# changelog

author: Lukas Nykryn <lnykryn@redhat.com> - 033-571
changelog:
  - Drop dependency on bridge-utils
  - dracut.sh: disable lsinitrd logging when quiet
  - netlib: fix botched backport


author: EL Errata <el-errata_ww@oracle.com> - 033-572.0.1
changelog:
  - Fix boot disk hung due raid1 corruption [Orabug: 31134130]
  - Send DHCP query only on min BDF device to improve boot times by 50-60 secs [Orabug: 29962625]
  - bcache module removed (now in bcache-tools upstream) [Orabug: 30800803]
  - add ofb and cfb to 01fips kernel module list [Orabug: 30622681]
  - Fix dhclient classless static route parsing [Orabug: 28881975]
  - Add new rd.iscsi.bypass parameter to always prefer root=, if it exists [Orabug: 30312004]
  - Remove 0560-95iscsi-iscsiroot-synchronously-wait-until-iscsistar.patch [Orabug: 30100182]
  - Oracle kernels are now shipped with .xz compressed modules - strip .xz before calculating module name ( backwards compatible ) [Orabug: 28622864] (Alex Burmashev)
  - 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
  - Enhancement of module alias handling for kernel upgrade and downgrade compatibility [Orabug: 24408414]
  - Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] (kevin.x.lyons@oracle.com)
  - Update 0001-Dracut-Handle-module-alias-of-the-running-kernel.patch to redirect to &1 instead of /dev/null [Orabug 24346754] [Orabug: 24658791] (Manjunath Govind)
  - add Handle module alias of the running kernel [Orabug: 24346754] (Manjunath Govind)
  - add Correctly handle module aliases [Orabug: 22600855] (Fabian Vogt)
  - add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)
  - parametrize initrd DAD packets to boot faster [Orabug: 27910517]
  - 01fips: Add sha3_generic module (Khalid Aziz <khalid.aziz@oracle.com>)


author: Tomas Mraz <tmraz@redhat.com> - 1.2.0-1
changelog:
  - add lib subpackage to avoid multilib on the base package
  - add ability to compute hmacs on multiple files at once
  - improved debugging with FIPSCHECK_DEBUG


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 1:6.0.0-13
changelog:
  - Explicitly added '-g' option into CFLAGS & CXXFLAGS to correctly build .debug_info for i386 (bug #1413034)
  - Added a workaround to correctly add hardening flags during build process (bug #1406689)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-9
changelog:
  - Amended fix for FIPS enforcement issue (#1163848)
  - Fixed issue with applications that close all file descriptors (#1165047)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-11
changelog:
  - Applied fix for urandom FD in FIPS140 mode (#1165047)
  - Applied fix for FIPS140-2 related regression (#1110696)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-13
changelog:
  - Corrected reseed and respect of max_number_of_bits_per_request in 
    FIPS140-2 mode. Also enhanced the initial tests. (#1228199)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.24-1
changelog:
  - Addressed issue with DSA public keys smaller than 2^1024 (#1238279)
  - Addressed two-byte buffer overflow in the DTLS-0.9 protocol (#1209365)
  - When writing certificates to smart cards write the CKA_ISSUER and
    CKA_SERIAL_NUMBER fields to allow NSS reading them (#1272179)
  - Use the shared system certificate store (#1110750)
  - Address MD5 transcript collision attacks in TLS key exchange (#1289888, 
    CVE-2015-7575)
  - Allow hashing data over 2^32 bytes (#1306953)
  - Ensure written PKCS#11 public keys are not marked as private (#1339453)
  - Ensure secure_getenv() is called on all uses of environment variables
    (#1344591).
  - Fix issues related to PKCS #11 private key listing on certain HSMs
    (#1351389)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-7
changelog:
  - Address interoperability issue with 3.5.x (#1388932)
  - Reject CAs which are both trusted and blacklisted in trust module (#1375303)
  - Added new functions to set issuer and subject ID in certificates (#1378373)
  - Reject connections with less than 1024-bit DH parameters (#1335931)
  - Fix issue that made GnuTLS parse only the first 32 extensions (#1383748)
  - Mention limitations of certtool in manpage (#1375463)
  - Read PKCS#8 files with HMAC-SHA256 -as generated by openssl 1.1 (#1380642)
  - Do not link directly to trousers but instead use dlopen (#1379739)
  - Fix incorrect OCSP validation (#1377569)
  - Added support for pin-value in PKCS#11 URIs (#1379283)
  - Added the --id option to p11tool (#1399232)
  - Improved sanity checks in RSA key generation (#1444780)
  - Addressed CVE-2017-5334, CVE-2017-5335, CVE-2017-5336, CVE-2017-5337,
    CVE-2017-7869


