but longs
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-110
changelog:
  - remove unnecessary calls to restart_stats which already removed
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-109
changelog:
  - Bug 14617138 - MIGRATING VM FROM SVS003 TO SVS001, VDISK CONFIGURATION ISSUE
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-107
changelog:
  - Bug 14507906 - OVM SPARC: CANNOT MOUNT VIRTUAL CDROM IN SOLARIS GUEST
    Bug 14481563 - OVM SPARC - CANNOT REMOVE CDROM WHEN VM IS RUNNING
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Bijan Mottahedeh <Bijan.Mottahedeh@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-106
changelog:
  - improve statistics
    This patch includes these improvements for statistics:
    1. Add tmem related stats.
    2. Prepare for solaris_ldoms support: the solaris_ldoms support patch is ready
    and will checkin after this patch.
    3. Every node send stats itself, which eliminates 20s delay compared to sending
    on master only.
    4. No qlayer monitor is required any more.
    We can safely remove these RPMs from Server ISO after this patch: `monitor`,
    `python-twisted-core`, `python-zope-interface`, `libyaml` and `PyYAML`.
    This patch is fully backward compatible and no Manager change is needed.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-105
changelog:
  - create assembly: remove AllocationUnits for Processor according to OVF spec
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Srinivas Maturi <srinivas.maturi@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-104
changelog:
  - add create_assembly() support
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-103
changelog:
  - link XMLRPC /api/1 to / to fix 3.1.1 Manager issue
    This patch links XMLRPC /api/1 to latest to fix release Manager 3.1.1 issue: it
    was hardcoded to pass down /api/1 for get_api_version().
    With this patch, OVM Manager 3.1.1 still works for OVM 3.2.1 Server.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-102
changelog:
  - revise plugin blacklist for sosreport according to request from support team.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Justin Jeffs <justin.jeffs@oracle.com> [bug 14479024]


author: Junjie Wei <junjie.wei@oracle.com> - 3.2.1-97
changelog:
  - Make sure the compiled regex is not None before searching.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-96
changelog:
  - ovs-agent-fake-uuid should be called in post script instead of pre script: at
    pre script, ovs-agent-fake-uuid is not installed yet, so it cannot be found.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-95
changelog:
  - add import_vm() support
    It has the same behavior as import_template() except creating VM instead of
    Template.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Xiaodong Yang <xiao.dong.yang@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-94
changelog:
  - list_vms fails on sparc if there is a bound domain
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-93
changelog:
  - network discovery fails if an interface has multiple IP addresses
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-92
changelog:
  - write a fake UUID if upgrading from 3.1.1 for Server SMBIOS version > 2.6
    For Server with SMBIOS 2.6+, in OVM 3.1.1-, we were using the wrong UUID. After
    upgrading to 3.2.1, Agent reports the right UUID. But Manager is still recording
    the old wrong UUID, so Manager cannot recognize this Server.
    The solution is: when upgrading from 3.1.1-, for Server with SMBIO
    2.6+, we writhe the old wrong UUID as fake UUID.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>
    Signed-off-by: Jingjie Jiang <jingjie.jiang@oracle.com> [bug 14511018] [bug 14216405]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-91
changelog:
  - Bug 14504906 - UNABLE TO DISCOVER A SPARC SERVER WHERE THERE IS AN INACTIVE VIRTUAL SWITCH
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-90
changelog:
  - add SASL authentication to LDoms XML connection
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Jingjie Jiang <jingjie.jiang@oracle.com> - 3.2.1-89
changelog:
  - Add the directory for storage utilization.
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Cathy Avery <cathy.avery@oracle.com> [bug 14502602]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-88
changelog:
  - add HVM_MAX_VNICS = 8 capability for xen
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com> [bug 14512851]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-87
changelog:
  - list migrating/saving VMs correctly
    During migrating/saving, the VM will be renamed to migrating-<name>. At this
    time if we call list_vm(), Agent will raise an exception: no such VM.
    This patch fixes this issue: it will check whether migrating-<name> is exist and
    then return the info of that VM.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com> [bug 14505079]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-86
changelog:
  - remove references to Solaris 11.1
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-85
changelog:
  - Bug 14480763 - LAUNCH SERIAL CONSOLE > WRONG VM
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-84
changelog:
  - log is incomplete when a LDMError exception is raised
    The problem comes from a pickle issue with user-defined Exception,
    see http://bugs.python.org/issue1692335. To avoid this issue,
    new exception constructor should call the base class constructor
    with the same arguments.
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-83
changelog:
  - Bug 14407300 - LDMXML CONNECTION FAIL FOR EACH API CALL
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Bijan Mottahedeh <Bijan.Mottahedeh@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-82
changelog:
  - We add a blacklist to sosreport plugins. Also run sosreport in single thread
    mode, which will help alleviate cpu, disk and memory load on busy servers.
    The time add by "--no-multithread" is acceptable. From my test:
    * Single thread: 2m28.507s
    * Multithread: 1m52.572s
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 14479024]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-81
changelog:
  - migration setup/cleanup API
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Bijan Mottahedeh <Bijan.Mottahedeh@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-80
changelog:
  - add support for async proc stop
    We add a default SIGUSR2 handler: raise an exception. And this exception will be
    sent to Manager by notification.
    Manager should always wait for the async proc exit notification. The
    notification may takes very long time to arrive, which means the it takes long
    time to stop the task, maybe the clean up need a lot of time. Anyway, Manager
    should be patient.
    We may add more specific stop handlers to other APIs in the future, e.g., on
    import_assembly(), we should clean up upon stopping. Currently if we stop the
    import_assembly() task, the import will still success, which will cause data out
    of sync between Server and Manager.
    Also in this patch:
    1). Improve the return value of ovs_async_proc_status(). Now it returns the
    process state in ps output.
    2). Improve logging: now both sync and async call respect the EXCEPTION_LIST
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com>


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.2.1-79
changelog:
  - When authentication fails the notification server goes into a silent loop, periodically
    checking if there is a new url and tries to reconnect again.  If the new url is the same
    the the old failing one the server will not try. This fix causes the server to try to
    reconnect on take_owner ship command regardless of the url value. [bug 14467543]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-78
changelog:
  - Bug 14468062 - SPARC SERVER GETOVMVERSION() RETURNS EXTRA FIELDS
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-77
changelog:
  - <Capabilities> should be part of the <Server> section
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-75
changelog:
  - remove open-ovf dependency from ovs-agent due to license issue
    Reimplemented the functions in open-ovf. Also in this patch:
    1. Move all assembly implementations to agent/lib/assembly.py: keep all logic
    together.
    2. Import internal reference files on import_assembly(), but implement external
    (http/https) reference files on deploy_assembly(). Before we do everything on
    import_assembly().
    3. Also return Templates created on deploy_assembly() besides ISOs and VirtualDisks.
    4. Removed some unused/unsupported contents from get_assembly_config(): Name,
    Strings, Floppy.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com> [bug 14399740]


author: Junjie Wei <junjie.wei@oracle.com> - 3.2.1-74
changelog:
  - The script calls sys.exit() to terminate the program. sys.exit() will raise
    SystemExit which is then caught by the exception handler and printed. As our
    intention here is just to terminate the program, this patch calls os._exit()
    instead. os._exit() will terminate the program without raising any exception.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Alex Chartre <alexandre.chartre@oracle.com>


author: Jingjie Jiang <jingjie.jiang@oracle.com> - 3.2.1-73
changelog:
  - Add storage_info command to ovs-agent for devmon.
    Signed-off-by: Jingjie Jiang <jingjie.jiang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 14399376]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-72
changelog:
  - add GPL header to ldoms/solaris files
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Liam Merwick <liam.merwick@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-71
changelog:
  - create /var/run/ovs-agent and /var/run/ovmwatch directories dynamically.
    For new Linux distributions, /var/run and it's alias /run are tmpfs.  So create
    dir /var/run/ovs-agent and /var/run/ovmwatch during installation time makes no
    sense any more.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-70
changelog:
  - sparc vm cpu reconfigure does not work
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.2.1-69
changelog:
  - Compare the slave MTU to the bond MTU since the bond MTY equal to its slave MTU,
    and there could be more than one slave in the bond. [bug 14365805]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-68
changelog:
  - sparc template and assembly support
    list_vms fails on sparc if there is an inactive domain
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Eric Sharakan <eric.sharakan@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Jingjie Jiang <jingjie.jiang@oracle.com> - 3.2.1-67
changelog:
  - Add ISCSI_Target contents into "ovs-agent-rpc discover_physical_luns".
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Cathy Avery <cathy.avery@oracle.com> [bug 13968454]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-66
changelog:
  - prevent vm from starting when server is in maintenance mode (ldoms)
    add agent password file for migration (ldoms)
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
    Signed-off-by: Eric Sharakan <eric.sharakan@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-65
changelog:
  - add vnc console and serial console capabilities
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Ellen Batbouta <ellen.batbouta@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-64
changelog:
  - change error text to hide maintenance mode from Agent: it's a Manager only concept.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Bijan Mottahedeh <bijan.mottahedeh@oracle.com> - 3.2.1-62
changelog:
  - Dynamic Vnet Support.
    Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-61
changelog:
  - remove Solaris and PRI code because of licensing issue (temporary solution for beta release)
    improve version reporting
    sparc vm start fails for vm with no vnet
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-60
changelog:
  - Bug 14355079 - JOB HUNG STARTING VM: ON SERVER: SVS001; SVR NOT RETURNING START COMMAND SUCCESS
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-59
changelog:
  - Fix Agent HA starting VMs on Server in maintenance mode issue.
    The solution is to use server roles to restrict start_vm(): if the server has
    no 'xen' role, start_vm() will raise an exception.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Wiekus Beukes <wiekus.beukes@oracle.com>


author: Jingjie Jiang <jingjie.jiang@oracle.com> - 3.2.1-58
changelog:
  - Merge the useful files from ovs-storage-utils into ovs-agent and only build the ovs-agent rpm. Also, take off vi from the file names.
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Zhigang Zhang <zhigang.zhang@oracle.com>


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.2.1-57
changelog:
  - Agent excludes VIFs from the network discovery by testing if /sys/class/net/vifx.y/device exists.
    If it does not then exclude it from discovery. Since the device entry exists in the new Kernel,
    this test is no longer valid. Use the Vif name to exclude it instead. [bug 14298598]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-56
changelog:
  - add missing patch r8609 (overrriden by r8613) again:
    r8609 | zhigwang | 2012-06-06 15:44:34 -0400 (Wed, 06 Jun 2012) | 14 lines
    Changed paths: 
       M /ovm/trunk/agent/lib/linux.py 
    check free space before unpack file 
    If there's not enough space, we don't need to unpack a file. 
    Unfortunately, we cannot get unpacked filesize for tar/tar.gz/tar.bz2.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com> 
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> 
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com> 
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com> [bug 14134281]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-55
changelog:
  - add VM_MEMORY_ALIGNMENT capability
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com> [bug 14192206]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-54
changelog:
  - sparc network discovery fails with bridge over bond
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-53
changelog:
  - sparc XML output for bond discovery is incorrect
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-52
changelog:
  - sparc vlan/bond/bridge merge errors
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-51
changelog:
  - socket shutdown errors should be ignored
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-50
changelog:
  - sparc discover_network fails with existing vswitch
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-49
changelog:
  - add local storage element capability
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-48
changelog:
  - exclusive LockFile fails on Solaris
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-47
changelog:
  - If import templates from one server and start the VM in another server, it seems
    the disk is not ready and pygrub will return error. However, this happened twice
    in unittest, but I haven't reproduced that yet.
    This patch will do a fsync() to the disk file.
    This patch also removes some wrong comments: copy_file() returns nothing on success.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 14268749]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-46
changelog:
  - fix logic error on create_vm
    This error is introduced in 3.2.1 during refactor: when VM directory exists, VM
    creation will success but no parameter will be applied, which is wrong.
    This patch fixes that and reverts to the old (3.1.1-) behavior: will apply
    parameters when the VM directory exists.
    Also remove unused passwdfile.default.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Jingjie Jiang <jingjie.jiang@oracle.com> - 3.2.1-44
changelog:
  - For some old systems which don't have the qualified UUID from SMBIO, we need to generat one, otherwise, we'd run into the problem that same UUID shared by different server.
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-43
changelog:
  - Restrict agent password to at least 6 characters due to oracle security policy
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 14221303]


author: Jingjie Jiang <jingjie.jiang@oracle.com> - 3.2.1-42
changelog:
  - According to RFC4122, fix the UUID little-endian issue for SMBIOS version 2.6 or later.
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Zhigang Zhang <zhigang.zhang@oracle.com> [bug 14175428]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-41
changelog:
  - LDoms VM configuration API and ovmwatch daemon
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.2.1-40
changelog:
  - The lock to prevent concurrent db access is not working. It is caused by wrong
    parameters passed to LockFile.acquire(). The patch also makes the parameters
    of LockFile.acquire() more consistant with that of FileLock.acquire().
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Oracle-bug: 14215643


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-39
changelog:
  - LDoms network API
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>


author: Jingjie Jiang <jingjie.jiang@oracle.com> - 3.2.1-38
changelog:
  - Clean-up the xml output from command discover_hardware since some items were NOT needed by Manager.


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.2.1-37
changelog:
  - Parse /etc/sysconfig/o2cb in discover_cluster().
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Xiaodong Yang <xiao.dong.yang@oracle.com>
  - Set the bond MTU to equal to the primary interface MTU, if the primary
    interface MTU is not 1500 [bug 14187447]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-36
changelog:
  - LDoms host API
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Bijan Mottahedeh <Bijan.Mottahedeh@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.2.1-35
changelog:
  - This problem was caused by the indent value is getting too large for the buffer.
    It is interesting that it produces on this system only. In case it is fixed
    and tested on ca-otest318 [bug 14105411]


author: <> - 3.2.1-34
changelog:
  - correct the value of nr_nodes for NUMA system.
    Signed-off-by: Jingjie Jiang <jingjie.jiang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 14141554]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-32
changelog:
  - retain default password upon upgrade
    If  customers using the default password (oracle), the old password file will
    be removed upon upgrading from 3.1.1- to 3.2.1.
    This patch will fix this: save before upgrade and then restore after upgrade. [bug 14158623]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-31
changelog:
  - Xend will destroy a VM is the VM restart too fast (within 60 seconds) to prevent
    loops.
    With this patch, reboot_vm() will first check the elapse time since start. If
    it's less then 60 seconds, it will wait for a while until the elapse time reach
    the 60 seconds limit. Then it will call xm reboot.
    The reboot_vm() time will a bit longer if you call it immediately after start_vm():
      "'07468e5732fc4a02941ecb57d1068dc9'"
    real    1m20.618s
    user    0m0.076s
    sys    0m0.032s
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com> [bug 13984761&14189650&14139399&14056739]


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.2.1-30
changelog:
  - Skip MII,Ethtool,and WOL data for VLAN interfaces.
    This info is duplicate and not used by the manager. [bug 14105411]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-28
changelog:
  - Repository db upgrade is broken
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-27
changelog:
  - Bump Agent API version to [3]
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-25
changelog:
  - Foundations for LDoms support
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Liam Merwick <liam.merwick@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.2.1-24
changelog:
  - Check if VIP is correctly bound to base IP before configuration.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Oracle-bug: 14107022


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-23
changelog:
  - check free space before unpack file
    If there's not enough space, we don't need to unpack a file.
    Unfortunately, we cannot get unpacked filesize for tar/tar.gz/tar.bz2.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com> [bug 14134281]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-20
changelog:
  - remove some unused capabilities
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Ellen Batbouta <ellen.batbouta@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-19
changelog:
  - add local vm running lock
    Before this patch, if users start the same VM upon it rebooting (shutdown, but
    about to start), two instances could be started.
    With this patch, we add a local VM running lock. Then either the rebooting
    instance get the lock, or the newly started one.
    We add a new local lock because the current dlm lock doesn't support this; dlm
    lock only prevent the VM from running on multiple nodes.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com> [bug 14147772]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-18
changelog:
  - using crypt() with salt and sha512 for agent password
    The old SHA password will be replaced upon successful authentication.
    Also the default user is removed.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: John Haxby <john.haxby@oracle.com> [bug 14018738&13423154]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-16
changelog:
  - fix ovs_async_proc() returns none issue.
    Currently the caller (Manager) gets two XMLRPC responses: the PID and None.
    Most of the time PID is returned first so there's no problem. That's why it's
    hard to reproduce. We should exit the child to eliminate the second None return. [bug 14102901]


author: Junjie Wei <junjie.wei@oracle.com> - 3.2.1-15
changelog:
  - Improve cluster teardown to avoid breaking the cluster when operation fails.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Xiaodong Yang <xiao.dong.yang@oracle.com> [bug 14024916]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-14
changelog:
  - make vmconfig/assembly/template code more generic
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.2.1-13
changelog:
  - Do not notify master change on manual remaster so the core API won't be confused.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Oracle-bug: 13955543


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-12
changelog:
  - Include VLAN ID and port base-name in the VLAN block (ethx.y) during discover network.
    This is to accommodates the manager requirement when handling Linux, and Solaris network discovery.
  - retain server roles when removing server from pool
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-11
changelog:
  - add more capabilities to discover server
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-10
changelog:
  - move generic api network methods to base class
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-9
changelog:
  - move generic api host methods to base class
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-8
changelog:
  - add discover server capabilities support
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-7
changelog:
  - report vm running on xenstore break
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-6
changelog:
  - check xenstore for vm running.
    This works even when xend is stopped.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.2.1-5
changelog:
  - EINTR errors returned by select() should be ignored
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-4
changelog:
  - Fix server role handling.
    After this patch, agent will not care about server roles; it just stores it
    there and return it on discovery.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com> [bug 14021630&13967480]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-3
changelog:
  - covert file using pipeline and get ride of unsecured old_run_cmd().
    Also add some check before running the pipeline command. [bug 13586490]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.2.1-2
changelog:
  - console: fix running vm number
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com> [bug 13938197]


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-88
changelog:
  - Send the remaster notification when remaster happens on a non-clustered server.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-87
changelog:
  - Do not send the remaster notification on a manual remaster.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Xiaodong Yang <xiao.dong.yang@oracle.com> [bug 13955543]


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.1.1-86
changelog:
  - The bug was caused by missing the tap device in HVM guest. It is correct now,
    all interfaces of a bridge will be changed. [bug 13951015]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-85
changelog:
  - fix no SMBIOS info on discover_hardware for Dell machines.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-83
changelog:
  - put hostname and ip into log to make debugging easier
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-82
changelog:
  - Parse /etc/oracle-release to get OS name and version.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com> [bug 13807427]


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-80
changelog:
  - Update host OS name to Oracle Linux.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com> [bug 13807427]


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.1.1-79
changelog:
  - Reduce the connected retry time on connection reset from 60
    second to 30 second, and Replace  exception  with error logs [bug 13044663]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-75
changelog:
  - ovfxen: support new VirtualSystemType
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Srinivas Maturi <srinivas.maturi@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-73
changelog:
  - Close the opened file when lock fails.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.1.1-72
changelog:
  - Preserve the default route when a adding a bridge to a bond where the
    default route is on one of its VLANs Ex (bond.5) [bug 13848014]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-71
changelog:
  - restart ovm-consoled to refresh SSL tty/vnc console wrappers upon take/release ownership.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-70
changelog:
  - Protect remaster() with locking.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-69
changelog:
  - Protect qlayer-monitor reload with locking.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-68
changelog:
  - filelock: close file on lock error.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com> [bug 13808494]


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-65
changelog:
  - Remove cluster.conf before stopping o2cb in cluster configuration rollback.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Oracle-bug: 13033100


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.1.1-64
changelog:
  - Do not write the MAC address to the config file if we are adding a vlan over a bond. [bug 13611644]


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-62
changelog:
  - Update messages sent to the core API when cluster operations fail.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-61
changelog:
  - Update 3 APIs to allow disposal of a cluster in error.
    destroy_cluster()
    leave_cluster()
    deconfigure_server_for_cluster()
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Xiaodong Yang <xiao.dong.yang@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-60
changelog:
  - Flush the cache after updating .ovsrepo so the update will be available on a
    different server connected to the same filesystem. It is related to the API
    ocfs2_get_meta_data() which reads the filesystem directly.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 13804273]


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-56
changelog:
  - Add libaio to linux_xen/setup.py to compile the ocfs2 extension.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-54
changelog:
  - Fix the monitor base if it is broken on a clustered non-master server.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-53
changelog:
  - ovfxen: adding default 'bootloader' and 'builder' to pv guest
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com> [bug 13618553]


author: <> - 3.1.1-52
changelog:
  - discover_physical_luns should be in the linux host module
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: <> - 3.1.1-50
changelog:
  - poolfs API module should have a base interface
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: <> - 3.1.1-49
changelog:
  - cluster API module should have a base interface
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-47
changelog:
  - Fix monitor base if broken before statistics processing.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com> [bug 13615293]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-46
changelog:
  - use maxvcpus instead vcpu_avail
    Dynamic cpu feature needs some change in Manager side. Here is the current status:
    1. vcpu_avail is not used any more: we need to use maxvcpus and vcpus. (someone
    hacked to support this change between 3.4 and 4.0, but kept vcpu_avail option
    there. I should notify find it early. sorry.)
    2. dynamic vcpu change only works for PV guest right now.
    3. dynamic vcpu change only support shrink vcpu numbers right now.
    For 2 and 3, maybe we should document it in release note. Latest xen-unstable
    using xl is still the case.
    Attached is the agent side change. Please make the Manager side change:
    1. don't use vcpu_avail at all.
    2. use maxvcpus for cpu limit
    3. use vcpus for dynamic cpu count
    The good part is: after changing to vcpus and maxvcpus, when we switch to xl, no
    change is needed in Manager side.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com> [bug 13644714]


author: <> - 3.1.1-45
changelog:
  - network API module should have a base interface
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-43
changelog:
  - Flush the cache before reading ocfs2 directly.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-42
changelog:
  - add missing patch during refactor:
    r6971 | juwei | 2011-09-15 16:50:36 -0400 (Thu, 15 Sep 2011) | 9 lines
    Allow server removal when HB_CONFIGURED and server addition when CLUSTERED while in both cases the agent just does nothing.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Xiaodong Yang <xiao.dong.yang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 12715713]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-41
changelog:
  - add missing patch during refactor:
    r7043 | zhigwang | 2011-10-05 17:23:41 -0400 (Wed, 05 Oct 2011) | 4 lines
    Changed paths:
    M /ovm/trunk/utils/common.py
    M /ovm/trunk/vm.py
    remove error log in progress report thread


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-40
changelog:
  - add missing patch during refactor:
    r6953 | zhigwang | 2011-09-13 14:59:32 -0400 (Tue, 13 Sep 2011) | 8 lines
    Changed paths:
    M /ovm/trunk/OVSConstants.py
    change monitor grace time to 3600
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-39
changelog:
  - add missing patch during refactor:
    r6983 | amisherf | 2011-09-16 17:02:25 -0400 (Fri, 16 Sep 2011) | 4 lines
    Changed paths:
    M /ovm/trunk/OVSNotificationServer.py
    Changed logging.error to logging.exception on send and connect to log stack trace of the binding. [bug 12983608]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-38
changelog:
  - add missing patch during refactor:
    r7004 | juwei | 2011-09-28 17:03:51 -0400 (Wed, 28 Sep 2011) | 7 lines
    Changed paths:
    M /ovm/trunk/OVSCommons.py
    Log stdout data as well when run_cmd() fails.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-37
changelog:
  - add missing patch during refactor:
    ------------------------------------------------------------------------
    r7008 | zhigwang | 2011-09-29 16:43:27 -0400 (Thu, 29 Sep 2011) | 8 lines
    Changed paths:
    M /ovm/trunk/OvfXen.py
    ovfxen: allow empty description
    Signed-off-by: Srinivas Maturi <srinivas.maturi@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com> [bug 13005139]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-36
changelog:
  - add back this commit, we missed it during refactor
    r7006 | zhigwang | 2011-09-28 17:38:33 -0400 (Wed, 28 Sep 2011) | 8 lines
    Changed paths:
    M /ovm/trunk/host.py
    enable ntpdate on ntpd start
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com> [bug 13578005&12999197]


author: <> - 3.1.1-33
changelog:
  - remote API module should have a base interface
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-32
changelog:
  - Update destroy_cluster() / leave_cluster() to allow force removal.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Xiaodong Yang <xiao.dong.yang@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-30
changelog:
  - add lint target
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-29
changelog:
  * Tue Feb 14 2012 Junjie Wei <junjie.wei@oracle.com> - 3.1.1-28 
  - Start the NFS service before export if necessary; Stop the NFS service after unexport if there is no other export.
    Handle the trailing "/" in the given path which causes unexport failures.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com>


author: <> - 3.1.1-27
changelog:
  - support for building different targets
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-26
changelog:
  - fix dynamic vcpu setting
    Currently, 'vcpu' means the max vcpu count; 'vcpu_avail' mean the current vcpu
    count. We should change dynamic vcpu count when user set 'vcpu_avail'. [bug 13644714]
  - remove unused function run_cmd_bg()
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-24
changelog:
  - Update export_fs(), unexport_fs() and disocver_exports().
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-23
changelog:
  - Change export_nfs() and unexport_nfs() to export_fs() and unexport_fs().
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-21
changelog:
  - Update cluster discovery to accommodate the code refactoring.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-20
changelog:
  - Add export_nfs() and unexport_nfs();
    Update discover_mounted_file_systems().
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-18
changelog:
  - This patch moves all xm calls to one place: xenxm.py.
    It's easier for ldoms integration and xl replacement.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-15
changelog:
  - This patch adds a new testcase for some utils functions. It also removes some
    executable property from files. And also fixed a bug on progress reporter.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-12
changelog:
  - remove unused xend configuration APIs
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 3.1.1-11
changelog:
  - stop_vm: support stopping orphan VMs
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Steve Noyes <steve.noyes@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-10
changelog:
  - Fix parsing of /proc/mounts.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Adnan Misherfi <adnan.misherfi@oracle.com> - 3.1.1-8
changelog:
  - re-wrote ovs_change_mtu to except a range of values (1500 to 64000),
    and to changes  mtu on a physical,vlan,bond,and bridge interface


author: Junjie Wei <junjie.wei@oracle.com> - 3.1.1-3
changelog:
  - Fix indentation in discover_cluster().
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>


author: EL Errata <el-errata_ww@oracle.com> - 147-2.63.0.1.1
changelog:
  - Decrease loglevel of inotify_add_watch failure [orabug 18609660] (vaughan.cao@oracle.com)
  - Add hyper-v dynamic memory support (Jerry Snitselaar) [orabug 18074065]
  - Add powerpath support (John Haxby) [orabug 16511097]
  - Add multi-volume btrfs detection. (John Haxby) [orabug 13443447]
  - use oom_score_adj() in place of deprecated oom_adj() (Chuck Anderson) [orabug 13712009]


author: Michal Sekletar <msekleta@redhat.com> - 147-2.63.1
changelog:
  - also limit the additional modprobe locked workers (#1281469)
  - 80-drivers.rules: only make an exception for ipmi for modprobe with DRIVER set (#1281467)


author: Harald Hoyer <harald@redhat.com> 147-2.60
changelog:
  - ata_id - fixup all 8 not only 6 bytes of the fw_rev string
  Resolves: rhbz#794561
  - udev: properly handle symlink removal by 'change' event
  Resolves: rhbz#1018171


author: Harald Hoyer <harald@redhat.com> 147-2.58
changelog:
  - do not print error, if /sys/class/firmware/timeout does
    not exist (yet)
  Resolves: rhbz#1140336
  - always call modprobe, even when a driver is bound to the device
  Resolves: rhbz#1084513
  - fixed for every modprobe locked worker, increase max_childs
    use ncnt instead of zcnt
  Resolves: rhbz#1164960
  - print warning in start_udev, if udevlog is used
  Resolves: rhbz#876535


author: Harald Hoyer <harald@redhat.com> 147-2.53
changelog:
  - add rule for idrac interface renaming
  Resolves: rhbz#1054482
  - for every modprobe locked worker, increase max_childs
  Resolves: rhbz#1028174
  - increase firmware timeout to 600 seconds
  Resolves: rhbz#1077186
  - add nvme pcie ssd scsi_id ENV
  Resolves: rhbz#1020856
  - scsi_id: add short option "-b" parsing
  Resolves: rhbz#910168
  - add  by-id (hardware serial number) for Micron PCIe SSDs
  Resolves: rhbz#839172
  - 80-iosched.rules: check for attributes
  Resolves: rhbz#1008341


author: Harald Hoyer <harald@redhat.com> 147-2.47
changelog:
  - add OPTIONS="log_priority=<loglevel>" for debugging purposes
  Resolves: rhbz#947067
  - limit default udevd maximum childs
  Resolves: rhbz#833172 rhbz#885978
  - add scm path_id support
  Resolves: rhbz#888647
  - header fix for C++
  Resolves: rhbz#909792
  - scsi_id: retry on EBUSY
  Resolves: rhbz#920961


author: Harald Hoyer <harald@redhat.com> 147-2.46
changelog:
  - make symlink/rename failure info() only
    this can happen for multipath devices
  Resolves: rhbz#838451


author: Harald Hoyer <harald@redhat.com> 147-2.43
changelog:
  - add cciss handling to path_id
  Resolves: rhbz#784697
  - add kmsg alias logger
  Resolves: rhbz#826396
  - extend udev(7) man page about character encoding in symlinks
  Resolves: rhbz#790321
  - fix cdrom_id to honor feature profiles, if no medium is present
  Resolves: rhbz#847925


author: Harald Hoyer <harald@redhat.com> 147-2.41
changelog:
  - add "nowatch" option to manpage
  Resolves: rhbz#628762
  - fixed return code of udev-post for "status"
  Resolves: rhbz#735410
  - fixed udev_device_get_devnode()
    backported cdb1d7608a2e2ba708a890eeab6e5e99409a1953
  Resolves: rhbz#784648


author: Harald Hoyer <harald@redhat.com> 147-2.37
changelog:
  - add requires for libgudev1 on libudev with version and release
  Resolves: rhbz#727500
  - change import property buffer to 16384 bytes
  Resolves: rhbz#726566


author: Harald Hoyer <harald@redhat.com> 147-2.36
changelog:
  - handle Vodafone K3565-Z 3G modem
  Resolves: rhbz#632646
  - update path_id to upstream version, which can handle SAS devices that 
    have no enclosure and handles iSCSI devices.
  Resolves: rhbz#698540 rhbz#714951
  - use IFINDEX for temporary network interface renaming
  Resolves: rhbz#701265
  - udev now changes the IO scheduler for all disks except sata disks to the 
    "deadline" scheduler.
  Resolves: rhbz#711254


author: Harald Hoyer <harald@redhat.com> 147-2.34
changelog:
  - add CFLAGS and LDFLAGS to add missing PIE and RELRO flags
  Resolves: rhbz#676004
  - fixed udevadm trigger segmentation fault
  Resolves: rhbz#677857


author: Harald Hoyer <harald@redhat.com> 147-2.32
changelog:
  - added new page codes for scsi_id, to export ID_SERIAL_80 and ID_SERIAL_83.
  Resolves: rhbz#644902
  - correctly handle ENV{ACL_MANAGE}==0
  Resolves: rhbz#674168


author: Harald Hoyer <harald@redhat.com> 147-2.31
changelog:
  - fixed zero macs in 70-persistent-net.rules
  Resolves: rhbz#656059
  - add 42-qemu-usb.rules
  Resolves: rhbz#663064
  - create /dev/hugepages directory
  Resolves: rhbz#667750


author: Harald Hoyer <harald@redhat.com> 147-2.30
changelog:
  - fixed udevadm segfault, if log is set to debug
  Resolves: rhbz#657360
  - fixed keyboard handling for extra keys, especially volume
    control
  Resolves: rhbz#617572
  - quote output of 'udevadm info --query=shenv' or
                    'udevadm info --query=shproperty'
  Resolves: rhbz#644330


author: Harald Hoyer <harald@redhat.com> 147-2.29
changelog:
  - set the selinux context for "add" events, regression
    the fix for rhbz#575128 caused a lot of selinux errors like
    rhbz#603729
  Resolves: rhbz#575128


author: Harald Hoyer <harald@redhat.com> 147-2.28
changelog:
  - quirk for cisco virtual cdrom was not complete, reports
    blank media, rhbz#628962
  Resolves: rhbz#624707


author: Harald Hoyer <harald@redhat.com> 147-2.27
changelog:
  - added ID_SERIAL_RAW to scsi_id export output, which is not
    whitespace stripped
  Resolves: rhbz#612173


author: Harald Hoyer <harald@redhat.com> 147-2.26
changelog:
  - more quirk for virtual machines, which do not report correct
    CDROM information
  Resolves: rhbz#624707


author: Harald Hoyer <harald@redhat.com> 147-2.22
changelog:
  - fixed random MAC address handling 
  - honor ifcfg HWADDR settings for 70-persistent-net.rules
  Resolves: rhbz#596464


author: Harald Hoyer <harald@redhat.com> 147-2.19
changelog:
  - do not blkid blank or audio CDROMs 
  Resolves: rhbz#606293
  - fixed scsi changer symlink
  Resolves: rhbz#603051
  - suppress warnings from usb_id
  Resolves: rhbz#585648
  - add path_id for virtio-blk devices
  Resolves: rhbz#601248
  - fixed reference leak in path_id sas patch
  Resolves: rhbz#537185


author: Harald Hoyer <harald@redhat.com> 147-2.18
changelog:
  - removed obsolete arguments to configure
  Resolves: rhbz#601882
  - add IMPORT{db} IMPORT{cmdline} and set rd_NO_MDIMSM for noiswmd kernel cmdline option
  Resolves: rhbz#589775
  - add port for sas in path_id 
  Resolves: rhbz#537185
  - add modprobe hack to serialize modprobes
  Resolves: rhbz#515413
  - revert path check from 147-2.16
  Resolves: rhbz#591970


author: Harald Hoyer <harald@redhat.com> 147-2.15
changelog:
  - fix "do not mark xvd* devices as cdrom by default (rhbz#584163)"
    included patch but did not apply
  - Resolves: rhbz#584163


author: Harald Hoyer <harald@redhat.com> 147-2.14
changelog:
  - do not mark xvd* devices as cdrom by default (rhbz#584163)
  - Do not rename network interfaces.
    This causes more problems, than solving the original one.
    (rhbz#565724)
  - Resolves: rhbz#584163, rhbz#572681


author: Harald Hoyer <harald@redhat.com> 147-2.13
changelog:
  - supress error message in pre/post while killing old udevd
    (rhbz#576819)
  - fixed a lot of cdrom related problems (rhbz#582557, rhbz#582559)
  - Resolves: rhbz#576819, rhbz#582557, rhbz#582559


author: Harald Hoyer <harald@redhat.com> 147-2.12
changelog:
  - fixed virtio-ports rule patch (rhbz#569699)
  - removed IFINDEX from renamed interfaces (rhbz#572681)
  - do not reset selinux labels (rhbz#575128)
  - Resolves: rhbz#572681, rhbz#569699, rhbz#575128


author: Harald Hoyer <harald@redhat.com> 147-2.11
changelog:
  - add SCSI SAS handling to path_id (rhbz#537185)
  - fixed handling of boxes with lots of disks and huge
    volume groups (rhbz#570016)
  - fixed virtio-ports rule (rhbz#569699)
  - Resolves: rhbz#537185, rhbz#569699, rhbz#570016


author: Harald Hoyer <harald@redhat.com> 147-2.10
changelog:
  - add one more letter to renamed interfaces to avoid name 
    clashing (rhbz#565724)
  - Resolves: rhbz#565724


author: Harald Hoyer <harald@redhat.com> 147-2.9
changelog:
  - rename non-handled network interfaces, so that the handled
    can be renamed to their destination name (rhbz#565724)
  - Resolves: rhbz#565724


author: Harald Hoyer <harald@redhat.com> 147-2.7
changelog:
  - fixed udev-post initscript retriggering (rhbz#566568)
  - attempt to fix network interface renaming (rhbz#565724)
  - Resolves: rhbz#565724, rhbz#566568


author: Harald Hoyer <harald@redhat.com> 147-2.4
changelog:
  - add symlink rule for virtio ports (rhbz#559180)
  - fixed initscript
  - create /dev/net/tun with 0666 in start_udev
  - Export ID_WWN_VENDOR_EXTENSION and ID_WWN_WITH_EXTENSION
  - Related: rhbz#543948 rhbz#515413
  - Resolves: rhbz#559180


author: Harald Hoyer <harald@redhat.com> 147-2.2
changelog:
  - only require s390utils-base, rather than s390utils (#553156)
  - removed non-working softlinks (partly fixes also #528883)
  - Resolves: rhbz#553156


author: Harald Hoyer <harald@redhat.com> 147-1
changelog:
  - version 147
  - Fix upgrade from Fedora 11 with bluez installed (#533925)
  - obsolete DeviceKit and DeviceKit-devel (#532961)
  - fixed udev-post exit codes (#523976)
  - own directory /lib/udev/keymaps (#521801)
  - no more floppy modaliases (#514329)
  - added one more modems to modem-modeswitch.rules (#515349)
  - add NEWS file to the doc section
  - automatically turn on hotplugged CPUs (rhbz#523127)
  - recognize a devtmpfs on /dev (bug #528488)


author: Harald Hoyer <harald@redhat.com> 145-2
changelog:
  - fix file permissions
  - remove rpath
  - chkconfig --add for udev-post
  - fix summaries
  - add "Required-Stop" to udev-post


author: Harald Hoyer <harald@redhat.com> 145-1
changelog:
  - version 145
  - add "udevlog" kernel command line option to redirect the
    output of udevd to /dev/.udev/udev.log


author: Harald Hoyer <harald@redhat.com> 143-2
changelog:
  - add acpi floppy modalias
  - add retrigger of failed events in udev-post.init
  - killall pids of udev in %pre


