# changelog

author: Martin Kosek <mkosek@redhat.com> - 3.2.2-1
changelog:
  - Update to upstream 3.2.2
  - Drop ipa-server-selinux subpackage
  - Drop redundant directory /var/cache/ipa/sessions
  - Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
  - Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
    issues when there are still old parts of software (like entitlements plugin)


author: Martin Kosek <mkosek@redhat.com> - 3.3.0-2
changelog:
  - Remove ipa-server-selinux obsoletes as upgrades from version prior to
    3.3.0 are not allowed
  - Wrap server-trust-ad subpackage description better
  - Add (noreplace) flag for %{_sysconfdir}/tmpfiles.d/ipa.conf
  - Change permissions on default_encoding_utf8.so to fix ipa-python Provides


author: Martin Kosek <mkosek@redhat.com> - 3.3.0-4
changelog:
  - ipa-server-install fails if --subject parameter is other than default
    realm (#983075)
  - do not allow configuring bind-dyndb-ldap without persistent search (#967876)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-2
changelog:
  - Unable to remove replica by ipa-replica-manage (#1001662)
  - Before uninstalling a server, warn about active replicas (#998069)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-3
changelog:
  - Replica installation fails for RHEL 6.4 master (#1004680)
  - Server uninstallation crashes if DS is not available (#998069)


author: Martin Kosek <mkosek@redhat.com> - 3.3.1-5
changelog:
  - Remove dependency on python-paramiko (#1002884)
  - Broken redirection when deleting last entry of DNS resource
    record (#1006360)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-1
changelog:
  - Update to upstream 3.3.2 (#991064)
  - Add delegation info to MS-PAC (#915799)
  - Warn about incompatibility with AD when IPA realm and domain
    differs (#1009044)
  - Allow PKCS#12 files with empty password in install tools (#1002639)
  - Privilege "SELinux User Map Administrators" did not list
    permissions (#997085)
  - SSH key upload broken when client joins an older server (#1009024)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-2
changelog:
  - Deprecate --serial-autoincrement option (#1016645)
  - CA installation always failed on replica (#1005446)
  - Re-initializing a winsync connection exited with error (#994980)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-4
changelog:
  - Server install failure during client enrollment shouldn't
    roll back (#1023086)
  - nsds5ReplicaStripAttrs are not set on agreements (#1023085)
  - ipa-server conflicts with mod_ssl (#1018172)


author: Martin Kosek <mkosek@redhat.com> - 3.3.2-5
changelog:
  - Temporarily move ipa-backup and ipa-restore functionality
    back to make them available in public Beta (#1003933)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-3
changelog:
  - Installer did not detect different server and IPA domain (#1026845)
  - Allow kernel keyring CCACHE when supported (#1026861)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-5
changelog:
  - Trust add tries to add same value of --base-id for sub domain,
    causing an error (#1033068)
  - Improved error reporting for adding trust case (#1029856)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-6
changelog:
  - Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
  - Re-adding existing trust fails (#1033216)
  - IPA uninstall exits with a samba error (#1033075)
  - Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
  - Fixed ownership of /usr/share/ipa/ui/js (#1026260)
  - ipa-tests: support external names for hosts (#1032668)
  - ipa-client-install fail due fail to obtain host TGT (#1029354)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-8
changelog:
  - Fix status trust-add command status message (#910453)
  - NetBIOS was not trimmed at 15 characters (#1030517)
  - Harden CA subsystem certificate renewal on CA clones (#1040018)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-12
changelog:
  - Missing objectclasses when empty password passed to host-add (#1052979)
  - sudoOrder missing in sudoers (#1052983)
  - Missing examples in sudorule help (#1049464)
  - Client automount does not uninstall when fstore is empty (#910899)
  - Error not clear for invalid realm given to trust-fetch-domains (#1052981)
  - trust-fetch-domains does not add idrange for subdomains found (#1049926)
  - Add option to show if an AD subdomain is enabled/disabled (#1052973)
  - ipa-adtrust-install still failed with long NetBIOS names (#1030517)
  - Error not clear for invalid relam given to trustdomain-find (#1049455)
  - renewed client cert not recognized during IPA CA renewal (#1033273)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-13
changelog:
  - Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
  - Increase default timeout for IPA services (#1033273)
  - Error while running trustdomain-find (#1054376)
  - group-show lists SID instead of name for external groups (#1054391)
  - Fix IPA server NetBIOS name in samba configuration (#1030517)
  - dnsrecord-mod produces missing API version warning (#1054869)
  - Hide trust-resolve command as internal (#1052860)
  - Add Trust domain Web UI (#1054870)
  - ipasam cannot delete multiple child trusted domains (#1056120)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-16
changelog:
  - Fallback to global policy in ipa lockout plugin (#912725)
  - Migration does not add users to default group (#903232)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-18
changelog:
  - Display server name in ipa command's verbose mode (#1061703)
  - Remove sourcehostcategory from default HBAC rule (#1061187)
  - dnszone-add cannot add classless PTR zones (#1058688)
  - Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-20
changelog:
  - trustdomain-find with pkey-only fails (#1068611)
  - Invalid credential cache in trust-add (#1069182)
  - ipa-replica-install prints unexpected error (#1069722)
  - Too big font in input fields in details facet in Firefox (#1069720)
  - trust-add for POSIX AD does not fetch trustdomains (#1070925)
  - Misleading trust-add error message in some cases (#1070926)
  - Access is not rejected for disabled domain (#1070924)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-22
changelog:
  - ipa-replica-install never checks for 7389 port (#1075165)
  - Non-terminated string may be passed to LDAP search (#1075091)
  - ipa-sam may fail to translate group SID into GID (#1073829)
  - Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-26
changelog:
  - When IdM server trusts multiple AD forests, IPA client returns invalid group
    membership info (#1079498)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-28
changelog:
  - ipa-client-automount fails with incompatibility error when installed against
    older IPA server (#1083108)