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-9
changelog:
  - Address crash in OCSP status request extension, by eliminating the
    unneeded parsing (CVE-2017-7507, #1455828)


author: Anderson Sasaki <ansasaki@redhat.com> 3.3.29-8
changelog:
  - Backported --sni-hostname option which allows overriding the hostname
    advertised to the peer (#1444792)
  - Improved counter-measures in TLS CBC record padding for lucky13 attack
    (CVE-2018-10844, #1589704, CVE-2018-10845, #1589707)
  - Added counter-measures for "Just in Time" PRIME + PROBE cache-based attack
    (CVE-2018-10846, #1589708)
  - Address p11tool issue in object deletion in batch mode (#1375307)
  - Backport PKCS#11 tests from master branch. Some tests were disabled due to
    unsupported features in 3.3.x (--load-pubkey and --test-sign options, ECC key
    generation without login, and certificates do not inherit ID from the private
    key)
  - p11tool explicitly marks certificates and public keys as NOT private objects
    and private keys as private objects
  - Enlarge buffer size to support resumption with large keys (#1542461)
  - Legacy HMAC-SHA384 cipher suites were disabled by default
  - Added DSA key generation to p11tool (#1464896)
  - Address session renegotiation issue using client certificate (#1434091)
  - Address issue when importing private keys into Atos HSM (#1460125)


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2102.200.4.el7uek]
changelog:
  - Revert "rds: Deregister all FRWR mr with free_mr" (aru kolappan)  [Orabug: 32426609]  
  - thermal: intel_pch_thermal: Add PCI ids for Lewisburg PCH. (Andres Freund)  [Orabug: 32424704]  
  - thermal: intel: intel_pch_thermal: Add Cannon Lake Low Power PCH support (Sumeet Pawnikar)  [Orabug: 32424704]  
  - thermal: intel: intel_pch_thermal: Add Comet Lake (CML) platform support (Gayatri Kammela)  [Orabug: 32424704]  
  - KVM: x86: Expose AVX512_FP16 for supported CPUID (Cathy Zhang)  [Orabug: 32424461]  
  - x86/kvm: Expose TSX Suspend Load Tracking feature (Cathy Zhang)  [Orabug: 32424461]  
  - x86: Expose SERIALIZE for supported cpuid (Paolo Bonzini)  [Orabug: 32424461]  
  - KVM: x86: Expose fast short REP MOV for supported cpuid (Zhenyu Wang)  [Orabug: 32424461]  
  - KVM: x86: Expose AVX512 VP2INTERSECT in cpuid for TGL (Zhenyu Wang)  [Orabug: 32424461]  
  - tools: update header files in the tools directory (Thomas Tai)  [Orabug: 32424461]  
  - x86: Enumerate AVX512 FP16 CPUID feature flag (Kyung Min Park)  [Orabug: 32424461]  
  - EDAC/i10nm: Add Intel Sapphire Rapids server support (Qiuxu Zhuo)  [Orabug: 32424461]  
  - EDAC/i10nm: Use readl() to access MMIO registers (Qiuxu Zhuo)  [Orabug: 32424461]  
  - EDAC: Add DDR5 new memory type (Qiuxu Zhuo)  [Orabug: 32424461]  
  - EDAC: Add three new memory types (Qiuxu Zhuo)  [Orabug: 32424461]  
  - x86/cpufeatures: Enumerate ENQCMD and ENQCMDS instructions (Fenghua Yu)  [Orabug: 32424461]  
  - x86/cpufeatures: Enumerate TSX suspend load address tracking instructions (Kyung Min Park)  [Orabug: 32424461]  
  - x86/cpufeatures: Add enumeration for SERIALIZE instruction (Ricardo Neri)  [Orabug: 32424461]  
  - x86/split_lock: Enable the split lock feature on Sapphire Rapids and Alder Lake CPUs (Fenghua Yu)  [Orabug: 32424461]  
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck)  [Orabug: 32424461]  
  - x86/cpufeatures: Add Architectural LBRs feature bit (Kan Liang)  [Orabug: 32424461]  
  - powercap: intel_rapl: add support for Sapphire Rapids (Zhang Rui)  [Orabug: 32424461]  
  - x86/cpu: Add Sapphire Rapids CPU model number (Tony Luck)  [Orabug: 32424461]  
  - EDAC, {skx,i10nm}: Use CPU stepping macro to pass configurations (Qiuxu Zhuo)  [Orabug: 32424461]  
  - x86/cpu: Add a X86_MATCH_INTEL_FAM6_MODEL_STEPPINGS() macro (Borislav Petkov)  [Orabug: 32424461]  
  - powercap/intel_rapl: Convert to new X86 CPU match macros (Thomas Gleixner)  [Orabug: 32424461]  
  - powercap/intel_rapl: add support for TigerLake Mobile (Zhang Rui)  [Orabug: 32424461]  
  - powercap/intel_rapl: add support for JasperLake (Zhang Rui)  [Orabug: 32424461]  
  - x86/cpufeatures: Add support for fast short REP; MOVSB (Tony Luck)  [Orabug: 32424461]  
  - powercap/intel_rapl: add support for Cometlake desktop (Zhang Rui)  [Orabug: 32424461]  
  - powercap/intel_rapl: add support for CometLake Mobile (Zhang Rui)  [Orabug: 32424461]  
  - crypto: lib/chacha20poly1305 - define empty module exit function (Jason A. Donenfeld)  [Orabug: 32417868]  
  - A/A Bonding: Add synchronized bundle failback (Gerd Rausch)  [Orabug: 32381881]