author: Harald Hoyer <harald@redhat.com> 142-4
changelog:
  - git fix: udevadm: settle - fix timeout
  - git fix: OWNER/GROUP: fix if logic
  - git fix: rule-generator: cd - skip by-path links if we create by-id links
  - git fix: fix possible endless loop for GOTO to non-existent LABEL
  - git fix: cdrom_id: suppress ID_CDROM_MEDIA_STATE=blank for plain non-writable 
  		CDROM media


author: Harald Hoyer <harald@redhat.com> 139-3
changelog:
  - renamed modprobe /etc/modprobe.d/floppy-pnp to
    /etc/modprobe.d/floppy-pnp.conf (bug #492732 #488768)
  - Resolves: rhbz#492732


author: Harald Hoyer <harald@redhat.com> 136-1
changelog:
  - test for restorecon in start_udev before it is used (bug #480608)
  - added groups video audio cdrom tape dialout in post
    (might be moved to MAKEDEV)
  - version 136


author: Harald Hoyer <harald@redhat.com> 135-2
changelog:
  - changed udevsettle -> udevadm settle
  - added doc to libudev-devel
  - added more attr and defattr
  - various rpmlint fixes


author: Harald Hoyer <harald@redhat.com> 126-1
changelog:
  - version 126
  - fixed udevadm syntax in start_udev (credits B.J.W. Polman)
  - removed some manually created devices from makedev (bug #457125)


author: Harald Hoyer <harald@redhat.com> 120-4.20080421git
changelog:
  - added patches from git:
  - persistent device naming: also read unpartitioned media
  - scsi_id: initialize serial strings
  - logging: add trailing newline to all strings
  - path_id: remove subsystem whitelist
  - allow setting of MODE="0000"
  - selinux: more context settings
  - rules_generator: net rules - always add KERNEL== match to generated rules
  - cdrom_id: replace with version which also exports media properties
  - vol_id: add --offset option
  - udevinfo: do not replace chars when printing ATTR== matches
  - Resolves: rhbz#440568


author: Harald Hoyer <harald@redhat.com> 120-3
changelog:
  - fixed pre/preun scriptlets (bug #441941)
  - removed fedora specific patch for selinux symlink handling


author: Harald Hoyer <harald@redhat.com> 120-2
changelog:
  - removed warning about deprecated /lib/udev/devices (rhbz#440961)
  - replaced /usr/bin/find with shell find function (rhbz#440961)


author: Harald Hoyer <harald@redhat.com> 118-9
changelog:
  - added more support for the "modprobedebug" kernel command 
    line option, to debug hanging kernel modules


author: Harald Hoyer <harald@redhat.com> 118-8
changelog:
  - added /etc/sysconfig/udev to configure some speedups
  - added "udevnopersist" as a kernel command line, to disable
    persistent storage symlink generation


author: Harald Hoyer <harald@redhat.com> 118-7
changelog:
  - files from /var/lib/udev/rules.d are copied to /dev/.udev/rules.d 
    at startup and back at shutdown
  - persistent cd and net rules generate the files in 
    /dev/.udev/rules.d now
  - added post section to symlink 70-persistent-cd.rules 70-persistent-net.rules
    from /etc/udev/rules.d to /dev/.udev/rules.d


author: Harald Hoyer <harald@redhat.com> 118-6
changelog:
  - moved all generated files to /var/lib/udev 
    (also 70-persistent-cd.rules 70-persistent-net.rules)
  - added a caching mechanism for MAKEDEV (saves some seconds on startup)
  - added trigger for selinux-policy and MAKEDEV to remove the udev cache files


author: Harald Hoyer <harald@redhat.com> 118-4
changelog:
  - made symlinks relative (rhbz#432878)
  - removed the backgrounding of node creation (rhbz#381461)
  - do not change sg group ownership to disk for scanners (rhbz#432602)
  - attempt to fix selinux symlink bug (rhbz#345071)
  - fixed URL
  - made rpmlint mostly happy
  - disabled static version (no static selinux lib)


author: Harald Hoyer <harald@redhat.com> 116-3
changelog:
  - fixed preun chkconfig
  - added /sbin path to chkconfig in post section 
  - patch: do not generate net rules for type > 256
  - fixes glitches appearing in bz#323991


author: Harald Hoyer <harald@redhat.com> 115-5.20071012git
changelog:
  - added upstream patch for rhbz#328691
  - moved floppy module loading to pnp-alias in /etc/modprobe.d/floppy-pnp


author: Harald Hoyer <harald@redhat.com> - 115-3
changelog:
  - some upstream fixes from git
  - removed last_rule for loop rules
  - added "udevinfo udevtrace" kernel command line options for better debugging


author: Harald Hoyer <harald@redhat.com> - 115-2
changelog:
  - some upstream fixes from git
  - last_rule for loop rules (speedup for live-cds/qemu with 128 loop devices)


author: Harald Hoyer <harald@redhat.com> - 114-4
changelog:
  - added patch to prevent persistent net rules for virtual network interfaces,
    like vmware and vlans


author: Harald Hoyer <harald@redhat.com> - 113-10
changelog:
  - do not run vol_id on non-partition block devices (bug #251401)
  - read all multiline pnp modaliases again


author: Harald Hoyer <harald@redhat.com> - 114-1
changelog:
  - version 114
  - big rule unification and cleanup
  - added persistent names for network and cdrom devices over reboot


author: Harald Hoyer <harald@redhat.com> - 113-7
changelog:
  - major rule cleanup
  - removed persistent rules from 50 and included upstream rules
  - removed skip_wait from modprobe


author: Harald Hoyer <harald@redhat.com> - 106-3
changelog:
  - modprobe only on modalias (bug #238140)
  - make startup messages visible again
  - speedup boot process by not executing pam_console_apply while booting
  - Resolves: rhbz#238140


author: Harald Hoyer <harald@redhat.com> - 106-1
changelog:
  - version 106
  - specfile cleanup
  - removed pilot rule
  - removed dasd_id and dasd_id rule
  - provide static versions in a subpackage


author: Harald Hoyer <harald@redhat.com> - 104-2
changelog:
  - moved uinput to input subdirectory (rhbz#213854)
  - added USB floppy symlinks (rhbz#185171)
  - fixed ZIP drive handling (rhbz#223016)
  - Resolves: rhbz#213854,rhbz#185171,rhbz#223016


author: Harald Hoyer <harald@redhat.com> - 095-9
changelog:
  - improved error msg for firmware_helper (bug #206944)
  - added xpram symlink to slram device nodes (bug #205563)
  - removed infiniband rules (bug #206224)
  - use newest path_id script (bug #207139)


author: Harald Hoyer <harald@redhat.com> - 095-7
changelog:
  - added udevtimeout=<timeout in seconds>
    kernel command line parameters for start_udev 
    (default is to wait forever)


author: Harald Hoyer <harald@redhat.com> - 089-1
changelog:
  - version 089
  - do not force loading of parport_pc (bug #186850)
  - manually load snd-powermac (bug #176761)
  - added usb floppy symlink (bug #185171)
  - start_udev uses udevtrigger now instead of udevstart


author: Harald Hoyer <harald@redhat.com> - 084-9
changelog:
  - create non-enum device (cdrom, floppy, scanner, changer)
    for compatibility (random device wins)
    e.g. /dev/cdrom -> hdd /dev/cdrom-hdc -> hdc /dev/cdrom-hdd -> hdd


author: Harald Hoyer <harald@redhat.com> - 084-8
changelog:
  - fixed ZIP drive thrashing (bz #181041 #182601)
  - fixed enumeration (%e does not work anymore) (bz #183288)


author: Peter Jones <pjones@redhat.com> - 084-7
changelog:
  - Don't start udevd in %post unless it's already running
  - Stop udevd before chkconfig --del in %preun


author: Harald Hoyer <harald@redhat.com> - 084-4
changelog:
  - fixed group issue with vol_id (bz #181432)
  - fixed dvb permissions (bz #179993)
  - added support for scsi media changer (bz #181911)
  - fixed pktcdvd device creation (bz #161268)


author: Harald Hoyer <harald@redhat.com> - 078-4
changelog:
  - removed group "video" from the rules
  - fixed specfile
  - load nvram, floppy, parport and lp modules in
    /etc/sysconfig/modules/udev-stw.modules until there 
    is a better solution
  - fixed more floppy module loading


author: Harald Hoyer <harald@redhat.com> - 077-2
changelog:
  - switched back to udevstart and use active /dev/.udev/queue waiting 
    in start_udev
  - removed support for old kernels
  - refined some udev.rules


author: Harald Hoyer <harald@redhat.com> - 075-2
changelog:
  - moved /etc/udev/scripts to /lib/udev
  - moved /etc/udev/devices to /lib/udev/devices
  - added new event replay for kernel >= 2.6.15
  - added usb devices
  - renamed cpu device to cpuid (bug #161538)
  - changed vendor string "Onstream" to "On[sS]tream" (bug #173043)
  - compiled all *_id programs statically


author: Bill Nottingham <notting@redhat.com> - 062-2
changelog:
  - update to 062
  - use included ata_id, build usb_id
  - load modules for pci, usb, pcmcia
  - ship RELEASE-NOTES in %doc


author: Harald Hoyer <harald@redhat.com> - 056-1
changelog:
  - updated to version 056
  - merged permissions in the rules file
  - added udevpermconv.sh to convert old permission files


author: Harald Hoyer <harald@redhat.com> - 050-6
changelog:
  - introducing /etc/udev/makedev.d/50-udev.nodes
  - glibcstatic patch modified to let gcc4 compile udev


author: Harald Hoyer <harald@redhat.com> - 048-2
changelog:
  - fixed a case where reading /proc/ide/hd?/media returns EIO
    (bug rh#142713)
  - changed all device node permissions of group "disk" to 0640 
    (bug rh#110197)
  - remove $udev_db with -fr in case of a directory (bug rh#142962)


author: Harald Hoyer <harald@redhat.com> - 039-6.FC3.1
changelog:
  - speed up pam_console.dev
  - mount pts and shm, in case of the dev trigger
  - increased timeout for udevstart
  - removed syslog() from signal handler (caused vmware locks)
  - turned off logging, which speeds up the boot process


author: Harald Hoyer <harald@redhat.com> - 039-5
changelog:
  - added udev-039-norm.patch, which prevents removal of hd* devices,
    because the kernel sends remove/add events, if an IDE removable device
    is close(2)ed. mke2fs, e.g. would fail in this case.


author: Harald Hoyer <harald@redhat.com> - 039-4
changelog:
  - do not call dev.d scripts, if network interface hasn't changed 
    the name
  - correct wait for dummy network devices
  - removed NONBLOCK from volume-id
  - do not log in udev.static, which should fix bug 136005


author: Harald Hoyer <harald@redhat.com> - 039-2
changelog:
  - improved wait_for_sysfs for virtual consoles with Kay Siever's patch
  - wait for ppp class
  - wait for LVM dm- devices
  - integrate wait_for_sys in udev.static for the initrd


author: Harald Hoyer <harald@redhat.com> - 039-1
changelog:
  - version 039, fixes also manpage bug 135996 
  - fixed glibc issue for static version (getgrnam, getpwnam) (bug 136005)
  - close the syslog in every app


author: Harald Hoyer <harald@redhat.com> - 038-2
changelog:
  - par[0-9] is now a symlink to lp
  - MAKEDEV the parport devices
  - now conflicts with older initscripts


author: Harald Hoyer <harald@redhat.com> - 035-1
changelog:
  - version 035, which only improves wait_for_sysfs
  - load ide modules in start_udev, until a hotplug script is available
    (bug 135260)


author: Harald Hoyer <harald@redhat.com> - 034-3
changelog:
  - removed scary error messages from wait_for_sysfs
  - symlink from nst? -> tape?
  - kill udevd on update


author: Harald Hoyer <harald@redhat.com> - 034-1
changelog:
  - new version udev-034
  - removed patches, which went upstream
  - pam_console.dev link renamed to 05-pam_console.dev
  - MAKEDEV.dev links renamed to 10-MAKEDEV.dev


author: Harald Hoyer <harald@redhat.com> - 032-10
changelog:
  - added floppy madness (bug 134830)
  - replay scsi events in start_udev for the devices on the adapter (bug 130746)


author: Harald Hoyer <harald@redhat.com> - 032-9
changelog:
  - obsoleted $UDEV_LOG, use udev_log
  - correct SYMLINK handling in pam_console.dev
  - specfile cleanup
  - added check-cdrom.sh for nice cdrom symlinks


author: Harald Hoyer <harald@redhat.com> - 032-8
changelog:
  - added patches from Féliciano Matias for multiple symlinks (bug 134477 and 134478)
  - corrected some permissions with a missing leading 0
  - added z90crypt to the permissions file (bug 134448)
  - corrected requires and conflicts tags
  - removed /dev/log from MAKEDEV creation


author: Harald Hoyer <harald@redhat.com> - 032-4
changelog:
  - made /etc/udev/devices/ for manual device nodes
  - refined SELINUX check, if /dev is not yet mounted in start_dev


author: Harald Hoyer <harald@redhat.com> - 032-3
changelog:
  - corrected permissions for /dev/rtc (bug 133636)
  - renamed device-mapper to mapper/control (bug 133688)


author: Harald Hoyer <harald@redhat.com> - 030-27
changelog:
  - simplified udev.conf
  - refined close_on_exec patch
  - added pam_console supply for symlinks, now gives correct permissions,
    for e.g. later plugged in cdroms
  - renamed sr? to scd? (see devices.txt; k3b likes that :)


author: Jeremy Katz <katzj@redhat.com> - 030-26
changelog:
  - require a 2.6 kernel
  - prereq instead of requires MAKEDEV
  - obsolete and provide dev
  - add a trigger for the removal of /dev so that we set things up


author: Harald Hoyer <harald@redhat.com> - 030-21
changelog:
  - applied enumeration patch from David Zeuthen for cdrom symlinks (bug 131532)
  - create /dev/ppp in start_udev (bug 131114)
  - removed nvidia devices from start_udev
  - check for restorecon presence in start_udev (bug 131904)


author: Harald Hoyer <harald@redhat.com> - 030-16
changelog:
  - moved %{_sysconfdir}/hotplug.d/default/udev.hotplug to %{_sysconfdir}/hotplug.d/default/10-udev.hotplug


author: Harald Hoyer <harald@redhat.com> - 030-15
changelog:
  - added nvidia devices to start_udev
  - added UDEV_RAMFS for backwards compat to udev.conf
  - changed Group (bug 131488)
  - added libselinux-devel to build requirements


author: Jeremy Katz <katzj@redhat.com> - 030-11
changelog:
  - use tmpfs instead of ramfs (it has xattr support now)
  - change variables appropriately to TMPFS intead of RAMFS in udev.conf
  - create loopN, not just loop in start_udev


author: Harald Hoyer <harald@redhat.com> - 030-8
changelog:
  - changed defaults not to remove device nodes
  - added rule for net/tun
  - extended start_udev to create devices, which can trigger module autoloading
  - refined cloexec patch, to redirect stdin,out,err of /dev.d execed apps to /dev/null


author: Harald Hoyer <harald@redhat.com> - 030-7
changelog:
  - removed usage of /usr/bin/seq in start_udev
  - set correct permissions in start_udev
  - extended the cloexec patch
  - removed udev-persistent package (define with_persistent==0)
  - check for /var/run/console/console.lock before calling /sbin/pam_console_setowner
  - linked pam_console_setowner statically against libglib-2.0.a


author: Harald Hoyer <harald@redhat.com> - 029-3
changelog:
  - put /etc/sysconfig/udev in /etc/udev/udev.conf and removed it
  - made only udev.static static
  - make our defaults the default values
  - removed /udev


author: Harald Hoyer <harald@redhat.com> - 026-2
changelog:
  - udev-026
  - preserve ownership of device nodes, which already exist
  - do not remove device nodes if UDEV_REMOVE="no"
  - added volume_id
  - build with klibc


author: Greg Kroah-Hartman <greg@kroah.com>
changelog:
  - add some more files to the documentation directory
  - add ability to build scsi_id and make it the default


author: Greg Kroah-Hartman <greg@kroah.com>
changelog:
  - fix up udevd build, as it's no longer needed to be build seperatly
  - add udevtest to list of files
  - more Red Hat sync ups.


author: Greg Kroah-Hartman <greg@kroah.com>
changelog:
  - add udevsend, and udevd to the files
  - add ability to build udevd with glibc after the rest is build with klibc


author: Robert Love <rml@tech9.net>
changelog:
  - Make work without a build root
  - Correctly install the right files
  - Pass the RPM_OPT_FLAGS to gcc so we can build per the build policy
  - Put some prereqs in
  - Install the hotplug symlink to udev


author: Benjamin Tissoires <btissoir@redhat.com> 1.4.5-4
changelog:
  - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601)
  - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601)
  - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601)


author: Soren Sandmann <ssp@redhat.com> 1.4.5-3
changelog:
  - cve-2013-6462.patch: sscanf overflow (bug 1049684)
  - sscanf-hardening.patch: Some other sscanf hardening fixes (1049684)