author: Martin Kosek <mkosek@redhat.com> - 3.3.3-29
changelog:
  - Server installation fails using external signed certificates with
    "IndexError: list index out of range" (#1111320)
  - Add rhino to BuildRequires to fix Web UI build error


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-4
changelog:
  - Update Requires on pki-ca to 10.1.2-4 (#1129558)
  - build: increase java stack size for all arches
  - Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
  - Fix dns zonemgr validation regression (#1056202)
  - Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
  - Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
    (#886645)
  - Add bind-dyndb-ldap working dir to IPA specfile
  - Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
    (#886645)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - Deadlock in schema compat plugin (#1161131)
  - ipactl stop should stop dirsrv last (#1161129)
  - Upgrade 3.3.5 to 4.1 failed (#1161128)
  - CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-5
changelog:
  - Update slapi-nis dependency to pull 0.54-2 (#891984)
  - ipa-restore: Don't crash if AD trust is not installed (#951581)
  - Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
  - Trust setting not restored for CA cert with ipa-restore command (#1159011)
  - ipa-server-install fails when restarting named (#1162340)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-6
changelog:
  - Fix: DNS installer adds invalid zonemgr email (#1056202)
  - ipaplatform: Use the dirsrv service, not target (#951581)
  - Fix: DNS policy upgrade raises asertion error (#1161128)
  - Fix upgrade referint plugin (#1161128)
  - Upgrade: fix trusts objectclass violationi (#1161128)
  - group-add doesn't accept gid parameter (#1149124)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-7
changelog:
  - ipa-csreplica-manage connect fails (#1157735)
  - error message which is not understandable when IDNA2003 characters are
    present in --zonemgr (#1163849)
  - Fix warning message should not contain CLI commands (#1114013)
  - Renewing the CA signing certificate does not extend its validity period end
    (#1163498)
  - RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
    httpd (#1159330)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-8
changelog:
  - Improve otptoken help messages (#919228)
  - Ensure users exist when assigning tokens to them (#919228)
  - Enable QR code display by default in otptoken-add (#919228)
  - Show warning instead of error if CA did not start (#1158410)
  - CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
  - Traceback when adding zone with long name (#1164859)
  - Backup & Restore mechanism (#951581)
  - ignoring user attributes in migrate-ds does not work if uppercase characters
    are returned by ldap (#1159816)
  - Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
  - Failure when installing on dual stacked system with external ca (#1128380)
  - ipa-server should keep backup of CS.cfg (#1059135)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - webui: use domain name instead of domain SID in idrange adder dialog
    (#891984)
  - webui: normalize idview tab labels (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-9
changelog:
  - schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
    build fails (#1167196)
  - Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
  - "ipa trust-add ... " cmd says : (Trust status: Established and verified)
    while in the logs we see "WERR_ACCESS_DENIED" during verification step.
    (#1144121)
  - POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
    (#1156466)
  - Add support/hooks for a one-time password system like SecureID in IPA
    (#919228)
  - Tracebacks with latest build for --zonemgr cli option (#1167270)
  - ID Views: Support migration from the sync solution to the trust solution
    (#891984)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-11