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2102.200.5.el7uek]
changelog:
  - vhost scsi: alloc vhost_scsi with kvzalloc() to avoid delay (Dongli Zhang)  [Orabug: 32471659]  
  - arm64: Reserve only 256M on RPi for crashkernel=auto (Vijay Kumar)  [Orabug: 32454711]  
  - nbd: freeze the queue while we're adding connections (Josef Bacik)  [Orabug: 32447284]  {CVE-2021-3348} 
  - futex: Handle faults correctly for PI futexes (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347} 
  - futex: Simplify fixup_pi_state_owner() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347} 
  - futex: Use pi_state_update_owner() in put_pi_state() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347} 
  - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347} 
  - futex: Provide and use pi_state_update_owner() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347} 
  - futex: Replace pointless printk in fixup_owner() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347} 
  - futex: Ensure the correct return value from futex_lock_pi() (Thomas Gleixner)  [Orabug: 32447185]  {CVE-2021-3347} 
  - uek-rpm: Enable Oracle Pilot BMC module (Eric Snowberg)  [Orabug: 32422661]  
  - hwmon: Add a new Oracle Pilot BMC driver (Eric Snowberg)  [Orabug: 32422661]  
  - rds: avoid crash on IB conn path shutdown prepare (Alan Maguire)  [Orabug: 32466763]  
  - mm/memcontrol: Increase threshold for draining per-cpu stocked bytes (Imran Khan)  [Orabug: 32314559]


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2102.200.6.el7uek]
changelog:
  - selinux: allow reading labels before policy is loaded (Jonathan Lebon)  [Orabug: 32492276]  
  - rds: tracepoints incorrectly reporting valid rds ping as drop (Alan Maguire)  [Orabug: 32490004]  
  - KVM: arm64: Save/restore sp_el0 as part of __guest_enter (Marc Zyngier)  [Orabug: 32488537]  
  - uek-rpm: config-aarch64: enable MEMORY HOTREMOVE (Mihai Carabas)  [Orabug: 32353873]  
  - arm64/mm/hotplug: Ensure early memory sections are all online (Anshuman Khandual)  [Orabug: 32353873]  
  - arm64/mm/hotplug: Enable MEM_OFFLINE event handling (Anshuman Khandual)  [Orabug: 32353873]  
  - arm64/mm/hotplug: Register boot memory hot remove notifier earlier (Anshuman Khandual)  [Orabug: 32353873]  
  - arm64/mm: Enable memory hot remove (Anshuman Khandual)  [Orabug: 32353873]  
  - arm64/mm: Hold memory hotplug lock while walking for kernel page table dump (Anshuman Khandual)  [Orabug: 32353873]  
  - rds: tracepoint-related KASAN: use-after-free Read in rds_send_xmit (Alan Maguire)  [Orabug: 32490030]  
  - inet: do not call sublist_rcv on empty list (Florian Westphal)  [Orabug: 32422895]  
  - net/mlx4_en: Handle TX error CQE (Moshe Shemesh)  [Orabug: 32485133]  
  - net/mlx4_en: Avoid scheduling restart task if it is already running (Moshe Shemesh)  [Orabug: 32485133]  
  - vdpa/mlx5: allow Jumbo MTU config other than standard sized MTU (Si-Wei Liu)  [Orabug: 32480078]  
  - vdpa/mlx5: should exclude header length and fcs from mtu (Si-Wei Liu)  [Orabug: 32480078]  
  - vdpa/mlx5: Fix memory key MTT population (Eli Cohen)  [Orabug: 32480078]  
  - vdpa: Use simpler version of ida allocation (Parav Pandit)  [Orabug: 32480078]  
  - vdpa: Add missing comment for virtqueue count (Parav Pandit)  [Orabug: 32480078]  
  - vdpa/mlx5: Use write memory barrier after updating CQ index (Eli Cohen)  [Orabug: 32480078]  
  - vdpa: remove unnecessary 'default n' in Kconfig entries (Stefano Garzarella)  [Orabug: 32480078]  
  - vhost_vdpa: switch to vmemdup_user() (Tian Tao)  [Orabug: 32480078]  
  - vhost_vdpa: return -EFAULT if copy_to_user() fails (Dan Carpenter)  [Orabug: 32480078]  
  - vdpa: mlx5: fix vdpa/vhost dependencies (Randy Dunlap)  [Orabug: 32480078]  
  - vdpa/mlx5: Setup driver only if VIRTIO_CONFIG_S_DRIVER_OK (Eli Cohen)  [Orabug: 32480078]  
  - vdpa/mlx5: Fix failure to bring link up (Eli Cohen)  [Orabug: 32480078]  
  - vdpa/mlx5: Make use of a specific 16 bit endianness API (Eli Cohen)  [Orabug: 32480078]  
  - vdpasim: fix "mac_pton" undefined error (Laurent Vivier)  [Orabug: 32480078]  
  - vdpasim: allow to assign a MAC address (Laurent Vivier)  [Orabug: 32480078]  
  - vdpasim: fix MAC address configuration (Laurent Vivier)  [Orabug: 32480078]  
  - vdpa: handle irq bypass register failure case (Zhu Lingshan)  [Orabug: 32480078]  
  - vdpa_sim: Fix DMA mask (Laurent Vivier)  [Orabug: 32480078]  
  - vdpa/mlx5: Fix error return in map_direct_mr() (Jing Xiangfeng)  [Orabug: 32480078]  
  - vhost_vdpa: Return -EFAULT if copy_from_user() fails (Dan Carpenter)  [Orabug: 32480078]  
  - vdpa_sim: implement get_iova_range() (Jason Wang)  [Orabug: 32480078]  
  - vhost: vdpa: report iova range (Jason Wang)  [Orabug: 32480078]  
  - vdpa: introduce config op to get valid iova range (Jason Wang)  [Orabug: 32480078]  
  - vhost_vdpa: remove unnecessary spin_lock in vhost_vring_call (Zhu Lingshan)  [Orabug: 32480078]  
  - vhost_vdpa: Fix duplicate included kernel.h (Tian Tao)  [Orabug: 32480078]  
  - rds: CONFIG_RDS_DEBUG + tracepoints breaks rds build (Alan Maguire)  [Orabug: 32442487]  
  - tools/power turbostat: Support additional CPU model numbers (Len Brown)  [Orabug: 32422450]  
  - tools/power turbostat: Support Tiger Lake (Chen Yu)  [Orabug: 32422450]