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.143
changelog:
  - From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Date: Wed, 21 Mar 2018 19:05:06 -0700
    Subject: x86/boot: Disable IBRS in intr/nmi exit path at bootup
    stage
    After reset, IBRS is disabled by processor, but a coming intr/nmi leave IBRS
    enabled after their exit. It's not necessory for bootup code to run in low
    performance with IBRS enabled.
    On ORACLE X6-2(500GB/88 cpus, dom0 11GB/20 vcpus), we observed an 200s+ delay
    in construct_dom0.
    By initializing use_shadow_spec_ctrl with 1, IBRS is disabled in intr/nmi exit
    path. Then delay in construct_dom0 is ~50s.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    (cherry picked from commit 52404341e0c4aced6a4ac9897d7b79be512f4e8b)
    Note this is a temporary fix, final fix is still under review in
    https://lists.xenproject.org/archives/html/xen-devel/2018-03/msg03079.html
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27741870] {CVE-2017-5753/CVE-2017-5715/CVE-2017-5754}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.142
changelog:
  - From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Date: Wed, 21 Mar 2018 20:30:22 -0700
    Subject: Fix a wrong check in DO_SPEC_CTRL_EXIT_TO_XEN
    The testb instruction in DO_SPEC_CTRL_EXIT_TO_XEN is wrong and it always set
    ZF, the following je instruction will always jump.
    %rsp doesn't point to cpuinfo struct in intr/nmi context, we need to calculate
    a correct pointer for cpuinfo struct.
    This patch fix above two issues.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrvsky@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    (cherry picked from commit 222bb10d34ac0eae6dd1147ecfa65788f4b9785c)
    This is part of XSA-254.
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27741870] {CVE-2017-5753/CVE-2017-5715/CVE-2017-5754}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.141
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86/paging: don't unconditionally BUG() on finding SHARED_M2P_ENTRY
    PV guests can fully control the values written into the P2M.
    This is XSA-251.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27188658] {CVE-2017-17565}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.140
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86/shadow: fix ref-counting error handling
    The old-Linux handling in shadow_set_l4e() mistakenly ORed together the
    results of sh_get_ref() and sh_pin(). As the latter failing is not a
    correctness problem, simply ignore its return value.
    In sh_set_toplevel_shadow() a failing sh_get_ref() must not be
    accompanied by installing the entry, despite the domain being crashed.
    This is XSA-250.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Tim Deegan <tim@xen.org>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27188652] {CVE-2017-17564}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.139
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86/shadow: fix refcount overflow check
    Commit c385d27079 ("x86 shadow: for multi-page shadows, explicitly track
    the first page") reduced the refcount width to 25, without adjusting the
    overflow check. Eliminate the disconnect by using a manifest constant.
    Interestingly, up to commit 047782fa01 ("Out-of-sync L1 shadows: OOS
    snapshot") the refcount was 27 bits wide, yet the check was already
    using 26.
    This is XSA-249.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: George Dunlap <george.dunlap@citrix.com>
    Reviewed-by: Tim Deegan <tim@xen.org>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27188647] {CVE-2017-17563}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.138
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86/mm: don't wrongly set page ownership
    PV domains can obtain mappings of any pages owned by the correct domain,
    including ones that aren't actually assigned as "normal" RAM, but used
    by Xen internally.  At the moment such "internal" pages marked as owned
    by a guest include pages used to track logdirty bits, as well as p2m
    pages and the "unpaged pagetable" for HVM guests. Since the PV memory
    management and shadow code conflict in their use of struct page_info
    fields, and since shadow code is being used for log-dirty handling for
    PV domains, pages coming from the shadow pool must, for PV domains, not
    have the domain set as their owner.
    While the change could be done conditionally for just the PV case in
    shadow code, do it unconditionally (and for consistency also for HAP),
    just to be on the safe side.
    There's one special case though for shadow code: The page table used for
    running a HVM guest in unpaged mode is subject to get_page() (in
    set_shadow_status()) and hence must have its owner set.
    This is XSA-248.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Tim Deegan <tim@xen.org>
    Reviewed-by: George Dunlap <george.dunlap@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27188642] {CVE-2017-17566}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.137
changelog:
  - From 52c2ad4c02e0ee603c302a6a3550509906b34c8f Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 14 Feb 2018 10:38:34 +0000
    Subject: [PATCH] x86/spec_ctrl: Fix several bugs in SPEC_CTRL_ENTRY_FROM_INTR_IST
    MIME-Version: 1.0
    Content-Type: text/plain; charset=UTF-8
    Content-Transfer-Encoding: 8bit
    DO_OVERWRITE_RSB clobbers %rax, meaning in practice that the bti_ist_info
    field gets zeroed.  Older versions of this code had the DO_OVERWRITE_RSB
    register selectable, so reintroduce this ability and use it to cause the
    INTR_IST path to use %rdx instead.
    The use of %dl for the %cs.rpl check means that when an IST interrupt hits
    Xen, we try to load 1 into the high 32 bits of MSR_SPEC_CTRL, suffering a #GP
    fault instead.
    Also, drop an unused label which was a copy/paste mistake.
    Reported-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Roger Pau Monne <roger.pau@citrix.com>
    (cherry picked from commit a2b08fbed388f18235fda5ba1655c1483ef3e215)
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.136
changelog:
  - From d797e6f4aa53b9d58f87c4ed49472a019108657c Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Mon, 12 Feb 2018 01:18:55 +0800
    Subject: [PATCH 51/51] x86: allow easier disabling of BTI mitigations
    Support both a "disable everything" and a "disable all RSB overwriting"
    sub-option.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    (cherry picked from commit 37f02a06b9d2f9d965b747a6752301314e935571)
    Conflicts:
    docs/misc/xen-command-line.markdown
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.135
changelog:
  - From 43591331a3c6814942f6392d2b04b41e9c70ea2e Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Mon, 12 Feb 2018 01:05:16 +0800
    Subject: [PATCH 50/51] x86/boot: Make alternative patching NMI-safe
    During patching, there is a very slim risk that an NMI or MCE interrupt in the
    middle of altering the code in the NMI/MCE paths, in which case bad things
    will happen.
    The NMI risk can be eliminated by running the patching loop in NMI context, at
    which point the CPU will defer further NMIs until patching is complete.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    (cherry picked from commit 5191c1ef51b00ec112206917647faea55be8b02f)
    Conflicts:
    xen/arch/x86/alternative.c
    Add macro ACCESS_ONCE into xen/include/xen/lib.h
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.134
changelog:
  - From ebb91aad16e7ec207944269a96b504760a85445e Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 31 Jan 2018 10:35:52 +0000
    Subject: [PATCH 49/51] xen/cmdline: Fix parse_boolean() for unadorned values
    A command line such as "cpuid=no-ibrsb,no-stibp" tickles a bug in
    parse_boolean() because the separating comma fails the NUL case.
    Instead, check for slen == nlen which accounts for the boundary (if any)
    passed via the 'e' parameter.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    (cherry picked from commit ac37ec1ddef234eeba6f438c29ff687c64962ebd)
    Conflicts:
    xen/common/kernel.c
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.133
changelog:
  - From 6a6cc03959d095b3f0f16c0158b13e14ecb63f59 Mon Sep 17 00:00:00 2001
    From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Date: Tue, 6 Feb 2018 09:16:07 +0800
    Subject: [PATCH 48/51] Optimize the context switch code a bit
    Based on upstream commit a2ed643ed783020f885035432e9c0919756921d1
    "x86/ctxt: Issue a speculation barrier between vcpu contexts"
    Only flush Branch Target Buffer when switching to a different vcpu context
    or non idle context.
    Use opt_ibpb instead of cpu_has_xen_ibpb suggested by Boris.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.132
changelog:
  - From 9824717af650fce2f5a24e8e967f127650731b28 Mon Sep 17 00:00:00 2001
    From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Date: Tue, 6 Feb 2018 08:36:22 +0800
    Subject: [PATCH 47/51] Update init_speculation_mitigations() to upstream's
    Based on upstream commit 2713715305ca516f698d58cec5e0b322c3b2c4eb
    "x86/boot: Calculate the most appropriate BTI mitigation to use"
    and combined upstream commit 30cbd0c83ef3d0edac2d5bcc41a9a2b7a843ae58
    "x86/spec_ctrl: Fix determination of when to use IBRS"
    Tried to port all changes in upstream commit to current code.
    This should include all the changes, such as:
    Set opt_rsb_native/opt_rsb_vmexit default to true, prefer retpoline without
    checking X86_FEATURE_IBRSB, remove redundant variable have_mitigation,
    remove *_SS variants for RSB stuff, enable RSB flushing no matter if IBRS is
    enabled, etc.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.131
changelog:
  - From 42a020d3da30f262c0e4ea4d485c0d555d9fe5e9 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Tue, 6 Feb 2018 08:00:00 +0800
    Subject: [PATCH 46/51] x86/entry: Avoid using alternatives in NMI/#MC paths
    This patch is deliberately arranged to be easy to revert if/when alternatives
    patching becomes NMI/#MC safe.
    For safety, there must be a dispatch serialising instruction in (what is
    logically) DO_SPEC_CTRL_ENTRY so that, in the case that Xen needs IBRS set in
    context, an attacker can't speculate around the WRMSR and reach an indirect
    branch within the speculation window.
    Using conditionals opens this attack vector up, so the else clause gets an
    LFENCE to force the pipeline to catch up before continuing.  This also covers
    the safety of RSB conditional, as execution it is guaranteed to either hit the
    WRMSR or LFENCE.
    One downside of not using alternatives is that there unconditionally an LFENCE
    in the IST path in cases where we are not using the features from IBRS-capable
    microcode.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    (cherry picked from commit 3fffaf9c13e9502f09ad4ab1aac3f8b7b9398f6f)
    Conflicts:
    xen/arch/x86/spec_ctrl.c
    xen/arch/x86/x86_64/entry.S
    xen/include/asm-x86/current.h
    Add a #define of UNLIKELY_DISPATCH_LABEL in xen/include/asm-x86/asm_defns.h
    picked from upstream commit 8e0da8c07f4f80e14314977a11f738bd74a5b62b
    "x86: Improve information from domain_crash_synchronous"
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.130
changelog:
  - From 61739747eafbfe9a1b0380d8abf4bd0302488f4a Mon Sep 17 00:00:00 2001
    From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Date: Tue, 6 Feb 2018 07:41:13 +0800
    Subject: [PATCH 45/51] Update RSB related implementation to upstream ones
    Based on upstream commit e6c0128e9ab25bf66df11377a33ee5584d7f99e3
    "x86/entry: Organise the clobbering of the RSB/RAS on entry to Xen"
    Update DO_OVERWRITE_RSB definition to to upstream's.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.129
changelog:
  - From a9b5491b2440345767d4adbccb60b28b6bd2b099 Mon Sep 17 00:00:00 2001
    From: Elena Ufimtseva <elena.ufimtseva@oracle.com>
    Date: Sat, 3 Feb 2018 04:14:08 +0800
    Subject: [PATCH 44/51] x86/domain: Move hvm_vcpu_initialize() before cpuid_policy_changed()
    Move hvm_vcpu_initialize() befor cpuid_policy_changed() which
    will allocate memory for MSR permission map and can be used in
    cpuid_policy_changed without triggering BUG_ON.
    OraBug: 27356726
    Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    (cherry picked from commit 3326ad769f1acc4697a0e608ea9c85ce5a05ca90)
    Conflicts:
    xen/arch/x86/domain.c
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.128
changelog:
  - From b3f98d22679af9186a8eae6372d173631058eb3d Mon Sep 17 00:00:00 2001
    From: Elena Ufimtseva <elena.ufimtseva@oracle.com>
    Date: Thu, 18 Jan 2018 11:31:49 -0500
    Subject: [PATCH 42/51] x86/svm: clear CPUID IBPB when feature is not supported
    The CPUID bit which exposes to the guest IBPB support was cleared under incorrect
    check of stibp field of CPUID policy, resulting in the guest not seeing this feature.
    Fix this by using correct check of ibpb in the cpuid_policy structure.
    OraBug: 27356726
    Signed-off-by: Elena Ufimtseva <elena.ufimtseva@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    (cherry picked from commit bb793ca5296e2100f1453f20360f02dfb9c920e5)
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.127
changelog:
  - From f6ea539df8760d6c765b597ad231670cdd9eac9d Mon Sep 17 00:00:00 2001
    From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Date: Thu, 11 Jan 2018 10:30:03 -0500
    Subject: [PATCH 41/51] x86/Spectre: Set thunk to THUNK_NONE if compiler support is not available
    If no microcode patch is available we end up setting thunk to THUNK_JMP.
    Which really is equivalent to THUNK_NONE (if CONFIG_INDIRECT_THUNK is not
    set, which it is not) but is somewhat misleading in terms of reporting.
    With this change the reported mitigation set will look as follows:
    (XEN) Speculative mitigation facilities:
    (XEN)   Hardware features: SMEP IBRS/IBPB STIBP
    (XEN) BTI mitigations: Thunk N/A, Others: IBRS+ IBPB SMEP RSB_VMEXIT
    Orabug: 27375656
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
    Reviewed-by: Bhavesh Davda <bhavesh.davda@oracle.com>
    (cherry picked from commit 88bf1ed2b377f03de6e6b20283af90be5065b395)
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.126
changelog:
  - From 27500d93fb5347b6f124ffdf7eacadda9ff97d51 Mon Sep 17 00:00:00 2001
    From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Date: Thu, 18 Jan 2018 09:36:43 +0800
    Subject: [PATCH 40/51] x86: cpuint. Move trap_init and init_idle_domain
    commit "x86: cpuint. Move the detection of CPU capabilities" move
    identify_cpu() ahead. On an env without MSR MSR_INTEL_PLATFORM_INFO,
    probe_intel_cpuid_faulting() trigger a #GP.
    Move trap_init() ahead too so that exception fixup mechanism take over the #GP.
    Move init_idle_domain() ahead to prevent #PG when loading GDT.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.125
changelog:
  - From f2552332306d0ff5a13e098064d64d65b78244a6 Mon Sep 17 00:00:00 2001
    From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Date: Sat, 6 Jan 2018 15:39:54 -0500
    Subject: [PATCH 39/51] x86: Always print info about speculative mitigation facilities
    This is XSA-254.
    Orabug: 27352416
    Reviewed-by: Bhavesh Davda <bhavesh.davda@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5753/CVE-2017-5715/CVE-2017-5754} {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.124
changelog:
  - From 8ce8a38615eaf8ae1b4e3ad8256d48f1569a4325 Mon Sep 17 00:00:00 2001
    From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Date: Sat, 6 Jan 2018 15:06:43 -0500
    Subject: [PATCH 38/51] x86: Don't use retpoline if CONFIG_INDIRECT_THUNK is not set
    If this config option is not set (which it is not, unless compiler
    support is available) the thunk degenerates to the original indirect
    call/jmp.
    This is XSA-254.
    Orabug: 27352416
    Reported-by: Bhavesh Davda <bhavesh.davda@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5753/CVE-2017-5715/CVE-2017-5754} {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.123
changelog:
  - From 0a9e0230c40a4f244b51ab3c75c4a055994564fc Mon Sep 17 00:00:00 2001
    From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Date: Wed, 3 Jan 2018 18:46:17 -0500
    Subject: [PATCH 37/51] x86: cpuint. Move the detection of CPU capabilities
    right after the microcode has been loaded but before the
    speculation check.
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.122
changelog:
  - From dd753a815210ce11f3a5d3bab503f04da9e455f3 Mon Sep 17 00:00:00 2001
    From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Date: Wed, 3 Jan 2018 18:46:16 -0500
    Subject: [PATCH 36/51] migration: Set the CPUID _before_ XEN_DOMCTL_sethvmcontext
    As the MSRs depend on the cpuid policies. And if we don't
    set them we will always have:
    (XEN) HVM6 restore: CPU_MSR 0
    (XEN) HVM6 restore: failed to load entry 20/0
    Along with:
    xc: progress: Reloading memory pages: 262144/1044481   25%
    xc: error: error setting the HVM context (1 = Operation not permitted): Internal error
    libxl: error: libxl_create.c:942:libxl__xc_domain_restore_done: restoring domain: Resource temporarily unavailable
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.121
changelog:
  - From 04d9a706f6b6189e076ec81286dbebd6bfbd4098 Mon Sep 17 00:00:00 2001
    From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Date: Wed, 3 Jan 2018 18:46:15 -0500
    Subject: [PATCH 35/51] x86/xen: Make cpu_has_[stibp,ibrsp,etc] work.
    All of those macros depend on c->x86_capability bits being
    set but we don't set them for word 8 and word 9. Which means
    they are always set to zero.
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.120
changelog:
  - From cb8f8c8439ae2c48ef23f37b800862400d774579 Mon Sep 17 00:00:00 2001
    From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Date: Wed, 3 Jan 2018 18:46:14 -0500
    Subject: [PATCH 34/51] x86: Expose CPUID.7, EDX.26->27 and CPUID.0x80000008, EBX.12
    If the CPU has this exposed _and_ the CPUID policy specifies it
    as such.
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - context
    Conflicts with OVM345:
    xen/arch/x86/hvm/hvm.c
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.119
changelog:
  - From 603b020531ff14349d9ed2112f677eb08a0f02bf Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:46:13 -0500
    Subject: [PATCH 33/51] x86/idle: Clear SPEC_CTRL while idle
    On contemporary hardware, setting IBRS/STIBP has a performance impact on
    adjacent hyperthreads.  It is therefore recommended to clear the setting
    before becoming idle, to avoid an idle core preventing adjacent userspace
    execution from running at full performance.
    Care must be taken to ensure there are no ret or indirect branch instructions
    between spec_ctrl_{enter,exit}_idle() invocations, which are forced always
    inline.  Care must also be taken to avoid using spec_ctrl_enter_idle() between
    flushing caches and becoming idle, in cases where that matters.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Add #include <xen/stringify.h> to xen/include/asm-x86/spec_ctrl.h to fix
    missing __stringify.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.118
changelog:
  - From ed733af08668249829ce7921e37d1eadd01e3dc9 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:46:12 -0500
    Subject: [PATCH 32/51] x86/cpuid: Offer Indirect Branch Controls to guests
    With all infrastructure in place, it is now safe to let guests see and use
    these features.  Allow AMD's IBPB to be set even on Intel hardware, so the
    toolstack can express "IBPB only" to guests.
    This also requires updating the libxc logic to understand the e8b feature
    leaf, which has the side effect of also offering CLZERO on applicable
    hardware.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - No cpuid.c/calculate_host_policy, put the chunk into
    update_domain_cpuid_info()
    - No need for cpufeature.h changes, they are for auto-generated CPUIDs
    - We don't support X86_FEATURE_CLZERO so no related changes in xc_cpuid_hvm_policy()
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.117
changelog:
  - From 393100a096448d1c61ecb8ac28bc901fb5bab187 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:46:11 -0500
    Subject: [PATCH 31/51] x86/ctxt: Issue a speculation barrier between vcpu contexts
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflict:
    - cpufeature.h differences
    - context
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.116
changelog:
  - From 437b0afa743e61037138579fb21dde7103779f69 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:46:10 -0500
    Subject: [PATCH 30/51] x86/entry: Clobber the Return Stack Buffer on entry to Xen
    ret instructions are unconditionally speculated based on values in the RSB.
    If any path in Xen executes more ret than call instructions, speculation can
    start following a guest controlled RSB entry.
    There is at least one path (wake from waitqueue) which can end up executing
    more ret than call instructions.  There may be other paths as well.
    To mitigate, overwrite the RSB (when appropriate; see code for details) when
    entering Xen from guest context.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - cpufeature.h differences
    - context
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.115
changelog:
  - From 9dccf941d3eaee41a8020c33bbc4e116fa047295 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:46:09 -0500
    Subject: [PATCH 29/51] x86/boot: Calculate the most appropriate BTI mitigation to use
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - context
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.114
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:46:08 -0500
    Subject: [PATCH 28/51] x86/entry: Use MSR_SPEC_CTRL at each entry/exit point
    Set or clear IBRS in Xen context, and appropriate guest values in guest
    context.  See the documentation in asm-x86/spec_ctrl_asm.h for details.
    Two semi-unrelated bugfixes are that various asm_defn.h macros have a hidden
    dependency on PAGE_SIZE, which results in an assembler error if used in a
    .macro definition.  Secondly, _ASM_MK_NOP() needs a separator at the end,
    rather than relying on its calling context for separation.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - context in entry.S (all of them), different labels, different routines
    - various context conflicts
    - add ifdef __ASSEMBLY__ to cpufeature.h
    - We don't have GET_STACK_END (from commit 4f6aea06) so use
    DO_SPEC_CTRL_EXIT_TO_XEN/DO_SPEC_CTRL_ENTRY from v4
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Conflicts with OVM345:
    xen/arch/x86/hvm/svm/entry.S
    xen/arch/x86/hvm/vmx/entry.S
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.113
changelog:
  - From f7ada379781e578655eb56820414aa549164d9f5 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:46:07 -0500
    Subject: [PATCH 27/51] x86: Protect unaware domains from meddling hyperthreads
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - cpufeature.h differences
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.112
changelog:
  - From 1a3cf9bdaae790318ec12f5239336d1c3d75208a Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:46:06 -0500
    Subject: [PATCH 26/51] x86/hvm: Permit guests direct access to MSR_{SPEC_CTRL,PRED_CMD}
    For performance reasons, HVM guests should have direct access to these MSRs
    when possible.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - Simplified call_policy_changed computation in
    update_domain_cpuid_info()
    - Adjust for different MSR intercept interface
    (vmx_disable_intercept_for_msr() vs vmx_set_msr_intercept())
    - context
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.111
changelog:
  - From 402cc9b0e1144e324eb4f2b9738fe50fc22b0c74 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:46:05 -0500
    Subject: [PATCH 25/51] x86/migrate: Move MSR_SPEC_CTRL on migrate
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - context in arch/x86/hvm/hvm.c
    - No need to port changes to xen/arch/x86/domctl.c (see comment in
    "x86: Avoid corruption on migrate for vcpus using CPUID Faulting" patch)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    - And expose in msrs_to_send the new MSR.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.110
changelog:
  - From 00cf5a13056c4cf690ba8e60655a45b5cf5fab8b Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:46:04 -0500
    Subject: [PATCH 24/51] x86/msr: Emulation of MSR_{SPEC_CTRL,PRED_CMD} for guests
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    -context
    - (re-)add gp_fault label
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.109
changelog:
  - From 891f15147af89356bba6f1f0c85d6e643cbc446c Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:46:03 -0500
    Subject: [PATCH 23/51] x86: Introduce a common cpuid_policy_updated()
    No practical change at the moment, but future changes will need to react
    irrespective of guest type.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Acked-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts
    - Different update_domain_cpuid_info implementation
    - context differences
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.108
changelog:
  - From f225e4f6f9dcdcbcd37c77d21febf317f32f5bc2 Mon Sep 17 00:00:00 2001
    From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Date: Wed, 3 Jan 2018 18:46:02 -0500
    Subject: [PATCH 22/51] x86: Introduce framework for cpuid policy updates
    And also set cpuid_policy bits.
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Conflicts with OVM345:
    xen/arch/x86/domctl.c
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.107
changelog:
  - From 7bb8630d6529c089f18ce4f679e1c0b3eecd783b Mon Sep 17 00:00:00 2001
    From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Date: Wed, 3 Jan 2018 18:46:01 -0500
    Subject: [PATCH 21/51] x86: Introduce cpuid_policy
    Just enough to get by...
    Also added the allocation on the idle domain path.
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.106
changelog:
  - From 2a5174e221f40367b12da1dafd11edc0d22d68ee Mon Sep 17 00:00:00 2001
    From: Gregory Herrero <gregory.herrero@oracle.com>
    Date: Thu, 12 Jan 2017 19:56:49 +0100
    Subject: [PATCH 20/51] xen: string: add few helpers from kernel side.
    strtobool() and strcspn() are needed to parse module parameters.
    OraBug: 25752156
    Signed-off-by: Blaise Boscaccy <blaise.boscaccy@oracle.com>
    Signed-off-by: Gregory Herrero <gregory.herrero@oracle.com>
    Backport from OVM345, need it to fix bool type unrecognized compile error
    introduced by "x86/msr: introduce struct msr_vcpu_policy"
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.105
changelog:
  - From e40c15c326e3a978366b692b8383a1d3829f92f9 Mon Sep 17 00:00:00 2001
    From: Sergey Dyasli <sergey.dyasli@citrix.com>
    Date: Tue, 16 Jan 2018 08:40:57 +0800
    Subject: [PATCH 19/51]  x86/msr: introduce struct msr_vcpu_policy
    The new structure contains information about guest's MSRs that are
    unique to each vCPU. It starts with only 1 MSR:
    MSR_INTEL_MISC_FEATURES_ENABLES
    Which currently has only 1 usable bit: cpuid_faulting.
    Add 2 global policy objects: hvm_max and pv_max that are inited during
    boot up. Availability of MSR_INTEL_MISC_FEATURES_ENABLES depends on
    availability of MSR_INTEL_PLATFORM_INFO.
    Add init_vcpu_msr_policy() which sets initial MSR policy for every vCPU
    during domain creation with a special case for Dom0.
    Signed-off-by: Sergey Dyasli <sergey.dyasli@citrix.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Kevin Tian <kevin.tian@intel.com>
    (cherry picked from commit 4187f79dc7184d90a1aa7a0439ccee2bc25355c2)
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - mostly context
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    [Also no ZERO_BLOCK_PTR, so fix that with xzalloc_bytes]
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - Free policy in vcpu_destroy (this happens to be XSA-253)
    OVM3.3 didn't have is_pv_domain, use is_hvm_domain instead
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.104
changelog:
  - From f12cc603ef75ba047032db06de829227fb8149f0 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:59 -0500
    Subject: [PATCH 18/51] x86/cmdline: Introduce a command line option to disable IBRS/IBPB, STIBP and IBPB
    Instead of gaining yet another top level boolean, introduce a more generic
    cpuid= option.  Also introduce a helper function to parse a generic boolean
    value.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - no arch/x86/cpuid.c, used arch/s86/setup.c for parse_xen_cpuid
    - context conflicts
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.103
changelog:
  - From 4d0490620f92c1c8afd3cc372042a811625b2ce4 Mon Sep 17 00:00:00 2001
    From: Juergen Gross <jgross@suse.com>
    Date: Mon, 15 Jan 2018 04:40:55 +0800
    Subject: [PATCH 17/51] xen: add an optional string end parameter to parse_bool()
    Add a parameter to parse_bool() to specify the end of the to be
    parsed string. Specifying it as NULL will preserve the current
    behavior to parse until the end of the input string, while passing
    a non-NULL pointer will specify the first character after the input
    string.
    This will allow to parse boolean sub-strings without having to
    write a NUL byte into the input string.
    Modify all users of parse_bool() to pass NULL for the new parameter.
    (cherry-picked from commit 532dec8e31174ed450adfd36a4b0b41dec27010d)
    Reviewed-by: Kevin Tian <kevin.tian@intel.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    -context, some files don't need a backport
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Chuck for xen/arch/x86/nmi.c is unnecessory for OVM33trunk and ignored
    Updated parse_bool() call in xen/drivers/passthrough/x86/ats.c
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.102
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:57 -0500
    Subject: [PATCH 16/51] x86/feature: Definitions for Indirect Branch Controls
    Contemporary processors are gaining Indirect Branch Controls via microcode
    updates.  Intel are introducing one bit to indicate IBRS and IBPB support, and
    a second bit for STIBP.  AMD are introducing IPBP only, so enumerate it with a
    separate bit.
    Furthermore, depending on compiler and microcode availability, we may want to
    run Xen with IBRS set, or clear.
    To use these facilities, we synthesise separate IBRS and IBPB bits for
    internal use.  A lot of infrastructure is required before these features are
    safe to offer to guests.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - No new(-ish) CPUID generation so skip xen-cpuid.c/gen-cpuid.py
    - Again, cpufeatures.h is different in OVM
    - No boot_cpu_data.extended_cpuid_level, use cpuid_eax(0x80000000)
    - context difference in libxl
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Conflicts with OVM345:
    tools/libxl/libxl_cpuid.c
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.101
changelog:
  - From d8b4ae425577a1f655c8cff0be293d781de87523 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:56 -0500
    Subject: [PATCH 15/51] x86: Introduce alternative indirect thunks
    Depending on hardware and microcode availability, we will want to replace
    IND_THUNK_REPOLINE with other implementations.
    For AMD hardware, choose IND_THUNK_LFENCE in preference to retpoline if lfence
    is known to be (or was successfully made) dispatch serialising.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - Different cpufeature.h implementaion
    - docs context conflict
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.100
changelog:
  - From ab5c0d96ac2ce58e8e53c371d8edb40c56d41219 Mon Sep 17 00:00:00 2001
    From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Date: Wed, 3 Jan 2018 18:45:55 -0500
    Subject: [PATCH 14/51] x86: Backport setup_force_cpu_cap
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.99
changelog:
  - From bd9dd63f37af9497dafe99837b0969a4255c01a5 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:54 -0500
    Subject: [PATCH 13/51] x86/amd: Try to set lfence as being Dispatch Serialising
    This property is required for the AMD's recommended mitigation for Branch
    Target Injection, but Xen needs to cope with being unable to detect or modify
    the MSR.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - cpufeatures.h is different
    - init_amd(): No X86_FEATURE_MFENCE_RDTSC in OVM
    Conflicts with OVM345:
    xen/include/asm-x86/cpufeature.h
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.98
changelog:
  - From a1c057435d00d0a354646ac20a816da86d41d28a Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:53 -0500
    Subject: [PATCH 12/51] x86/boot: Report details of speculative mitigations
    Nothing very interesting at the moment, but the logic will grow as new
    mitigations are added.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - context conflict in setup.c
    - No IS_ENABLED in spec_ctl.c
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.97
changelog:
  - From 18c2570481a34757f3ffb748492419f8c701d4a2 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Mon, 15 Jan 2018 03:22:27 +0800
    Subject: [PATCH 11/51] x86: Support indirect thunks from assembly code
    Introduce CALL_THUNK and JMP_THUNK which either degrade to a normal indirect
    branch, or dispatch to the __x86.indirect_thunk.* symbols.
    Update all the manual indirect branches in to use the new thunks.  The
    indirect branches in the boot and kexec path are left intact as we can't use
    the compiled-in thunks at those points.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - x86_emulate.c code is different
    - Include asm/asm_defns.h in x86_emulate.c
    - no IS_ENABLED, so use ifdef
    - No changes to extable.c (not needed)
    - Added -Wa -I CFLAGS option to help compiler find include for asm(".include ...")
    Conflicts:
    xen/arch/x86/Rules.mk
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.96
changelog:
  - From f4320455dda798daeee71016b51d44412a44a090 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:51 -0500
    Subject: [PATCH 10/51] common/wait: Clarifications to wait infrastructure
    This logic is not as clear as it could be.  Add some comments to help.
    Rearrange the asm block in __prepare_to_wait() to separate the GPR
    saving/restoring from the internal logic.
    While tweaking, add an unreachable() following the jmp in
    check_wakeup_from_wait().
    No functional change.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.95
changelog:
  - From 723cfd81c74b542ca39f2eaa4a1ddd0185afb88e Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:50 -0500
    Subject: [PATCH 09/51] x86: Support compiling with indirect branch thunks
    Use -mindirect-branch=thunk-extern/-mindirect-branch-register when available.
    To begin with, use the retpoline thunk.  Later work will add alternative
    thunks which can be selected at boot time.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - context
    conflicts with OVM3.4.5:
    xen/arch/x86/xen.lds.S
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.94
changelog:
  - From 6e590870401bf2d397854be69044dfa4a38d8641 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:49 -0500
    Subject: [PATCH 08/51] x86/entry: Erase guest GPR state on entry to Xen
    This reduces the number of code gadgets which can can be attacked with
    arbitrary guest-controlled GPR values.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - the file is include/asm-x86/x86_64/asm_defns.h
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.93
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:48 -0500
    Subject: [PATCH 07/51] x86/pv: Move hypercall handling up into C
    Partial backport of:
    939ba61bd376955ae3a519c09364346aed2be070
    c99986fa168ef79b1ea6c071f57017e40b367383
    5464f1210c6341762ca0457253adfa035ffe666c
    51e5d6c7a29640490eeab4e4c3d60b9c2d3d3054
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts with OVM3.4.5:
    xen/arch/x86/Makefile
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.92
changelog:
  - From f3887d89fab676198fe9b3f8e7320829c0976233 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:47 -0500
    Subject: [PATCH 06/51] x86/hvm: Use SAVE_ALL to construct the cpu_user_regs frame after VMExit
    No practical change.
    One side effect in debug builds is that %rbp is inverted in the manner
    expected by the stack unwinder to indicate a interrupt frame.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - Different GET_CURRENT() definitions
    Conflicts with OVM3.4.5
    xen/arch/x86/hvm/svm/entry.S
    xen/arch/x86/hvm/vmx/entry.S
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.91
changelog:
  - From 293480dc127724df4e580a7b6502323603679f77 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:46 -0500
    Subject: [PATCH 05/51] x86/entry: Rearrange RESTORE_ALL to restore register in stack order
    Results in a more predictable (i.e. linear) memory access pattern.
    No functional change.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - different file path, no code conflicts
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.90
changelog:
  - From 49f43709b0234bf6c6f7ca0c64aea0351ef6ab62 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:45 -0500
    Subject: [PATCH 04/51] x86/entry: Remove support for partial cpu_user_regs frames
    Save all GPRs on entry to Xen.
    The entry_int82() path is via a DPL1 gate, only usable by 32bit PV guests, so
    can get away with only saving the 32bit registers.  All other entrypoints can
    be reached from 32 or 64bit contexts.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - Drop BUILD_COMMON_IRQ, (comit 29f6c57c2372a53)
    - update RESTORE_ALL (get some clobbering from upstream)
    - Make SAVE_ALL a macro
    - Many asm changes due to context differences
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.89
changelog:
  - From f80955ebd6237713c00714197e29cd5a77be928d Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:44 -0500
    Subject: [PATCH 03/51] x86/alt: Introduce ALTERNATIVE{,_2} macros
    To help creating alternative frames in assembly.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.88
changelog:
  - From ab1ba081885621fb8bf88ac201653c4e7133418c Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Wed, 3 Jan 2018 18:45:43 -0500
    Subject: [PATCH 02/51] x86/alt: Break out alternative-asm into a separate header file
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Conflicts:
    - alternative.h context
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.87
changelog:
  - From: Tim Deegan <tim@xen.org>
    Date: Mon, 15 Jan 2018 03:31:47 +0800
    Subject: [PATCH 01/51] x86: mark BUG()s and assertion failures as terminal.
    This helps avoid static analysis false-positives, and might lead to
    better code density as the compiler knows it doesn't have to restore
    spilled state &c.
    Signed-off-by: Tim Deegan <tim@xen.org>
    Acked-by: Keir Fraser <keir@xen.org>
    Prequisite patch for "common/wait: Clarifications to wait infrastructure"
    Conflicts:
    xen/include/asm-x86/bug.h
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27340096] {CVE-2017-5715}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.86
changelog:
  - x86/hvm: assert that we we saved a sane number of MSRs.
    Just as a backstop measure against later changes that add MSRs to the
    save function without updating the count in the init function.
    Signed-off-by: Tim Deegan <tim@xen.org>
    Acked-by: Jan Beulich <jbeulich@suse.com>
    (cherry picked from commit 891219a9d3958860b915021f622f7119b9b880d8)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    This patch is backported from OVS345.
    upstream commit: 891219a9d3958860b915021f622f7119b9b880d8
    OVS345 commit: 5139d82b5ec7cfc2f493f30e1be7e40ef1b76c42
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527848]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.85
changelog:
  - x86: Avoid corruption on migrate for vcpus using CPUID Faulting
    Xen 4.8 and later virtualises CPUID Faulting support for guests.  However, the
    value of MSR_MISC_FEATURES_ENABLES is omitted from the vcpu state, meaning
    that the current cpuid faulting setting is lost on migrate/suspend/resume.
    Instead of following the MSR status quo, take the opportunity to make the
    logic more generic, and in particular, trivial to extend for future MSRs.
    This is done by discarding the notion of optional MSRs, and requiring the
    toolstack to be prepared to move all of the MSRs, although only a subset will
    typically need to move.
    This allows for the use of guest_{rd,wr}msr() alone to evaluate whether an MSR
    needs moving.  This is a benefit because it means there is a single piece of
    logic responsible for evaluating whether a guest can use an MSR, and which
    values are acceptable.
    One small adjustment to guest_wrmsr() is required to cope with being called in
    toolstack context.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Julien Grall <julien.grall@linaro.org>
    (cherry picked from commit b90f86be161c74df8cb69c98d9f22885d9d87114)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Conflicts:
    xen/arch/x86/domctl.c
    xen/arch/x86/msr.c
    xen/include/asm-x86/msr.h
    [But since Xen 4.4 does not have CPUID faulting this just adds
    the infrastructure pieces and comments out the MSR_INTEL_MISC_FEATURES_ENABLES.
    Also we ignore completely the XEN_DOMCTL_get_vcpu_msrs and
    XEN_DOMCTL_set_vcpu_msrs hypercall handling. Which is used to filter
    out more selectively which payloads should be migrated over (for example
    the guest may not have used the MSR handling code). But in Xen 4.4
    it uses the XEN_DOMCTL_gethvmcontext which internally calls hvm_save
    which walks over all of the functions that registered via
    hvm_save_cpu_msrs - which we didn't do as the .init has never
    been set or called - so for all intent and purpose this is a NOP]
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Removed unused rc in hvm_load_cpu_msrs()
    This patch is backported from OVS345.
    upstream commit: b90f86be161c74df8cb69c98d9f22885d9d87114
    OVS345 commit: 744a3f074e93edf9323c2a3c734064c36610210a
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527848]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.84
changelog:
  - x86/hvm: Don't corrupt the HVM context stream when writing the MSR record
    Ever since it was introduced in c/s bd1f0b45ff, hvm_save_cpu_msrs() has had a
    bug whereby it corrupts the HVM context stream if some, but fewer than the
    maximum number of MSRs are written.
    _hvm_init_entry() creates an hvm_save_descriptor with length for
    msr_count_max, but in the case that we write fewer than max, h->cur only moves
    forward by the amount of space used, causing the subsequent
    hvm_save_descriptor to be written within the bounds of the previous one.
    To resolve this, reduce the length reported by the descriptor to match the
    actual number of bytes used.
    A typical failure on the destination side looks like:
    (XEN) HVM4 restore: CPU_MSR 0
    (XEN) HVM4.0 restore: not enough data left to read 56 MSR bytes
    (XEN) HVM4 restore: failed to load entry 20/0
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Release-acked-by: Julien Grall <julien.grall@linaro.org>
    (cherry picked from commit d2f86bf604698806d311cc251c1b66fbb752673c)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    This patch is backported from OVS345.
    upstream commit: d2f86bf604698806d311cc251c1b66fbb752673c
    OVS345 commit: 6b9bf9bad2b25c07c4d1161a43c293c10e5c8014
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527848]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.83
changelog:
  - x86: generic MSRs save/restore
    This patch introduces a generic MSRs save/restore mechanism, so that
    in the future new MSRs' save/restore could be added w/ smaller change
    than the full blown addition of a new save/restore type.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Liu Jinsong <jinsong.liu@intel.com>
    Acked-by: Keir Fraser <keir@xen.org>
    (cherry picked from commit bd1f0b45ff1fde2de8d2a2b397b9686a1185ed4e)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    This patch is backported from OVS345.
    upstream commit: bd1f0b45ff1fde2de8d2a2b397b9686a1185ed4e
    OVS345 commit: fce3f56b95e3e6135efaaef377ac9c6666b7a222
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527848]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.82
changelog:
  - x86/msr: introduce guest_wrmsr()
    The new function is responsible for handling WRMSR from both HVM and PV
    guests. Currently it handles only 2 MSRs:
    MSR_INTEL_PLATFORM_INFO
    MSR_INTEL_MISC_FEATURES_ENABLES
    It has a different behaviour compared to the old MSR handlers: if MSR
    is being handled by guest_wrmsr() then WRMSR will either succeed (if
    a guest is allowed to access it and provided a correct value based on
    its MSR policy) or produce a GP fault. A guest will never see
    a successful WRMSR of some MSR unknown to this function.
    guest_wrmsr() unifies and replaces the handling code from
    vmx_msr_write_intercept() and priv_op_write_msr().
    Signed-off-by: Sergey Dyasli <sergey.dyasli@citrix.com>
    This also fixes a bug on AMD hardware where a guest which tries to
    enable CPUID faulting via a direct write to the MSR will observe it
    appearing to succeed, but because Xen actually ignored the write.
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Kevin Tian <kevin.tian@intel.com>
    (cherry picked from commit 664adc5ccab1388ea8ff4dd476473d04effaa2c8)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Conflicts:
    xen/arch/x86/hvm/hvm.c
    xen/arch/x86/hvm/vmx/vmx.c
    xen/arch/x86/pv/emul-priv-op.c
    [Which is mostly b/c we are not backporting the CPUID fault framework
    and CPUID policy - as such most of this code is just NOP.
    We do have to handle the return case more explicitly as we don't
    have the full framework to just return a value, we must also
    act on it (move the EIP if #GP for example)]
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Removed the (now) unneded label and local variable
    This patch is backported from OVS345.
    upstream commit: 664adc5ccab1388ea8ff4dd476473d04effaa2c8
    OVS345 commit: 4875fd148cfb8e5b58613e56b2c91b55a480174a
    Conflicts with OVS345 patch:
    xen/arch/x86/hvm/hvm.c
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527848]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.81
changelog:
  - x86/msr: introduce guest_rdmsr()
    The new function is responsible for handling RDMSR from both HVM and PV
    guests. Currently it handles only 2 MSRs:
    MSR_INTEL_PLATFORM_INFO
    MSR_INTEL_MISC_FEATURES_ENABLES
    It has a different behaviour compared to the old MSR handlers: if MSR
    is being handled by guest_rdmsr() then RDMSR will either succeed (if
    a guest is allowed to access it based on its MSR policy) or produce
    a GP fault. A guest will never see a H/W value of some MSR unknown to
    this function.
    guest_rdmsr() unifies and replaces the handling code from
    vmx_msr_read_intercept() and priv_op_read_msr().
    Signed-off-by: Sergey Dyasli <sergey.dyasli@citrix.com>
    This (along with the prep work in init_domain_msr_policy()) also fixes
    a bug where Dom0 could probe and find CPUID faulting, even though it
    couldn't actually use it.
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Kevin Tian <kevin.tian@intel.com>
    (cherry picked from commit 37f074a33831633118735b61c6f4e7b413792629)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Conflicts:
    xen/arch/x86/hvm/hvm.c
    xen/arch/x86/hvm/vmx/vmx.c
    xen/arch/x86/msr.c
    xen/arch/x86/pv/emul-priv-op.c
    [Granted we don't actually have any of those MSRs to handle so this
    just code that adds this support and is a NOP.
    And we also have to handle the return in a more obvious fashion
    than just returning - that it handle the #GP if needed.]
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Remove the (now) unused gp_fault label and dp variable;
    This patch is backported from OVS345.
    upstream commit: 37f074a33831633118735b61c6f4e7b413792629
    OVS345 commit: 872f5dfaad4970632fd9e3d3efbb8b588882c433
    Conflicts with OVS345 patch:
    xen/arch/x86/hvm/hvm.c
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527848]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.80
changelog:
  - x86/msr: introduce struct msr_domain_policy
    The new structure contains information about guest's MSRs that are
    shared between all domain's vCPUs. It starts with only 1 MSR:
    MSR_INTEL_PLATFORM_INFO
    Which currently has only 1 usable bit: cpuid_faulting.
    Add 2 global policy objects: hvm_max and pv_max that are inited during
    boot up. It's always possible to emulate CPUID faulting for HVM guests
    while for PV guests the H/W support is required.
    Add init_domain_msr_policy() which sets initial MSR policy during
    domain creation with a special case for Dom0.
    Signed-off-by: Sergey Dyasli <sergey.dyasli@citrix.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Kevin Tian <kevin.tian@intel.com>
    (cherry picked from commit 4098b092e1902de9925342a527f8173cdb376426)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Conflicts:
    xen/arch/x86/domain.c
    xen/arch/x86/setup.c
    xen/include/asm-x86/domain.h
    xen/include/asm-x86/msr.h
    [As we don't have fb034f42, and in fact we don't have code to
    handle MSR_INTEL_PLATFORM_INFO so this whole backport is just
    to add the basic code]
    This patch is backported from OVS345.
    upstream commit: 4098b092e1902de9925342a527f8173cdb376426
    OVM345 commit: d4c8753d0833fd243feac51455f2b201562c2922
    Conflicts with OVS345 patch:
    xen/arch/x86/domain.c
    xen/arch/x86/msr.c
    xen/include/asm-x86/msr.h
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527848]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.79
changelog:
  - microcode: Always scan the initramfs for microcode
    And also include the microcode information in the dmesg.
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    This patch is backported from OVS345.
    OVM345 commit: 5e6b4df47e81b4215a7a1d8de3c5b48a333b8b4f
    Conflicts with OVS345 patch:
    file xen.spec does not exist
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527850]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.78
changelog:
  - x86: Move microcode loading earlier
    Move microcode loading earlier for the boot CPU and secondary CPUs so
    that it takes place before identify_cpu() is called for each CPU.
    Without this, the detected features may be wrong if the new microcode
    loading adjusts the feature bits. That could mean that some fixes (e.g.
    d6e9f8d4f35d ("x86/vmx: fix vmentry failure with TSX bits in LBR"))
    don't work as expected.
    Previously during boot, the microcode loader was invoked for each
    secondary CPU started and then again for each CPU as part of an
    initcall. Simplify the code so that it is invoked exactly once for each
    CPU during boot.
    Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Release-acked-by: Julien Grall <julien.grall@arm.com>
    (cherry picked from commit f97838bbd980a0104e16c4a12fbf514f9fa805f1)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Conflicts:
    xen/arch/x86/cpu/common.c
    xen/arch/x86/setup.c
    xen/arch/x86/smpboot.c
    xen/include/asm-x86/processor.h
    This patch is backported from OVS345.
    upstream commit: f97838bbd980a0104e16c4a12fbf514f9fa805f1
    OVS345 commit: e9b8b96e2aeefbb561ef85364d0313fb29a5994d
    Conflicts with OVS345 patches:
    - change true/false to 1/0
    - change bool to bool_t
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527850]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.77
changelog:
  - x86/traps: make panic and reboot paths safe during early boot
    Reverse two conditions in show_registers().  For an early crash, it is not
    safe to dereference 'current' for its HVM status before knowing that it is a
    guest vcpu.
    Introduce SYS_STATE_smp_boot to distinguish the point at which APs need
    considering before boot is complete.  There is one code change required as a
    result; .init.text symbols are still in use before Xen is active, so alter its
    predicate in is_active_kernel_text().
    Make use of SYS_STATE_smp_boot in machine_{halt,restart}().  Before Xen starts
    booting the APs, any execution here is certainly the BSP.
    When halting or rebooting particularly early, this avoids the risks of a #PF
    or #GP when accessing the LAPIC before generic_apic_probe(), as well as trying
    to enable interrupts before init_IRQ() is complete.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    upstream commit: 415738e2f6e5635b537cbf93a5a1620b15afff6f
    Conflicts:
    xen/arch/x86/x86_64/traps.c
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527850]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.76
changelog:
  - x86/microcode: Check whether the microcode is correct
    We do the microcode code update in two steps - the presmp:
    'microcode_presmp_init' and when CPUs are brought up: 'microcode_init'.
    The earlier performs the microcode update on the BSP - but
    unfortunately it does not check whether the update failed. Which means
    that we might try later to update a incorrect payload on the rest of
    CPUs.
    This patch handles this odd situation.
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Keir Fraser <keir@xen.org>
    upstream commit: 4deea8515b1caba8803816399068f2a75d65f8ad
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527850]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.75
changelog:
  - [PATCH 1/5] x86/microcode: Scan the initramfs payload for microcode blob
    The Linux kernel is able to update the microcode during early bootup
    via inspection of the initramfs blob to see if there is an cpio image
    with certain microcode files. Linux is able to function with two (or
    more) cpio archives in the initrd b/c it unpacks all of the cpio
    archives.
    The format of the early initramfs is nicely documented in Linux's
    Documentation/x86/early-microcode.txt:
    Early load microcode
    ====================
    By Fenghua Yu <fenghua.yu@intel.com>
    Kernel can update microcode in early phase of boot time. Loading microcode early
    can fix CPU issues before they are observed during kernel boot time.
    Microcode is stored in an initrd file. The microcode is read from the initrd
    file and loaded to CPUs during boot time.
    The format of the combined initrd image is microcode in cpio format followed by
    the initrd image (maybe compressed). Kernel parses the combined initrd image
    during boot time. The microcode file in cpio name space is:
    kernel/x86/microcode/GenuineIntel.bin
    During BSP boot (before SMP starts), if the kernel finds the microcode file in
    the initrd file, it parses the microcode and saves matching microcode in memory.
    If matching microcode is found, it will be uploaded in BSP and later on in all
    APs.
    The cached microcode patch is applied when CPUs resume from a sleep state.
    There are two legacy user space interfaces to load microcode, either through
    /dev/cpu/microcode or through /sys/devices/system/cpu/microcode/reload file
    in sysfs.
    In addition to these two legacy methods, the early loading method described
    here is the third method with which microcode can be uploaded to a system's
    CPUs.
    The following example script shows how to generate a new combined initrd file in
    /boot/initrd-3.5.0.ucode.img with original microcode microcode.bin and
    original initrd image /boot/initrd-3.5.0.img.
    mkdir initrd
    cd initrd
    mkdir kernel
    mkdir kernel/x86
    mkdir kernel/x86/microcode
    cp ../microcode.bin kernel/x86/microcode/GenuineIntel.bin
    find .|cpio -oc >../ucode.cpio
    cd ..
    cat ucode.cpio /boot/initrd-3.5.0.img >/boot/initrd-3.5.0.ucode.img
    As such this code inspects the initrd to see if the microcode
    signatures are present and if so updates the hypervisor.
    The option to turn this scan on/off is gated by the 'ucode'
    parameter. The options are now:
    'scan'      Scan for the microcode in any multiboot payload.
    <index>     Attempt to load microcode blob (not the cpio archive
    format) from the multiboot payload number.
    This option alters slightly the 'ucode' parameter by only allowing
    either parameter:
    ucode=[<index>|scan]
    Implementation wise the ucode_blob is defined as __initdata.
    That is OK from the viewpoint of suspend/resume as the the underlaying
    architecture microcode (microcode_intel or microcode_amd) end up saving
    the blob in 'struct ucode_cpu_info' which is a per-cpu data
    structure (see ucode_cpu_info). They end up saving it when doing the
    pre-SMP (for CPU0) and SMP (for the rest) microcode loading.
    Naturally if one does a hypercall to update the microcode and it is
    newer, then the old per-cpu data is replaced.
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Keir Fraser <keir@xen.org>
    upstream commit: 155587481e392e4261038364e2761aab27f597ed
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 27527850]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.74
changelog:
  - From 68449158041fc39eb63685d6374b3de62a3f4327 Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Thu, 4 Feb 2016 11:38:52 +0100
    Subject: [PATCH 12/73] x86: support 2- and 3-way alternatives
    Parts taken from Linux, but implementing the ALTERNATIVE*() macros
    recursively to avoid needless redundancy.
    Also make the .discard section non-writable (we might even consider
    dropping its alloc flag too) and limit the pushing and popping of
    sections.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    (cherry picked from commit 6f8e41c67a884b5eaa321bd58fdcf593179f5f2c)
    Conflicts:
    xen/include/asm-x86/alternative.h
    [As we didn't backport da62246e4c x86/xsaves: enable xsaves/xrstors/xsavec in xen
    which added:
    +#define ASM_OUTPUT2(a...) a
    in the header file]
    OraBug: 27298556
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.73
changelog:
  - From f4d7de07b024989a112e173929901bb1e26c7b15 Mon Sep 17 00:00:00 2001
    From: Borislav Petkov <bp@suse.de>
    Date: Sat, 3 Dec 2016 16:02:58 +0100
    Subject: [PATCH 11/73] xen/x86/alternatives: Do not use sync_core() to serialize I$
    We use sync_core() in the alternatives code to stop speculative
    execution of prefetched instructions because we are potentially changing
    them and don't want to execute stale bytes.
    What it does on most machines is call CPUID which is a serializing
    instruction. And that's expensive.
    However, the instruction cache is serialized when we're on the local CPU
    and are changing the data through the same virtual address. So then, we
    don't need the serializing CPUID but a simple control flow change. Last
    being accomplished with a CALL/RET which the noinline causes.
    Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Reviewed-by: Andy Lutomirski <luto@kernel.org>
    [Linux commit 34bfab0eaf0fb5c6fb14c6b4013b06cdc7984466]
    Ported to Xen.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Jan Beulich <jbeulich@suse.com>
    (cherry picked from commit b01c2fb5834aea0328db55c310caa34173021d3d)
    Conflicts:
    xen/arch/x86/livepatch.c
    [As the name of the arch_livepatch_apply/arch_livepatch_revert
    is what is upstream but we have the 'jmp' in the name, hence
    we get a conflict]
    OraBug: 27298556
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    patched on text_poke_early directly as we didn't support livepatch
    and don't have apply_alternatives_nocheck, etc.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.72
changelog:
  - From 77e70ca515c1f7b091414c38ca55d78ae0f8ce66 Mon Sep 17 00:00:00 2001
    From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Date: Fri, 12 Aug 2016 16:11:27 -0400
    Subject: [PATCH 10/73] x86/arm64: Expose the ALT_[ORIG|REPL]_PTR macros to header files.
    That way common code can use the same macro to access
    the most common attributes without much #ifdef.
    Take advantage of it right away in the livepatch code.
    Note: on ARM we use tabs to conform to the style of the file.
    Acked-by: Julien Grall <julien.grall@arm.com>
    Acked-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    (cherry picked from commit 3e883d8b7ac22ce92120a78a82426bb62f6b9c15)
    Conflicts:
    xen/arch/arm/alternative.c
    xen/include/asm-arm/alternative.h
    [We did not backport ARM support in Xen 4.4]
    OraBug: 27298556
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Conflicts:
    xen/include/asm-x86/alternative.h
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.71
changelog:
  - From ba0c795a4780843f670fcc9f53fc5fff2cf59f33 Mon Sep 17 00:00:00 2001
    From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Date: Wed, 30 Mar 2016 13:45:59 -0400
    Subject: [PATCH 09/73] x86: Alter nmi_callback_t typedef
    Drop paranthesis and function pointer on nmi_callback_t typedef.
    Make it more inline with how x86 maintainers want function
    typedefs to be.
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Prerequisite patch to avoid compile error
    Conflict:
    xen/include/asm-x86/nmi.h
    Remove const type declare for nmi callback
    I didn't use the commit from OVM3.4.5 as it's partial, use upstream one
    instead.
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.70
changelog:
  - From 8a2642a90356d8587ee085be9864b3dd693ce575 Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Wed, 9 Mar 2016 16:51:16 +0100
    Subject: [PATCH 08/73] x86/alternatives: correct near branch check
    Make sure the near JMP/CALL check doesn't consume uninitialized
    data, not even in a benign way. And relax the length check at once.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    (cherry picked from commit cd29140ef0e65a33d62e7f5ee843077e51913f01)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    OraBug: 27298556
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.69
changelog:
  - From 5c537d54dc02cfb88d069073c076659000c84c26 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Thu, 25 Feb 2016 13:06:16 +0100
    Subject: [PATCH 07/73] x86: disable CR0.WP while applying alternatives
    In preparation for marking .text as read-only, care needs to be taken not to
    fault while applying alternatives.
    Swapping back to RW mappings is a possibility, but would require additional
    TLB management.  A temporary disabling of CR0.WP is cleaner.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Jan Beulich <jbeulich@suse.com>
    (cherry picked from commit 36c672b559d35e088b181c67538b1ed5bacb0da5)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    OraBug: 27298556
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.68
changelog:
  - From 04c2e0b07c2d43f229357ca5eb196037ca473d67 Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Mon, 30 Jun 2014 16:01:03 +0200
    Subject: [PATCH 05/73] x86: move alternative.c data fully into .init.*
    This wasn't done upon the initial addition of the file since the
    section processing needs some adjustment for this: We can't mark the
    two arrays needing relocations as either __initdata or __initconst, as
    both have the potential of creating section conflicts (with -fPIC the
    compiler may want to mark the section writable due to the necessary
    relocations, colliding with other __initconst uses, and if the compiler
    chooses to use the provided section name, __initdata on a constant
    object might collide with other __initdata uses). However, local data
    known to be referenced only by init code/data can also safely be moved
    into .init.*. Hence the respective logic is being tweaked such that it
    won't complain on non-empty .*.local sections.
    While at it also drop the non-local section names from
    SPECIAL_DATA_SECTIONS - they can't be safely converted.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    (cherry picked from commit eb2952b43a70ae485e297f826212b6b279ca0361)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678] 
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Thu, 25 Feb 2016 13:01:01 +0100
    Subject: [PATCH 06/73] work around Clang generating .data.rel.ro section for init-only files
    Clang-3.8 generates several .data.rel.ro sections when compiling Xen.  As
    these contain no global symbols, they should be .data.rel.ro.local.  This
    breaks the SPECIAL_DATA_SECTIONS check when converting the transition units to
    being init-only.
    For alternatives.c, explicitly move the nops arrays into __initconst.  For efi
    boot.c, manually create the optimisation performed by Clang by collapsing the
    switch statement into a lookup table.  The double use of const is required to
    avoid breaking the ARM build by creating a section type conflict with
    fdt_guid.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    (cherry picked from commit 00d5d5ce23e6bfe0a3b0bdddd44d68d661af7da5)
    Conflicts:
    xen/arch/x86/efi/boot.c
    [Context change]
    OraBug: 27298556
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.67
changelog:
  - From 29adc0b38beca84d969c88da33fb638af3dbe43f Mon Sep 17 00:00:00 2001
    From: Feng Wu <feng.wu@intel.com>
    Date: Tue, 3 Jun 2014 11:31:21 +0200
    Subject: [PATCH 04/73] x86: port the basic alternative mechanism from Linux to Xen
    This patch ports the basic alternative mechanism from Linux to Xen.
    With this mechanism, we can patch code based on the CPU features.
    Signed-off-by: Feng Wu <feng.wu@intel.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    (cherry picked from commit 5542ac7f908c2819fcedb06ee9dc24af94d89566)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.66
changelog:
  - From 56afdf2a6a9c40084d4e4f4d088ac71b2eaea6df Mon Sep 17 00:00:00 2001
    From: Feng Wu <feng.wu@intel.com>
    Date: Tue, 3 Jun 2014 11:29:12 +0200
    Subject: [PATCH 03/73] x86: add definitions for NOP operation
    This patch adds definitions for different length of NOP operation.
    Signed-off-by: Feng Wu <feng.wu@intel.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    (cherry-picked from commit 1911b1b3106f410e411115ba8ac0ac69718ca9bf)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.65
changelog:
  - From 6cf8b84ed5532859f2cfb5b845f93782d0386777 Mon Sep 17 00:00:00 2001
    From: Feng Wu <feng.wu@intel.com>
    Date: Tue, 3 Jun 2014 11:29:38 +0200
    Subject: [PATCH 02/73] x86: make set_nmi_callback return the old nmi callback
    This patch makes set_nmi_callback return the old nmi callback, so
    we can set it back later.
    Signed-off-by: Feng Wu <feng.wu@intel.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Prerequisite patch to avoid compile error
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.64
changelog:
  - From 9d906632fbe2dcfdef4e786122fc71b94e37c01e Mon Sep 17 00:00:00 2001
    From: Julien Grall <julien.grall@linaro.org>
    Date: Wed, 28 Aug 2013 15:47:16 +0100
    Subject: [PATCH 01/73] xen: Introduce __initconst to store initial const data
    It's possible to have 2 type (const and non-const) of data in the same
    compilation unit. Using only __initdata will result to a compilation error:
    error: $variablename causes as section tupe conflict with $variablename2
    because a section containing const variables is marked read only and so cannot
    contain non-const variables.
    Signed-off-by: Julien Grall <julien.grall@linaro.org>
    Acked-by: Ian Cambell <ian.campbell@citrix.com>
    CC: Jan Beulich <JBeulich@suse.com>
    CC: Keir Fraser <keir@xen.org>
    Prerequisite patch to avoid compile issue
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27519678]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.63
changelog:
  - Due to the history performance reason, we decide to disable PoD feature
    in old OVM product.XSA-246,XSA-247 [bug 27121016] {CVE-2017-17044,CVE-2017-17045}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.62
changelog:
  - From 2a99aa99fc84a45f505f84802af56b006d14c52e Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Fri, 19 Aug 2016 15:08:10 +0100
    Subject: [PATCH] xen/physmap: Do not permit a guest to populate PoD pages for itself
    PoD is supposed to be entirely transparent to guest, but this interface has
    been left exposed for a long time.
    The use of PoD requires careful co-ordination by the toolstack with the
    XENMEM_{get,set}_pod_target hypercalls, and xenstore ballooning target.  The
    best a guest can do without toolstack cooperation crash.
    Furthermore, there are combinations of features (e.g. c/s c63868ff "libxl:
    disallow PCI device assignment for HVM guest when PoD is enabled") which a
    toolstack might wish to explicitly prohibit (in this case, because the two
    simply don't function in combination).  In such cases, the guest mustn't be
    able to subvert the configuration chosen by the toolstack.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Jan Beulich <jbeulich@suse.com>
    Conflict:
    xen/common/memory.c
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 27121016]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.61
changelog:
  - x86/shadow: correct SH_LINEAR mapping detection in sh_guess_wrmap()
    The fix for XSA-243 / CVE-2017-15592 (c/s bf2b4eadcf379) introduced a change
    in behaviour for sh_guest_wrmap(), where it had to cope with no shadow linear
    mapping being present.
    As the name suggests, guest_vtable is a mapping of the guests pagetable, not
    Xen's pagetable, meaning that it isn't the pagetable we need to check for the
    shadow linear slot in.
    The practical upshot is that a shadow HVM vcpu which switches into 4-level
    paging mode, with an L4 pagetable that contains a mapping which aliases Xen's
    SH_LINEAR_PT_VIRT_START will fool the safety check for whether a SHADOW_LINEAR
    mapping is present.  As the check passes (when it should have failed), Xen
    subsequently falls over the missing mapping with a pagefault such as:
    (XEN) Pagetable walk from ffff8140a0503880:
    (XEN)  L4[0x102] = 000000046c218063 ffffffffffffffff
    (XEN)  L3[0x102] = 000000046c218063 ffffffffffffffff
    (XEN)  L2[0x102] = 000000046c218063 ffffffffffffffff
    (XEN)  L1[0x103] = 0000000000000000 ffffffffffffffff
    This is part of XSA-243.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Tim Deegan <tim@xen.org>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896489] {CVE-2017-15592}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.60
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Subject: x86/cpu: fix IST handling during PCPU bringup
    Clear IST references in newly allocated IDTs.  Nothing good will come of
    having them set before the TSS is suitably constructed (although the chances
    of the CPU surviving such an IST interrupt/exception is extremely slim).
    Uniformly set the IST references after the TSS is in place.  This fixes an
    issue on AMD hardware, where onlining a PCPU while PCPU0 is in HVM context
    will cause IST_NONE to be copied into the new IDT, making that PCPU vulnerable
    to privilege escalation from PV guests until it subsequently schedules an HVM
    guest.
    This is XSA-244.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Move IST setting in subarch_percpu_traps_init() as no load_system_tables() here
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896604]  {CVE-2017-15594}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.59
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Subject: x86/shadow: Don't create self-linear shadow mappings for 4-level translated guests
    When initially creating a monitor table for 4-level translated guests, don't
    install a shadow-linear mapping.  This mapping is actually self-linear, and
    trips up the writeable heuristic logic into following Xen's mappings, not the
    guests' shadows it was expecting to follow.
    A consequence of this is that sh_guess_wrmap() needs to cope with there being
    no shadow-linear mapping present, which in practice occurs once each time a
    vcpu switches to 4-level paging from a different paging mode.
    An appropriate shadow-linear slot will be inserted into the monitor table
    either while constructing lower level monitor tables, or by sh_update_cr3().
    While fixing this, clarify the safety of the other mappings.  Despite
    appearing unsafe, it is correct to create a guest-linear mapping for
    translated domains; this is self-linear and doesn't point into the translated
    domain.  Drop a dead clause for translate != external guests.
    This is part of XSA-243.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Tim Deegan <tim@xen.org>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896489]  {CVE-2017-15592}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.58
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Subject: x86: Disable the use of auto-translated PV guests
    This is a minimal backport of c/s 92942fd3d469 "x86/mm: drop
    guest_{map,get_eff}_l1e() hooks" from Xen 4.7, which stated:
    Disallow the unmaintained and presumed broken translated-but-not-external
    paging mode combination ...
    It turns out that this mode is insecure to run with, as opposed to just simply
    broken.
    This is part of XSA-243.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896489]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.57
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86: don't allow page_unlock() to drop the last type reference
    Only _put_page_type() does the necessary cleanup, and hence not all
    domain pages can be released during guest cleanup (leaving around
    zombie domains) if we get this wrong.
    This is XSA-242.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896488]  {CVE-2017-15593}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.56
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86: don't store possibly stale TLB flush time stamp
    While the timing window is extremely narrow, it is theoretically
    possible for an update to the TLB flush clock and a subsequent flush
    IPI to happen between the read and write parts of the update of the
    per-page stamp. Exclude this possibility by disabling interrupts
    across the update, preventing the IPI to be serviced in the middle.
    This is XSA-241.
    Suggested-by: George Dunlap <george.dunlap@citrix.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: George Dunlap <george.dunlap@citrix.com>
    Conflict:
    xen/arch/x86/mm.c
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896482]  {CVE-2017-15588}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186.55
changelog:
  - x86/mm: Disable PV linear pagetables by default
    Allowing pagetables to point to other pagetables of the same level
    (often called 'linear pagetables') has been included in Xen since its
    inception.  But it is not used by the most common PV guests (Linux,
    NetBSD, minios), and has been the source of a number of subtle
    reference-counting bugs.
    Add a command-line option to control whether PV linear pagetables are
    allowed (disabled by default).
    Signed-off-by: George Dunlap <george.dunlap@citrix.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Conflict:
    docs/misc/xen-command-line.markdown
    Changes since v2:
    - s/_/-/; in command-line option
    - Added __read_mostly
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26896443]  {CVE-2017-15595}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.54
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86/HVM: prefill partially used variable on emulation paths
    Certain handlers ignore the access size (vioapic_write() being the
    example this was found with), perhaps leading to subsequent reads
    seeing data that wasn't actually written by the guest. For
    consistency and extra safety also do this on the read path of
    hvm_process_io_intercept(), even if this doesn't directly affect what
    guests get to see, as we've supposedly already dealt with read handlers
    leaving data completely unitialized.
    This is XSA-239.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Conflict:
    xen/arch/x86/hvm/intercept.c
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896434]  {CVE-2017-15589}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.53
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86/FLASK: fix unmap-domain-IRQ XSM hook
    The caller and the FLASK implementation of xsm_unmap_domain_irq()
    disagreed about what the "data" argument points to in the MSI case:
    Change both sides to pass/take a PCI device.
    This is part of XSA-237.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Conflict:
    xen/xsm/flask/hooks.c
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896408]  {CVE-2017-15590}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.52
changelog:
  - Subject: x86/IRQ: conditionally preserve irq <-> pirq mapping on map error paths
    Mappings that had been set up before should not be torn down when
    handling unrelated errors.
    This is part of XSA-237.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: George Dunlap <george.dunlap@citrix.com>
    Remove the related chunk in xen/arch/x86/irq.c and xen/arch/x86/physdev.c as there is no MAP_PIRQ_TYPE_MULTI_MSI
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896404]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.51
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86/MSI: disallow redundant enabling
    At the moment, Xen attempts to allow redundant enabling of MSI by
    having pci_enable_msi() return 0, and point to the existing MSI
    descriptor, when the msi already exists.
    Unfortunately, if subsequent errors are encountered, the cleanup
    paths assume pci_enable_msi() had done full initialization, and
    hence undo everything that was assumed to be done by that
    function without also undoing other setup that would normally
    occur only after that function was called (in map_domain_pirq()
    itself).
    Rather than try to make the redundant enabling case work properly, just
    forbid it entirely by having pci_enable_msi() return -EEXIST when MSI
    is already set up.
    This is part of XSA-237.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: George Dunlap <george.dunlap@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896408]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.50
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86: enforce proper privilege when (un)mapping pIRQ-s
    (Un)mapping of IRQs, just like other RESOURCE__ADD* / RESOURCE__REMOVE*
    actions (in FLASK terms) should be XSM_DM_PRIV rather than XSM_TARGET.
    This in turn requires bypassing the XSM check in physdev_unmap_pirq()
    for the HVM emuirq case just like is being done in physdev_map_pirq().
    The primary goal security wise, however, is to no longer allow HVM
    guests, by specifying their own domain ID instead of DOMID_SELF, to
    enter code paths intended for PV guest and the control domains of HVM
    guests only.
    This is part of XSA-237.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: George Dunlap <george.dunlap@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896404]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.49
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86: don't allow MSI pIRQ mapping on unowned device
    MSI setup should be permitted only for existing devices owned by the
    respective guest (the operation may still be carried out by the domain
    controlling that guest).
    This is part of XSA-237.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26896404]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.48
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: gnttab: also validate PTE permissions upon destroy/replace
    In order for PTE handling to match up with the reference counting done
    by common code, presence and writability of grant mapping PTEs must
    also be taken into account; validating just the frame number is not
    enough. This is in particular relevant if a guest fiddles with grant
    PTEs via non-grant hypercalls.
    Note that the flags being passed to replace_grant_host_mapping()
    already happen to be those of the existing mapping, so no new function
    parameter is needed.
    This is XSA-234.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26721591] {CVE-2017-14319}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.47
changelog:
  - From: Juergen Gross <jgross@suse.com>
    Subject: tools/xenstore: dont unlink connection object twice
    A connection object of a domain with associated stubdom has two
    parents: the domain and the stubdom. When cleaning up the list of
    active domains in domain_cleanup() make sure not to unlink the
    connection twice from the same domain. This could happen when the
    domain and its stubdom are being destroyed at the same time leading
    to the domain loop being entered twice.
    Additionally don't use talloc_free() in this case as it will remove
    a random parent link, leading eventually to a memory leak. Use
    talloc_unlink() instead specifying the context from which the
    connection object should be removed.
    This is XSA-233.
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Reviewed-by: Ian Jackson <ian.jackson@eu.citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26721575] {CVE-2017-14317}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.46
changelog:
  - From: George Dunlap <george.dunlap@citrix.com>
    Subject: xen/mm: make sure node is less than MAX_NUMNODES
    The output of MEMF_get_node(memflags) can be as large as nodeid_t can
    hold (currently 255).  This is then used as an index to arrays of size
    MAX_NUMNODE, which is 64 on x86 and 1 on ARM, can be passed in by an
    untrusted guest (via memory_exchange and increase_reservation) and is
    not currently bounds-checked.
    Check the value in page_alloc.c before using it, and also check the
    value in the hypercall call sites and return -EINVAL if appropriate.
    Don't permit domains other than the hardware or control domain to
    allocate node-constrained memory.
    This is XSA-231.
    Signed-off-by: George Dunlap <george.dunlap@citrix.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26721504] {CVE-2017-14316}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.119.10
changelog:
  - x86: enforce consistent cachability of MMIO mappings
    We've been told by Intel that inconsistent cachability between
    multiple mappings of the same page can affect system stability only
    when the affected page is an MMIO one. Since the stale data issue is
    of no relevance to the hypervisor (since all guest memory accesses go
    through proper accessors and validation), handling of RAM pages
    remains unchanged here. Any MMIO mapped by domains however needs to be
    done consistently (all cachable mappings or all uncachable ones), in
    order to avoid Machine Check exceptions. Since converting existing
    cachable mappings to uncachable (at the time an uncachable mapping
    gets established) would in the PV case require tracking all mappings,
    allow MMIO to only get mapped uncachable (UC, UC-, or WC).
    This also implies that in the PV case we mustn't use the L1 PTE update
    fast path when cachability flags get altered.
    Since in the HVM case at least for now we want to continue honoring
    pinned cachability attributes for pages not mapped by the hypervisor,
    special case handling of r/o MMIO pages (forcing UC) gets added there.
    Arguably the counterpart change to p2m-pt.c may not be necessary, since
    UC- (which already gets enforced there) is probably strict enough.
    Note that the shadow code changes include fixing the write protection
    of r/o MMIO ranges: shadow_l1e_remove_flags() and its siblings, other
    than l1e_remove_flags() and alike, return the new PTE (and hence
    ignoring their return values makes them no-ops).
    This is CVE-2016-2270 / XSA-154.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: boris.ostrovsky@oracle.com [bug 22752939] {CVE-2016-2270}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.119.9
changelog:
  - x86/VMX: sanitize rIP before re-entering guest
    ... to prevent guest user mode arranging for a guest crash (due to
    failed VM entry). (On the AMD system I checked, hardware is doing
    exactly the canonicalization being added here.)
    Note that fixing this in an architecturally correct way would be quite
    a bit more involved: Making the x86 instruction emulator check all
    branch targets for validity, plus dealing with invalid rIP resulting
    from update_guest_eip() or incoming directly during a VM exit. The only
    way to get the latter right would be by not having hardware do the
    injection.
    Note further that there are a two early returns from
    vmx_vmexit_handler(): One (through vmx_failed_vmentry()) leads to
    domain_crash() anyway, and the other covers real mode only and can
    neither occur with a non-canonical rIP nor result in an altered rIP,
    so we don't need to force those paths through the checking logic.
    This is XSA-170.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: boris.ostrovsky@oracle.com [bug 22706636] {CVE-2016-2271}