changelog:
  - Throw zonemgr error message before installation proceeds (#1163849)
  - Winsync: Setup is broken due to incorrect import of certificate (#1169867)
  - Enable last token deletion when password auth type is configured (#919228)
  - ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
  - add --hosts and --hostgroup options to allow/retrieve keytab methods
    (#1007367)
  - Extend host-show to add the view attribute in set of default attributes
    (#1168916)
  - Prefer TCP connections to UDP in krb5 clients (#919228)
  - [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
  - webui: increase notification duration (#1171089)
  - RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
  - RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
    (#1170003)
  - Improve validation of --instance and --backend options in ipa-restore
    (#951581)
  - RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
  - Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-12
changelog:
  - RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
    (#1169591)
  - CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
    (#1172578)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-13
changelog:
  - Expand the token auth/sync windows (#919228)
  - Access is not rejected for disabled domain (#1172598)
  - krb5kdc crash in ldap_pvt_search (#1170695)
  - RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-14
changelog:
  - IPA Replicate creation fails with error "Update failed! Status: [10 Total
    update abortedLDAP error: Referral]" (#1166265)
  - running ipa-server-install --setup-dns results in a crash (#1072502)
  - DNS zones are not migrated into forward zones if 4.0+ replica is added
    (#1175384)
  - gid is overridden by uid in default trust view (#1168904)
  - When migrating warn user if compat is enabled (#1177133)
  - Clean up debug log for trust-add (#1168376)
  - No error message thrown on restore(full kind) on replica from full backup
    taken on master (#1175287)
  - ipa-restore proceed even IPA not configured (#1175326)
  - Data replication not working as expected after data restore from full backup
    (#1175277)
  - IPA externally signed CA cert expiration warning missing from log (#1178128)
  - ipa-upgradeconfig fails in CA-less installs (#1181767)
  - IPA certs fail to autorenew simultaneouly (#1173207)
  - More validation required on ipa-restore's options (#1176034)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-16
changelog:
  - PassSync does not sync passwords due to missing ACIs (#1181093)
  - ipa-replica-manage list does not list synced domain (#1181010)
  - Do not assume certmonger is running in httpinstance (#1181767)
  - ipa-replica-manage disconnect fails without password (#1183279)
  - Put LDIF files to their original location in ipa-restore (#1175277)
  - DUA profile not available anonymously (#1184149)
  - IPA replica missing data after master upgraded (#1176995)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-17
changelog:
  - Wrong directories created on full restore (#1186398)
  - ipa-restore crashes if replica is unreachable (#1186396)
  - idoverrideuser-add option --sshpubkey does not work (#1185410)


author: Martin Kosek <mkosek@redhat.com> - 4.1.0-18
changelog:
  - Fix ipa-pwd-extop global configuration caching (#1187342)
  - group-detach does not add correct objectclasses (#1187540)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-18.1
changelog:
  - "an internal error has occurred" during ipa host-del --updatedns (#1198431)
  - Renamed patch 1013 to 0114, as it was merged upstream
  - Fax number not displayed for user-show when kinit'ed as normal user.
    (#1198430)
  - Replication agreement with replica not disabled when ipa-restore done without
    IPA installed (#1199060)
  - Limit deadlocks between DS plugin DNA and slapi-nis (#1199128)