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2102.200.7.el7uek]
changelog:
  - KVM: arm64: pmu: Don't mark a counter as chained if the odd one is disabled (Eric Auger)  [Orabug: 32504832]  
  - xen-blkback: fix error handling in xen_blkbk_map() (Jan Beulich)  [Orabug: 32492108]  {CVE-2021-26930} 
  - xen-scsiback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492100]  {CVE-2021-26931} 
  - xen-netback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492100]  {CVE-2021-26931} 
  - xen-blkback: don't "handle" error by BUG() (Jan Beulich)  [Orabug: 32492100]  {CVE-2021-26931} 
  - Xen/gntdev: correct error checking in gntdev_map_grant_pages() (Jan Beulich)  [Orabug: 32492092]  {CVE-2021-26932} 
  - Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() (Jan Beulich)  [Orabug: 32492092]  {CVE-2021-26932} 
  - Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() (Jan Beulich)  [Orabug: 32492092]  {CVE-2021-26932} 
  - Xen/x86: don't bail early from clear_foreign_p2m_mapping() (Jan Beulich)  [Orabug: 32492092]  {CVE-2021-26932}


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2102.200.8.el7uek]
changelog:
  - config: enable CONFIG_MLX5_MPFS (Brian Maly)  [Orabug: 32522477]  
  - random: wire /dev/random with a DRBG instance (Saeed Mirzamohammadi)  [Orabug: 32522086]  
  - crypto: drbg - always try to free Jitter RNG instance (Stephan Müller)  [Orabug: 32522086]  
  - crypto: drbg - always seeded with SP800-90B compliant noise source (Stephan Müller)  [Orabug: 32522086]  
  - crypto: jitter - SP800-90B compliance (Stephan Müller)  [Orabug: 32522086]  
  - crypto: jitter - add header to fix buildwarnings (Ben Dooks)  [Orabug: 32522086]  
  - crypto: jitter - fix comments (Alexander E. Patrakov)  [Orabug: 32522086]  
  - Revert "RDMA/umem: Move to allocate SG table from pages" (John Donnelly)  [Orabug: 32481224]  
  - Revert "lib/scatterlist: Add support in dynamic allocation of SG table from pages" (John Donnelly)  [Orabug: 32481224]  
  - Revert "Maintainer: Fix build warning introduced in commit 99b99d76e6732" (John Donnelly)  [Orabug: 32481224]