author: Joe Jin <joe.jin@oracle.com> - 4.3.0-55.el6.119.7
changelog:
  - have architectures specify the number of PIRQs a hardware domain gets
    The current value of nr_static_irqs + 256 is often too small for larger
    systems. Make it dependent on CPU count and number of IO-APIC pins on
    x86, and (until it obtains PCI support) simply NR_IRQS on ARM.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: David Vrabel <david.vrabel@citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Release-Acked-by: Konrad Rzeszutek Wilk <Konrad.wilk@oracle.com>
    (cherry picked from commit 7e73a6e7f12ae080222c5d339799905de3443a6e)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Backported-by: Joe Jin <joe.jin@oracle.com> [bug 22668626] [bug 22661468]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.119.6
changelog:
  - xl/xend: error out if pcnet emulated driver model is used.
    From http://xenbits.xen.org/xsa/advisory-162.html:
    The QEMU security team has predisclosed the following advisory:
    The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving
    packets in loopback mode, appends CRC code to the receive
    buffer. If the data size given is same as the buffer size(4096),
    the appended CRC code overwrites 4 bytes after the s->buffer,
    making the adjacent 's->irq' object point to a new location.
    IMPACT
    ======
    A guest which has access to an emulated PCNET network device
    (e.g. with "model=pcnet" in their VIF configuration) can exploit this
    vulnerability to take over the qemu process elevating its privilege to
    that of the qemu process.
    This patch resolves XSA-162 but is not the solution provided by xen.org.
    If using either xl or xm - in both cases fail the creation
    if model=pcnet is used.
    Suggested-by:  Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    ---
    tools/libxl/libxl.c                 |  4 ++++
    tools/python/xen/xend/XendConfig.py | 15 ++++++++++++++-
    2 files changed, 18 insertions(+), 1 deletion(-) [bug 22553036] {CVE-2015-7504}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.119.5
changelog:
  - x86/VMX: prevent INVVPID failure due to non-canonical guest address
    While INVLPG (and on SVM INVLPGA) don't fault on non-canonical
    addresses, INVVPID fails (in the "individual address" case) when passed
    such an address.
    Since such intercepted INVLPG are effectively no-ops anyway, don't fix
    this in vmx_invlpg_intercept(), but instead have paging_invlpg() never
    return true in such a case.
    This is XSA-168.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: zhenzhong.duan@oracle.com [bug 22584445] {CVE-2016-1571}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.119.4
changelog:
  - x86/mm: PV superpage handling lacks sanity checks
    MMUEXT_{,UN}MARK_SUPER fail to check the input MFN for validity before
    dereferencing pointers into the superpage frame table.
    get_superpage() has a similar issue.
    This is XSA-167.
    Reported-by: Qinghao Tang <luodalongde@gmail.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22583075] {CVE-2016-1570}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.119.3
changelog:
  - x86/HVM: avoid reading ioreq state more than once
    Otherwise, especially when the compiler chooses to translate the
    switch() to a jump table, unpredictable behavior (and in the jump table
    case arbitrary code execution) can result.
    This is XSA-166.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22551154]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.119.2
changelog:
  - x86: don't leak ST(n)/XMMn values to domains first using them
    FNINIT doesn't alter these registers, and hence using it is
    insufficient to initialize a guest's initial state.
    This is XSA-165.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22551085] {CVE-2015-8555}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.119.1
changelog:
  - MSI-X: avoid array overrun upon MSI-X table writes
    pt_msix_init() allocates msix->msix_entry[] to just cover
    msix->total_entries entries. While pci_msix_readl() resorts to reading
    physical memory for out of bounds reads, pci_msix_writel() so far
    simply accessed/corrupted unrelated memory.
    pt_iomem_map()'s call to cpu_register_physical_memory() registers a
    page granular region, which is necessary as the Pending Bit Array may
    share space with the MSI-X table (but nothing else is allowed to). This
    also explains why pci_msix_readl() actually honors out of bounds reads,
    but pci_msi_writel() doesn't need to.
    This is XSA-164.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22550995] {CVE-2015-8554}


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-27
changelog:
  - sandbox: Improve comments in sysconfig file
  Resolves: rhbz#1159336
  - secon, newrole: fix inconsistence between --help and man page
  Resolves: rhbz#1278811, rhbz#1278913


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-26
changelog:
  - restorecond: treat root as a regular user
  Resolves: rhbz#1281877
  - semanage: don't skip reserver_port_t
  Resolves: rhbz#1225806
  - semanage: check if a store exists
  Resolves: rhbz#1208801
  - fixfiles: check the SELinux status
  Resolves: rhbz#1240788


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-23
changelog:
  - Move python scripts in /usr/share/system-config-selinux to policycoreutils-python
  Resolves: rhbz#995778


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-21
changelog:
  - fixfiles verify: do not relabel /tmp and /var/tmp dirs
  Resolves: rhbz#1113083
  - Fix semanage -S <store> -o <output>
  Resolves: rhbz#1122850


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-20
changelog:
  - chcat: Change the isSensitivity() detection
  Resolves: rhbz#965397
  - Move sepolgen utility from policycoreutils-gui to policycoreutils-python
  Resolves: rhbz#995778
  - audit2allow: use date time format compatible with ausearch
  Resolves: rhbz#1111999


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.47
changelog:
  - Fix setfiles man page
  Resolves:#1086456
  - Fix  semanage fcontext  error message when non-existing context given
  Resolves:#1122023


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.46
changelog:
  - Make semanage -i working on empty file
  - Fix setfiles man page
  - Fix setfiles -r option to be working correctly
  Resolves:#1086456


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.43
changelog:
  - Fix semanage man page to contain also noreload option
  Resolves:#1032828
  - Fix sandbox man page
  - Make setfiles more informative if bad option is given


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.42
changelog:
  - Fail properly on invalid options for restorecon/setfiles when using -R or -r
  - Check if all files exist for setfiles and restorecon
  - Remove handling of cgroups from sandbox. 
  Resolves:#1091139
  - Make -q and -d options mutually exclusive


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.41
changelog:
  - Allow use sandbox to follow homedirs symlinks
  Resolves:#913175
  - Make sure file equivalance target and source do not end
   with a /
  - Allow make only valid domains as permissive domains
  - Fix polgen.py to allow "_" in a policy file.
  - Implement --noreload option to semanage
  - Add missing long options in sandbox man page


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.37
changelog:
  - Add workaround to make allow_polyinstantiation=1 directive working for xguest with semanage-booleans
  Resolves:#1008790


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.33
changelog:
  - Fix semanage
  Resolves:#860506
  - Make semanage man page and help consistent
  - Fix setsebool to give better error message on bad boolean names
  - Add support for exclude dirs in fixfiles
  - Fix semanage boolean to require a value


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.31
changelog:
  - Make setsebool less verbose on errors
  Resolves:#984484
  - Make <<none>> spec working for semanage fcontext
  - Make audit2allow witn o option to append output instead of write


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.11
changelog:
  - Remove sandbox calling -k, only should be used by seunshare, should not be
  called all the time.
  Resolves: #679690
  Resolves: #679689
  Resolves: #677541
  Resolves: #679798


author: Tim Waugh <twaugh@redhat.com> 4.0-5.20090819
changelog:
  - Updated to foomatic-db-4.0-20090819.
  - Removed deprecated foomatic-db-hpijs tarball.
  - Use buildroot macro throughout.


author: Tim Waugh <twaugh@redhat.com> 4.0-3.20090702
changelog:
  - License for ppds sub-package should include GPLv2+.
  - Ship COPYING file in main package.
  - Added filesystem sub-package for directory ownership.


author: Tim Waugh <twaugh@redhat.com> 4.0-2.20090702
changelog:
  - Move foomatic-db-ppds symlink to ppds sub-package.
  - Use sed instead of perl in raster PPDs (bug #512739).
  - Removed code to convert old-style printer IDs (there are none).
  - Ship README file.


author: Brian C. Lane <bcl@redhat.com> 2.1-19
changelog:
  - libparted: HFS/HFS+ probe: don't let a corrupt FS evoke failed assertion
    Resolves: #797979
  - tests: exercise and document the HFS-probe bug fix
    Resolves: #797979
  - libparted: use largest_partnum in dm_reread_part_table
    Resolves: #803108
  - tests: test creating 20 device-mapper partitions
    Resolves: #803108
  - libparted: preserve the uuid on dm partitions
    Resolves: #832145
  - tests: Make sure dm UUIDs are not erased
    Resolves: #832145


author: Brian C. Lane <bcl@redhat.com> 2.1-18
changelog:
  - libparted: copy flags when duplicating GPT partitions
  - test for GPT partition duplicate
    Resolves: #750395
  - Use dm_udev_wait for dm operations
    Resolves: #698121
    Resolves: #751164


author: Brian C. Lane <bcl@redhat.com> 2.1-17
changelog:
  - Disable t9020 (scsi_debug num_parts is broken)
  - Add a wait loop to t9030 when removing the partition
  - Remove size parameter from scsi_debug in t9030
    Resolves: #746098


author: Brian C. Lane <bcl@redhat.com> 2.1-14
changelog:
  - Fix scsi_debug race condition in tests
  - turn t9020 and t9030 tests back on
  - Add legacy_boot support to GPT disklabel (#711148)
    Resolves: #711148
  - Remove asserts from CHS guessing code (#692562)
    Resolves: #692562
  - Fix snap radius and don't allow values < 1 (#665496)
    Resolves: #665496


author: Brian C. Lane <bcl@redhat.com> 2.1-13
changelog:
  - Double the buffer for fdasd_check_api_version
    Resolves: #693852
  - Disable tests that fail when run as root


author: Brian C. Lane <bcl@redhat.com> 2.1-11
changelog:
  - Document the align-check command
    Resolves: #642476
  - Default to 1MiB partition alignment
    Resolves: #618255


author: Hans de Goede <hdegoede@redhat.com> 2.1-7
changelog:
  - Properly check dm_task_run return value (#585158)
    Resolves: #585158
  - Fix mkpartfs (ext2) on partitions >2TB (#585159)
    Resolves: #585159
  - Add a flag for detecting diagnostics / recovery partitions


author: Hans de Goede <hdegoede@redhat.com> 2.1-3
changelog:
  - Don't crash when reading a DASD disk with PV's on there (#563419)
    Resolves: #563419
  - Don't overwrite the pmbr when merely printing a gpt table (#563211)
    Resolves: #563211


author: Hans de Goede <hdegoede@redhat.com> 2.1-2
changelog:
  - Fix various memory leaks in error paths (#556012)
  - Add %check section to the specfile, invoking make check
  - If a drive does not have alignment information available default
    to an alignment of 1MiB (#559639)
    Resolves: #559639


author: Hans de Goede <hdegoede@redhat.com> 2.1-1
changelog:
  - New upstream release 2.1
  - Drop all our patches (all merged upstream)
  - This fixes the usage of disks with 4k logical sectors (#523954)
    Resolves: #523954


author: Hans de Goede <hdegoede@redhat.com> 1.9.0-25
changelog:
  - Fix crash when partitioning loopback devices (#546622)
    Resolves: #549075
  - Drop no-cylinder-align patch:
    - its functionality is superseeded by the per disk flags
    - its only user (pyparted) has been updated to use those
    - this is not upstream so we don't want other programs to start using it


author: Hans de Goede <hdegoede@redhat.com> 1.9.0-24
changelog:
  - Allow partitioning of loopback devices (#546622)
  - Add libparted function to query maximum partition length and start
    addresses for a given disk (#533417)
  - Add per disk flags functions from upstream, this is the way upstream
    has implemented the disable cylinder alignment functionality
  - Add --align cmdline option to specify how to align new partitions
    see the parted man page for details (#361951)
  - Make the default alignment for new partitions optimal (#361951)
    Resolves: #361951
  - When cylinder alignment is disabled, allow use of the last (incomplete)
    cylinder of the disk (#533328)
  - Don't crash when printing partition tables in Russian (#543029)
  - Make parted work correctly with new lvm (#525095)


author: Hans de Goede <hdegoede@redhat.com> 1.9.0-22
changelog:
  - Fix error when creating a fresh dasd disk on a dasd device
    with a corrupted dasd label (#533808)


author: Hans de Goede <hdegoede@redhat.com> 1.9.0-20
changelog:
  - Fix error when creating a fresh dasd disk (#532425)
  - Rewrite dasd disk duplication patches, as the old old ones conflicted
    with fixing creating a fresh dasd disk


author: Hans de Goede <hdegoede@redhat.com> 1.9.0-17
changelog:
  - Only change the partition type to 82 when setting the swap flag on dos
    labels, not when resetting it


author: Hans de Goede <hdegoede@redhat.com> 1.9.0-15
changelog:
  - ped_partition_is_busy() should not throw exceptions (#527035)
  - msdos_partition_is_flag_available() should return 1 for swap flag (#513729)


author: Joel Granados <jgranado@redhat.com> - 1.8.8-15
changelog:
  - Begin to identify virtio devices.
  - Actually change the partition type in msdos lables (dcantrell).


author: Peter Jones <pjones@redhat.com> - 1.8.8-4
changelog:
  - Don't interactively ask to fix an AlternateGPT's location when not
    at the end of the disk; this is so that disk images written to a
    usb-key can work reasonably.


author: David Cantrell <dcantrell@redhat.com> - 1.8.6-12
changelog:
  - Add KNOWN ISSUES section to parted(8) man page explaining that we cannot
    currently do ext3 resizing inside parted (#367101)
  - Update the xvd patch to include 'xvd' in the string table that parted
    uses when printing device types (#366971)
  - Do not install the linux.h or gnu.h headers


author: David Cantrell <dcantrell@redhat.com> - 1.8.6-4
changelog:
  - Fix primary partition cylinder alignment error for DOS disk labels (#229745)
  - Do not build and package up libparted.a, only the shared library


author: David Cantrell <dcantrell@redhat.com> - 1.8.6-1
changelog:
  - Upgrade to GNU parted-1.8.6, summary of major change(s):
       a) Revert linux-swap(new) and linux-swap(old) fs types, it's
          linux-swap for all swap types (#233085)


author: David Cantrell <dcantrell@redhat.com> - 1.8.4-1
changelog:
  - Upgrade to GNU parted-1.8.4, summary of major changes:
       a) Update to use newest GNU developer tools
       b) Use gnulib, the GNU portability library
       c) HFS+ resize support
       d) Windows Vista fixes
       e) AIX disk label fixes
       f) >512 byte logical sector read support on Linux
  - Spec file cleanups per Fedora packaging guidelines


author: David Cantrell <dcantrell@redhat.com> - 1.8.2-5
changelog:
  - Remove period from end of summary line (package review)
  - Use preferred BuildRoot (package review)
  - BR device-mapper-devel


author: David Cantrell <dcantrell@redhat.com> - 1.8.2-4
changelog:
  - Patched parted.8 man page to show partition names apply to GPT disklabels
    as well as Mac and PC98 disklabels (#221600)


author: David Cantrell <dcantrell@redhat.com> - 1.8.2-3
changelog:
  - Remove BR for libtermcap-devel
  - Specifically preserve starting alignment of 0x800 on Windows Vista
    (see http://support.microsoft.com/kb/923332 for details)
  - Fix incorrect sector parameter used to initialize a new PedAlignment


author: David Cantrell <dcantrell@redhat.com> - 1.8.2-2
changelog:
  - Preserve starting sector for primary NTFS 3.1 partitions (Windows
    Vista) when modifying the DOS disk label.  NTFS 3.1 partitions do
    not start on the 2nd head of the 1st cylinder at the beginning of
    the drive.


author: David Cantrell <dcantrell@redhat.com> - 1.7.1-17
changelog:
  - For init_generic() failures on user-mode Linux block devices, goto
    error_free_arch_specific instead of error_free_dev.


author: David Cantrell <dcantrell@redhat.com> - 1.7.1-16
changelog:
  - Don't throw PED_EXCEPTION_ERROR in ped_geometry_read() if accessing
    sectors outside of partition boundary, since returning false will
    shift ped_geometry_check() to the correct sectors.


author: David Cantrell <dcantrell@redhat.com> - 1.7.1-14
changelog:
  - Improve error message returned by _parse_header() on GPT-labeled disks
    so users actually have an idea of how to correct the problem
  - Fix off-by-one error with LastUsableLBA and PartitionEntryLBA overlap
    to prevent possible data corruption when using non-parted GPT editing
    tools


author: Peter Jones <pjones@redhat.com> - 1.7.1-13
changelog:
  - Don't use the "volume name" as the device node name on dm device
    partitions, it isn't really what we want at all.


author: David Cantrell <dcantrell@redhat.com> - 1.7.1-12
changelog:
  - Updated O_DIRECT patch to work around s390 problems
  - Update LastUsableLBA on GPT-labeled disks after LUN resize (#194238)
  - Fix exception when backup GPT table is not in the correction location
    and parted tries to move it (#194238)


author: David Cantrell <dcantrell@redhat.com> - 1.7.1-11
changelog:
  - Expand error buffer to 8192 bytes in vtoc_error()
  - Do not apply O_DIRECT patch on S/390 or S/390x platforms


author: Chris Lumens <clumens@redhat.com> 1.6.23-1
changelog:
  - Updated to 1.6.23.
  - Get rid of separate Mac patches that are now included in upstream.
  - Update DASD and AIX patches.


author: Chris Lumens <clumens@redhat.com> 1.6.22-3
changelog:
  - Modified Apple_Free patch to take care of the case where the partitions
    are unnamed, causing many errors to be printed (#159047).


author: Chris Lumens <clumens@redhat.com> 1.6.22-1
changelog:
  - Updated to 1.6.22.
  - Get rid of separate gc4 patch that's now included upstream.
  - Take Mac LVM patch from parted CVS.


author: Jeremy Katz <katzj@redhat.com> - 1.6.16-2
changelog:
  - add patch from Matt Domsch to fix consistency of GPT disk labels 
    with the EFI specification for disks > 2TB (#138480)
  - understand the new Sun UFS partition ID
  - merge the new geometry probing from CVS to see if that helps the 
    assertions people are seeing (#138419)


author: Jeremy Katz <katzj@redhat.com> - 1.6.15-5
changelog:
  - add patch from Matt Domsch to add a unique signature to new DOS labels 
    so that we can later determine which BIOS disk is which (#106674)


author: Phil Knirsch <pknirsch@redhat.com> 1.6.15-4
changelog:
  - Fixed dasd patch (had some duplicate file patches in it)
  - Fixed problem with parted segfaulting on SCSI discs on s390 (#133997)


author: Jeremy Katz <katzj@redhat.com> - 1.6.12-2
changelog:
  - fix assertion error when checking flags on non-active partition (#130692)
  - buildrequires: gettext-devel


author: Jeremy Katz <katzj@redhat.com> - 1.6.12-1
changelog:
  - update to 1.6.12 with major changes to CHS handling to hopefully fix #115980
  - adjust dasd patch accordingly, drop some included patches


author: Jeremy Katz <katzj@redhat.com> - 1.6.9-4
changelog:
  - add patch from Matt Domsch to not use the get/set last sector ioctls 
    with a 2.6 kernel (#121455)


author: Jeremy Katz <katzj@redhat.com> - 1.6.9-1
changelog:
  - update to 1.6.9
  - need automake17
  - python-devel is superfluous with pyparted as a separate package
  - lose the fake-libtool stuff, 1.6.9 was disted with newer auto*


author: Jeremy Katz <katzj@redhat.com> - 1.6.6-1
changelog:
  - update to 1.6.6 
  - split dasd into a patch instead of included in the tarball
  - python module is now in the pyparted package (separate src.rpm)
  - ExcludeArch: ppc64 (#118183)


author: Jeremy Katz <katzj@redhat.com> 1.6.3-33
changelog:
  - 2.6 removes the geometry fixups that used to be present for IDE disks.  
    According to Andries, just follow what's in the partition table and don't 
    worry about what Linux "detects"


author: Matt Wilson <msw@redhat.com> 1.6.3-20
changelog:
  - don't detect AIX physical volumes as msdos partition tables (#91748)
  - added stubbed code for manipulating AIX PVs, enough to clobber the
    signature. (#91748)


author: Matt Wilson <msw@redhat.com> 1.6.3-18
changelog:
  - use metadata partitions to protect DASD VTOC
  - stash DASD specific data in disk specific areas, not arch specific
    areas.


author: Karsten Hopp <karsten@redhat.de> 1.6.3-11
changelog:
  - use different define to enable DASD debugging
    Otherwise we'll get a lot of dasd debug output because DEBUG is
    always defined


author: Jeremy Katz <katzj@redhat.com> 1.4.24-7
changelog:
  - use make LIBTOOL=/usr/bin/libtool instead of recreating everything
  - add patch from Jack Howarth <howarth@bromo.med.uc.edu> to self host properly
  - add patch to treat GPT structs as little-endian always and treat GUIDS 
    as little-endian blobs
  - add patch to recognize hp service partitions


author: Jeremy Katz <katzj@redhat.com> 1.4.24-6hammer
changelog:
  - libtoolize, etc for x86_64
  - hack to get the python module in the right place until python.m4 
    from automake is fixed


author: Matt Wilson <msw@redhat.com> 1.4.20-0.1pre3
changelog:
  - new dist from CVS with new autoconf and automake
  - gpt is in 1.4.20, removed patch1 (gpt support)
  - partstatic is in 1.4.20, removed patch2 (partstatic patch)


author: Matt Wilson <msw@redhat.com> 1.4.16-8
changelog:
  - new dist from cvs with changes to the python binding: register
    DEVICE_I20 and DEVICE_ATARAID, check to make sure that a partition
    exists in the PedDisk when using it to find ped_disk_next_partition


author: Matt Wilson <msw@redhat.com> 1.4.16-6
changelog:
  - added a patch (Patch1) to link the c library in dynamically, the
    rest of the libs statically for the parted binary (MF #49358)


author: Matt Wilson <msw@redhat.com>
changelog:
  - made a new dist from CVS that includes binding for
    disk.get_partition_by_sector and accessing the name of a disk type


author: Matt Wilson <msw@redhat.com>
changelog:
  - 1.4.16
  - regenerated gpt patch against 1.4.16, incorporated
    parted-1.4.15-pre1-gpt-printf.patch into the same patch, removed Patch1


author: Matt Wilson <msw@redhat.com>
changelog:
  - added a new dist tarball that contains a check in python code to
    make sure that a partition exists within a disk before trying to
    remove it from the disk
  - also changed _probe_with_open to make the first probed filesystem win


author: Matt Wilson <msw@redhat.com>
changelog:
  - added another fix for ext2/ext3
  - added Patch4 to move the crc32 function into its own namespace so
    we don't colide with zlib when both are in the same executable space


author: Matt Wilson <msw@redhat.com>
changelog:
  - include python binding
  - enable shared library (for python binding, we want fpic code)
    with --enable-shared
  - build parted binary static with --enable-all-static
  - don't run libtoolize on this.


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 1.4.11
  - add EFI GPT patch from Matt Domsch (<Matt_Domsch@dell.com>)
  - don't run autoconf, it relies on a newer non-released version
    of autoconf...