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.1.0-18.2
changelog:
  - IPA extdom plugin fails when encountering large groups (#1193759)
  - CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
    (#1202998)


author: Jan Cholasta <jcholast@redhat.com> - 4.1.0-18.3
changelog:
  - [ipa-python] ipalib.errors.LDAPError: failed to decode certificate:
    (SEC_ERROR_INVALID_ARGS) security library: invalid arguments. (#1194312)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-0.1.alpha1
changelog:
  - Resolves: #805188  [RFE] "ipa migrate-ds" ldapsearches with scope=1
  - Resolves: #1019272 With 20000+ users, adding a user to a group intermittently
    throws Internal server error
  - Resolves: #1035494 Unable to add Kerberos principal via kadmin.local
  - Resolves: #1045153 ipa-managed-entries --list -p <badpassword> still requires
    DM password
  - Resolves: #1125950 ipa-server-install --uinstall doesn't remove port 7389
    from ldap_port_t
  - Resolves: #1132540 [RFE] Expose service delegation rules in UI and CLI
  - Resolves: #1145584 ipaserver/install/cainstance.py creates pkiuser not
    matching uidgid
  - Resolves: #1176036 IDM client registration failure in a high load environment
  - Resolves: #1183116 Remove Requires: subscription-manager
  - Resolves: #1186054 permission-add does not prompt to enter --right option in
    interactive mode
  - Resolves: #1187524 Replication agreement with replica not disabled when
    ipa-restore done without IPA installed
  - Resolves: #1188195 Fax number not displayed for user-show when kinit'ed as
    normal user.
  - Resolves: #1189034 "an internal error has occurred" during ipa host-del
    --updatedns
  - Resolves: #1193554 ipa-client-automount: failing with error LDAP server
    returned UNWILLING_TO_PERFORM. This likely means that minssf is enabled.
  - Resolves: #1193759 IPA extdom plugin fails when encountering large groups
  - Resolves: #1194312 [ipa-python] ipalib.errors.LDAPError: failed to decode
    certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
  - Resolves: #1194633 Default trust view can be deleted in lower case
  - Resolves: #1196455 ipa-server-install step [8/27]: starting certificate
    server instance - confusing CA staus message on TLS error
  - Resolves: #1198263 Limit deadlocks between DS plugin DNA and slapi-nis
  - Resolves: #1199527 [RFE] Use datepicker component for datetime fields
  - Resolves: #1200867 [RFE] Make OTP validation window configurable
  - Resolves: #1200883 [RFE] Switch apache to use mod_auth_gssapi
  - Resolves: #1202998 CVE-2015-1827 ipa: memory corruption when using
    get_user_grouplist() [rhel-7.2]
  - Resolves: #1204637 slow group operations
  - Resolves: #1204642 migrate-ds: slow add o users to default group
  - Resolves: #1208461 IPA CA master server update stuck on checking getStatus
    via https
  - Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
  - Resolves: #1211708 ipa-client-install gets stuck during NTP sync
  - Resolves: #1215197 ipa-client-install ignores --ntp-server option during time
    sync
  - Resolves: #1215200 ipa-client-install configures IPA server as NTP source
    even if IPA server has not ntpd configured
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
  - Related:  #1204809 Rebase ipa to 4.2
    - Update to upstream 4.2.0.alpha1


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-0.2.alpha1
changelog:
  - Resolves: #1228671 pkispawn fails in ipa-ca-install and ipa-kra-install
  - Related:  #1204809 Rebase ipa to 4.2
    - Fix minimum version of slapi-nis
    - Require python-sss and python-sss-murmur (provided by sssd-1.13.0)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-1
changelog:
  - Resolves: #846033  [RFE] Documentation for JSONRPC IPA API
  - Resolves: #989091  Ability to manage IdM/IPA directly from a standard LDAP
    client
  - Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
    users in IdM
  - Resolves: #1115294 [RFE] Add support for DNSSEC
  - Resolves: #1145748 [RFE] IPA running with One Way Trust
  - Resolves: #1199520 [RFE] Introduce single upgrade tool - ipa-server-upgrade
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
  - Resolves: #1200728 [RFE] Replicate PKI Profile information
  - Resolves: #1200735 [RFE] Allow issuing certificates for user accounts
  - Resolves: #1204054 SSSD database is not cleared between installs and
    uninstalls of ipa
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
  - Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
  - Resolves: #1204504 [RFE] Add access control so hosts can create their own
    services
  - Resolves: #1206534 [RFE] Offer Kerberos over HTTP (kdcproxy) by default
  - Resolves: #1206613 [RFE] Configure IPA to be a trust agent by default
  - Resolves: #1209476 package ipa-client does not require package dbus-python
  - Resolves: #1211589 [RFE] Add option to skip the verify_client_version
  - Resolves: #1211608 [RFE] Generic support for unknown DNS RR types (RFC 3597)
  - Resolves: #1215735 ipa-replica-prepare automatically adds a DNS zone
  - Resolves: #1217010 OTP Manager field is not exposed in the UI
  - Resolves: #1222475 krb5kdc : segfault at 0 ip 00007fa9f64d82bb sp
    00007fffd68b2340 error 6 in libc-2.17.so
  - Related:  #1204809 Rebase ipa to 4.2
    - Update to upstream 4.2.0
    - Move /etc/ipa/kdcproxy to the server subpackage