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2102.200.10.el7uek]
changelog:
  - scsi: target: core: Make completion affinity configurable (Mike Christie)  [Orabug: 32403502]  
  - target: flush submission work during TMR processing (Mike Christie)  [Orabug: 32403502]  
  - target iblock: add backend plug/unplug callouts (Mike Christie)  [Orabug: 32403502]  
  - target: fix backend plugging (Mike Christie)  [Orabug: 32403502]  
  - target: cleanup cmd flag bits (Mike Christie)  [Orabug: 32403502]  
  - tcm loop: use lio wq cmd submission helper (Mike Christie)  [Orabug: 32403502]  
  - tcm loop: use blk cmd allocator for se_cmds (Mike Christie)  [Orabug: 32403502]  
  - vhost scsi: use lio wq cmd submission helper (Mike Christie)  [Orabug: 32403502]  
  - target: add workqueue based cmd submission (Mike Christie)  [Orabug: 32403502]  
  - target: add gfp_t arg to target_cmd_init_cdb (Mike Christie)  [Orabug: 32403502]  
  - target: remove target_submit_cmd_map_sgls (Mike Christie)  [Orabug: 32403502]  
  - tcm_fc: Convert to new submission API (Mike Christie)  [Orabug: 32403502]  
  - xen-scsiback: Convert to new submission API (Mike Christie)  [Orabug: 32403502]  
  - vhost-scsi: Convert to new submission API (Mike Christie)  [Orabug: 32403502]  
  - usb gadget: Convert to new submission API (Mike Christie)  [Orabug: 32403502]  
  - sbp_target: Convert to new submission API (Mike Christie)  [Orabug: 32403502]  
  - tcm_loop: Convert to new submission API (Mike Christie)  [Orabug: 32403502]  
  - qla2xxx: Convert to new submission API (Mike Christie)  [Orabug: 32403502]  
  - ibmvscsi_tgt: Convert to new submission API (Mike Christie)  [Orabug: 32403502]  
  - srpt: Convert to new submission API (Mike Christie)  [Orabug: 32403502]  
  - target: break up target_submit_cmd_map_sgls (Mike Christie)  [Orabug: 32403502]  
  - target: rename transport_init_se_cmd (Mike Christie)  [Orabug: 32403502]  
  - target: drop kref_get_unless_zero in target_get_sess_cmd (Mike Christie)  [Orabug: 32403502]  
  - target: move t_task_cdb initialization (Mike Christie)  [Orabug: 32403502]  
  - scsi: tcm_loop: Allow queues, can_queue and cmd_per_lun to be settable (Mike Christie)  [Orabug: 32403502]  
  - scsi: target: Make state_list per CPU (Mike Christie)  [Orabug: 32403502]  
  - scsi: target: Drop sess_cmd_lock from I/O path (Mike Christie)  [Orabug: 32403502]  
  - scsi: qla2xxx: Move sess cmd list/lock to driver (Mike Christie)  [Orabug: 32403502]  
  - scsi: target: Remove TARGET_SCF_LOOKUP_LUN_FROM_TAG (Mike Christie)  [Orabug: 32403502]  
  - scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG (Mike Christie)  [Orabug: 32403502]  
  - scsi: target: Fix cmd_count ref leak (Mike Christie)  [Orabug: 32403502]  
  - scsi: target: Fix LUN ref count handling (Mike Christie)  [Orabug: 32403502]  
  - scsi: target: Fix lun lookup for TARGET_SCF_LOOKUP_LUN_FROM_TAG case (Sudhakar Panneerselvam)  [Orabug: 32403502]  
  - scsi: target: Rename target_setup_cmd_from_cdb() to target_cmd_parse_cdb() (Sudhakar Panneerselvam)  [Orabug: 32403502]  
  - scsi: target: Fix NULL pointer dereference (Sudhakar Panneerselvam)  [Orabug: 32403502]  
  - scsi: target: Initialize LUN in transport_init_se_cmd() (Sudhakar Panneerselvam)  [Orabug: 32403502]  
  - scsi: target: Factor out a new helper, target_cmd_init_cdb() (Sudhakar Panneerselvam)  [Orabug: 32403502]  
  - mm: memcontrol: decouple reference counting from page accounting (Johannes Weiner)   
  - uek-rpm: add opbmc to nano-kernel (Eric Snowberg)  [Orabug: 32555675]  
  - rds: rds_drop_egress events should be enabled as part of RDS_RTD_SND (Alan Maguire)  [Orabug: 32587016]  
  - rds: use dedicated rds_send_lock_contention tracepoint instead of drop (Alan Maguire)  [Orabug: 32587016]  
  - rds: ensure saddr/daddr for tracepoints is not NULL (Alan Maguire)  [Orabug: 32580940]  
  - hsr: use netdev_err() instead of WARN_ONCE() (Taehee Yoo)  [Orabug: 32576070]  
  - PCI: hotplug: Add module parameter to allow user control of LEDs (Thomas Tai)  [Orabug: 32556980]  
  - net/rds: increase 1MB MR pool size for RDS (Manjunath Patil)   
  - block/diskstats: accumulate all per-cpu counters in one pass (Konstantin Khlebnikov)  [Orabug: 32531556]  
  - arm64/crash_core: fix TCR_EL1.T1SZ in vmcoreinfo (John Donnelly)  [Orabug: 32559514]  