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-5
changelog:
  - Correctly mark the LDAP default password value as encrypted (CVE-2011-0002)
    Resolves: #668021
  - Default LDAP cn to username if gecos is empty
    Resolves: #670151
  - Preserve setuid and setgid bits when copying files from /etc/skel
    Resolves: #724987
  - Fix segfault when reading database files with certain sizes
    Resolves: #788521


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-2
changelog:
  - Allow supplying passwords from scripts
  - Allow specifying a LDAP simple bind password in libuser.conf
    Resolves: #562832


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-1
changelog:
  - Update to libuser-0.56.13.
    Resolves: #251951
    Resolves: #454079
    Resolves: #456373
    Resolves: #456382
    Resolves: #530513


author: Miloslav Trmač <mitr@redhat.com> - 0.56.11-1
changelog:
  - Update to libuser-0.56.11.
    Resolves: #454091
    Resolves: #456267
    Resolves: #456270
    Resolves: #487129


author: Miloslav Trmač <mitr@redhat.com> - 0.56.7-1
changelog:
  - Add support for SHA256 and SHA512 in password hashes
    Related: #173583
  - Fix file locking on some architectures
  - Rename sr@Latn.po to sr@latin.po
    Resolves: #426584
  - Address issues from a review by Jason Tibbitts:
    - Remove default.-c, moving the provided functions to libuser proper
    - Remove the WITH_SELINUX build option
    - Move Python library test to %check
    Resolves: #226054


author: Miloslav Trmač <mitr@redhat.com> - 0.56.6-1
changelog:
  - Set SELinux file contexts when creating home directories, preserve them when
    moving home directories
    Resolves: #351201


author: Miloslav Trmač <mitr@redhat.com> - 0.56.5-1
changelog:
  - Work around spurious error messages when run against the Fedora Directory
    server
  - Fix error reporting when creating home directories and creating/removing mail
    spool files
    Resolves: #318121


author: Miloslav Trmač <mitr@redhat.com> - 0.56.4-2
changelog:
  - Split the Python module to a separate subpackage (original patch by Yanko
    Kaneti)
  - Update the License: tag


author: Miloslav Trmac <mitr@redhat.com> - 0.56.1-1
changelog:
  - When changing passwords, only silently ignore know shadow markers, not all
    invalid hashes
    Resolves: #225495


author: Miloslav Trmac <mitr@redhat.com> - 0.56-1
changelog:
  - Tighten the API and implementation to avoid corrupting number-like strings;
    the module interface ABI has changed
    Resolves: #226976


author: Miloslav Trmac <mitr@redhat.com> - 0.54.6-1
changelog:
  - Fix bugs in handling of invalid lines in the files and shadow modules
  - Fix pattern matching in lu_*_enumerate_full in the files and shadow modules
  - Add more error reporting, return non-zero exit status on error from utils
  - Use the skeleton directory specified in libuser.conf by Python
    admin.createHome and admin.addUser, add parameter skeleton= to admin.addUser
    (#189984)


author: Miloslav Trmac <mitr@redhat.com> - 0.54.1-1
changelog:
  - Support importing of configuration from shadow-utils (/etc/login.defs and
    /etc/default/useradd)
  - Add libuser.conf(5) man page


author: Miloslav Trmac <mitr@redhat.com> - 0.54-1
changelog:
  - Make sure attributes with no values can never appear
  - Fix crash in the "files" module when an attribute is missing
  - Use hidden visibility for internal functions, remove them from
    libuser/user_private.h; this changes module interface ABI


author: Miloslav Trmac <mitr@redhat.com> - 0.53.8-1
changelog:
  - Permit "portable" user and group names as defined by SUSv3, plus trailing $
    (#159452)
  - Don't build static libraries


author: Miloslav Trmac <mitr@redhat.com> - 0.53.5-1
changelog:
  - Ignore nss_compat lines in the "files" module (#154651)
  - Autodetect Python version (#154096)
  - Add BuildRequires: libselinux-devel, s/BuildPrereq/BuildRequires/


author: Miloslav Trmac <mitr@redhat.com> - 0.53.3-2
changelog:
  - Add Requires: glib2-devel to libuser-devel (#152501)
  - Run ldconfig using %post{,un} -p to let RPM play tricks


author: Miloslav Trmac <mitr@redhat.com> - 0.53.3-1
changelog:
  - Don't silently ignore some I/O errors
  - Don't include a Cyrus SASL v1 header file when libldap links to v2 (#150046)
  - Rebuild with gcc 4


author: Miloslav Trmac <mitr@redhat.com> - 0.53.2-1
changelog:
  - Important bug fixes in lchage, lgroupmod, lnewusers and lusermod
  - Minor bug fixes in lpasswd and luseradd
  - Add man pages for the utilities (#61673)


author: Miloslav Trmac <mitr@redhat.com> - 0.53-1
changelog:
  - Support UID and GID values larger than LONG_MAX (#124967)
  - Fix updating of groups after user renaming in lusermod
  - Allow setting a shadow password even if the current shadow password is
    invalid (#131180)
  - Add lu_{user,group}_unlock_nonempty (#86414); module interface ABI has 
    changed
  - Miscellaneous bug and memory leak fixes


author: Miloslav Trmac <mitr@redhat.com> - 0.52.6-1
changelog:
  - Make error reporting more consistent, more verbose and always on stderr
    (partly #133861, original patch by Pawel Salek)
  - Mark strings previously blocked by string freeze for translation


author: Miloslav Trmac <mitr@redhat.com> - 0.52.5-1
changelog:
  - Fix home directory renaming in ADMIN.modifyUser (#135280)
  - Further Python reference counting fixes


author: Miloslav Trmac <mitr@redhat.com> - 0.52.2-1
changelog:
  - Allow LDAP connection using ldaps, custom ports or without TLS (original
    patch from Pawel Salek).


author: Miloslav Trmac <mitr@redhat.com> - 0.51.12-1
changelog:
  - Don't claim success and exception at the same time (#133479)
  - LDAP fixes, second round
  - Various other bugfixes


author: Miloslav Trmac <mitr@redhat.com> - 0.51.11-1
changelog:
  - Allow documented optional arguments in Python
    ADMIN.{addUser,modifyUser,deleteUser} (#119812)
  - Add man pages for lchfn and lchsh
  - LDAP fixes, first round
  - Avoid file conflict on multilib systems
  - Call ldconfig correctly


author: Miloslav Trmac <mitr@redhat.com> - 0.51.10-1
changelog:
  - Don't attempt to lookup using original entity name after entity
    modification (rename in particular) (#78376, #121252)
  - Fix copying of symlinks from /etc/skel (#87572, original patch from gLaNDix)
  - Make --enable-quota work, and fix the quota code to at least compile (#89114)
  - Fix several bugs (#120168, original patch from Steve Grubb)
  - Don't hardcode python version in spec file (#130952, from Robert Scheck)
  - Properly integrate the SELinux patch, it should actually be used now, even
    though it was "enabled" since 0.51.7-6


author: Miloslav Trmac <mitr@redhat.com> - 0.51.8-1
changelog:
  - Update to build with latest autotools and gtk-doc
  - Update ALL_LINGUAS and POTFILES.in
  - Rebuild to depend on newer openldap


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.7-1
changelog:
  - ldap: set error codes correctly when we encounter failures initializing
  - don't double-close modules which fail initialization
  - ldap: don't set an error in cases where one is already set


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.6-1
changelog:
  - use a crypt salt consistent with the defaults/crypt_style setting when
    setting new passwords (#79337)


author: Nalin Dahyabhai <nalin@redhat.com> 0.51.5-1
changelog:
  - expose lu_get_first_unused_id() as a package-private function
  - provide libuser.ADMIN.getFirstUnusedUid and libuser.ADMIN.getFirstUnusedGid
    in python


author: Nalin Dahyabhai <nalin@redhat.com> 0.51-1
changelog:
  - files: ignore blank lines in files
  - libuser: disallow creation of accounts with names containing whitespace,
    control characters, or non-ASCII characters


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.101-1
changelog:
  - fix python bindings of enumerateFull functions
  - adjust prompter wrapping to not error out on successful returns


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.100-1
changelog:
  - be more careful about printing error messages
  - fix refreshing after adding of accounts
  - ldap: try to use a search to convert names to DNs, and only fall back to
    guessing if it turns up nothing
  - files: fix an off-by-one in removal of entries


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.98-1
changelog:
  - automatically refresh entities after add, modify, setpass, removepass,
    lock, and unlock operations
  - remove debug spewage when creating and removing mail spools
  - files: fix saving of multi-valued attributes
  - rename MEMBERUID attribute for groups to MEMBERNAME


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.97-1
changelog:
  - files: fix bug in removals
  - ldap: revert attempts at being smart at startup time, because it makes UIs
    very messy (up the three whole dialogs just to start the ldap stuff!)


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.93-1
changelog:
  - move shadow initialization for groups to the proper callback
  - rework locking in the files module to not require that files be writable


author: Nalin Dahyabhai <nalin@redhat.com> 0.49.91-1
changelog:
  - ldap: finish port to new API
  - sasl: finish port to new API (needs test)
  - libuser: don't commit object changes before passing data to service
    functions which might need differing data sets to figure out what to
    change (for example, ldap)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - renamed the python module
  - revamped internals to use gobject's gvalues and gvaluearrays instead of
    glists of cached strings
  - add enumeration-with-data functions to the C library


author: Nalin Dahyabhai <nalin@redhat.com> 0.32-1
changelog:
  - link the python module against libpam
  - attempt to import the python modules at build-time to verify dependencies


author: Nalin Dahyabhai <nalin@redhat.com> 0.30-1
changelog:
  - quotaq: fix argument order when reading quota information
  - user_quota: set quota grace periods correctly
  - luseradd: never create home directories for system accounts


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - HUP nscd on modifications
  - userutil.c: mmap files we're reading for probable speed gain
  - userutil.c: be conservative with the amount of random data we read
  - docs fixes


author: Nalin Dahyabhai <nalin@redhat.com> 0.28-1
changelog:
  - apps: print usage on errors
  - lnewusers.c: initialize groups as groups, not users
  - lnewusers.c: set passwords for new accounts
  - luseradd.c: accept group names in addition to IDs for the -g flag
  - luseradd.c: allow the primary GID to be a preexisting group


author: Nalin Dahyabhai <nalin@redhat.com> 0.27-1
changelog:
  - add ko translation files
  - files.c: fix a heap corruption bug in lock/unlock (#51750)
  - files.c: close a memory leak in reading of files


author: Nalin Dahyabhai <nalin@redhat.com> 0.26-1
changelog:
  - lusermod: change user name in groups the user is a member of during renames
  - lgroupmod: change primary GID for users who are in the group during renumbers
  - ldap.c: handle new attributes more gracefully if possible
  - add ru translation files


author: Nalin Dahyabhai <nalin@redhat.com> 0.25.1-1
changelog:
  - rename the quota source files to match the library, which clears up a
    file conflict with older quota packages
  - add ja translation files


author: Nalin Dahyabhai <nalin@redhat.com> 0.25-1
changelog:
  - close up some memory leaks
  - add the ability to include resident versions of modules in the library


author: Nalin Dahyabhai <nalin@redhat.com> 0.24-3
changelog:
  - stop leaking descriptors in the files module
  - speed up user creation by reordering some checks for IDs being in use
  - update the shadowLastChanged attribute when we set a password
  - adjust usage of getXXXXX_r where needed
  - fix assorted bugs in python binding which break prompting


author: Nalin Dahyabhai <nalin@redhat.com> 0.23-1
changelog:
  - install sv translation
  - make lpasswd prompt for passwords when none are given on the command line
  - make sure all user-visible strings are marked for translation
  - clean up some user-visible strings
  - require PAM authentication in lchsh, lchfn, and lpasswd for non-networked modules


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - print uids and gids of users and names in lid app
  - fix tree traversal in users_enumerate_by_group and groups_enumerate_by_users
  - implement enumerate_by_group and enumerate_by_user in ldap module
  - fix id-based lookups in the ldap module
  - implement islocked() method in ldap module
  - implement setpass() method in ldap module
  - add lchfn and lchsh apps
  - add %d substitution to libuser.conf


author: Nalin Dahyabhai <nalin@redhat.com> 0.21-1
changelog:
  - finish adding a sasldb module which manipulates a sasldb file
  - add users_enumerate_by_group and groups_enumerate_by_users


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - luserdel: remove the user's primary group if it has the same name as
    the user and has no members configured (-G disables)
  - fixup some configure stuff to make libuser.conf get generated correctly
    even when execprefix isn't specified


author: Nalin Dahyabhai <nalin@redhat.com> 0.20-1
changelog:
  - only call the auth module when setting passwords (oops)
  - use GTrees instead of GHashTables for most internal tables
  - files: complain properly about unset attributes
  - files: group passwords are single-valued, not multiple-valued
  - add lpasswd app, make sure all apps start up popt with the right names


author: Nalin Dahyabhai <nalin@redhat.com> 0.18-1
changelog:
  - actually make the new optional arguments optional
  - fix lu_error_new() to actually report errors right
  - fix part of the python bindings
  - include tools in the binary package again
  - fixup modules so that password-changing works right again
  - add a "key" field to prompt structures for use by apps which like to
    cache these things
  - add an optional "mvhomedir" argument to userModify (python)


author: Nalin Dahyabhai <nalin@redhat.com> 0.16.1-1
changelog:
  - finish home directory population
  - implement home directory moving
  - change entity get semantics in the python bindings to allow default values for .get()
  - add lu_ent_has(), and a python has_key() method to Entity types
  - don't include tools in the binary package
  - add translated strings


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - lib/user.c: catch and ignore errors when running stacks
  - lusermod: fix slightly bogus help messages
  - luseradd: when adding a user and group, use the gid of the group
    instead of the user's uid as the primary group
  - properly set the password field in user accounts created using
    auth-only auth modules (shadow needs "x" instead of "!!")
  - implement home directory removal, start on population


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix group password setting in the files module
  - setpass affects both auth and info, so run both stacks


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix errors due to uninitialized fields in the python bindings
  - add kwargs support to all python wrappers
  - add a mechanism for passing arguments to python callbacks


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't bail when writing empty fields to colon-delimited files
  - use permissions of the original file when making backup files instead of 0600


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish implementing is_locked methods in files/shadow module
  - finish cleanup of the python bindings
  - allow conditional builds of modules so that we can build without
    all of the prereqs for all of the modules


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - clean up quota bindings some more
  - finish most of the ldap bindings
  - fix a subtle bug in the files module that would show up when renaming accounts
  - fix mapping methods for entity structures in python


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - get bindings for prompts to work correctly
  - clean up some of the add/remove semantics (set source on add)
  - ldap: implement enumeration
  - samples/enum: fix the argument order


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add functions for enumerating users and groups, optionally per-module
  - lusermod.c: -s should specify the shell, not the home directory


author: Nalin Dahyabhai <nalin@redhat.com> 0.8
changelog:
  - add a "quiet" prompter
  - add --interactive flag to sample apps and default to using quiet prompter
  - ldap: attempt a "self" bind if other attempts fail
  - krb5: connect to the password-changing service if the user principal has
    the NULL instance


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - the great adding-of-the-copyright-statements
  - take more care when creating backup files in the files module


author: Nalin Dahyabhai <nalin@redhat.com> 0.7
changelog:
  - add openldap-devel as a buildprereq
  - krb5: use a continuous connection
  - krb5: add "realm" config directive
  - ldap: use a continuous connection
  - ldap: add "server", "basedn", "binddn", "user", "authuser" config directives
  - ldap: actually finish the account deletion function
  - ldap: don't send cleartext passwords to the directory
  - fix naming attribute for users (should be uid, not gid)
  - refine the search-by-id,convert-to-name,search-by-name logic
  - fix handling of defaults when the config file is read in but contains no value
  - implement an LDAP information store
  - try to clean up module naming with libtool
  - luseradd: pass plaintext passwords along
  - luseradd: use symbolic attribute names instead of hard-coded
  - lusermod: pass plaintext passwords along
  - lgroupadd: pass plaintext passwords along
  - lgroupmod: pass plaintext passwords along
  - add libuser as a dependency of libuser-devel


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.27
changelog:
  - xen/pt: unknown PCI config space fields should be read-only
    ... by default. Add a per-device "permissive" mode similar to pciback's
    to allow restoring previous behavior (and hence break security again,
    i.e. should be used only for trusted guests).
    This is part of XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>)
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164488] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.25
changelog:
  - xen/pt: add a few PCI config space field descriptions
    Since the next patch will turn all not explicitly described fields
    read-only by default, those fields that have guest writable bits need
    to be given explicit descriptors.
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164488] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.24
changelog:
  - xen/pt: add a few PCI config space field descriptions
    Since the next patch will turn all not explicitly described fields
    read-only by default, those fields that have guest writable bits need
    to be given explicit descriptors.
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    ---
    Notes:
    - blindly allowing all VPD reads may still be a problem (out of bounds
    addresses aren't allowed, but the spec doesn't say what the effect
    would be) ==> also an issue in pciback?
    - Vendor Specific cap regs aren't in the table (will become r/o by
    default with this change)
    - many PCIe cap regs aren't in the table (will again become r/o)
    - same for PM cap regs at offsets 6 and 7
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164488] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.23
changelog:
  - xen/pt: mark reserved bits in PCI config space fields
    The adjustments are solely to make the subsequent patches work right
    (and hence make the patch set consistent), namely if permissive mode
    (introduced by the last patch) gets used (as both reserved registers
    and reserved fields must be similarly protected from guest access in
    default mode, but the guest should be allowed access to them in
    permissive mode).
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164488] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.21
changelog:
  - xen/pt: mark all PCIe capability bits read-only
    xen_pt_emu_reg_pcie[]'s PCI_EXP_DEVCAP needs to cover all bits as read-
    only to avoid unintended write-back (just a precaution, the field ought
    to be read-only in hardware).
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-By: Todd Vierling <todd.vierling@oracle.com> [bug 21164488] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.20
changelog:
  - xen/pt: mark all PCIe capability bits read-only
    xen_pt_emu_reg_pcie[]'s PCI_EXP_DEVCAP needs to cover all bits as read-
    only to avoid unintended write-back (just a precaution, the field ought
    to be read-only in hardware).
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164488] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.19
changelog:
  - xen/pt: split out calculation of throughable mask in PCI config space handling
    This is just to avoid having to adjust that calculation later in
    multiple places.
    Note that including ->ro_mask in get_throughable_mask()'s calculation
    is only an apparent (i.e. benign) behavioral change: For r/o fields it
    doesn't matter > whether they get passed through - either the same flag
    is also set in emu_mask (then there's no change at all) or the field is
    r/o in hardware (and hence a write won't change it anyway).
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164488] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.18
changelog:
  - xen/MSI: don't open-code pass-through of enable bit modifications
    Without this the actual XSA-131 fix would cause the enable bit to not
    get set anymore (due to the write back getting suppressed there based
    on the OR of emu_mask, ro_mask, and res_mask).
    Note that the fiddling with the enable bit shouldn't really be done by
    qemu, but making this work right (via libxc and the hypervisor) will
    require more extensive changes, which can be postponed until after the
    security issue got addressed.
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-By: Todd Vierling <todd.vierling@oracle.com> [bug 21164488] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.17
changelog:
  - xen/MSI-X: disable logging by default
    ... to avoid allowing the guest to cause the control domain's disk to
    fill.
    This is XSA-130.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21159377] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.16
changelog:
  - xen: don't allow guest to control MSI mask register
    It's being used by the hypervisor. For now simply mimic a device not
    capable of masking, and fully emulate any accesses a guest may issue
    nevertheless as simple reads/writes without side effects.
    This is XSA-129.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21158638] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.15
changelog:
  - xen: properly gate host writes of modified PCI CFG contents
    The old logic didn't work as intended when an access spanned multiple
    fields (for example a 32-bit access to the location of the MSI Message
    Data field with the high 16 bits not being covered by any known field).
    Remove it and derive which fields not to write to from the accessed
    fields' emulation masks: When they're all ones, there's no point in
    doing any host write.
    This fixes a secondary issue at once: We obviously shouldn't make any
    host write attempt when already the host read failed.
    This is XSA-128.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21157363] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.13
changelog:
  - xen/pt: correctly handle PM status bit
    xen_pt_pmcsr_reg_write() needs an adjustment to deal with the RW1C
    nature of the not passed through bit 15 (PCI_PM_CTRL_PME_STATUS).
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164488] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.11
changelog:
  - xen/pt: consolidate PM capability emu_mask
    There's no point in xen_pt_pmcsr_reg_{read,write}() each ORing
    PCI_PM_CTRL_STATE_MASK and PCI_PM_CTRL_NO_SOFT_RESET into a local
    emu_mask variable - we can have the same effect by setting the field
    descriptor's emu_mask member suitably right away. Note that
    xen_pt_pmcsr_reg_write() is being retained in order to allow later
    patches to be less intrusive.
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-By: Todd Vierling <todd.vierling@oracle.com> [bug 21164488] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.9
changelog:
  - xen/MSI: don't open-code pass-through of enable bit modifications
    Without this the actual XSA-131 fix would cause the enable bit to not
    get set anymore (due to the write back getting suppressed there based
    on the OR of emu_mask, ro_mask, and res_mask).
    Note that the fiddling with the enable bit shouldn't really be done by
    qemu, but making this work right (via libxc and the hypervisor) will
    require more extensive changes, which can be postponed until after the
    security issue got addressed.
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164488] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.8
changelog:
  - xen/MSI-X: limit error messages resulting from bad guest behavior
    ... to avoid allowing the guest to cause the control domain's disk to
    fill.
    The first message in pci_msix_write() can simply be deleted, as this
    is indeed bad guest behavior, but such out of bounds writes don't
    really need to be logged.
    The second one is more problematic, as there guest behavior may only
    appear to be wrong: For one, the old logic didn't take the mask-all bit
    into account. And then this shouldn't depend on host device state (i.e.
    the host may have masked the entry without the guest having done so).
    Plus these writes shouldn't be dropped even when an entry is unmasked.
    Instead, if they can't be made take effect right away, they should take
    effect on the next unmasking or enabling operation - the specification
    explicitly describes such caching behavior. Until we can validly drop
    the message (implementing such caching/latching behavior), issue the
    message just once per MSI-X table entry.
    Note that the log message in pci_msix_read() similar to the one being
    removed here is not an issue: "addr" being of unsigned type, and the
    maximum size of the MSI-X table being 32k, entry_nr simply can't be
    negative and hence the conditonal guarding issuing of the message will
    never be true.
    This is XSA-130.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21159377] {CVE-2015-????}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.47.6
changelog:
  - xen: properly gate host writes of modified PCI CFG contents
    The old logic didn't work as intended when an access spanned multiple
    fields (for example a 32-bit access to the location of the MSI Message
    Data field with the high 16 bits not being covered by any known field).
    Remove it and derive which fields not to write to from the accessed
    fields' emulation masks: When they're all ones, there's no point in
    doing any host write.
    This fixes a secondary issue at once: We obviously shouldn't make any
    host write attempt when already the host read failed.
    This is XSA-128.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-By: Todd Vierling <todd.vierling@oracle.com> [bug 21157363] {CVE-2015-????}


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3-1
changelog:
  - enforce Solaris 11.1.* and LDoms Manager 3.1.*
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3-1
changelog:
  - SPARC - build fails if default pkg publisher is not ovm
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 3.3-1
changelog:
  - Bug 18264418 - UPGRADESERVER.PY SCRIPT DOES NOT CHECK MISSING DLM MODULE FOR SPARC SERVER
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Adnan Misherfi <adnan.misherfi@oracle.com> 3.3-6.290
changelog:
  - remove 'Obsoletes: openvswitch' and add 'Requires: openvswitch'
    for upgrade from 3.1.1 to 3.3.1 [bug 18154640]


author: Zhigang Wang <zhigang.x.wang@oracle.com> 3.3-6.282
changelog:
  - Remove the obsoletes
    kernel-uek < 3.8.13-16.2.2
    kernel-uek-firmware < 3.8.13-16.2.2 [bug 18161458]


author: Jingdong Lu <jingdong.lu@oracle.com> 3.3-6.237
changelog:
  - add packages to server iso [bug 17945724]
  - use python from OL instead of ovm fork [bug 17950918] 
  - use coreutils from OL instead of ovm fork [bug 17951276]
  - remove python-numeric from server iso [bug 17951332]
  - use grub from OL instead of ovm fork [bug 17951880]
  - remove udhcp from server iso [bug 17959422]


author: Tianyue Lan <tianyue.lan@oracle.com> 3.3-6.205
changelog:
  - provide ql2xxx-firmware [bug 17761192]
  - Obsolete kmod-openvswitch openvswitch due to openvswitch not ready for uek3


author: Zhigang Wang <zhigang.x.wang@oracle.com> 3.3-6.182
changelog:
  - obsolete osc-plugin-manager-devel < 1.2.9 [bug 17616512]
             anacron
             libvolume_id
             cryptsetup-luks < 1.2.0
             system-config-securitylevel-tui,
             pypxeboot, and
             rdac-mpp-tools


author: Tianyue Lan <tianyue.lan@oracle.com> 3.3-6.178
changelog:
  - Obsolete ovs-python-uuid, audit-libs-python < 2.2, libselinux-python < 2.0.94
    xen-devel < 4.3.0, ql2xxx-firmware [bug 17609297]


author: Kevin Lyons <kevin.x.lyons@oracle.com> 3.3-6.136
changelog:
  - Update for OVM rebase to OL6:
    Change el5_ovs_release to be el_ovs_release
    Change source. tarball to ovs-release-3.tgz
    Bump version of enterprise-linux-release to 6


author: Adnan Misherfi <adnan.misherfi@oracle.com> 3.2-5.201
changelog:
  - Load bnx2x driver with TPA disabled "options bnx2x disable_tpa=1" 
    to avoid driver problems when the port is used as an interface 
    to the bridge. [bug 15971208]


author: Zhigang Wang <zhigang.x.wang@oracle.com> 3.2-5.148
changelog:
  - Obsolete qlayer monitor packages [bug 14767772]
    python-zope-interface
    python-twisted-core
    monitor
    libyaml
    PyYAML


author: Zhigang Wang <zhigang.x.wang@oracle.com> 3.2-5.147
changelog:
  - Obsolete packages [bug 14767790]
    cyrus-sasl
    cyrus-sasl-md5
    dbus-python
    dnsmasq
    e4fsprogs-devel
    e4fsprogs-libs
    gnutls
    libdaemon


author: Alexandre Chartre <alexandre.chartre@oracle.com> 3.2-5.125
changelog:
  - Solaris build and package support
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Srinivas Maturi <srinivas.maturi@oracle.com>


author: Kevin Lyons <kevin.x.lyons@oracle.com> 3.1-1.72
changelog:
  - Add Obsoletes: kernel-ovs, Provides: kernel, and Requires: kernel-uek
    to allow yum and anaconda upgrades to work correctly without modifying
    kernel-uek package. [bug 13810743]


author: Kevin Lyons <kevin.x.lyons@oracle.com> 2.1-0.9
changelog:
  - Split out ovs_release and el5_ovs_release
  - Updated xen version to 3.1.3-0.0.4
  - Removed xen changeset


author: Kevin Lyons <kevin.x.lyons@oracle.com> 2.1-0.8
changelog:
  - Reverted back to version 2.1 to aviod problems with ULN
  - Updated xen version to 3.1.3-0.0.3
  - Updated xen changeset to 15642


author: Keshav Sharma <keshav.sharma@oracle.com> 2.0-0.5
changelog:
  - split into 2 binary rpms ovs-release and enterprise-linux-ovs
  - updated xen info
  - obsolete enterprise release
  - Updated Product name & version


author: Ray Strode <rstrode@redhat.com> - 0.3.0-2
changelog:
  - Grab X server display device from XFree86_VT root window property,
    if X server doesn't have a controlling terminal.


author: David Zeuthen <davidz@redhat.com> - 0.2.1-1
changelog:
  - Update to upstream release 0.2.1
  - Drop the patch to daemonize properly as that was merged upstream


author: David Zeuthen <davidz@redhat.com> - 0.2.1-0.git20070402
changelog:
  - Update to git snapshot to get a lot of bug fixes
  - Use libX11 rather than gtk2 to verify X11 sessions; update BR and R
  - Split X11-using bits into a new subpackage ConsoleKit-x11 (#233982)
  - Use correct location for PAM module on 64-bit (#234545)
  - Build developer documentation and put them in ConsoleKit-docs


author: David Zeuthen <davidz@redhat.com> - 0.1.3-0.git20070301
changelog:
  - Update to git snapshot
  - Drop all patches as they are committed upstream
  - New tool ck-list-sessions
  - New -libs subpackage with run-time libraries and a PAM module
  - New -devel subpackage with headers


author: David Zeuthen <davidz@redhat.com> - 0.1.0-5.el6
changelog:
  - Start ConsoleKit a bit earlier so it starts before HAL (98 -> 90)
  - Minimize stack usage so VIRT size is more reasonable (mclasen)
  - Make session inactive when switching to non-session (davidz)


author: Anton Arapov <anton@redhat.com> - 1:1.17-10
changelog:
  - Fix buffer overflow
  - Resolves: rhbz#768803
  - Update to microcode-20111110.dat
  - Resolves: rhbz#736266


author: Kyle McMartin <kyle@redhat.com> - 1:1.17-2
changelog:
  - Don't use a CVS release for RHEL, otherwise it'll always be a branch
    and irritating.
  - Fix syntax error in microcode_ctl.init.
  - Resolves: rhbz#552246.


author: Dave Jones <davej@redhat.com>
changelog:
  - Shorten sleep time during init.
    This really needs to be replaced with proper udev hooks, but this is
    a quick interim fix.


author: Jarod Wilson <jwilson@redhat.com>
changelog:
  - Spec cleanup and macro standardization.
  - Update license
  - Update microcode data file to 20080131 revision.


author: Dave Jones <davej@redhat.com>
changelog:
  - Drop the node creation/deletion change from previous release.
    It'll cause grief with selinux, and was a hack to get around
    a udev shortcoming that should be fixed properly.


author: Dave Jones <davej@redhat.com>
changelog:
  - Create/remove the /dev/cpu/microcode dev node as needed.
  - Use correct path again for the microcode.dat.
  - Remove some no longer needed tests in the init script.


author: Dave Jones <davej@redhat.com>
changelog:
  - Only enable microcode_ctl service if the CPU is capable.
  - Prevent microcode_ctl getting restarted multiple times on initlevel change (#141581)
  - Make restart/reload work properly
  - Do nothing if not started by root.


author: Elio Maldonado <emaldona@redhat.com> - 4.9.5-2
changelog:
  - Update to NSPR_4_9_5_RTM
  - Resolves: rhbz#927186 - Rebase to nspr-4.9.5
  - Add upstream URL for an existing patch per packaging guidelines


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.1-16.20090824bzr68
changelog:
  - Rebase to new upstream snapshot
  - Patches merged upstream
  - Fixes deprecation warnings on py2.6/py3.0
  - Remove py2.3 patch -- only needed for EPEL-4


author: Toshio Kuratomi <toshio@tiki-lounge.com> - 0.1-3
changelog:
  - Add a patch to work under Python 2.3.
  - Stop shipping the tests as they are useless to the end user.


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.20.2.el6uek]
changelog:
  - x86: Add another set of MSR accessor functions (Borislav Petkov)  [Orabug: 27444923]  {CVE-2017-5753} 
  - userns: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - udf: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - fs: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - qla2xxx: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - p54: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - carl9170: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - uvcvideo: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - locking/barriers: introduce new observable speculation barrier (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/cpu/AMD: Make the LFENCE instruction serialized (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/rsb: add comment specifying why we skip STUFF_RSB (Ankur Arora)  [Orabug: 27451658]  {CVE-2017-5715} 
  - x86/rsb: make STUFF_RSB jmp labels more robust (Ankur Arora)  [Orabug: 27451658]  {CVE-2017-5715} 
  - x86/spec: Also print IBRS if IBPB is disabled. (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spectre: Drop the warning about ibrs being obsolete. (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - Add set_ibrs_disabled and set_ibpb_disabled (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec: Don't print the Missing arguments for option spectre_v2 (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/boot: Add early cmdline parsing for options with arguments (Tom Lendacky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86, boot: Carve out early cmdline parsing function (Borislav Petkov)  [Orabug: 27376697]  
  - x86: Add command-line options 'spectre_v2' and 'nospectre_v2' (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Fix kABI build breakage (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/mm: Only set IBPB when the new thread cannot ptrace current thread (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/mm: Set IBPB upon context switch (Brian Maly)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Display correct settings for the SPECTRE_V[12] bug (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/cpu: Implement CPU vulnerabilites sysfs functions (Thomas Gleixner)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/IBRS/IBPB: Set sysctl_ibrs/ibpb_enabled properly (Boris Ostrovsky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec_ctrl: Disable if running as Xen PV guest (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - sysfs/cpu: Add vulnerability folder (Thomas Gleixner)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5754} 
  - x86, cpu: Expand cpufeature facility to include cpu bugs (Borislav Petkov)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/cpufeatures: Add X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5754} 
  - x86/entry: STUFF_RSB only after switching to kernel CR3 (Ankur Arora)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/IBRS: Make sure we restore MSR_IA32_SPEC_CTRL to a valid value (Boris Ostrovsky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Use IBRS for firmware update path (David Woodhouse)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/microcode: Recheck IBRS features on microcode reload (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/idle: Disable IBRS entering idle and enable it on wakeup (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/enter: Use IBRS on syscall and interrupts (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/enter: MACROS to set/clear IBRS (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/feature: Detect the x86 IBRS feature to control Speculation (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/pti/efi: broken conversion from efi to kernel page table (Pavel Tatashin)  [Orabug: 27333764]  {CVE-2017-5754} 
  - PTI: unbreak EFI old_memmap (Jiri Kosina)  [Orabug: 27333764] [Orabug: 27333760]  {CVE-2017-5754} {CVE-2017-5754} 
  - kaiser: Set _PAGE_NX only if supported (Lepton Wu)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: rename X86_FEATURE_KAISER to X86_FEATURE_PTI (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - KPTI: Rename to PAGE_TABLE_ISOLATION (Kees Cook)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Check boottime cmdline params (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: x86: Fix NMI handling (Jiri Kosina)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: move paravirt clock vsyscall mapping out of kaiser_init (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: disable if xen PARAVIRT (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Reenable PARAVIRT (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: asm/tlbflush.h handle noPGE at lower level (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: add "nokaiser" boot option, using ALTERNATIVE (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/alternatives: add asm ALTERNATIVE macro (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: alloc_ldt_struct() use get_zeroed_page() (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86: kvmclock: Disable use from vDSO if KPTI is enabled (Ben Hutchings)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: Fix build with CONFIG_FUNCTION_GRAPH_TRACER (Kees Cook)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm/kaiser: re-enable vsyscalls (Andrea Arcangeli)  [Orabug: 27333764]  {CVE-2017-5754} 
  - KAISER: Kernel Address Isolation (Richard Fellner)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kprobes: Prohibit probing on .entry.text code (Masami Hiramatsu)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm/64: Fix reboot interaction with CR4.PCIDE (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Enable CR4.PCIDE on supported systems (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add the 'nopcid' boot option to turn off PCID (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Disable PCID on 32-bit kernels (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Fix flush_tlb_page() on Xen (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Disable preemption during CR3 read+write (Sebastian Andrzej Siewior)  [Orabug: 27333764]  {CVE-2017-5754} 
  - sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm, sched/core: Turn off IRQs in switch_mm() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm, sched/core: Uninline switch_mm() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - sched/core: Add switch_mm_irqs_off() and use it in the scheduler (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - mm/mmu_context, sched/core: Fix mmu_context.h assumption (Ingo Molnar)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: If INVPCID is available, use it to flush global mappings (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Fix INVPCID asm constraint (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add INVPCID helpers (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86: Clean up cr4 manipulation (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/paravirt: Dont patch flush_tlb_single (Thomas Gleixner)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/ldt: Make modify_ldt synchronous (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} {CVE-2015-5157}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.20.1.el6uek]
changelog:
  - tty: Fix race in pty_write() leading to NULL deref (Todd Vierling)  [Orabug: 25392692]  
  - ocfs2/dlm: ignore cleaning the migration mle that is inuse (xuejiufei)  [Orabug: 26479780]  
  - KEYS: fix dereferencing NULL payload with nonzero length (Eric Biggers)  [Orabug: 26592025]  
  - oracleasm: Copy the integrity descriptor (Martin K. Petersen)  [Orabug: 26649818]  
  - mm: Tighten x86 /dev/mem with zeroing reads (Kees Cook)  [Orabug: 26675925]  {CVE-2017-7889} 
  - xscore: add dma address check (Zhu Yanjun)  [Orabug: 27058468]  
  - more bio_map_user_iov() leak fixes (Al Viro)  [Orabug: 27069042]  {CVE-2017-12190} 
  - fix unbalanced page refcounting in bio_map_user_iov (Vitaly Mayatskikh)  [Orabug: 27069042]  {CVE-2017-12190} 
  - nvme: Drop nvmeq->q_lock before dma_pool_alloc(), so as to prevent hard lockups (Aruna Ramakrishna)  [Orabug: 25409587]  
  - nvme: Handle PM1725 HIL reset (Martin K. Petersen)  [Orabug: 26277600]  
  - char: lp: fix possible integer overflow in lp_setup() (Willy Tarreau)  [Orabug: 26403940]  {CVE-2017-1000363} 
  - ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race between read and ioctl (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: fix NULL pointer dereference in read()/ioctl() race (Vegard Nossum)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix negative queue usage by racy accesses (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race at concurrent reads (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race among timer ioctls (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ipv6/dccp: do not inherit ipv6_mc_list from parent (WANG Cong)  [Orabug: 26404005]  {CVE-2017-9077} 
  - ocfs2: fix deadlock issue when taking inode lock at vfs entry points (Eric Ren)  [Orabug: 26427126]  
  - ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock (Eric Ren)  [Orabug: 26427126]  
  - ping: implement proper locking (Eric Dumazet)  [Orabug: 26540286]  {CVE-2017-2671} 
  - aio: mark AIO pseudo-fs noexec (Jann Horn)  [Orabug: 26643598]  {CVE-2016-10044} 
  - vfs: Commit to never having exectuables on proc and sysfs. (Eric W. Biederman)  [Orabug: 26643598]  {CVE-2016-10044} 
  - vfs, writeback: replace FS_CGROUP_WRITEBACK with SB_I_CGROUPWB (Tejun Heo)  [Orabug: 26643598]  {CVE-2016-10044} 
  - x86/acpi: Prevent out of bound access caused by broken ACPI tables (Seunghun Han)  [Orabug: 26643645]  {CVE-2017-11473} 
  - sctp: do not inherit ipv6_{mc|ac|fl}_list from parent (Eric Dumazet)  [Orabug: 26650883]  {CVE-2017-9075} 
  - [media] saa7164: fix double fetch PCIe access condition (Steven Toth)  [Orabug: 26675142]  {CVE-2017-8831} 
  - [media] saa7164: fix sparse warnings (Hans Verkuil)  [Orabug: 26675142]  {CVE-2017-8831} 
  - fs: __generic_file_splice_read retry lookup on AOP_TRUNCATED_PAGE (Abhi Das)  [Orabug: 26797306]  
  - timerfd: Protect the might cancel mechanism proper (Thomas Gleixner)  [Orabug: 26899787]  {CVE-2017-10661} 
  - scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly (Xin Long)  [Orabug: 26988627]  {CVE-2017-14489} 
  - mqueue: fix a use-after-free in sys_mq_notify() (Cong Wang)  [Orabug: 26643556]  {CVE-2017-11176} 
  - ipv6: avoid overflow of offset in ip6_find_1stfragopt (Sabrina Dubroca)  [Orabug: 27011273]  {CVE-2017-7542} 
  - packet: fix tp_reserve race in packet_set_ring (Willem de Bruijn)  [Orabug: 27002450]  {CVE-2017-1000111} 
  - mlx4_core: calculate log_num_mtt based on total system memory (Wei Lin Guay)  [Orabug: 26883934]  
  - xen/x86: Add interface for querying amount of host memory (Boris Ostrovsky)  [Orabug: 26883934]  
  - Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri)  [Orabug: 26796364]  {CVE-2017-1000251} 
  - xen: fix bio vec merging (Roger Pau Monne)  [Orabug: 26645550]  {CVE-2017-12134} 
  - fs/exec.c: account for argv/envp pointers (Kees Cook)  [Orabug: 26638921]  {CVE-2017-1000365} {CVE-2017-1000365} 
  - l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() (Guillaume Nault)  [Orabug: 26586047]  {CVE-2016-10200} 
  - xfs: fix two memory leaks in xfs_attr_list.c error paths (Mateusz Guzik)  [Orabug: 26586022]  {CVE-2016-9685} 
  - KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings (David Howells)  [Orabug: 26585994]  {CVE-2016-9604} 
  - ipv6: fix out of bound writes in __ip6_append_data() (Eric Dumazet)  [Orabug: 26578198]  {CVE-2017-9242} 
  - posix_acl: Clear SGID bit when setting file permissions (Jan Kara)  [Orabug: 25507344]  {CVE-2016-7097} {CVE-2016-7097} 
  - nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields)  [Orabug: 26366022]  {CVE-2017-7645}


author: Jacob Wang <jacob.wang@oracle.com> 004-356.0.1.el6
changelog:
  - add nvme kernel module to list for initramfs. [orabug 19476860] (Dan Duval)
  - do not strip modules with signatures. [orabug 17458249] (Jerry Snitselaar)
  - scsi_wait module removed in 3.8. Mute errors. [orabug 16977193] (Maxim Uvarov)
  - find firmware in /lib/modules/firmware/`uname -r` first
    and /lib/modules/firmware second. [orabug 13351090] (Maxim Uvarov)
  - Fix btrfs discovery [orabug 13388545]


author: Harald Hoyer <harald@redhat.com> 004-356
changelog:
  - fixed support for multiple fcoe devices
  Resolves: rhbz#1022766
  - fixed iscsiroot with iscsi_firmware boot
  Resolves: rhbz#1126346