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-2
changelog:
  - Resolves: #1131907 [ipa-client-install] cannot write certificate file
    '/etc/ipa/ca.crt.new': must be string or buffer, not None
  - Resolves: #1195775 unsaved changes dialog internally inconsistent
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - Stageusedr-activate: show username instead of DN
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - Prevent to rename certprofile profile id
  - Resolves: #1222047 IPA to AD Trust: IPA ERROR 4016: Remote Retrieve Error
  - Resolves: #1224769 copy-schema-to-ca.py does not overwrites schema files
    - copy-schema-to-ca: allow to overwrite schema files
  - Resolves: #1241941 kdc component installation of IPA failed
    - spec file: Update minimum required version of krb5
  - Resolves: #1242036 Replica install fails to update DNS records
    - Fix DNS records installation for replicas
  - Resolves: #1242884 Upgrade to 4.2.0 fails when enabling kdc proxy
    - Start dirsrv for kdcproxy upgrade


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-3
changelog:
  - Resolves: #1170770 [AD TRUST]IPA should detect inconsistent realm domains
    that conflicts with AD DC
    - trusts: Check for AD root domain among our trusted domains
  - Resolves: #1195339 ipa-client-install changes the label on various files
    which causes SELinux denials
    - sysrestore: copy files instead of moving them to avoind SELinux issues
  - Resolves: #1196656 [ipa-client][rhel71] enable debugging for spawned
    commands / ntpd -qgc $tmpfile hangs
    - enable debugging of ntpd during client installation
  - Resolves: #1205264 Migration UI Does Not Work When Anonymous Bind is Disabled
    - migration: Use api.env variables.
  - Resolves: #1212719 abort-clean-ruv subcommand should allow
    replica-certifyall: no
    - Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand
  - Resolves: #1216935 ipa trust-add shows ipa: ERROR: an internal error has
    occurred
    - dcerpc: Expand explanation for WERR_ACCESS_DENIED
    - dcerpc: Fix UnboundLocalError for ccache_name
  - Resolves: #1222778 idoverride group-del can delete user and user-del can
    delete group
    - dcerpc: Add get_trusted_domain_object_type method
    - idviews: Restrict anchor to name and name to anchor conversions
    - idviews: Enforce objectclass check in idoverride*-del
  - Resolves: #1234919 Be able to request certificates without certmonger service
    running
    - cermonger: Use private unix socket when DBus SystemBus is not available.
    - ipa-client-install: Do not (re)start certmonger and DBus daemons.
  - Resolves: #1240939 Please add dependency on bind-pkcs11
    - Create server-dns sub-package.
    - ipaplatform: Add constants submodule
    - DNS: check if DNS package is installed
  - Resolves: #1242914 Bump minimal selinux-policy and add booleans to allow
    calling out oddjobd-activated services
    - selinux: enable httpd_run_ipa to allow communicating with oddjobd services
  - Resolves: #1243261 non-admin users cannot search hbac rules
    - fix hbac rule search for non-admin users
    - fix selinuxusermap search for non-admin users
  - Resolves: #1243652 Client has missing dependency on memcache
    - do not import memcache on client
  - Resolves: #1243835 [webui] user change password dialog does not work
    - webui: fix user reset password dialog
  - Resolves: #1244802 spec: selinux denial during kdcproxy user creation
    - Fix selinux denial during kdcproxy user creation
  - Resolves: #1246132 trust-fetch-domains: Do not chown keytab to the sssd user
    - oddjob: avoid chown keytab to sssd if sssd user does not exist
  - Resolves: #1246136 Adding a privilege to a permission avoids validation
    - Validate adding privilege to a permission
  - Resolves: #1246141 DNS Administrators cannot search in zones
    - DNS: Consolidate DNS RR types in API and schema
  - Resolves: #1246143 User plugin - user-find doesn't work properly with manager
    option
    - fix broken search for users by their manager