  - x86/platform/uv: Fix UV4 hub revision adjustment (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Fix copied UV5 output archtype (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Drop last traces of uv_flush_tlb_others (Jiri Slaby)  [Orabug: 32527680]  
  - x86/tlb/uv: Add a forward declaration for struct flush_tlb_info (Borislav Petkov)  [Orabug: 32527680]  
  - x86/platform/uv: Recognize UV5 hubless system identifier (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Remove spaces from OEM IDs (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Fix missing OEM_TABLE_ID (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Update Copyrights to conform to HPE standards (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Update for UV5 NMI MMR changes (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Update UV5 TSC checking (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Update node present counting (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Update UV5 MMR references in UV GRU (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Adjust GAM MMR references affected by UV5 updates (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Update MMIOH references based on new UV5 MMRs (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Add and decode Arch Type in UVsystab (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Add UV5 direct references (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Update UV MMRs for UV5 (Mike Travis)  [Orabug: 32527680]  
  - drivers/misc/sgi-xp: Adjust references in UV kernel modules (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Remove SCIR MMR references for UV systems (Mike Travis)  [Orabug: 32527680]  
  - x86/platform/uv: Remove UV BAU TLB Shootdown Handler (Mike Travis)  [Orabug: 32527680]  
  - x86/apic/uv: Avoid unused variable warning (Arnd Bergmann)  [Orabug: 32527680]  
  - x86/platform/uv: Remove vestigial mention of UV1 platform from bios header (steve.wahl@hpe.com)  [Orabug: 32527680]  
  - x86/platform/uv: Remove support for UV1 platform from uv (steve.wahl@hpe.com)  [Orabug: 32527680]  
  - x86/platform/uv: Remove support for uv1 platform from uv_hub (steve.wahl@hpe.com)  [Orabug: 32527680]  
  - x86/platform/uv: Remove support for UV1 platform from uv_bau (steve.wahl@hpe.com)  [Orabug: 32527680]  
  - x86/platform/uv: Remove support for UV1 platform from uv_mmrs (steve.wahl@hpe.com)  [Orabug: 32527680]  
  - x86/platform/uv: Remove support for UV1 platform from x2apic_uv_x (steve.wahl@hpe.com)  [Orabug: 32527680]  
  - x86/platform/uv: Remove support for UV1 platform from uv_tlb (steve.wahl@hpe.com)  [Orabug: 32527680]  
  - x86/platform/uv: Remove support for UV1 platform from uv_time (steve.wahl@hpe.com)  [Orabug: 32527680]  
  - x86/platform/uv: Remove the unused _uv_cpu_blade_processor_id() macro (Christoph Hellwig)  [Orabug: 32527680]  
  - x86/platform/uv: Unexport uv_apicid_hibits (Christoph Hellwig)  [Orabug: 32527680]  
  - x86/platform/uv: Remove _uv_hub_info_check() (Christoph Hellwig)  [Orabug: 32527680]  
  - x86/platform/uv: Simplify uv_send_IPI_one() (Christoph Hellwig)  [Orabug: 32527680]  
  - x86/platform/uv: Remove the UV*_HUB_IS_SUPPORTED macros (Christoph Hellwig)  [Orabug: 32527680]  
  - x86/platform/uv: Remove the uv_partition_coherence_id() macro (Christoph Hellwig)  [Orabug: 32527680]  
  - x86/apic/uv: Remove code for unused distributed GRU mode (Steve Wahl)  [Orabug: 32527680]  
  - cper,edac,efi: Memory Error Record: bank group/address and chip id (Alex Kluver)  [Orabug: 32526741]  
  - edac,ghes,cper: Add Row Extension to Memory Error Record (Alex Kluver)  [Orabug: 32526741]  
  - perf/x86/intel/uncore: With > 8 nodes, get pci bus die id from NUMA info (Steve Wahl)  [Orabug: 32526200]  
  - perf/x86/intel/uncore: Store the logical die id instead of the physical die id. (Steve Wahl)  [Orabug: 32526200]  
  - perf/x86/intel/uncore: Generic support for the PCI sub driver (Kan Liang)  [Orabug: 32526200]  
  - perf/x86/intel/uncore: Factor out uncore_pci_pmu_unregister() (Kan Liang)  [Orabug: 32526200]  
  - perf/x86/intel/uncore: Factor out uncore_pci_pmu_register() (Kan Liang)  [Orabug: 32526200]  
  - perf/x86/intel/uncore: Factor out uncore_pci_find_dev_pmu() (Kan Liang)  [Orabug: 32526200]  
  - perf/x86/intel/uncore: Factor out uncore_pci_get_dev_die_info() (Kan Liang)  [Orabug: 32526200]