  - find firmware in /lib/modules/firmware/`uname -r` first
    and /lib/modules/firmware second. [orabug 13351090] (Maxim Uvarov)
  - Fix btrfs discovery [orabug 13388545]


author: Harald Hoyer <harald@redhat.com> 004-347
changelog:
  - backport of the rootfallback= kernel cmdline option
  Resolves: rhbz#737687
  - call iscsistart regardless of network failures
  Resolves: rhbz#1099603
  - set the firmware loading timeout to 600
  Related: rhbz#1077186
  - add install_items to dracut.conf man page
  Resolves: rhbz#1041484
  - pickup nvme driver
  Resolves: rhbz#1041484
  - create  /dev/btrfs-control
  Resolves: rhbz#1070676
  - create all hook directories
  Resolves: rhbz#1051448


author: Harald Hoyer <harald@redhat.com> 004-334
changelog:
  - fcoe: add --link-retry=100 to fipvlan call
  Resolves: rhbz#1012316
  - ldd: redirect error to /dev/null
  - do not turn off biosdevname, if not given on kernel cmdline
  Resolves: rhbz#1011508
  - network: fixed ibft parsing
  Resolves: rhbz#1011508


author: Harald Hoyer <harald@redhat.com> 004-327
changelog:
  - fixed crypt: add support for keyfiles in the initramfs
  Resolves: rhbz#886194
  - fixed booting with iSCSI and without network config
  Resolves: rhbz#910605


author: Harald Hoyer <harald@redhat.com> 004-322
changelog:
  - fixed crypt: add support for keyfiles in the initramfs
  Resolves: rhbz#886194
  - fixed FIPS module checking
  Resolves: rhbz#947729


author: Harald Hoyer <harald@redhat.com> 004-316
changelog:
  - create the initramfs non-world readable
  - unset LD_LIBRARY_PATH and GREP_OPTIONS
  Resolves: rhbz#912299
  - add mkinitrd man page
  Resolves: rhbz#610462
  - add bonding
  Resolves: rhbz#851666
  - lvm: add "--yes" to lvchange
  Resolves: rhbz#720684
  - crypt: add support for keyfiles in the initramfs
  Resolves: rhbz#886194
  - start iscsi regardless of network, if requested
  Resolves: rhbz#813687
  - install multipath module only, when root is multipath in generic mode
  Resolves: rhbz#916144
  - fips: handle checksum checks for RHEV kernels
  Resolves: rhbz#947729
  - add xhci-hcd driver
  Resolves: rhbz#960729


author: Harald Hoyer <harald@redhat.com> 004-302
changelog:
  - add vlan support
  Resolves: rhbz#858187
  - fixed "LiveCD boot from iscsi targets" patch (Regression bug 863964)
  Resolves: rhbz#794751


author: Harald Hoyer <harald@redhat.com> 004-298
changelog:
  - fixed fcoe-up script for new Brocade switch
  Resolves: rhbz#813057
  - document "rd_retry" option in dracut(8) man page
  Resolves: rhbz#823507
  - convert all MAC parameter to lowercase
  Resolves: rhbz#835646
  - add "no_eject" option for "live_ram"
  Resolves: rhbz#843105


author: Harald Hoyer <harald@redhat.com> 004-273
changelog:
  - fixed option --omit-drivers
  Resolves: rhbz#722879
  - increase wait time for network interfaces to get UP to 10s
  Resolves: rhbz#794863


author: Harald Hoyer <harald@redhat.com> 004-271
changelog:
  - no vconfig requirement anymore
  Resolves: rhbz#714039
  - new option --omit-drivers
  Resolves: rhbz#722879
  - suppress udevadm settle output
  Resolves: rhbz#747840
  - extend lsinitrd to cope with xz images
  Resolves: rhbz#752005
  - respect primary console setting
  Resolves: rhbz#752073


author: Harald Hoyer <harald@redhat.com> 004-268
changelog:
  - fixed dracut manpage
  Resolves: rhbz#703164
  - fixed assembling of mdraid degraded arrays
  Resolves: rhbz#761584
  - fixed ifup to set broadcast address
  Resolves: rhbz#752584
  - fixed iscsiroot for multiple iscsi disks
  Resolves: rhbz#752066


author: Harald Hoyer <harald@redhat.com> 004-256
changelog:
  - increase timeout to wait for dhcp connections
  Resolves: rhbz#742920
  - check /tmp/net.$netif.override before sourcing it
  Resolves: rhbz#696980


author: Harald Hoyer <harald@redhat.com> 004-254
changelog:
  - fixed killproc()
  Resolves: rhbz#701864
  - hardcode modprobe of various iscsi offload drivers
  Resolves: rhbz#737134


author: Harald Hoyer <harald@redhat.com> 004-248
changelog:
  - 95fcoe/fcoe-up: load 8021q module before fipvlan
  Resolves: rhbz#736094
  - modprobe iscsi_boot_sysfs
  Resolves: rhbz#737134


author: Harald Hoyer <harald@redhat.com> 004-247
changelog:
  - add "-F" to selinux restorecon 
  Resolves: rhbz#741430
  - kill iscsiuio before switching root
  Resolves: rhbz#701864


author: Harald Hoyer <harald@redhat.com> 004-244
changelog:
  - add dracut-fips-aesni subpackage
  Resolves: rhbz#740487 
  - add /var/log in initramfs
  Resolves: rhbz#701864


author: Harald Hoyer <harald@redhat.com> 004-239
changelog:
  - fixed raid assembly with encrypted members
  Resolves: rhbz#737593
  - support bnx2fc for FCoE
  Resolves: rhbz#736094
  - fixed iscsi module loading
  Resolves: rhbz#737479


author: Harald Hoyer <harald@redhat.com> 004-234
changelog:
  - add broadcom iscsi offload support
  Resolves: rhbz#701864
  - fixed dm dracut module, to no require dmraid
  Resolves: rhbz#732686
  - fixed md raid assembly
  Resolves: rhbz#732967


author: Harald Hoyer <harald@redhat.com> 004-231
changelog:
  - add more kernel modules for iSCSI
  Resolves: rhbz#696980
  - chown /var/lib/rpcbind to rpc user and make it 770
  Resolves: rhbz#698160
  - remove "--no-degraded" from mdadm arguments
  Resolves: rhbz#698165
  - remove script error in mdraid_start.sh
  Resolves: rhbz#698215
  - parse and mount fstab.sys
  Resolves: rhbz#701309
  - add "dm-mod" and "dm-crypt" to fips modules
  Resolves: rhbz#707609
  - set LANG=C for chrooted selinux operations
  Resolves: rhbz#712254
  - use "--partial" to assemble degraded lvm mirrors
  Resolves: rhbz#723548
  - spec file patch cleanup to resemble git repo at
  http://git.kernel.org/?p=boot/dracut/dracut.git;a=shortlog;h=refs/heads/RHEL-6


author: Harald Hoyer <harald@redhat.com> 004-52
changelog:
  - fips: support /boot on LVM Volume for non-encrypted root
  - preunlink binaries in fips mode
  Resolves: rhbz#696131
  - Fixed FCoE booting with EDD information


author: Harald Hoyer <harald@redhat.com> 004-48
changelog:
  - removed rd.fips.skipkernel and move fipscheck to a later
    point of time, where root is already mounted
  Resolves: rhbz#692843


author: Harald Hoyer <harald@redhat.com> 004-44
changelog:
  - fixed die() and emergency mode for fips
  Resolves: rhbz#670925
  - added dracut-caps with caps module
  Resolves: rhbz#677340


author: Harald Hoyer <harald@redhat.com> 004-43
changelog:
  - fixed "fips=0"
  - fixed .hmac file installation for hostonly mode
  - hardcode to include libssl.so* in fips
  Resolves: rhbz#670925


author: Harald Hoyer <harald@redhat.com> 004-42
changelog:
  - fixed instmods() for fips module
  - do not load tcrypt with "noexit" parameter
  Resolves: rhbz#670925


author: Harald Hoyer <harald@redhat.com> 004-37
changelog:
  - add aes-xts in FIPS module
  Resolves: rhbz#670925
  - start multipathd with the new -B option
  Resolves: rhbz#674238


author: Harald Hoyer <harald@redhat.com> 004-34
changelog:
  - fix md rule generation
  Resolves: rhbz#595096
  - add 96insmodpost dracut module
  Resolves: rhbz#645648
  - add "--force" to mkinitrd
  Resolves: rhbz#610466
  - fix dmraid without mdadm
  Resolves: rhbz#626389
  - install the complete /etc/multipath directory
  Resolves: rhbz#630911
  - install multipath by default, but run only if wwids are present
  Resolves: rhbz#636668 rhbz#642083
  - removed vconfig dependency
  Resolves: rhbz#645799
  - install all md/dm modules
  Resolves: rhbz#626389
  - add fcoe=edd parameter
  Resolves: rhbz#634013
  - add ip=ibft parameter
  Resolves: rhbz#640979


author: Harald Hoyer <harald@redhat.com> 004-26
changelog:
  - wait for LVM and crypt devices to appear
  Resolves: rhbz#607699
  - add sleeps to fcoe-up and move it out of udev
  Resolves: rhbz#611976
  - fixed selinux return code handling
  Resolves: rhbz#615950


author: Harald Hoyer <harald@redhat.com> 004-25
changelog:
  - mount live images to /dev/.initramfs/live and do not
    umount it, so that cdrom_id works in the real root
    and /dev/live is pointing to the correct device
  Resolves: rhbz#605356


author: Harald Hoyer <harald@redhat.com> 004-23
changelog:
  - add vconfig requirement to dracut-network
  Resolves: rhbz#608015
  - fixed dhcp6 option for ip argument
  Resolves: rhbz#605283


author: Harald Hoyer <harald@redhat.com> 004-21
changelog:
  - Remove requirements, which are not really needed
  Resolves: rhbz#598509
  - fixed copy of network config to /dev/.initramfs/ (patch 146)
  Resolves: rhbz#594649
  - more password beauty (patch 142)
  Resolves: rhbz#561092
  - support multiple iSCSI disks (patch 143)
  Resolves: rbhz#580190
  - fixed selinux=0 (patch 130)
  Resolves: rhbz#593080
  - add support for booting LVM snapshot root volume (patch 145)
  Resolves: rbhz#602723
  - remove hardware field from BOOTIF= (patch 148)
  Resolves: rhbz#599593
  - add aes kernel modules and fix crypt handling (patch 137, patch 140 and patch 147)
  Resolves: rhbz#600170


author: Harald Hoyer <harald@redhat.com> 004-18
changelog:
  - fixed dracut manpages 
  Resolves: rhbz#589109
  - use ccw-init and ccw rules from s390utils
  Resolves: rhbz#533494
  - fixed fcoe
  Resolves: rhbz#486244
  - various other bugfixes seen in Fedora


author: Harald Hoyer <harald@redhat.com> 004-16
changelog:
  - fixed rpmlint errors (rhbz#570547)
  - removed firmware package from dracut-kernel (rhbz#572634)
  - add dcb support to dracut's FCoE support (rhbz#563794)
  - force install some modules in hostonly mode (rhbz#573094)
  - various other bugfixes
  - Resolves: rhbz#570547, rhbz#572634, rhbz#563794, rhbz#573094


author: Harald Hoyer <harald@redhat.com> 004-13
changelog:
  - fixed multipath scanning
  - fixed NFS4 (rhbz#564293)
  - add /etc/dracut.conf.d config dir
  - fixed selinux disabled state
  - fixed s390 cio scripts
  - fixed lib64 check (rhbz#562113)
  - Resolves: rhbz#564293, rhbz#562113


author: Harald Hoyer <harald@redhat.com> 004-12
changelog:
  - add IPv6 support
  - fixed multipath check
  - fixed selinux autorelabel case
  - Resolves: rhbz#546615 rhbz#553195


author: Harald Hoyer <harald@redhat.com> 002-26
changelog:
  - add WITH_SWITCH_ROOT make flag
  - add fips requirement conditional
  - add more device mapper modules (bug #539656)


author: Harald Hoyer <harald@redhat.com> 002-22
changelog:
  - add module 90multipath
  - add module 01fips
  - renamed module 95ccw to 95znet (bug #533833)
  - crypt: ignore devices in /etc/crypttab (root is not in there)
  - dasd: only install /etc/dasd.conf in hostonly mode (bug #533833)
  - zfcp: only install /etc/zfcp.conf in hostonly mode (bug #533833)
  - kernel-modules: add scsi_dh scsi_dh_rdac scsi_dh_emc (bug #527750)
  - dasd: use dasdconf.sh from s390utils (bug #533833)


author: Harald Hoyer <harald@redhat.com> 002-18
changelog:
  - renamed lvm/device-mapper udev rules according to upstream changes
  - fixed dracut search path issue


author: Harald Hoyer <harald@redhat.com> 002-13
changelog:
  - fixed init=<command> handling
  - kill loginit if "rdinitdebug" specified
  - run dmsquash-live-root after udev has settled (bug #527514)


author: Harald Hoyer <harald@redhat.com> 002-10
changelog:
  - do not destroy assembled raid arrays if mdadm.conf present
  - mount /dev/shm 
  - let udevd not resolve group and user names
  - preserve timestamps of tools on initramfs generation
  - generate symlinks for binaries correctly
  - moved network from udev to initqueue
  - mount nfs3 with nfsvers=3 option and retry with nfsvers=2
  - fixed nbd initqueue-finished
  - improved debug output: specifying "rdinitdebug" now logs
    to dmesg, console and /init.log
  - stop udev before killing it
  - add ghost /var/log/dracut.log
  - dmsquash: use info() and die() rather than echo
  - strip kernel modules which have no x bit set
  - redirect stdin, stdout, stderr all RW to /dev/console
    so the user can use "less" to view /init.log and dmesg


author: Warren Togami <wtogami@redaht.com> 002-5
changelog:
  - Revert back to -3, Add umount back to initrd
    This makes no functional difference to LiveCD.  See Bug #525319


author: Harald Hoyer <harald@redhat.com> 002-3
changelog:
  - bail out if selinux policy could not be loaded and 
    selinux=0 not specified on kernel command line 
    (bug #524113)
  - set finished criteria for dmsquash live images


author: Harald Hoyer <harald@redhat.com> 001-10
changelog:
  - add ifname= argument for persistent netdev names
  - new /initqueue-finished to check if the main loop can be left
  - copy mdadm.conf if --mdadmconf set or mdadmconf in dracut.conf


author: Harald Hoyer <harald@redhat.com> 001-8
changelog:
  - plymouth: use plymouth-populate-initrd
  - add add_drivers for dracut and dracut.conf
  - do not mount /proc and /selinux manually in selinux-load-policy


author: Harald Hoyer <harald@redhat.com> 001-1
changelog:
  - version 001
  - see http://dracut.git.sourceforge.net/git/gitweb.cgi?p=dracut/dracut;a=blob_plain;f=NEWS


author: Harald Hoyer <harald@redhat.com> 0.8-1
changelog:
  - version 0.8 
  - see http://dracut.git.sourceforge.net/git/gitweb.cgi?p=dracut/dracut;a=blob_plain;f=NEWS


author: Harald Hoyer <harald@redhat.com> 0.7-1
changelog:
  - version 0.7
  - see http://dracut.git.sourceforge.net/git/gitweb.cgi?p=dracut/dracut;a=blob_plain;f=NEWS


author: Harald Hoyer <harald@redhat.com> 0.6-1
changelog:
  - version 0.6
  - see http://dracut.git.sourceforge.net/git/gitweb.cgi?p=dracut/dracut;a=blob_plain;f=NEWS


author: Harald Hoyer <harald@redhat.com> 0.5-1
changelog:
  - version 0.5
  - see http://dracut.git.sourceforge.net/git/gitweb.cgi?p=dracut/dracut;a=blob_plain;f=NEWS


author: Harald Hoyer <harald@redhat.com> 0.4-1
changelog:
  - version 0.4
  - see http://dracut.git.sourceforge.net/git/gitweb.cgi?p=dracut/dracut;a=blob_plain;f=NEWS


author: Harald Hoyer <harald@redhat.com> 0.3-1
changelog:
  - version 0.3
  - see http://dracut.git.sourceforge.net/git/gitweb.cgi?p=dracut/dracut;a=blob_plain;f=NEWS


author: Dan Walsh <dwalsh@redhat.com> - 2.0.94-5.1
changelog:
  - Cleanup selinux_mnt on disabled machines
  Resolves: #706049
  - Make restorecon python binding use realpath
  Resolves: #698583


author: Dan Walsh <dwalsh@redhat.com> - 2.0.94-1
changelog:
  * Set errno=EINVAL for invalid contexts from Dan Walsh.
  	* pkgconfig fix to respect LIBDIR from Dan Walsh.
  Resolves: #593788


author: Dan Walsh <dwalsh@redhat.com> - 2.0.93-1
changelog:
  - Update to upstream 
  	* Show strerror for security_getenforce() by Colin Waters.
  	* Merged selabel database support by KaiGai Kohei.
  	* Modify netlink socket blocking code by KaiGai Kohei.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.92-1
changelog:
  - Update to upstream 
  	* Fix from Eric Paris to fix leak on non-selinux systems.
  	* regenerate swig wrappers
  	* pkgconfig fix to respect LIBDIR from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.91-1
changelog:
  - Update to upstream 
  	* Change the AVC to only audit the permissions specified by the
  	policy, excluding any permissions specified via dontaudit or not
  	specified via auditallow.
  	* Fix compilation of label_file.c with latest glibc headers.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.90-1
changelog:
  - Update to upstream 
  	* add/reformat man pages by Guido Trentalancia <guido@trentalancia.com>.
  	* Change exception.sh to be called with bash by Manoj Srivastava <srivasta@debian.org>


author: Dan Walsh <dwalsh@redhat.com> - 2.0.87-1
changelog:
  - Update to upstream 
  	* Add exception handling in libselinux from Dan Walsh. This uses a
  	  shell script called exception.sh to generate a swig interface file.
  	* make swigify
  	* Make matchpathcon print <<none>> if path not found in fcontext file.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.85-1
changelog:
  - Update to upstream 
  	* Reverted Tomas Mraz's fix for freeing thread local storage to avoid
  	pthread dependency.
  	* Removed fini_context_translations() altogether.
  	* Merged lazy init patch from Stephen Smalley based on original patch
  	by Steve Grubb.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.84-1
changelog:
  - Update to upstream 
  	* Add per-service seuser support from Dan Walsh.
  	* Let load_policy gracefully handle selinuxfs being mounted from Stephen Smalley.
  	* Check /proc/filesystems before /proc/mounts for selinuxfs from Eric
  	Paris.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.82-1
changelog:
  - Update to upstream 
  	* Fix improper use of thread local storage from Tomas Mraz <tmraz@redhat.com>.
  	* Label substitution support from Dan Walsh.
  	* Support for labeling virtual machine images from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.81-1
changelog:
  - Update to upstream 
  	* Trim / from the end of input paths to matchpathcon from Dan Walsh.
  	* Fix leak in process_line in label_file.c from Hiroshi Shinji.
  	* Move matchpathcon to /sbin, add matchpathcon to clean target from Dan Walsh.
  	* getdefaultcon to print just the correct match and add verbose option from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.80-1
changelog:
  - Update to upstream 
  	* deny_unknown wrapper function from KaiGai Kohei.
  	* security_compute_av_flags API from KaiGai Kohei.
  	* Netlink socket management and callbacks from KaiGai Kohei.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.79-1
changelog:
  - Update to upstream 
  	* Netlink socket handoff patch from Adam Jackson.
  	* AVC caching of compute_create results by Eric Paris.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.76-4
changelog:
  - Add new function getseuser which will take username and service and return
  - seuser and level.  ipa will populate file in future.
  - Change selinuxdefcon to return just the context by default


author: Dan Walsh <dwalsh@redhat.com> - 2.0.75-2
changelog:
  - Eamon Walsh Patch - libselinux: allow shell-style wildcarding in X names
  - Add Restorecon/Install python functions from Luke Macken


author: Dan Walsh <dwalsh@redhat.com> - 2.0.75-1
changelog:
  - Update to Upstream
  	* Correct message types in AVC log messages.
  	* Make matchpathcon -V pass mode from Dan Walsh.
  	* Add man page for selinux_file_context_cmp from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.73-1
changelog:
  - Update to Upstream
  	* New man pages from Dan Walsh.
  	* Update flask headers from refpolicy trunk from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.71-1
changelog:
  - Update to Upstream
  	* Add group support to seusers using %groupname syntax from Dan Walsh.
  	* Mark setrans socket close-on-exec from Stephen Smalley.
  	* Only apply nodups checking to base file contexts from Stephen Smalley.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.70-1
changelog:
  - Update to Upstream
  	* Merge ruby bindings from Dan Walsh.
  - Add support for Linux groups to getseuserbyname


author: Dan Walsh <dwalsh@redhat.com> - 2.0.69-1
changelog:
  - Update to Upstream
  	* Handle duplicate file context regexes as a fatal error from Stephen Smalley.
  	  This prevents adding them via semanage.
  	* Fix audit2why shadowed variables from Stephen Smalley.
  	* Note that freecon NULL is legal in man page from Karel Zak.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.67-1
changelog:
  - Update to Upstream
  	* New and revised AVC, label, and mapping man pages from Eamon Walsh.
  	* Add swig python bindings for avc interfaces from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.65-1
changelog:
  - Update to Upstream
  	* Fix selinux_file_context_verify() and selinux_lsetfilecon_default() to call matchpathcon_init_prefix if not already initialized.
  	* Add -q qualifier for -V option of matchpathcon and change it to indicate whether verification succeeded or failed via exit status.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.64-1
changelog:
  - Update to Upstream
  	* Fixed selinux_set_callback man page.
  	* Try loading the max of the kernel-supported version and the libsepol-supported version when no manipulation of the binary policy is needed from Stephen Smalley.
  	* Fix memory leaks in matchpathcon from Eamon Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.60-1
changelog:
  - Update to Upstream
  	* Changed selinux_init_load_policy() to not warn about a failed mount of selinuxfs if selinux was disabled in the kernel.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.55-1
changelog:
  - Update to Upstream
  	* Merged compute_member AVC function and manpages from Eamon Walsh.
  	* Provide more error reporting on load policy failures from Stephen Smalley.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.52-1
changelog:
  - Update to Upstream
  	* Disable setlocaldefs if no local boolean or users files are present from Stephen Smalley.
  	* Skip userspace preservebools processing for Linux >= 2.6.22 from Stephen Smalley.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.47-1
changelog:
  - Fix memory references in audit2why and change to use tuples
  - Update to Upstream
  	* Fix for the avc:  granted null message bug from Stephen Smalley.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.45-1
changelog:
  - Upgrade to upstream
  	* dlopen libsepol.so.1 rather than libsepol.so from Stephen Smalley.
  	* Based on a suggestion from Ulrich Drepper, defer regex compilation until we have a stem match, by Stephen Smalley.
  	*  A further optimization would be to defer regex compilation until we have a complete match of the constant prefix of the regex - TBD.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.42-1
changelog:
  - Upgrade to upstream
  	* AVC enforcing mode override patch from Eamon Walsh.
  	* Aligned attributes in AVC netlink code from Eamon Walsh.
  - Move libselinux.so back into devel package, procps has been fixed


author: Dan Walsh <dwalsh@redhat.com> - 2.0.40-1
changelog:
  - Upgrade to upstream
  	* Merged refactored AVC netlink code from Eamon Walsh.
  	* Merged new X label namespaces from Eamon Walsh.
  	* Bux fix and minor refactoring in string representation code.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.37-1
changelog:
  - Upgrade to upstream
  	* Merged selinux_get_callback, avc_open, empty string mapping from Eamon Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.35-1
changelog:
  - Upgrade to upstream
  	* Make netlink socket close-on-exec to avoid descriptor leakage from Dan Walsh.
  	* Pass CFLAGS when using gcc for linking from Dennis Gilmore.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.33-1
changelog:
  - Upgrade to latest from NSA
  	* Re-map a getxattr return value of 0 to a getfilecon return value of -1 with errno EOPNOTSUPP from Stephen Smalley.
  	* Fall back to the compat code for security_class_to_string and security_av_perm_to_string from Stephen Smalley.
  	* Fix swig binding for rpm_execcon from James Athey.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.30-1
changelog:
  - Move libselinux.so into devel package
  - Upgrade to upstream
  	* Fix segfault resulting from uninitialized print-callback pointer.
  	* Added x_contexts path function patch from Eamon Walsh.
  	* Fix build for EMBEDDED=y from Yuichi Nakamura.
  	* Fix markup problems in selinux man pages from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.29-1
changelog:
  - Upgrade to upstream
  	* Updated version for stable branch.	
  	* Added x_contexts path function patch from Eamon Walsh.
  	* Fix build for EMBEDDED=y from Yuichi Nakamura.
  	* Fix markup problems in selinux man pages from Dan Walsh.
  	* Updated av_permissions.h and flask.h to include new nscd permissions from Dan Walsh.
  	* Added swigify to top-level Makefile from Dan Walsh.
  	* Fix for string_to_security_class segfault on x86_64 from Stephen
  	  Smalley.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.21-1
changelog:
  - Upgrade to upstream
  	* Class and permission mapping support patches from Eamon Walsh.
  	* Object class discovery support patches from Chris PeBenito.
  	* Refactoring and errno support in string representation code.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.18-1
changelog:
  - Upgrade to upstream
  	* Merged patch to reduce size of libselinux and remove need for libsepol for embedded systems from Yuichi Nakamura.
  	  This patch also turns the link-time dependency on libsepol into a runtime (dlopen) dependency even in the non-embedded case.

  2.0.17 2007-05-31
  	* Updated Lindent script and reindented two header files.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.16-1
changelog:
  - Upgrade to upstream
  	* Merged additional swig python bindings from Dan Walsh.
  	* Merged helpful message when selinuxfs mount fails patch from Dax Kelson.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.13-1
changelog:
  - Upgrade to upstream
  	* Merged rpm_execcon python binding fix, matchpathcon man page fix, and getsebool -a handling for EACCES from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.11-1
changelog:
  - Upgrade to upstream
  	* Merged userspace AVC patch to follow kernel's behavior for permissive mode in caching previous denials from Eamon Walsh.
  	* Merged sidput(NULL) patch from Eamon Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.9-1
changelog:
  - Upgrade to upstream
  	* Merged class/av string conversion and avc_compute_create patch from Eamon Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.7-1
changelog:
  * Merged patch to drop support for CACHETRANS=0 config option from Steve Grubb.
  	* Merged patch to drop support for old /etc/sysconfig/selinux and
  	  /etc/security policy file layout from Steve Grubb.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.5-1
changelog:
  - Upgrade to upstream
  	* Merged init_selinuxmnt() and is_selinux_enabled() improvements from Steve Grubb.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.4-1
changelog:
  - Upgrade to upstream
  	* Removed sending of setrans init message.
  	* Merged matchpathcon memory leak fix from Steve Grubb.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.0-1
changelog:
  * Merged patch from Todd Miller to remove sscanf in matchpathcon.c because
  	  of the use of the non-standard format (original patch changed
  	  for style).
  	* Merged patch from Todd Miller to fix memory leak in matchpathcon.c.


author: Dan Walsh <dwalsh@redhat.com> - 1.33.4-1
changelog:
  - Upstream wanted some minor changes, upgrading to keep api the same
  - Upgrade to upstream
  	* Merged selinux_check_securetty_context() and support from Dan Walsh.
  Resolves: #200110


author: Dan Walsh <dwalsh@redhat.com> - 1.33.3-1
changelog:
  - Upgrade to upstream
  	* Merged patch for matchpathcon utility to use file mode information
  	  when available from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> - 1.33.1-2
changelog:
  - Add James Antill patch for login verification of MLS Levels
  -  MLS ragnes need to be checked, Eg. login/cron. This patch adds infrastructure.


author: Dan Walsh <dwalsh@redhat.com> - 1.33.1-1
changelog:
  - Upgrade to latest from NSA
  	* Merged updated flask definitions from Darrel Goeddel.
   	  This adds the context security class, and also adds
  	  the string definitions for setsockcreate and polmatch.


author: Dan Walsh <dwalsh@redhat.com> - 1.30.29-1
changelog:
  - Upgrade to latest from NSA
  	* Merged av_permissions.h update from Steve Grubb,
  	  adding setsockcreate and polmatch definitions.


author: Dan Walsh <dwalsh@redhat.com> - 1.30.27-1
changelog:
  - Upgrade to latest from NSA
  	* Merged patch to not log avc stats upon a reset from Steve Grubb.
  	* Applied patch to revert compat_net setting upon policy load.
  	* Merged file context homedir and local path functions from
  	  Chris PeBenito.


author: Dan Walsh <dwalsh@redhat.com> - 1.30.25-1
changelog:
  - Upgrade to latest from NSA
  	* Merged file context homedir and local path functions from
  	  Chris PeBenito.
  	* Rework functions that access /proc/pid/attr to access the
  	  per-thread nodes, and unify the code to simplify maintenance.


author: Dan Walsh <dwalsh@redhat.com> - 1.30.24-1
changelog:
  - Upgrade to latest from NSA
  	* Merged return value fix for *getfilecon() from Dan Walsh.
  	* Merged sockcreate interfaces from Eric Paris.


author: Dan Walsh <dwalsh@redhat.com> - 1.30.22-1
changelog:
  - Upgrade to latest from NSA
  	* Merged no-tls-direct-seg-refs patch from Jeremy Katz.
  	* Merged netfilter_contexts support patch from Chris PeBenito.


author: Dan Walsh <dwalsh@redhat.com> 1.30.19-1
changelog:
  - Upgrade to latest from NSA
  	* Lindent.
  	* Merged {get,set}procattrcon patch set from Eric Paris.
  	* Merged re-base of keycreate patch originally by Michael LeMay from Eric Paris.
  	* Regenerated Flask headers from refpolicy.
  	* Merged patch from Dan Walsh with:
  	  - Added selinux_file_context_{cmp,verify}.
  	  - Added selinux_lsetfilecon_default.
  	  - Delay translation of contexts in matchpathcon.


author: Dan Walsh <dwalsh@redhat.com> 1.30.15-1
changelog:
  - Upgrade to latest from NSA
  	* Merged patch from Dan Walsh with:
  	* Added selinux_getpolicytype() function.
  	* Modified setrans code to skip processing if !mls_enabled.
  	* Set errno in the !selinux_mnt case.
  	* Allocate large buffers from the heap, not on stack.
  	  Affects is_context_customizable, selinux_init_load_policy,
  	  and selinux_getenforcemode.


author: Dan Walsh <dwalsh@redhat.com> 1.30.10-1
changelog:
  - Upgrade to latest from NSA
  	* Merged simple setrans client cache from Dan Walsh.
  	  Merged avcstat patch from Russell Coker.
  	* Modified selinux_mkload_policy() to also set /selinux/compat_net
  	  appropriately for the loaded policy.


author: Dan Walsh <dwalsh@redhat.com> 1.30.8-1
changelog:
  - More fixes for translation cache
  - Upgrade to latest from NSA
  	* Added matchpathcon_fini() function to free memory allocated by
  	  matchpathcon_init().


author: Dan Walsh <dwalsh@redhat.com> 1.30.6-1
changelog:
  - Upgrade to latest from NSA
  	* Merged getfscreatecon man page fix from Dan Walsh.
  	* Updated booleans(8) man page to drop references to the old
  	  booleans file and to note that setsebool can be used to set
  	  the boot-time defaults via -P.


author: Dan Walsh <dwalsh@redhat.com> 1.30.5-1
changelog:
  - Upgrade to latest from NSA
  	* Merged fix warnings patch from Karl MacMillan.	
  	* Merged setrans client support from Dan Walsh.
  	  This removes use of libsetrans.
  	* Merged patch to eliminate use of PAGE_SIZE constant from Dan Walsh.
  	* Merged swig typemap fixes from Glauber de Oliveira Costa.


author: Dan Walsh <dwalsh@redhat.com> 1.30.3-1
changelog:
  - Upgrade to latest from NSA
  	* Added distclean target to Makefile.
  	* Regenerated swig files.
  	* Changed matchpathcon_init to verify that the spec file is
  	  a regular file.
  	* Merged python binding t_output_helper removal patch from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.30-1
changelog:
  - Make some fixes so it will build on RHEL4
  - Upgrade to latest from NSA
  	* Updated version for release.
  	* Altered rpm_execcon fallback logic for permissive mode to also
  	  handle case where /selinux/enforce is not available.


author: Dan Walsh <dwalsh@redhat.com> 1.29.4-1
changelog:
  - Upgrade to latest from NSA
  	* Added format attribute to myprintf in matchpathcon.c and
  	  removed obsoleted rootlen variable in init_selinux_config().


author: Dan Walsh <dwalsh@redhat.com> 1.29.3-1
changelog:
  - Upgrade to latest from NSA
  	* Merged several fixes and improvements from Ulrich Drepper
  	  (Red Hat), including:
  	  - corrected use of getline
  	  - further calls to __fsetlocking for local files
  	  - use of strdupa and asprintf
  	  - proper handling of dirent in booleans code
  	  - use of -z relro
  	  - several other optimizations
  	* Merged getpidcon python wrapper from Dan Walsh (Red Hat).


author: Dan Walsh <dwalsh@redhat.com> 1.29.2-1
changelog:
  - Upgrade to latest from NSA
  	* Merged call to finish_context_translations from Dan Walsh.
  	  This eliminates a memory leak from failing to release memory
  	  allocated by libsetrans.


author: Dan Walsh <dwalsh@redhat.com> 1.27.28-1
changelog:
  - Update to latest from NSA
  	* Added MATCHPATHCON_VALIDATE flag for set_matchpathcon_flags() and
  	  modified matchpathcon implementation to make context validation/
  	  canonicalization optional at matchpathcon_init time, deferring it
  	  to a successful matchpathcon by default unless the new flag is set
  	  by the caller.
  	* Added matchpathcon_init_prefix() interface, and
  	  reworked matchpathcon implementation to support selective
  	  loading of file contexts entries based on prefix matching
  	  between the pathname regex stems and the specified path
  	  prefix (stem must be a prefix of the specified path prefix).