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-4
changelog:
  - Resolves: #1072383 [RFE] Provide ability to map CAC identity certificates to
    users in IdM
    - store certificates issued for user entries as
    - user-show: add --out option to save certificates to file
  - Resolves: #1145748 [RFE] IPA running with One Way Trust
    - Fix upgrade of sidgen and extdom plugins
  - Resolves: #1195339 ipa-client-install changes the label on various files
    which causes SELinux denials
    - Use 'mv -Z' in specfile to restore SELinux context
  - Resolves: #1198796 Text in UI should describe differing LDAP vs Krb behavior
    for combinations of "User authentication types"
    - webui: add LDAP vs Kerberos behavior description to user auth
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - ULC: Fix stageused-add --from-delete command
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - certprofile-import: do not require profileId in profile data
    - Give more info on virtual command access denial
    - Allow SAN extension for cert-request self-service
    - Add profile for DNP3 / IEC 62351-8 certificates
    - Work around python-nss bug on unrecognised OIDs
  - Resolves: #1204501 [RFE] Add Password Vault (KRA) functionality
    - Validate vault's file parameters
    - Fixed missing KRA agent cert on replica.
  - Resolves: #1225866 display browser config options that apply to the browser.
    - webui: add Kerberos configuration instructions for Chrome
    - Remove ico files from Makefile
  - Resolves: #1246342 Unapply idview raises internal error
    - idviews: Check for the Default Trust View only if applying the view
  - Resolves: #1248102 [webui] regression - incorrect/no failed auth messages
    - webui: fix regressions failed auth messages
  - Resolves: #1248396 Internal error in DomainValidator.__search_in_dc
    - dcerpc: Fix UnboundLocalError for ccache_name
  - Resolves: #1249455 ipa trust-add failed CIFS server configuration does not
    allow access to \\pipe\lsarpc
    - Fix selector of protocol for LSA RPC binding string
    - dcerpc: Simplify generation of LSA-RPC binding strings
  - Resolves: #1250192 Error in ipa trust-fecth-domains
    - Fix incorrect type comparison in trust-fetch-domains
  - Resolves: #1251553 Winsync setup fails with unexpected error
    - replication: Fix incorrect exception invocation
  - Resolves: #1251854 ipa aci plugin is not parsing aci's correctly.
    - ACI plugin: correctly parse bind rules enclosed in
  - Resolves: #1252414 Trust agent install does not detect available replicas to
    add to master
    - adtrust-install: Correctly determine 4.2 FreeIPA servers