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2102.200.11.el7uek]
changelog:
  - mm/vmscan: fix infinite loop in drop_slab_node (Chunxin Zang)  [Orabug: 32620155]  
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech)  [Orabug: 32603378]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365} 
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech)  [Orabug: 32603378]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365} 
  - scsi: iscsi: Report connection state in sysfs (Gabriel Krisman Bertazi)  [Orabug: 32603378]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365} 
  - sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output (Joe Perches)  [Orabug: 32603378]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365} 
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Lee Duncan)  [Orabug: 32603378]  {CVE-2021-27363} {CVE-2021-27364} {CVE-2021-27365} 
  - drm/nouveau: bail out of nouveau_channel_new if channel init fails (Frantisek Hrbata)  [Orabug: 32591559]  {CVE-2020-25639} 
  - mm: support memblock alloc on the exact node for sparse_buffer_init() (Yunfeng Ye)  [Orabug: 32613823]  
  - mm/sparse.c: do not waste pre allocated memmap space (Michal Hocko)  [Orabug: 32613823]  
  - mm/sparse: consistently do not zero memmap (Vincent Whitchurch)  [Orabug: 32613823]


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2102.200.12.el7uek]
changelog:
  - Revert "x86/platform/uv: Update UV MMRs for UV5" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Add UV5 direct references" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Add and decode Arch Type in UVsystab" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Update MMIOH references based on new UV5 MMRs" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Adjust GAM MMR references affected by UV5 updates" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Update UV5 MMR references in UV GRU" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Update node present counting" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Update UV5 TSC checking" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Update for UV5 NMI MMR changes" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Update Copyrights to conform to HPE standards" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Fix missing OEM_TABLE_ID" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Remove spaces from OEM IDs" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Recognize UV5 hubless system identifier" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/tlb/uv: Add a forward declaration for struct flush_tlb_info" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Drop last traces of uv_flush_tlb_others" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Fix copied UV5 output archtype" (Jack Vogel)  [Orabug: 32651197]  
  - Revert "x86/platform/uv: Fix UV4 hub revision adjustment" (Jack Vogel)  [Orabug: 32651197]


author: Jack Vogel <jack.vogel@oracle.com> [5.4.17-2102.200.13.el7uek]
changelog:
  - bpf, selftests: Fix up some test_verifier cases for unprivileged (Piotr Krysiuk)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171} 
  - bpf: Add sanity check for upper ptr_limit (Piotr Krysiuk)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171} 
  - bpf: Simplify alu_limit masking for pointer arithmetic (Piotr Krysiuk)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171} 
  - bpf: Fix off-by-one for area size in creating mask to left (Piotr Krysiuk)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171} 
  - bpf: Prohibit alu ops for pointer types not defining ptr_limit (Piotr Krysiuk)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171} 
  - selftests/bpf: Test access to bpf map pointer (Andrey Ignatov)  [Orabug: 32656761]  {CVE-2020-27170} {CVE-2020-27171} 
  - bpf: Fix truncation handling for mod32 dst reg wrt zero (Daniel Borkmann)  [Orabug: 32673813]  {CVE-2021-3444} 
  - bpf: Fix 32 bit src register truncation on div/mod (Daniel Borkmann)  [Orabug: 32673813]  {CVE-2021-3444}


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-5
changelog:
  - add FIPS DRBG implementation
  - run the FIPS POST tests in shared library constructor
  - make it possible to run the test suite in the FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-13
changelog:
  - touch only urandom in the selftest and when /dev/random is
    unavailable for example by SELinux confinement
  - fix the RSA selftest key (p q swap)


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-14
changelog:
  - add DRBG CAVS driver and other necessary CAVS driver updates (#1172568)
  - allow ath reinitialization in FIPS mode
  - allow for auto-initialization of DRBG


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-16_1
changelog:
  - [RHEL] Apply 'Add missing dependencies to the tests package'
  - [RHEL] Apply 'Update patch from upstream'


author: Sahana Prasad <sahana@redhat.com> - 1.1.5-3
changelog:
  - Enables building on old kernels [sync fix in Fedora from omosnance].
  - This is required for covscans as they run on RHEL7 machines.


author: Yiling Qiang <yiling.qiang@oracle.com> - 1.2.0-2.0.1
changelog:
  - enable replace_hmaccalc by default in OL7 [Orabug: 32620431]
  - remove /usr/libexec and %ldconfig_scriptlets to fix build issue [Orabug: 32620431]
  - build requires texlive-ec [Orabug: 32620431]
  - require kernel-uek-devel instead of kernel-headers [Orabug: 32620431]
  - Change distroname_ext in spec file to oracle


author: Paul Wouters <pwouters@redhat.com> - 3.25-1
changelog:
  - Resolves: rhbz#1591817 rebase libreswan to 3.25
  - Resolves: rhbz#1536404 CERT_PKCS7_WRAPPED_X509 error
  - Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated
  - Resolves: rhbz#1574011 libreswan is missing a Requires: unbound-libs >= 1.6.6


author: Paul Wouters <pwouters@redhat.com> - 3.25-2
changelog:
  - Resolves: rhbz#1597322 Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors


author: Paul Wouters <pwouters@redhat.com> - 3.25-5
changelog:
  - Resolves: rhbz#1639404 Unable to verify certificate with non-empty Extended Key Usage which does not include serverAuth or clientAuth
  - Resolves: rhbz#1630355 Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N
  - Resolves: rhbz#1629902 libreswan assertion failed when OAKLEY_KEY_LENGTH is zero for IKE using AES_CBC
  - Resolves: rhbz#1623279 [abrt] [faf] libreswan: strncpy(): /usr/libexec/ipsec/pluto killed by 11
  - Resolves: rhbz#1625303 config: recursive include check doesn't work
  - Resolves: rhbz#1664521 libreswan 3.25 in FIPS mode is incorrectly rejecting X.509 public keys that are >= 3072 bits


author: Paul Wouters <pwouters@redhat.com> - 3.25-6
changelog:
  - Resolves: rhbz#1630355 Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N [updated]
  - Resolves: rhbz#1679735 libreswan using NSS IPsec profiles regresses when critical flags are set causing validation failure


author: Paul Wouters <pwouters@redhat.com> - 3.25-7
changelog:
  - Resolves: rhbz#1673105 Opportunistic IPsec instances of /32 groups or auto=start that receive delete won't restart


author: Paul Wouters <pwouters@redhat.com> - 3.25-8
changelog:
  - Resolves: rhbz#1686991 IKEv1 traffic interruption when responder deletes SAs 60 seconds before EVENT_SA_REPLACE


author: Paul Wouters <pwouters@redhat.com> - 3.25-9
changelog:
  - Resolves: rhbz#1724200 libreswan: XFRM policy for OE/32 peer is deleted when shunts for previous half-open state expire