author: Dan Walsh <dwalsh@redhat.com> 1.27.25-1
changelog:
  - Update to latest from NSA
  	* Added -f file_contexts option to matchpathcon util.
  	  Fixed warning message in matchpathcon_init().
  	* Merged Makefile python definitions patch from Dan Walsh.


author: Dan Walsh <dwalsh@redhat.com> 1.27.22-1
changelog:
  - Update to latest from NSA
  	* Merged make failure in rpm_execcon non-fatal in permissive mode
  	  patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.27.21-1
changelog:
  - Update to latest from NSA
  	* Added MATCHPATHCON_NOTRANS flag for set_matchpathcon_flags()
  	  and modified matchpathcon_init() to skip context translation
  	  if it is set by the caller.


author: Dan Walsh <dwalsh@redhat.com> 1.27.20-1
changelog:
  - Update to latest from NSA
  	* Added security_canonicalize_context() interface and
  	  set_matchpathcon_canoncon() interface for obtaining
  	  canonical contexts.  Changed matchpathcon internals
  	  to obtain canonical contexts by default.  Provided
  	  fallback for kernels that lack extended selinuxfs context
  	  interface.
  - Patch to not translate mls when calling setfiles


author: Dan Walsh <dwalsh@redhat.com> 1.27.19-1
changelog:
  - Update to latest from NSA
  	* Merged seusers parser changes from Ivan Gyurdiev.
  	* Merged setsebool to libsemanage patch from Ivan Gyurdiev.
  	* Changed seusers parser to reject empty fields.


author: Dan Walsh <dwalsh@redhat.com> 1.27.14-1
changelog:
  - Update to latest from NSA
  	* Merged selinux_path() and selinux_homedir_context_path()
  	  functions from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.27.12-1
changelog:
  - Update to latest from NSA
  	* Merged get_default_context_with_rolelevel and man pages from
  	  Dan Walsh (Red Hat).
  	* Updated call to sepol_policydb_to_image for sepol changes.
  	* Changed getseuserbyname to ignore empty lines and to handle
  	no matching entry in the same manner as no seusers file.


author: Dan Walsh <dwalsh@redhat.com> 1.27.9-1
changelog:
  - Update to latest from NSA
  	* Changed selinux_mkload_policy to try downgrading the
  	latest policy version available to the kernel-supported version.
  	* Changed selinux_mkload_policy to fall back to the maximum
  	policy version supported by libsepol if the kernel policy version
  	falls outside of the supported range.


author: Dan Walsh <dwalsh@redhat.com> 1.27.7-1
changelog:
  - Update to latest from NSA
  	* Changed getseuserbyname to fall back to the Linux username and
  	NULL level if seusers config file doesn't exist unless 
  	REQUIRESEUSERS=1 is set in /etc/selinux/config.
  	* Moved seusers.conf under $SELINUXTYPE and renamed to seusers.


author: Dan Walsh <dwalsh@redhat.com> 1.27.6-1
changelog:
  - Update to latest from NSA
  	* Added selinux_init_load_policy() function as an even higher level
  	interface for the initial policy load by /sbin/init.  This obsoletes
  	the load_policy() function in the sysvinit-selinux.patch. 
  	* Added selinux_mkload_policy() function as a higher level interface
  	for loading policy than the security_load_policy() interface.


author: Dan Walsh <dwalsh@redhat.com> 1.27.4-1
changelog:
  - Update to latest from NSA
  	* Merged fix for matchpathcon (regcomp error checking) from Johan
  	Fischer.  Also added use of regerror to obtain the error string
  	for inclusion in the error message.


author: Dan Walsh <dwalsh@redhat.com> 1.27.3-1
changelog:
  - Update to latest from NSA
  	* Changed getseuserbyname to not require (and ignore if present)
  	the MLS level in seusers.conf if MLS is disabled, setting *level
  	to NULL in this case.


author: Dan Walsh <dwalsh@redhat.com> 1.25.7-1
changelog:
  - Update from NSA
  	* Merged modified form of patch to avoid dlopen/dlclose by
  	the static libselinux from Dan Walsh.  Users of the static libselinux
  	will not have any context translation by default.


author: Dan Walsh <dwalsh@redhat.com> 1.25.6-1
changelog:
  - Update from NSA
  	* Added public functions to export context translation to
  	users of libselinux (selinux_trans_to_raw_context,
  	selinux_raw_to_trans_context).


author: Dan Walsh <dwalsh@redhat.com> 1.25.4-1
changelog:
  - Update from NSA
  	* Hid translation-related symbols entirely and ensured that 
  	raw functions have hidden definitions for internal use.
  	* Allowed setting NULL via context_set* functions.
  	* Allowed whitespace in MLS component of context.
  	* Changed rpm_execcon to use translated functions to workaround
  	lack of MLS level on upgraded systems.


author: Dan Walsh <dwalsh@redhat.com> 1.25.3-1
changelog:
  * Merged context translation patch, originally by TCS,
  	  with modifications by Dan Walsh (Red Hat).


author: Dan Walsh <dwalsh@redhat.com> 1.25.2-1
changelog:
  - Update from NSA
  	* Merged several fixes for error handling paths in the
  	  AVC sidtab, matchpathcon, booleans, context, and get_context_list
  	  code from Serge Hallyn (IBM). Bugs found by Coverity.
  	* Removed setupns; migrated to pam.
  	* Merged patches to rename checkPasswdAccess() from Joshua Brindle.
  	  Original symbol is temporarily retained for compatibility until 
  	  all callers are updated.


author: Dan Walsh <dwalsh@redhat.com> 1.23.11-1
changelog:
  - Update from NSA
  	* Merged avcstat and selinux man page from Dan Walsh.
  	* Changed security_load_booleans to process booleans.local 
  	  even if booleans file doesn't exist.


author: Dan Walsh <dwalsh@redhat.com> 1.23.10-1
changelog:
  - Update from NSA
  	* Merged set_selinuxmnt patch from Bill Nottingham (Red Hat).
  	* Rewrote get_ordered_context_list and helpers, including
  	  changing logic to allow variable MLS fields.


author: Dan Walsh <dwalsh@redhat.com> 1.23.4-1
changelog:
  - Update from NSA
  	* Merged fix for set_matchpathcon* functions from Andreas Steinmetz.
  	* Merged fix for getconlist utility from Andreas Steinmetz.


author: Dan Walsh <dwalsh@redhat.com> 1.23.1-1
changelog:
  - Update from NSA
  	* Added set_matchpathcon_flags() function for setting flags
  	  controlling operation of matchpathcon.  MATCHPATHCON_BASEONLY
  	  means only process the base file_contexts file, not 
  	  file_contexts.homedirs or file_contexts.local, and is for use by
  	  setfiles -c.
  	* Updated matchpathcon.3 man page.


author: Dan Walsh <dwalsh@redhat.com> 1.21.10-1
changelog:
  - Update from NSA
  	* Merged matchpathcon patch for file_contexts.homedir from Dan Walsh.
  	* Added selinux_users_path() for path to directory containing
  	  system.users and local.users.


author: Dan Walsh <dwalsh@redhat.com> 1.21.7-1
changelog:
  - Update from NSA
  	* Modified avc_dump_av to explicitly check for any permissions that
  	  cannot be mapped to string names and display them as a hex value.
  	* Regenerated av_permissions.h.


author: Dan Walsh <dwalsh@redhat.com> 1.21.5-1
changelog:
  - Update from NSA
  	* Generalized matchpathcon internals, exported more interfaces,
  	  and moved additional code from setfiles into libselinux so that
  	  setfiles can directly use matchpathcon.


author: Dan Walsh <dwalsh@redhat.com> 1.21.4-1
changelog:
  - Update from NSA
  	* Prevent overflow of spec array in matchpathcon.
  	* Fixed several uses of internal functions to avoid relocations.
  	* Changed rpm_execcon to check is_selinux_enabled() and fallback to
  	  a regular execve if not enabled (or unable to determine due to a lack
  	  of /proc, e.g. chroot'd environment).


author: Dan Walsh <dwalsh@redhat.com> 1.19.4-1
changelog:
  - Update to latest from upstream
  	* Changed matchpathcon to return -1 with errno ENOENT for 
  	  <<none>> entries, and also for an empty file_contexts configuration.


author: Dan Walsh <dwalsh@redhat.com> 1.19.3-1
changelog:
  - Upgrade to upstream
  	* Removed some trivial utils that were not useful or redundant.
  	* Changed BINDIR default to /usr/sbin to match change in Fedora.
  	* Added security_compute_member.
  	* Added man page for setcon.


author: Steve Grubb <sgrubb@redhat.com> 1.18.1-2
changelog:
  - Add patch to make setsebool update bool on disk
  - Make togglesebool have a rollback capability in case it blows up inflight


author: Dan Walsh <dwalsh@redhat.com> 1.17.14-1
changelog:
  - Upgrade to latest  from NSA
  	* Merged setenforce and removable context patch from Dan Walsh.
  	* Merged build fix for alpha from Ulrich Drepper.
  	* Removed copyright/license from selinux_netlink.h - definitions only.


author: Dan Walsh <dwalsh@redhat.com> 1.17.6-1
changelog:
  - Add strcasecmp in selinux_config
  - Update from NSA
  	* Changed avc_has_perm_noaudit to not fail on netlink errors.
  	* Changed avc netlink code to check pid based on patch by Steve Grubb.
  	* Merged second optimization patch from Ulrich Drepper.
  	* Changed matchpathcon to skip invalid file_contexts entries.
  	* Made string tables private to libselinux.
  	* Merged strcat->stpcpy patch from Ulrich Drepper.
  	* Merged matchpathcon man page from Dan Walsh.
  	* Merged patch to eliminate PLTs for local syms from Ulrich Drepper.
  	* Autobind netlink socket.
  	* Dropped compatibility code from security_compute_user.
  	* Merged fix for context_range_set from Chad Hanson.
  	* Merged allocation failure checking patch from Chad Hanson.
  	* Merged avc netlink error message patch from Colin Walters.


author: Dan Walsh <dwalsh@redhat.com> 1.17.5-1
changelog:
  - Update from NSA
  	* Merged second optimization patch from Ulrich Drepper.
  	* Changed matchpathcon to skip invalid file_contexts entries.
  	* Made string tables private to libselinux.
  	* Merged strcat->stpcpy patch from Ulrich Drepper.
  	* Merged matchpathcon man page from Dan Walsh.
  	* Merged patch to eliminate PLTs for local syms from Ulrich Drepper.
  	* Autobind netlink socket.
  	* Dropped compatibility code from security_compute_user.
  	* Merged fix for context_range_set from Chad Hanson.
  	* Merged allocation failure checking patch from Chad Hanson.
  	* Merged avc netlink error message patch from Colin Walters.


author: Dan Walsh <dwalsh@redhat.com> 1.17.2-1
changelog:
  - Add matchpathcon man page
  - Latest from NSA
  	* Merged patch to eliminate PLTs for local syms from Ulrich Drepper.
  	* Autobind netlink socket.
  	* Dropped compatibility code from security_compute_user.
  	* Merged fix for context_range_set from Chad Hanson.
  	* Merged allocation failure checking patch from Chad Hanson.
  	* Merged avc netlink error message patch from Colin Walters.


author: Dan Walsh <dwalsh@redhat.com> 1.17.1-1
changelog:
  - Latest from NSA
  	* Autobind netlink socket.
  	* Dropped compatibility code from security_compute_user.
  	* Merged fix for context_range_set from Chad Hanson.
  	* Merged allocation failure checking patch from Chad Hanson.
  	* Merged avc netlink error message patch from Colin Walters.


author: Dan Walsh <dwalsh@redhat.com> 1.15.1-1
changelog:
  - Update to latest from NSA
  - Add fix to only get old path if file_context file exists in old location


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.4
changelog:
  - fix CVE-2017-3731 - DoS via truncated packets with RC4-MD5 cipher
  - fix CVE-2016-8610 - DoS of single-threaded servers via excessive alerts


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.3
changelog:
  - fix CVE-2016-2177 - possible integer overflow
  - fix CVE-2016-2178 - non-constant time DSA operations
  - fix CVE-2016-2179 - further DoS issues in DTLS
  - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
  - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
  - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
  - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
  - fix CVE-2016-6304 - unbound memory growth with OCSP status request
  - fix CVE-2016-6306 - certificate message OOB reads
  - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
    112 bit effective strength
  - replace expired testing certificates


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.1
changelog:
  - fix CVE-2016-2105 - possible overflow in base64 encoding
  - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
  - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO
  - fix CVE-2016-0799 - memory issues in BIO_printf


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-46
changelog:
  - fix 1-byte memory leak in pkcs12 parse (#1229871)
  - document some options of the speed command (#1197095)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-43
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-38
changelog:
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34
changelog:
  - copy digest algorithm when handling SNI context switch
  - improve documentation of ciphersuites - patch by Hubert Kario
  - add support for setting Kerberos service and keytab in
    s_server and s_client


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-33
changelog:
  - fix CVE-2014-3570 - incorrect computation in BN_sqr()
  - fix CVE-2014-3571 - possible crash in dtls1_get_record()
  - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state
  - fix CVE-2014-8275 - various certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0205 - do not allow unauthenticated client DH certificate
  - fix CVE-2015-0206 - possible memory leak when buffering DTLS records


author: Adam Jackson <ajax@redhat.com> 1.2.2-2
changelog:
  - libvorbis-1.2.2-svn16228.patch: Backport a fix from pre-1.2.3 to hopefully
    fix small sound file playback. (#505610)


author: Roman Rakus <rrakus@redhat.com> - 4.1.2-15
changelog:
  - Fixed a bug that caused trap handlers to be executed recursively,
    corrupting internal data structures.
    Resolves: #964687


author: Roman Rakus <rrakus@redhat.com> - 4.1.2-12
changelog:
  - Update info about trap in man page
    Resolves: #799958
  - Enable system-wide bash_logout
    Resolves: #677439
  - instead of setting the signal handler to SIG_IGN while installing
    the new trap handler, block the signal and unblock it after the new handler
    is installed
    Resolves: #695656


author: Roman Rakus <rrakus@redhat.com> - 4.1.2-5
changelog:
  - Builtins like echo and printf won't report errors
    when output does not succeed due to EPIPE
    Resolves: #664468


author: Roman Rakus <rrakus@redhat.com> - 4.1.2-4
changelog:
  - don't segfault when trying to bind int variable to array
    with bad array subsrcipt
    Resolves: #618289


author: Roman Rakus rrakus@redhat.com 4.1.2-1
changelog:
  - rebase to 4.1
  - Patch level 2
    Resolves #542692
  - Include COPYING in bash base rpm
    Resolves #553250


author: Jesse Keating <jkeating@redhat.com> - 3.2-29
changelog:
  - Add the Requires(post) back for ncurses-libs, so that rpm knows
    where to break the loop.  The post actually does require the curses
    libs for the sh calls.  Could consider doing this in LUA and not have
    any external deps.


author: Roman Rakus <rrakus@redhat.com> - 3.2-28
changelog:
  - Removing Requires for mktemp and ncurses, which cause
    dependencing loop
  - Enabling #define SSH_SOURCE_BASHRC, because ssh changed.
    Resolves: #458839
  - Catch signals right after calling execve()
    Resolves: #455548


author: Tomas Janousek <tjanouse@redhat.com> - 3.2-20
changelog:
  - Added bash32-026 upstream official patch
  - Added bash32-027 upstream official patch (#249987)
  - Added bash32-028 upstream official patch
  - Added bash32-029 upstream official patch (#286861)
  - Added bash32-030 upstream official patch
  - Added bash32-031 upstream official patch (#358231)
  - Added bash32-032 upstream official patch
  - Added bash32-033 upstream official patch
  - Fix insert command repeating in vi mode (#190350)


author: Tomas Janousek <tjanouse@redhat.com> - 3.2-19
changelog:
  - fix cursor position when prompt has one invisible character (#358231)
  - dropped examples/loadables/ from docs, since it wasn't possible to build them
    anyway (#174380)
  - fix #286861: Wrong input confuses bash's arithmetic unit permanently
  - fix #344411: $RANDOM stays the same when job executed in the background


author: Pete Graner <pgraner@redhat.com> - 3.2-18
changelog:
  - Added bash32-021 upstream official patch
  - Added bash32-025 upstream official patch
  - Added bash32-024 upstream official patch
  - Added bash32-023 upstream official patch
  - Added bash32-022 upstream official patch


author: Pete Graner <pgraner@redhat.com> - 3.2-17
changelog:
  - Added bash32-018 upstream official patch
  - Added bash32-020 upstream official patch
  - Added bash32-019 upstream official patch


author: Pete Graner <pgraner@redhat.com> - 3.2-15
changelog:
  - Update to the Improve bash $RANDOM pseudo RNG (bug #234906) 
    now works with subshells and make $RANDOM on demand thus reducing the 
    amount of AVCs thrown.


author: Tim Waugh <twaugh@redhat.com> 3.2-7
changelog:
  - Reinstated this change:
    - Post requires ncurses (bug #224567).
  - Reverted this change:
    - Added triggers for install-info (bug #225609).


author: Tim Waugh <twaugh@redhat.com> 3.2-5
changelog:
  - Added triggers for install-info (bug #225609).
  - Use full path to utilities in scriptlets (bug #225609).
  - Fix missing sh-bangs in example scripts (bug #225609).
  - Post requires ncurses (bug #224567).
  - Removed Prefix tag (bug #225609).
  - Fixed BuildRoot tag (bug #225609).
  - Removed trailing full-stop from summary (bug #225609).
  - Spec file is now UTF-8 (bug #225609).
  - Removed obsolete Obsoletes (bug #225609).
  - Moved 'make check' to new 'check' section (bug #225609).
  - Removed uses of RPM_SOURCE_DIR (bug #225609).
  - Fixed macros in changelog (bug #225609).
  - Changed tabs to spaces (bug #225609).


author: Tim Waugh <twaugh@redhat.com> 3.2-1
changelog:
  - Build requires autoconf and gettext.
  - 3.2.  No longer need aq, login, ulimit, sighandler or read-memleak
    patches.


author: Tim Waugh <twaugh@redhat.com> 3.1-2
changelog:
  - No longer need loadables, mbinc or shellfunc patches.
  - Use literal single-quote in bash man page where appropriate (bug #177051).


author: Tim Waugh <twaugh@redhat.com> 3.1-1
changelog:
  - 3.1.
  - No longer need ia64, utf8, multibyteifs, jobs, sigpipe,
    read-e-segfault, manpage, crash, pwd, afs, subshell patches.
  - Remove wrap patch for now.
  - Use upstream patch to fix arrays.


author: Tim Waugh <twaugh@redhat.com> 3.0-40
changelog:
  - Fix read memleak when reading from non-blocking fd (bug #173283).
  - Missed another loop for improved sighandler patch (bug #169231).


author: Tim Waugh <twaugh@redhat.com> 3.0-36
changelog:
  - Added Url: tag (bug #172770).
  - Do not explicitly gzip info pages (bug #172770).
  - Fix permissions on bashbug (bug #172770).


author: Tim Waugh <twaugh@redhat.com>
changelog:
  - Fixed AFS support for output redirection, so that the correct errors
    are reported for other filesystems (bug #155373).


author: Tim Waugh <twaugh@redhat.com>
changelog:
  - Reverted this change:
    - Added code to /etc/skel/.bash_logout to support the gpm selection buffer
      invalidation on virtual terminals (bug #115493).


author: Tim Waugh <twaugh@redhat.com> 3.0-21
changelog:
  - Added code to /etc/skel/.bash_logout to support the gpm selection buffer
    invalidation on virtual terminals (bug #115493).


author: Tim Waugh <twaugh@redhat.com> 3.0-13
changelog:
  - Check for EINVAL from waitpid() and avoid WCONTINUED in that case.
  - Fixed jobs4 test.
  - Applied experimental upstream patch for trap compatibility.
  - Re-make documentation to reflect source changes.


author: Tim Waugh <twaugh@redhat.com> 3.0-5
changelog:
  - Make trap usage string show POSIX usage (bug #128938).
  - Updated ${x[@]:1} expansion fix from bug-bash list.
  - Updated patch to fix unset array crash (from bug-bash list).


author: Tim Waugh <twaugh@redhat.com> 3.0-2
changelog:
  - Fixed brace expansion (bug #129128).
  - Build with AFS support again, since bug #86514 seems fixed upstream
    (bug #129094).


author: Tim Waugh <twaugh@redhat.com> 2.05b-23
changelog:
  - Fix a warning message (bug #79629).
  - Don't remove generated source during build, for debuginfo package.
  - Don't build with AFS support (bug #86514).


author: Tim Waugh <twaugh@redhat.com> 2.05b-6
changelog:
  - Add the (4) patches from ftp.gnu.org (bug #75888, bug #72512).
  - Ship '.' man page, which doesn't get picked up by glob.
  - Don't install files not shipped when building.
  - Locale shell variables fix (bug #74701).


author: Tim Waugh <twaugh@redhat.com> 2.05b-4
changelog:
  - Fix history substitution modifiers in UTF-8 (bug #70294, bug #71186).
  - Fix ADVANCE_CHAR at end of string (bug #70819).
  - docs: CWRU/POSIX.NOTES no longer exists, but ship POSIX.


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.05a-9
changelog:
  - Add patch from Ulrich Drepper to get better error messages when trying
    to launch an application with a bad ELF interpreter (e.g. libc5 ld.so)
    (#60870)


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.05-5
changelog:
  - Don't set BASH_ENV in .bash_profile, it causes .bashrc to be sourced
    twice in interactive non-login shells.
  - s/Copyright/License/


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.05-2
changelog:
  - bash comes with its own copy of readline... Add the patches we're
    applying in the readline package.


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.05-1
changelog:
  - Update to 2.05
  - Change PROMPT_COMMAND in bashrc for xterms
    to something less space consuming (#24159)
  - Provide plugs for alternate prompt commands (#30634), but don't
    default to them


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 2.04 final
  - remove the echo, pwd, test and kill man pages from the package,
    we're getting them from sh-utils


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 2.04beta5
  - adapt patches
  - Fix up bashrc
  - Don't put in bashrc1, this should be done by the bash1 package
  - use install -c instead of plain install to work on *BSD
  - remove the collected patches - they're now in the base version.
  - make compressed man pages optional


author: Florian La Roche <Florian.LaRoche@redhat.com>
changelog:
  - add some collected patches for bash2
  - change it over to be the main bash package
  - install man-pages root:root
  - obsolete bash2, bash2-doc


author: Ian Macdonald <ianmacd@xs4all.nl>
changelog:
  - upgraded to version 2.02
  - Alpha, MIPS & Sparc patches removed due to lack of test platforms
  - glibc & signal patches no longer required
  - added documentation subpackage (doc)


author: Donnie Barnes <djb@redhat.com>
changelog:
  - added signal handling patch from Dean Gaudet <dgaudet@arctic.org> that
    is based on a change made in bash 2.0.  Should fix some early exit
    problems with suspends and fg.


author: Martin Sebor <msebor@redhat.com> - 2.12-1.196
changelog:
  - Fix CVE-2015-8776 glibc: Segmentation fault caused by passing
    out-of-range data to strftime() (#1358011).


author: Carlos O'Donell <carlos@redhat.com> - 2.12-1.190
changelog:
  - Fix CVE-2015-7547: getaddrinfo() stack-based buffer overflow (#1296029).
  - Update malloc free_list cyclic fix (#1264189).
  - Update tzdata-update changes (#1200555).


author: Carlos O'Donell <carlos@redhat.com> - 2.12-1.182
changelog:
  - Avoid PLT in libm for feupdateenv (#1186104).
  - Allow PLT entry in libc for _Unwind_Find_FDE on s390/s390x (#1186104).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.169
changelog:
  - Check for NULL arena pointer in _int_pvalloc (#1246656).
  - Don't change no_dyn_threshold on mallopt failure (#1246660).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.168
changelog:
  - Unlock main arena after allocation in calloc (#1245731).
  - Enable robust malloc change again (#1245731).
  - Fix perturbing in malloc on free and simply perturb_byte (#1245731).
  - Don't fall back to mmap prematurely (#1245731).


author: Carlos O'Donell <carlos@redhat.com> -2.12-1.167
changelog:
  - The malloc deadlock avoidance support has been temporarily removed since it
    triggers deadlocks in certain applications (#1243824).


author: Carlos O'Donell <carlos@redhat.com> - 2.12-1.158
changelog:
  - Enhance nscd to detect any configuration file changes (#859965).
  - Fix __times() handling of EFAULT when buf is NULL (#1124204).
  - Fix memory leak with dlopen() and thread-local storage variables (#978098).
  - Prevent getaddrinfo from writing DNS queries to random fd (CVE-2013-7423,
    - Implement userspace half of in6.h header coordination (#1053178).
  - Correctely size relocation cache used by profiler (#1144132).
  - Fix reuse of cached stack leading to bounds overrun of DTV (#1116050).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.157
changelog:
  - Return failure in getnetgrent only when all netgroups have been searched
    (#1085312).
  - Fix valgrind warning in nscd_stats (#1091915).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.156
changelog:
  - Initialize xports array (#1159167).
  - Fix tst-default-attr test to not fail on powerpc (#1023306).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.149
changelog:
  - Remove gconv transliteration loadable modules support (CVE-2014-5119,
    - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.147
changelog:
  - Fix stack overflow due to large AF_INET6 requests (CVE-2013-4458, #1111460).
  - Fix buffer overflow in readdir_r (CVE-2013-4237, #1111460).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.146
changelog:
  - Fix memory order when reading libgcc handle (#905941).
  - Fix format specifier in malloc_info output (#1027261).
  - Fix nscd lookup for innetgr when netgroup has wildcards (#1054846).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.143
changelog:
  - [ppc] Add VDSO IFUNC for gettimeofday (#1028285).
  - [ppc] Fix ftime gettimeofday internal call returning bogus data (#1099025).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.141
changelog:
  - Fix infinite loop in nscd when netgroup is empty (#1085273).
  - Provide correct buffer length to netgroup queries in nscd (#1074342).
  - Return NULL for wildcard values in getnetgrent from nscd (#1085289).
  - Avoid overlapping addresses to stpcpy calls in nscd (#1082379).
  - Initialize all of datahead structure in nscd (#1074353).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.134
changelog:
  - Fix return code from getent netgroup when the netgroup is not found (#1039988).
  - Fix handling of static TLS in dlopen'ed objects (#995972).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.133
changelog:
  - Don't use alloca in addgetnetgrentX (#1043557).
  - Adjust pointers to triplets in netgroup query data (#1043557).


author: Carlos O'Donell <carlos@redhat.com> - 2.12-1.132
changelog:
  - Revert the addition of gettimeofday vDSO function for ppc and ppc64 until
    OPD VDSO function call issues are resolved (#1026533).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.123
changelog:
  - Backport GLIBC sched_getcpu and gettimeofday vDSO functions for ppc (#929302).
  - Fall back to local DNS if resolv.conf does not define nameservers (#928318).
  - Add systemtap probes to slowexp and slowpow (#905575).


author: Carlos O'Donell <codonell@redhat.com> - 2.12-1.122
changelog:
  - Fix getaddrinfo stack overflow resulting in application crash (CVE-2013-1914, #951213).
  - Fix multibyte character processing crash in regexp (CVE-2013-0242, #951213).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.120
changelog:
  - Fix multiple nss_compat initgroups() bugs (#966778).
  - Don't use simple lookup for AF_INET when AI_CANONNAME is set (#863384).


author: Alexandre Oliva <aoliva@redhat.com> - 2.12-1.119
changelog:
  - Add MAP_HUGETLB and MAP_STACK support (#916986).
  - Update translation for stale file handle error (#970776).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.118
changelog:
  - Improve performance of _SC_NPROCESSORS_ONLN (#rh952422).
  - Fix up _init in pt-initfini to accept arguments (#663641).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.116
changelog:
  - Fix mutex locking for PI mutexes on spurious wake-ups on pthread condvars
    (#552960).
  - New environment variable GLIBC_PTHREAD_STACKSIZE to set thread stack size
    (#663641).


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.114
changelog:
  - The ttyname and ttyname_r functions on Linux now fall back to searching for
    the tty file descriptor in /dev/pts or /dev if /proc is not available.  This
    allows creation of chroots without the procfs mounted on /proc.  (#851470)


author: Jeff Law <law@redhat.com> - 2.12-1.107
changelog:
  - Simplify test for magic file to change memcpy behaviour
    and correctly handle encoded return value from inlined
    syscall (#846342, #874642)


author: Jeff Law <law@redhat.com> - 2.12-1.104
changelog:
  - Change from magic environment variable to existance of
    magic file /etc/sysconfig/32bit_ssse3_mempy_via_32bit_ssse3_memmove
    to trigger change in memcpy behavior. (#846342, #865375)
  - Fix IPTOS_CLASS #define. (#864322)


author: Jeff Law <law@redhat.com> - 2.12-1.99
changelog:
  - Allow broken code to avoid the 32 bit SSSE3 memcpy implementations
    by setting the environment variable
    32BIT_SSSE3_MEMCPY_VIA_32BIT_SSSE3_MEMMOVE to any value (#846342)


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.98
changelog:
  - Backport upstream glibc 4f031072a5055abd83717820b59efdaa463d5853
    locale/findlocale.c (_nl_find_locale): Return right away if
    _nl_explode_name failed.
    locale/programs/locarchive.c (add_locale_to_archive): Likewise. (#848082)


author: Jeff Law <law@redhat.com> - 2.12-1.97
changelog:
  - Fix handling of variable length characters in recent fseek
    fseek changes.  Fix testcase to include string.h which
    avoids failures on s390[x] and ppc (#827362).


author: Jeff Law <law@redhat.com> - 2.12-1.96
changelog:
  - Increase size of temporary buffers to avoid unnecessary DNS
    lookups (#837695)
  - Properly handle case where server rejects query (#804686)


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.92
changelog:
  - Mark /etc/rpc as a configuration file in glibc.spec. (#829222)
  - Fix for unpredictable results with some non-default
    floating point rounding modes.. (#837918)


author: Jeff Law <law@redhat.com> - 2.12-1.91
changelog:
  - Fix integer overflow leading to buffer overflow in strto*
    and related out of bounds array index (#847930)


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.89
changelog:
  - Delay setting file->decided until we have successfully loaded the file's data. (#832516)
  - FIX vfprintf() to return EOVERFLOW (not ERANGE) when the (INT_MAX/4)th or larger argument
    is specified in the format string. (#830127)


author: Jeff Law <law@redhat.com> - 2.12-1.86
changelog:
  - Pack IPv4 servers at the start of nsaddr_list and
    only track the number of IPV4 servers in EXT(statp)->nscount
    Thanks to Michael Chapman (#841787)


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.84
changelog:
  - Fix fnmatch() failure when '*' wildcard was applied on a file name
    containing multi-byte character(s) (#826149)


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.83
changelog:
  - Fix for iconv() segfault when the invalid multibyte character 0xffff is input while
    converting from IBM930 (#823909).


author: Jeff Law <law@redhat.com> - 2.12-1.78
changelog:
  - Fix option rotate with single IPV6 server (#804630)
  - Fix loading first object along a path when tracing (#808337)
  - Don't free non-malloced memory.  (#809602)


author: Jeff Law <law@redhat.com> - 2.12-1.74
changelog:
  - Correctly handle large response to AF_UNSPEC dns lookup (#795498)
  - Always use another area after a failed allocation in the
   main arena (#795328)


author: Jeff Law <law@redhat.com> - 2.12-1.68
changelog:
  - Disable 552960 changes again, they're still not right.
  - Fix locking on malloc family retry paths (#789238)


author: Jeff Law <law@redhat.com> - 2.12-1.66
changelog:
  - Fix lost wakeups in pthread_cond_*, reenable 552960 patch (#552960)
  - Fix resolv.conf parsing for ipv6 (#789189)
  - Fix nscd crash when group has many members (#788959)
  - Fix Ukrainian currency symbol (#789209)


author: Jeff Law <law@redhat.com> - 2.12-1.50
changelog:
  - Handle EAGAIN from FUTEX_WAIT_REQUEUE_PI (#552960)
  - Fix return value from pthread_create if stack allocation for new thread fails
    (#767746)
  - Move libmemusage.so and libpcprofile.so into base RPM (#752123)
  - Remove .UTF-8 suffix from locale names when it is the only supported codeset
    (#749188)
  - Fix warnings in __bswap_16. (#750531)
  - Fix access after end of search string in regex matcher (#757887)
  - Fix locking in _IO_flush_all_lockp (#751750)
  - Check malloc arena atomically  (#740506)
  - Don't call reused_arena when _int_new_arena failed


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.48
changelog:
  - Fix grouping and reuse other locales in various locales (#688720)
  - Drop lock before calling malloc_printerr (#726517)
  - More complete check for AVX enablement (#752122)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.39
changelog:
  - Make sure AVC thread has capabilities (#700507)
  - Fix memory leak in dlopen with RTLD_NOLOAD (#699724)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.35
changelog:
  - Report write error in addmnt even for cached streams (#688980,
    CVE-2011-1089)
  - Handle Lustre filesystem (#712248)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.34
changelog:
  - Query NIS domain only when needed (#718057)
  - Update: Use mmap for allocation of buffers used for __abort_msg
    (#676591)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.31
changelog:
  - Support Intel processor model 6 and model 0x2c (#695595)
  - Optimize memcpy for SSSE3 (#695812)
  - Optimize strlen for SSE2 (#695963)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.27
changelog:
  - Fix PLT use due to __libc_alloca_cutoff
  - Schedule nscd cache pruning more accurately from re-added values
    (#703481)
  - Fix POWER4 optimized strncmp to not read past differing bytes
    (#694386)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.26
changelog:
  - Create debuginfo-common on biarch platforms (#676467)
  - Use Rupee sign in Indian locales (#692838)
  - Signal temporary host lookup errors in nscd as such to the requester
    (#703480)
  - Define initgroups callback for nss_files (#705465)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.22.1
changelog:
  - Avoid too much stack use in fnmatch (#681054, CVE-2011-1071)
  - Properly quote output of locale (#625893, CVE-2011-1095)
  - Don't leave empty element in rpath when skipping the first element,
    ignore rpath elements containing non-isolated use of $ORIGIN when
    privileged (#667974, CVE-2011-0536)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.21.1
changelog:
  - Revert "Optimize memcpy, mempcpy and memmove" to let broken software
    continue to be broken (#676065)
  - Optimize memset (#676076)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.12
changelog:
  - Fix vDSO synthetic hwcap handling so they are not masked out from
    ld.so.cache matching (#615701)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.11
changelog:
  - Work around kernel rejecting valid absolute timestamps (#580498)
  - Document M_PERTURB (#615090)
  - Fix x86 pthread_cond_signal FUTEX_WAKE_OP fallback (#623187)
  - Fix concurrency problem between dl_open and dl_iterate_phdr (#646954)
  - Fix x86-64 strchr propagation of search byte into all bytes of SSE
    register (#647448)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.8
changelog:
  - Fix bug in generic strstr/memmem implementation handling certain
    repeated patterns (#641128)
  - Correctly align TCB for AVX (#642584)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.7
changelog:
  - Round cache sizes to handle odd sizes (#607010)
  - Fix initializsation of cpu features (#630801)
  - Fix ifunc thunk for strspn on x86 in static libc (#631011)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.3
changelog:
  - Implement recvmmsg on all archs (#594194)
  - Avoid strict aliasing issues (#594194)
  - Fix nscd user creation (#594256)
  - Fix access outside of red zone on ppc (#593771)
  - Fix scope handling during dl_close (#593686)


author: Andreas Schwab <schwab@redhat.com> - 2.12-1.1
changelog:
  - Fix exit codes in nscd start script (#582738)
  - Fix lookup of collation sequence value during regexp matching (#587360)
  - Handle too-small buffers in Linux getlogin_r (BZ#11571)
  - Fix name of tt_RU.UTF-8@iqtelif locale (#589138)


author: Roland McGrath <roland@redhat.com> - 2.12-1
changelog:
  - Update to 2.12 release.
    - Fix ldconfig chroot handling.
    - Don't deadlock in __dl_iterate_phdr while (un)loading objects.
    - Fix handling of newline in addmntent.
    - Fix AIO when thread creation failed.