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-5
changelog:
  - Fixed SHA-3 implementation to conform to final standard (#1252936)
  - Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues
    in secp256r1 and secp384r1 calculations (#1314374)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-8
changelog:
  - Use a cache-silent version of mpz_powm to prevent cache-timing
    attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489)


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-3
changelog:
  - include patches for CVE-2020-6829, CVE-2020-12400,
    and CVE-2020-12401 from upstream (ECC constant time issues).
  - include patches for CVE-2020-12403 from upstream
    (CHACHA issues).
  - include self-tests for kdfs and cmac.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn of ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: John Mcwalters <john.mcwalters@oracle.com> - 3.53.1-6.0.1
changelog:
  - Add fips140-2 DSA Known Answer Test fix [Orabug: 26679337]
  - Add fips140-2 ECDSA/RSA/DSA Pairwise Consistency Test fix [Orabug: 26617814],
    [Orabug: 26617879], [Orabug: 26617849]


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
changelog:
  - Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
  - Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
  - Do not segfault in audit code during cleanup (#1488083)
  - Add WinSCP 5.10+ compatibility (#1496808)
  - Clatch between ClientAlive and rekeying timeouts (#1480510)
  - Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
  - Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-18 + 0.10.3-2
changelog:
  - invalidate supplemental group cache used by temporarily_use_uid()
    when the target uid differs (#1583735)


author: Herbert van den Bergh <herbert.van.den.bergh@oracle.com> - 7.4p1-21.0.1
changelog:
  - enlarge format buffer size for certificate serial
    number so the log message can record any 64-bit integer without
    truncation (openssh bz#3012) [Orabug: 30448895]


author: Ilya Okomin <ilya.okomin@oracle.com> - 7.4p1-21.0.3
changelog:
  - Enable fips KDF POST [Orabug: 32461750]
  - Disable diffie-hellman-group-exchange-sha256 KEX FIPS method [Orabug: 32461739]


author: John Mcwalters <john.mcwalters@oracle.com> - 7.4p1-22.0.1_fips
changelog:
  - Change Epoch from 1 to 10
  - Enable fips KDF POST [Orabug: 32461750]
  - Disable diffie-hellman-group-exchange-sha256 KEX FIPS method [Orabug: 32461739]


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-12
changelog:
  - fix CVE-2017-3737 - incorrect handling of fatal error state
  - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-13
changelog:
  - add S390x assembler updates
  - make CA name list comparison function case sensitive (#1548401)
  - fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
  - fix CVE-2018-0732 - large prime DH DoS of TLS client
  - fix CVE-2018-0737 - RSA key generation cache timing vulnerability
  - fix CVE-2018-0739 - stack overflow parsing recursive ASN.1 structure


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
changelog:
  - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
  - fix incorrect error message on FIPS DSA parameter generation (#1603597)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-17
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
    timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
changelog:
  - fix CVE-2018-0734 - DSA signature local timing side channel
  - fix CVE-2019-1559 - 0-byte record padding oracle
  - close the RSA decryption One & done EM side channel (#1619558)


author: Ilya Okomin <ilya.okomin@oracle.com> 1.0.2k-21.0.1
changelog:
  - Fix DH self-test to add shared secret comparison [Orabug: 32467026]
  - Add DH support changes for SP 800-56A rev3 requirements [Orabug: 32467059]
  - Add TLS KDF self-test [Orabug: 32467193]
  - Add EC keys pairwise consistency test [Orabug: 32467059]


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
  - fix CVE-2021-23841 openssl: NULL pointer dereference
    in X509_issuer_and_serial_hash()
  - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
  - Resolves: rhbz#1932132, rhbz#1932126


author: John McWalters <john.mcwalters@oracle.com> 1.0.2k-22_fips
changelog:
  - Change Epoch from 1 to 10
  - Fix DH self-test to add shared secret comparison [Orabug: 32467026]
  - Add DH support changes for SP 800-56A rev3 requirements [Orabug: 32467059]
  - Add TLS KDF self-test [Orabug: 32467193]
  - Add EC keys pairwise consistency test [Orabug: 32467059]


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
  - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
  - Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
  - Resolves: rhbz#2039993


author: Lukáš Lipinský <lukas.lipinsky@oracle.com> 1.0.2k-24.0.3
changelog:
  - fix CVE-2022-0778 openssl: Fix possible infinite loop in BN_mod_sqrt()
  - Change Epoch from 1 to 10
  - Fix DH self-test to add shared secret comparison [Orabug: 32467026]
  - Add DH support changes for SP 800-56A rev3 requirements [Orabug: 32467059]
  - Add TLS KDF self-test [Orabug: 32467193]
  - Add EC keys pairwise consistency test [Orabug: 32467059]


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
  - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Related: rhbz#2067160