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-20
changelog:
  - Update from master
    - Fix bugs in x86-32 strcmp-sse4.S and strcmp-ssse3.S
    - Add x86-32 FMA support
    - Don't crash in trace mode when dependencies are missing
    - x86-64 SSE4 optimized memcmp
    - Fix makecontext on s390/s390x


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-18
changelog:
  - Update from master
    - Implement interfaces to set and get names of threads (BZ#11390)
    - Locale data updates (BZ#10824, BZ#10936, BZ#11470, BZ#11471)
    - Print reload count in nscd statistics (BZ#10915)
    - Fix reading loginuid file in getlogin{,_r}
    - Fix fallocate error return on i386
    - Fix cproj implmentation (BZ#10401)
    - Fix getopt handing (BZ#11039, BZ#11040, BZ#11041)
    - Implement new mode for NIS passwd.adjunct.byname table (BZ#11134)
    - Obey LD_HWCAP_MASK in ld.so.cache lookups


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-17
changelog:
  - Update from master
    - Locale data updates (BZ#11007, BZ#11258, BZ#11272, BZ#10554)
    - Handle DNS timeouts in old-style lookup code (BZ#11010)
    - Fix aux cache handling in ldconfig with chroot (BZ#11149)
    - Fix printing error messages in getopt (BZ#11043)
    - Declare iruserok and iruserok_af (BZ#11070)
    - Fix option aliasing in argp (BZ#11254)
    - Handle POSIX-compliant errno value of unlink in remove (BZ#11276)
    - Fix definition and testing of S_ISSOCK (BZ#11279)
    - Fix retrieving of kernel header version (BZ#11287)
    - Fix concurrent handling of __cpu_features (BZ#11292)
    - Handle unnecessary padding in getdents64 (BZ#11333)
    - Fix changes to interface list during getifaddrs calls (BZ#11387)
    - Missing memory barrier in DES initialization (BZ#11449)
    - Fix spurious UNAVAIL status is getaddrinfo
    - Add support for new clocks (BZ#11389)
    - Fix Linux getlogin{_r,} implementation
    - Fix missing zero-termination in cuserid (BZ#11397)
    - Fix glob with empty pattern
    - Fix handling of STB_GNU_UNIQUE in LD_TRACE_PRELINKING
    - Unify wint_t handling in wchar.h and wctype.h (BZ#11410)
    - Implement handling of libc ABI in ELF header
    - Don't underestimate length of DST substitution in rpath
    - Power7-optimized 64-bit and 32-bit memcpy
  - Assign global scope to RFC 1918 addresses (#577626)


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-15
changelog:
  - Update from master
    - sparc64: Fix handling of R_SPARC_TLS_LE_* relocations (#571551)
    - Handle ext4 and logfs in statvfs functions
    - Fix setxid race with thread creation
    - Pass -mtune=i686 to assembler when compiling for i686
    - Fix R_X86_64_PC32 overflow detection
    - Fix msgrcv on sparc64
    - Fix unwind info in x86 strcmp-sse4.S (BZ#11332)
    - sparc: Add multiarch support for memset/bzero/memcpy
  - Remove directories owned by filesystem (#569414)
  - Add %ghost /etc/gai.conf to glibc-common (#567748)


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-13
changelog:
  - Update from master
    - Use CPUID_OFFSET instead of FEATURE_OFFSET
    - Add 32bit memcmp/strcmp/strncmp optimized for SSSE3/SSS4.2
    - Fix file descriotor leak in nftw with FTW_CHDIR (BZ#11271)
    - Add Sparc STT_GNU_IFUNC support
    - Add power7-optimized classification functions
  - Reapply "Optimize 32bit memset/memcpy with SSE2/SSSE3."
  - Use unsigned comparison in sse memcpy/memset


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-12
changelog:
  - Update from master
    - Update constants in <sys/mount.h> for current kernels (#11235)
    - Fix endless loop with invalid /etc/shells file (#11242)
    - Fix sorting of malayalam letter 'na' (#10414)
    - Add kok_IN locale
    - Use common collation data in as_IN locale
    - Avoid alloca in setenv for long strings
  - Use shared mapping to reserve memory when creating locale archive (#10855)
  - Fix fstat on Linux/sparc64 (#11155)


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-11
changelog:
  - Update from master
    - Fix error checking in iconv (#558053)
    - Don't map U00DF to U1E9E in toupper table
    - _nl_load_locale() incorrectly handles mmap() failures (BZ#11200)
    - Fix various issues in regex matcher (BZ#11183, BZ#11184, BZ#11185,
      BZ#11186, BZ#11187, BZ#11188, BZ#11189, BZ#11190, BZ#11191,
      BZ#11192, BZ#11193)


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-10
changelog:
  - Update from master
    - Fix ____longjmp_chk for s390/s390x
    - Remove duplicate definitions of O_DSYNC and O_RSYNC for Linux/sparc
    - Ignore negative dynamic entry types (#546890)
    - Fix pthread_cond_*wait with requeue-PI on i386 (#548989)
    - Fix _XOPEN_SOURCE_EXTENDED handling
  - Revert "Optimize 32bit memset/memcpy with SSE2/SSSE3."


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-9
changelog:
  - Update from master.
    - Define IPTOS_CLASS_* macros according to RFC 2474 (BZ#11027)
    - Always use IPv4 sockets for IPv4 addresses (BZ#11141)
    - regcomp.c: do not ignore memory allocation failure (BZ#11127)
    - Fix malloc_info without prior allocations (BZ#11126)
    - Optimize 32bit memset/memcpy with SSE2/SSSE3
    - Relax feature tests in headers


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-5
changelog:
  - Update from master.
    - Additional setcontext(), etc. conformance tests (BZ#11115).
    - Handle AT_FDCWD in futimens (BZ#10992).
    - Update poll.h header for POSIX 2008 (BZ#11093).
    - Avoid ELF lookup race.


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-4
changelog:
  - Update from master.
    - Add Requeue-PI support for x86 arch.
    - Redefine O_SYNC and O_DSYNC to match 2.6.33+ kernels.
    - Fix a few error cases in *name4_r lookup handling (BZ#11000).
    - Fix kernel version check in recent ptsname change (BZ#11046).
    - Add more warnings to exec functions (BZ#11056).
    - Add recvmmsg interface.
    - Define SCHED_IDLE and SCHED_RESET_ON_FORK for Linux.


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-3
changelog:
  - Update from master.
    - Fix infloop in __pthread_disable_asynccancel on x86_64 (#537690).
    - Prevent unintended file desriptor leak in grantpt (#530558).
    - Fix startup to security-relevant statically linked binaries (#528631).
  - Re-install CFI in x86/x86_64 clone (#491542).


author: Andreas Schwab <schwab@redhat.com> - 2.11.90-2
changelog:
  - Update from master.
    - Define week, first_weekday, and first_workday for en_DK locale (#525126).
    - Use struct timespec for timestamps in struct stat also if
      __USE_XOPEN2K8 (#539870).
    - Fix week information for nl_NL locale (#499748).
    - Update ntp_gettime for Linux (#479558).
    - Fix getwc* and putwc* on non-wide streams (BZ#10958).
    - Avoid warnings in CPU_* macros when using const bitsets (BZ#10918).
    - Handle LC_GLOBAL_LOCALE in duplocale (BZ#10969).
    - Fix _NC_LOCALE_NAME definition (BZ#10968).
    - Add missing Linux MADV_* definitions (BZ#10972).
    - Add support for new Linux error ERFKILL (BZ#10939).
  - Enable multi-arch support on ppc and ppc64.


author: Andreas Schwab <schwab@redhat.com> - 2.11-2
changelog:
  - Fix readahead on powerpc32.
  - Fix R_PPC64_{JMP_IREL,IRELATIVE} handling.
  - Fix preadv, pwritev and fallocate for -D_FILE_OFFSET_BITS=64 (#533063).


author: Andreas Schwab <schwab@redhat.com> - 2.11-1
changelog:
  - Update to 2.11 release.
  - Disable multi-arch support on PowerPC again since binutils is too old.
  - Fix crash in tzdata-update due to use of multi-arch symbol (#532128).


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-27
changelog:
  - Update from master.
    - Fix races in setXid implementation (BZ#3270).
    - Implement IFUNC for PPC and enable multi-arch support.
    - Implement mkstemps/mkstemps64 and mkostemps/mkostemps64 (BZ#10349).
    - Fix IA-64 and S390 sigevent definitions (BZ#10446).
    - Fix memory leak in NIS grp database handling (BZ#10713).
    - Print timestamp in nscd debug messages (BZ#10742).
    - Fix mixing IPv4 and IPv6 name server in resolv.conf.
    - Fix range checks in coshl.
    - Implement SSE4.2 optimized strchr and strrchr.
    - Handle IFUNC symbols in dlsym (#529965).
    - Misc fixes (BZ#10312, BZ#10315, BZ#10319, BZ#10391, BZ#10425,
      BZ#10540, BZ#10553, BZ#10564, BZ#10609, BZ#10692, BZ#10780,
      BZ#10717, BZ#10784, BZ#10789, BZ#10847
  - No longer build with -fno-var-tracking-assignments.


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-26
changelog:
  - Update from master.
    - Add ____longjmp_chk for sparc.
  - Avoid installing the same libraries twice.


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-25
changelog:
  - Update from master
    - Fix descriptor leak when calling dlopen with RTLD_NOLOAD (#527409).
    - Fix week-1stday in C locale.
    - Check for integer overflows in formatting functions.
    - Fix locale program error handling (#525363).


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-22
changelog:
  - Update from master.
    - Fix endless loop in localedef.
    - Fix __longjmp_chk on s390/s390x.
  - Fix exit codes in nscd start script (#521848).
  - Build with -fno-var-tracking-assignments for now (#523172).


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-20
changelog:
  - Update from master.
    - Fix strstr/strcasestr/fma/fmaf on x86_64 (#519226).
    - Fix lookup of group names in hesiod initgroups (#520472).


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-15
changelog:
  - Update from master.
    - fix fortify failure with longjmp from alternate stack (#512103).
  - Add conflict with prelink (#509655).


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-13
changelog:
  - Update from master.
    - fix rehashing of unique symbols (#515677)
  - Fix spurious messages with --excludedocs (#515948)


author: Andreas Schwab <schwab@redhat.com> - 2.10.90-10
changelog:
  - Update from master.
    * fix memory ordering in pthread_mutex_unlock (BZ#10418)
    * implement RES_USE_DNSSEC option in resolver (#205842)
    * fix hang in ldd -r (#513945)


author: Andreas Schwab <aschwab@redhat.com> 2.10.90-1
changelog:
  - Update from master.
  - Enable multi-arch support on x86/x86-64.
  - Add requires glibc-headers to glibc-devel (#476295).
  - Implement second fallback mode for DNS requests (#505105).
  - Don't generate invalid POSIX TZ string for Asia/Dhaka timezone (#506941).
  - Allow backtrace through __longjmp_chk on powerpc.


author: Jakub Jelinek <jakub@redhat.com> 2.10.1-2
changelog:
  - fix accept4 on architectures other than i?86/x86_64
  - robustify nscd client code during server GC
  - fix up nscd segfaults during daemon shutdown
  - fix memchr on ia64 (BZ#10162)
  - replace the Sun RPC license with the BSD license, with the explicit
    permission of Sun Microsystems
  - fix up powerpc long double errno reporting


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-21
changelog:
  - update from trunk
    - fix localedef
    - fix SHIFT_JIS iconv EILSEQ handling (#497267)
    - misc fixes (BZ#10093, BZ#10100)


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-17
changelog:
  - update from trunk
    - if threads have very small stack sizes, use much smaller buffer
      in __get_nprocs when called from within malloc (#494631)


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-15
changelog:
  - rebuilt with fixed gcc to avoid miscompilation of i586 memmove
  - reenable experimental malloc again


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-11
changelog:
  - update from trunk
    - POSIX 2008 prototype adjustments for scandir{,64}, alphasort{,64} and
      versionsort{,64}
    - fix libthread_db (#491197)


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-9
changelog:
  - update from trunk
    - POSIX 2008 support: -D_XOPEN_SOURCE=700 and -D_POSIX_C_SOURCE=200809L
  - move libnldbl_nonshared.a on ppc*/s390*/sparc* back to glibc-devel


author: Jakub Jelinek <jakub@redhat.com> 2.9.90-7
changelog:
  - update from trunk
  - adjust for i586 + i686 from i386 + i686 build
  - split static libraries into glibc-static subpackage
  - ld -r the whole libpthread.a together to avoid endless issues with
    -static ... -lpthread
  - require 2.6.18 and later kernel


author: Jakub Jelinek <jakub@redhat.com> 2.9-3
changelog:
  - temporarily disable _nss_dns_gethostbyname4_r (#459756)
  - NIS hostname lookup fixes (#473073, #474800, BZ#7058)
  - fix unsetenv (#472941)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-17
changelog:
  - update from trunk
    - don't abort on broken DNS replies (#469299, BZ#7009)
    - misc fixes (BZ#6966, BZ#7008, BZ#6955, BZ#6843)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-16
changelog:
  - update from trunk
    - further resolver fixes
    - another dynamic TLS handling fix (#469263)
    - misc fixes (BZ#6867, BZ#6875, BZ#6919, BZ#6920, BZ#6942, BZ#6947,
  		BZ#6968, BZ#6974, BZ#6980, BZ#6995)
  - rebuild with newer rpm to avoid stripping
    shared libraries when they shouldn't be (#468129)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-14
changelog:
  - update from trunk
    - fix dynamic TLS handling (#467309)
    - fix sys/signalfd.h for C++ (#467172)
    - fix sprof (#458861)
    - fix _mcount and socket syscalls on s390x (#464146)
    - try harder to allocate memory in valloc and pvalloc (#461481)
  - fix power6 32-bit libs (#467311)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-12
changelog:
  - update from trunk
    - revert origin changes (#457849)
    - use MAP_STACK for thread stacks
    - misc fixes (BZ#6845, BZ#6544, BZ#6634, BZ#6589, BZ#6790, BZ#6791,
      BZ#6824)
    - power7 bits (BZ#6817)
    - fix expm1 on i?86/x86_64 (#43354, BZ#5794)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-11
changelog:
  - update from trunk
    - fix non-absolute $ORIGIN handling (#457560)
    - exported some further libresolv APIs (#453325)
    - misc fixes


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-10
changelog:
  - update from trunk
    - resolver fixes
    - misc fixes (BZ#6771, BZ#6763, BZ#6698, BZ#6712)
    - s390{,x} utmp/utmpx bi-arch support (BZ#6724)
    - popen "e" flag
  - fr_FR locale changes reenabled


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-9
changelog:
  - update from trunk
    - fix unbuffered vfprintf if writing to the stream fails (#455360)
    - remove useless "malloc: using debugging hooks" message (#455355)
    - nscd fixes
    - fix resolver alignment issues (#454500)
    - fix setvbuf (BZ#6719)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-7
changelog:
  - update from trunk
    - avoid *lround* on ppc* clobbering cr3/cr4 registers (#450790)
    - further nscd fixes (#450704)
    - use inotify in nscd to watch files


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-6
changelog:
  - update from trunk
    - nscd fixes (#450704)
    - fix getservbyport (#449358)
    - fix regexp.h (#446406)
    - avoid crashing on T_DNAME in DNS responses (#450766)


author: Jakub Jelinek <jakub@redhat.com> 2.8.90-1
changelog:
  - update to trunk
    - O(n) memmem/strstr/strcasestr
    - i386/x86_64 TLS descriptors support
    - concurrent IPv4 and IPv6 DNS lookups by getaddrinfo


author: Jakub Jelinek <jakub@redhat.com> 2.8-3
changelog:
  - don't run telinit u in %post if both /dev/initctl and
    /sbin/initctl exist (#444978)
  - workaround GCC ppc64 miscompilation of c{log{,10},acosh,atan}l
    (#444996)


author: Jakub Jelinek <jakub@redhat.com> 2.8-2
changelog:
  - fix nscd races during GC (BZ#5381)
  - rebuilt with fixed GCC to fix regex miscompilation on power6
  - SPARC fixes


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-16
changelog:
  - update to trunk
    - misc fixes (BZ#4997, BZ#5741)
    - make sure all users of __libc_setlocale_lock know it is
      now a rwlock
    - fix ppc/ppc64 compatibility _sys_errlist and _sys_siglist
      symbols


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-15
changelog:
  - update to trunk
    - misc fixes (BZ#4314, BZ#4407, BZ#5209, BZ#5436, BZ#5768, BZ#5998,
  		BZ#6024)
  - restart sshd in %post when upstart is used - it doesn't have
    /dev/initctl (#441763)
  - disable assert checking again


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-14
changelog:
  - update to trunk
    - misc fixes (BZ#5443, BZ#5475, BZ#5478, BZ#5939, BZ#5979, BZ#5995,
  		BZ#6004, BZ#6007, BZ#6020, BZ#6021, BZ#6042)
    - change mtrace to keep perl 5.10 quiet (#441082)
    - don't share conversion state between mbtowc and wctomb (#438687)
    - if st_blksize is too large and malloc fails, retry with smaller
      buffer in opendir (#430768)
    - correct *printf overflow test (#358111)


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-13
changelog:
  - update to trunk
    - don't define ARG_MAX in <limits.h>, as it is no longer
      constant - use sysconf (_SC_ARG_MAX) to get the current
      argument size limit
    - fix build on sparc64
  - only service sshd condrestart if /etc/rc.d/init.d/sshd exists
    (#428859)


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-12
changelog:
  - update to trunk
    - new CLONE_* flags in <sched.h> (#438542)
    - nis+ errno clobbering fix (#437945)
    - fix adjtime (#437974)


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-8
changelog:
  - update to trunk
    - {,v}{as,d}printf and obstack_{,v}printf fortification (#435905)
    - fix getnameinfo/gethostbyaddr (#428067, BZ#5790)
    - fix yp_order (#435519, BZ#5854)
    - misc fixes (BZ#5779, BZ#5736, BZ#5627, BZ#5818, BZ#5012)
  - merge review cleanup (Tom Callaway, #225806)


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-7
changelog:
  - update to trunk
    - make NI_MAXHOST and NI_MAXSERV available even in BSDish
      namespaces (BZ#5737)
    - timerfd_* syscalls


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-4
changelog:
  - update to trunk
    - misc fixes (BZ#5541, BZ#5545, BZ#5553, BZ#5112, BZ#5520)
    - getaddrinfo fixes
    - signalize EOVERFLOW from sem_post instead of overflowing
      the counter
    - fix i?86 makecontext
    - fix iconv for iso-2022-jp//translit (#397021)


author: Jakub Jelinek <jakub@redhat.com> 2.7.90-3
changelog:
  - update to trunk
    - fix recognition of interface family (#425768)
    - add __THROW to __ctype_{b,tolower,toupper}_loc prototypes


author: Jakub Jelinek <jakub@redhat.com> 2.7-1
changelog:
  - glibc 2.7 release
  - fix tzfile.c for times after last transition (#333561)
  - fix sem_post@GLIBC_2.0 on i?86
  - appease valgrind in libpthread.so initialization
  - misc fixes (BZ#3425, BZ#5184, BZ#5186)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-20
changelog:
  - install <bits/error.h> (#330031)
  - disable -D_FORTIFY_SOURCE{,=2} support (with a warning) for
    GCC 3.4.x and earlier(#327641)
  - pl_PL locale changes (BZ#4098, #242296)
  - misc fixes (BZ#1140, BZ#3195, BZ#3242, BZ#4359)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-18
changelog:
  - add signalfd, eventfd, eventfd_read, eventfd_write
  - qsort speedups
  - workaround for cpuid bugs (#324081)
  - make sure gettext's conversion_lock is initialized even if
    program isn't linked against libpthread.so.0, only dlopens it (#321761)
  - misc fixes (BZ#5112, BZ#5113, BZ#5104, BZ#5063, BZ#5010, BZ#4407,
    BZ#3924, BZ#5103, BZ#2633, BZ#181, BZ#73, #321901)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-17
changelog:
  - fix {,v}swprintf with -D_FORTIFY_SOURCE=1 -mlong-double-64 on ppc*/s390*/sparc*
  - strcoll fixes
  - misc fixes (BZ#645, BZ#5071)
  - locale fixes (BZ#4941, #299321, #203364, #196711, #236212)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-16
changelog:
  - misc fixes (BZ#4963, BZ#4972, BZ#5028, BZ#5043, BZ#5058)
  - improve -D_FORTIFY_SOURCE{,=2} diagnostic through warning/error
    attributes
  - fix wcscpy, wcpcpy, fgetws, fgetws_unlocked, swprintf and vswprintf
    fortification inlines
  - fix a scalability issue with lazy binding in heavily multithreaded
    programs


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-14
changelog:
  - -D_FORTIFY_SOURCE{,=2} support for C++
  - fortification of fread{,_unlocked}
  - support *scanf m allocation modifier (%ms, %mls, %mc, ...)
  - in -std=c99 or -D_XOPEN_SOURCE=600 mode don't recognize
    %as, %aS and %a[ as a GNU extension for *scanf
  - fix splice, vmsplice, tee return value, make them cancellation
    points
  - mq_open checking
  - use inline function rather than function-like macro
    for open{,at}{,64} checking
  - IFA_F_OPTIMISTIC handling in getaddrinfo (#259681)
  - fix an ABBA deadlock in ld.so (#284171)
  - remove sparc{32,64} unwind info from _start and clone


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-12
changelog:
  - readd x86_64 gettimeofday stuff, initialize it earlier
  - nis_list fix (#254115)
  - workaround for bugs in ia64 silly /emul/ia32-linux hack (#253961)
  - misc fixes (BZ#3924, BZ#4566, BZ#4582, BZ#4588, BZ#4726, BZ#4946,
    BZ#4905, BZ#4814, BZ#4925, BZ#4936, BZ#4896, BZ#4937, BZ#3842,
    BZ#4554, BZ#4557, BZ#4938)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-11
changelog:
  - remove __strtold_internal and __wcstold_internal from ppc*/s390*/sparc*
    *-ldbl.h headers
  - temporarily backout x86_64 gettimeofday.S changes (#252453)
  - some further sparc, sparc64 and alpha fixes


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-10
changelog:
  - don't open /etc/ld.so.{cache,preload} with O_NOATIME (#252146)
  - s390{,x}, alpha and sparc fixes
  - sparcv9 is no longer an aux arch, as we expect
    to not build sparc.rpm glibc any longer, only sparcv9.rpm,
    sparc64.rpm and new two aux arches sparcv9v.rpm and sparc64v.rpm


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-9
changelog:
  - private futex even for mutexes and condvars
  - some further O_CLOEXEC changes
  - use vDSO on x86_64 if available
  - ia64 build fixes (#251983)


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-3
changelog:
  - fix open{,at}{,64} macro for -pedantic (#250897)
  - add transliteration for l with stroke (#250492)
  - fix strtod ("-0", NULL)
  - update License tag


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-2
changelog:
  - make aux-cache purely optional performance optimization in ldconfig,
    don't issue any errors if it can't be created (#250430)
  - remove override_headers hack, BuildRequire >= 2.6.22 kernel-headers
    and rely on its content


author: Jakub Jelinek <jakub@redhat.com> 2.6.90-1
changelog:
  - update to trunk
    - private futex optimizations
    - open{,at}{,64} argument checking
  - ldconfig speedups


author: Jakub Jelinek <jakub@redhat.com> 2.6-4
changelog:
  - filter <built-in> pseudo-files from debuginfo source lists (#245714)
  - fix sscanf when errno is EINTR before the call (BZ#4745)
  - save/restore errno around reading /etc/default/nss (BZ#4702)
  - fix LD_HWCAP_MASK handling
  - disable workaround for #210748, instead backport
    ld.so locking fixes from the trunk (#235026)
  - new x86_64 memcpy
  - don't write uninitialized padding bytes to nscd socket
  - fix dl{,v}sym, dl_iterate_phdr and dlopen if some library is
    mapped into ld.so's inter-segment hole on x86_64 (#245035, #244545)
  - fix LD_AUDIT=a:b program (#180432)
  - don't crash on pseudo-zero long double values passed to
    *printf on i?86/x86_64/ia64 (BZ#4586)
  - fix *printf %La and strtold with some hexadecimal floating point
    constants on ppc/ppc64
  - fix nextafterl on ppc/ppc64
  - fix sem_timedwait on i?86 and x86_64


author: Jakub Jelinek <jakub@redhat.com> 2.6-3
changelog:
  - don't use %config(missingok) for locale-archive.tmpl,
    instead of removing it altogether truncate it to zero
    size (#240697)
  - add a workaround for #210748


author: Jakub Jelinek <jakub@redhat.com> 2.6-2
changelog:
  - restore malloc_set_state backwards compatibility (#239344)
  - fix epoll_pwait (BZ#4525)
  - fix printf with unknown format spec or positional arguments
    and large width and/or precision (BZ#4514)
  - robust mutexes fix (BZ#4512)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-23
changelog:
  - use madvise MADV_DONTNEED in malloc
  - fix ia64 feraiseexcept
  - fix s390{,x} feholdexcept (BZ#3427)
  - ppc fenv fixes
  - make fdatasync a cancellation point (BZ#4465)
  - fix *printf for huge precisions with wide char code and multi-byte
    strings
  - fix dladdr (#232224, BZ#4131)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-22
changelog:
  - add transliteration for <U2044> (BZ#3213)
  - fix *scanf with %f on hexadecimal floats without exponent (BZ#4342)
  - fix *printf with very large precisions for %s (#238406, BZ#4438)
  - fix inet_ntop size checking for AF_INET (BZ#4439)
  - for *printf %e avoid 1.000e-00, for exponent 0 always use + sign (#238431)
  - fix a regression introduced in #223467 changes
  - gethostby*_r alignment fixes (BZ#4381)
  - fix ifaddrs error handling


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-21
changelog:
  - don't include individual locale files in glibc-common,
    rather include prepared locale-archive template and let
    build-locale-archive create locale-archive from the template
    and any user supplied /usr/lib/locale/*_* directories,
    then unlink the locale-archive template - this should save
    > 80MB of glibc-common occupied disk space
  - fix _XOPEN_VERSION (BZ#4364)
  - fix printf with %g and values tiny bit smaller than 1.e-4 (#235864,
    BZ#4362)
  - fix NIS+ __nisfind_server (#235229)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-20
changelog:
  - assorted NIS+ speedups (#223467)
  - fix HAVE_LIBCAP configure detection (#178934)
  - remove /usr/sbin/rpcinfo from glibc-common (#228894)
  - nexttoward*/nextafter* fixes (BZ#3306)
  - feholdexcept/feupdateenv fixes (BZ#3427)
  - speed up fnmatch with two or more * in the pattern


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-19
changelog:
  - fix power6 libm compat symbols on ppc32 (#232633)
  - fix child refcntr in NPTL fork (#230198)
  - fix ifaddrs with many net devices on > 4KB page size arches (#230151)
  - fix pthread_mutex_timedlock on x86_64 (#228103)
  - various fixes (BZ#3919, BZ#4101, BZ#4130, BZ#4181, BZ#4069, BZ#3458)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-18
changelog:
  - fix nftw with FTW_CHDIR on / (BZ#4076)
  - nscd fixes (BZ#4074)
  - fix fmod{,f,l} on i?86 (BZ#3325)
  - support localized digits for fp values in *scanf (BZ#2211)
  - namespaces fixes (BZ#2633)
  - fix euidaccess (BZ#3842)
  - glob fixes (BZ#3996)
  - assorted locale data fixes (BZ#1430, BZ#672, BZ#58, BZ#3156,
    BZ#2692, BZ#2648, BZ#3363, BZ#3334, BZ#3326, BZ#3322, BZ#3995,
    BZ#3885, BZ#3884, BZ#3851)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-17
changelog:
  - RFC2671 support in resolver (#205842)
  - fix strptime (BZ#3944)
  - fix regcomp with REG_NEWLINE (BZ#3957)
  - fix pthread_mutex_timedlock on x86_64 (#228103)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-16
changelog:
  - add strerror_l
  - fix application crashes when doing NSS lookups through nscd
    mmapped databases and nscd decides to start garbage collection
    during the lookups (#219145, #225315)
  - fix %0lld printing of 0LL on 32-bit architectures (BZ#3902)
  - ignore errors from install-info in glibc-devel scriptlets
    (#223691)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-15
changelog:
  - fix NIS getservbyname when proto is NULL
  - fix nss_compat +group handling (#220658)
  - cache services in nscd
  - fix double free in fts_close (#222089)
  - fix vfork+execvp memory leak (#221187)
  - soft-fp fixes (BZ#2749)
  - further strtod fixes (BZ#3855)
  - make sure pthread_kill doesn't return EINVAL even if
    the target thread exits in between pthread_kill ESRCH check
    and the actual tgkill syscall (#220420)
  - fix ABBA deadlock possibility in ld.so scope locking code


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-14
changelog:
  - fix {j,m}rand48{,_r} on 64-bit arches (BZ#3747)
  - handle power6x AT_PLATFORM (#216970)
  - fix a race condition in getXXbyYY_r (#219145)
  - fix tst-pselect testcase


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-13
changelog:
  - fix setcontext on ppc32 (#219107)
  - fix wide stdio after setvbuf (#217064, BZ#2337)
  - handle relatime mount option in statvfs
  - revert i?86/x86_64 clone CFI temporarily


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-12
changelog:
  - fix hasmntopt (#218802)
  - fix setusershell and getusershell (#218782)
  - strtod fixes (BZ#3664, BZ#3673, BZ#3674)
  - fix memusage with realloc (x, 0)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-11
changelog:
  - allow suid apps to setenv NIS_PATH and influence through that
    nis_list and nis_lookup (#209155)
  - fix ttyname and ttyname_r with invalid file descriptor (#218276)
  - cs_CZ LC_TIME fixes (#218438)
  - fix build with 2.6.19+ headers (#217723)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-9
changelog:
  - fix last svc_run change (#217850)
  - on ppc64 build __libc_start_main without unwind info,
    as it breaks MD_FROB_UPDATE_CONTEXT (#217729, #217775; in the
    future that could be fixable just by providing .cfi_undefined r2
    in __libc_start_main instead)
  - add unwind info for x86-64 restore_rt signal return landing pad
    (#217087)
  - add power6x subdir to /lib/ and /lib/rtkaio/,
    link all libs from ../power6/* into them


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-8
changelog:
  - fix svc_run (#216834, BZ#3559)
  - add -fasynchronous-unwind-tables to CFLAGS (#216518)
  - make sure there is consistent timestamp for /etc/ld.so.conf,
    /etc/localtime and /etc/rpc between multilib glibc rpms


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-7
changelog:
  - handle IPv6 addresses in /etc/hosts that are mappable to
    IPv4 addresses in IPv4 host lookups (#215283)
  - fix :include: /etc/alias handling (#215572)
  - handle new tzdata format to cope with year > 2037 transitions
    on 64-bit architectures


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-5
changelog:
  - fix sysconf (_SC_LEVEL{2,3}_CACHE_SIZE) on Intel Core Duo
    CPUs
  - fix libthread_db.so on TLS_DTV_AT_TP architectures
  - fix --inhibit-rpath (#214569)
  - fix _r_debug content when prelinked ld.so executes
    a program as its argument
  - fix strxfrm
  - powerpc-cpu add-on updates


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-4
changelog:
  - fix atexit backwards compatibility (#213388)
  - add mai_IN locale (#213415)
  - remove bogus /usr/lib/librt.so.1 symlink (#213555)
  - fix memusage (#213656)
  - change libc.info category (#209493)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-2
changelog:
  - fix ia64 build
  - don't call _dl_close outside of dl_load_lock critical section
    if dlopen failed (BZ#3426)
  - add rtld scope locking (#211133)


author: Jakub Jelinek <jakub@redhat.com> 2.5.90-1
changelog:
  - fix i?86 6 argument syscalls (e.g. splice)
  - fix rtld minimal realloc (BZ#3352)
  - fix RFC3484 getaddrinfo sorting according to rules 4 and 7 (BZ#3369)
  - fix xdrmem_setpos (#211452)
  - bump __GLIBC_MINOR__
  - increase PTHREAD_STACK_MIN on ppc{,64} to 128K to allow
    64K pagesize kernels (#209877)
  - speed up initgroups on NIS+ (#208203)


author: Jakub Jelinek <jakub@redhat.com> 2.5-2
changelog:
  - fix nscd database growing (#207928)
  - bypass prelinking when LD_DYNAMIC_WEAK=1 is in the environment


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-35
changelog:
  - fix glob with large number of matches (BZ#3253)
  - fix fchownat on kernels that don't support that syscall (BZ#3252)
  - fix lrintl on s390{,64}


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-34
changelog:
  - fix ppc{32,64} longjmp (BZ#3225)
  - fix user visible spelling errors (BZ#3137)
  - fix l{,l}rint{,f,l} around zero (BZ#2592)
  - avoid stack trampoline in s390{,x} makecontext


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-33
changelog:
  - fix dlclose (#206639)
  - don't load platform optimized libraries if kernel doesn't set
    AT_PLATFORM
  - fix ppc{32,64} libSegFault.so
  - use -mtune=generic even for glibc-devel.i386 (#206437)
  - fix /lib/librt.so.1 symlink


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-32
changelog:
  - on ppc* use just AT_PLATFORM and altivec AT_HWCAP bit for library selection
  - fix lrintl and lroundl on ppc{,64}
  - use hidden visibility on fstatat{,64} and mknodat in libc_nonshared.a


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-31
changelog:
  - fix pthread_cond_{,timed}wait cancellation (BZ#3123)
  - fix lrint on ppc32 (BZ#3155)
  - fix malloc allocating more than half of address space (BZ#2775)
  - fix mktime on 32-bit arches a few years after 2038 (BZ#2821)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-30
changelog:
  - add librtkaio, to use it add /%{lib}/rtkaio to your
    LD_LIBRARY_PATH or /etc/ld.so.conf
  - fix or_IN February name (#204730)
  - fix pthread_create called from cancellation handlers (BZ#3124)
  - fix regex case insensitive searches with characters where upper
    and lower case multibyte representations have different length
    (e.g. I and dotless i, #202991)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-29
changelog:
  - randomize resolver query ids before use instead after use (#205113)
  - fix resolver symver checking with DT_GNU_HASH (#204909)
  - put .hash section in glibc libraries at the end of RO segment
    when .gnu.hash is present


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-27
changelog:
  - allow $LIB and $PLATFORM in dlopen parameters even in suid/sgid (#204399)
  - handle $LIB/$PLATFORM in LD_LIBRARY_PATH
  - fix splice prototype (#204530)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-26
changelog:
  - real fix for the doubly linked list corruption problem
  - try harder in realloc to allocate memory (BZ#2684)
  - fix getnameinfo error reporting (#204122)
  - make localedef more robust on invalid input (#203728)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-25
changelog:
  - temporarily back out code to limit number of unsorted block
    sort iterations (#203735, #204027)
  - handle PLT symbols in dladdr properly (BZ#2683)
  - avoid malloc infinite looping for allocations larger than
    the system can allocate (#203915)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-23
changelog:
  - malloc fixes, especially for 32-bit arches (#202309)
  - further *_IN locale fixes (#200230)
  - fix get{serv,rpc}ent{,_r} if NIS map is empty (#203237)
  - fix /usr/bin/iconv (#203400)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-21
changelog:
  - if some test gets stuck, kill the tee process after make check
    finishes
  - build with -mtune=generic on i686 and x86_64


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-19
changelog:
  - adaptive malloc brk/mmap threshold
  - fix fchownat to use kernel syscall (if available) on many arches (#201870)
  - only define O_DIRECT with -D_GNU_SOURCE on ia64 to match all
    other arches (#201748)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-18
changelog:
  - NIS+ fixes
  - fix memusage and xtrace scripts (#200736)
  - redirect /sbin/service sshd condrestart std{out,err} to /dev/null
    when executed from glibc_post_upgrade


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-16
changelog:
  - fix dladdr on binaries/libraries with only DT_GNU_HASH and no
    DT_HASH (#200635)
  - fix early timeout of initgroups data in nscd (#173019)
  - add am/pm display to es_PE and es_NI locales (#167101)
  - fix nss_compat failures when nis/nis+ unavailable (#192072)


author: Roland McGrath <roland@redhat.com> 2.4.90-15
changelog:
  - fix missing destructor calls in dlclose (#197932)
  - enable transliteration support in all locales (#196713)
  - disallow RTLD_GLOBAL flag for dlmopen in secondary namespaces (#197462)
  - PI mutex support


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-12
changelog:
  - buildrequire gettext
  - enable fstatat64/newfstatat syscalls even on ppc*/s390*/ia64 (#196494)
  - fix out of memory behavior in gettext (#194321)
  - fix regex on multi-byte non-UTF-8 charsets (#193873)
  - minor NIS+ fixes (#190803)
  - don't use cancellable calls in posix_spawn* and only set{u,g}id
    current thread if requested (#193631)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-11
changelog:
  - don't exit from nscd -i <database> before the database is
    actually invalidated, add locking to prune_cache (#191464)
  - build glibc-devel.i386 static libraries with
    -mno-tls-direct-seg-refs -DNO_TLS_DIRECT_SEG_REFS
  - RFC3542 support (advanced API for IPv6; #191001, BZ##2693)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-8
changelog:
  - update from CVS
    - fix nss_compat when SETENT_BATCH_READ=TRUE is in /etc/default/nss
    - fix RFC3484 precedence table for site-local and ULA addresses (#188364)
    - fix a sunrpc memory leak


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-5
changelog:
  - update from CVS
    - some NIS+ fixes
    - allow overriding rfc3484 address sorting tables for getaddrinfo
      through /etc/gai.conf (sample config file included in %doc directory)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-4
changelog:
  - update from CVS
    - SETENT_BATCH_READ /etc/default/nss option for speeding up
      some usages of NIS+ (#188246)
    - move debug state change notification (#179208)
    - fix ldd script if one of the dynamic linkers is not installed (#190259)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-3
changelog:
  - update from CVS
    - fix a typo in nscd.conf (#190085)
    - fix handling of SIGHUP in nscd when some caches are disabled (#189978)
    - make nscd paranoia mode working with non-root server-user (#189779)


author: Jakub Jelinek <jakub@redhat.com> 2.4.90-2
changelog:
  - update from CVS
    - fix getaddrinfo (#190002)
    - add auto-propagate nscd.conf options (#177154)
    - fix nscd auditing (#169148)


author: Jakub Jelinek <jakub@redhat.com> 2.4-6
changelog:
  - update from CVS
    - NIS+ fixes
    - don't segfault on too large argp key values (#189545)
    - getaddrinfo fixes for RFC3484 (#188364)


author: Jakub Jelinek <jakub@redhat.com> 2.4-5
changelog:
  - update from CVS
    - pshared robust mutex support
    - fix btowc and bwtoc in C++ (#186410)
    - fix NIS+ (#186592)
    - don't declare __wcsto*l_internal for non-GCC or if not -O1+ (#185667)
  - don't mention nscd failures on 2.0 kernels (#185335)


author: Jakub Jelinek <jakub@redhat.com> 2.4-2
changelog:
  - accurate unwind info for lowlevellock.h stubs on %{ix86}
  - fix ppc/ppc64 ceill, floorl, rintl, roundl and truncl (BZ#2423)


author: Jakub Jelinek <jakub@redhat.com> 2.3.91-2
changelog:
  - update from CVS
    - fix sYSMALLOc for MALLOC_ALIGNMENT > 2 * SIZE_SZ (#183895)
    - revert ppc32 malloc alignment patch, it breaks malloc_set_state
      and needs some further thoughts and time (#183894)
  - provide accurate unwind info for lowlevellock.h stubs on x86_64