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-5
changelog:
  - Resolves: #1199530 [RFE] Provide user lifecycle managment capabilities
    - user-undel: Fix error messages.
  - Resolves: #1200694 [RFE] Support for multiple cert profiles
    - Prohibit deletion of predefined profiles
  - Resolves: #1232819 testing ipa-restore on fresh system install fails
    - Backup/resore authentication control configuration
  - Resolves: #1243331 pkispawn fails when migrating to 4.2 server from 3.0
    server
    - Require Dogtag PKI >= 10.2.6
  - Resolves: #1245225 Asymmetric vault drops traceback when the key is not
    proper
    - Asymmetric vault: validate public key in client
  - Resolves: #1248399 Missing DNSSEC related files in backup
    - fix typo in BasePathNamespace member pointing to ods exporter config
    - ipa-backup: archive DNSSEC zone file and kasp.db
  - Resolves: #1248405 PassSync should be disabled after ipa-winsync-migrate is
    finished
    - winsync-migrate: Add warning about passsync
    - winsync-migrate: Expand the man page
  - Resolves: #1248524 User can't find any hosts using "ipa host-find $HOSTNAME"
    - adjust search so that it works for non-admin users
  - Resolves: #1250093 ipa certprofile-import accepts invalid config
    - Require Dogtag PKI >= 10.2.6
  - Resolves: #1250107 IPA framework should not allow modifying trust on AD trust
    agents
    - trusts: Detect missing Samba instance
  - Resolves: #1250111 User lifecycle - preserved users can be assigned
    membership
    - ULC: Prevent preserved users from being assigned membership
  - Resolves: #1250145 Add permission for user to bypass caacl enforcement
    - Add permission for bypassing CA ACL enforcement
  - Resolves: #1250190 idrange is not added for sub domain
    - idranges: raise an error when local IPA ID range is being modified
    - trusts: harden trust-fetch-domains oddjobd-based script
  - Resolves: #1250928 Man page for ipa-server-install is out of sync
    - install: Fix server and replica install options
  - Resolves: #1251225 IPA default CAACL does not allow cert-request for services
    after upgrade
    - Fix default CA ACL added during upgrade
  - Resolves: #1251561 ipa vault-add Unknown option: ipavaultpublickey
    - validate mutually exclusive options in vault-add
  - Resolves: #1251579 ipa vault-add --user should set container owner equal to
    user on first run
    - Fixed vault container ownership.
  - Resolves: #1252517 cert-request rejects request with correct
    krb5PrincipalName SAN
    - Fix KRB5PrincipalName / UPN SAN comparison
  - Resolves: #1252555 ipa vault-find doesn't work for services
    - vault: Add container information to vault command results
    - Add flag to list all service and user vaults
  - Resolves: #1252556 Missing CLI param and ACL for vault service operations
    - Added CLI param and ACL for vault service operations.
  - Resolves: #1252557 certprofile: improve profile format documentation
    - certprofile-import: improve profile format documentation
    - certprofile: add profile format explanation
  - Resolves: #1253443 ipa vault-add creates vault with invalid type
    - vault: validate vault type
  - Resolves: #1253480 ipa vault-add-owner does not fail when adding an existing
    owner
    - baseldap: Allow overriding member param label in LDAPModMember
    - vault: Fix param labels in output of vault owner commands
  - Resolves: #1253511 ipa vault-find does not use criteria
    - vault: Fix vault-find with criteria
  - Resolves: #1254038 ipa-replica-install pk12util error returns exit status 10
    - install: Fix replica install with custom certificates
  - Resolves: #1254262 ipa-dnskeysync-replica crash cannot contact kdc
    - improve the handling of krb5-related errors in dnssec daemons
  - Resolves: #1254412 when dirsrv is off ,upgrade from 7.1 to 7.2 fails with
    starting CA and named-pkcs11.service
    - Server Upgrade: Start DS before CA is started.
  - Resolves: #1254637 Add ACI and permission for managing user userCertificate
    attribute
    - add permission: System: Manage User Certificates
  - Resolves: #1254641 Remove CSR allowed-extensions restriction
    - cert-request: remove allowed extensions check
  - Resolves: #1254693 vault --service does not normalize service principal
    - vault: normalize service principal in service vault operations
  - Resolves: #1254785 ipa-client-install does not properly handle dual stacked
    hosts
    - client: Add support for multiple IP addresses during installation.
    - Add dependency to SSSD 1.13.1
    - client: Add description of --ip-address and --all-ip-addresses to man page


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-6
changelog:
  - Resolves: #1249226 IPA dnssec-validation not working for AD dnsforwardzone
    - DNSSEC: fix forward zone forwarders checks
  - Resolves: #1250190 idrange is not added for sub domain
    - trusts: format Kerberos principal properly when fetching trust topology
  - Resolves: #1252334 User life cycle: missing ability to provision a stage user
    from a preserved user
    - Add user-stage command
  - Resolves: #1252863 After applying RHBA-2015-1554 errata, IPA service fails to
    start.
    - spec file: Add Requires(post) on selinux-policy
  - Resolves: #1254304 Changing vault encryption attributes
    - Change internal rsa_(public|private)_key variable names
    - Added support for changing vault encryption.
  - Resolves: #1256715 Executing user-del --preserve twice removes the user
    pernamently
    - improve the usability of `ipa user-del --preserve` command


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-7
changelog:
  - Resolves: #1256840 [webui] majority of required fields is no longer marked as
    required
    - fix missing information in object metadata
  - Resolves: #1256842 [webui] no option to choose trust type when creating a
    trust
    - webui: add option to establish bidirectional trust
  - Resolves: #1256853 Clear text passwords in KRA install log
    - Removed clear text passwords from KRA install log.
  - Resolves: #1257072 The "Standard Vault" MUST not be the default and must be
    discouraged
    - vault: change default vault type to symmetric
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: prevent rename (modrdn)


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-8
changelog:
  - Resolves: #1254689 Storing big file as a secret in vault raises traceback
    - vault: Limit size of data stored in vault
  - Resolves: #1255880 ipactl status should distinguish between different
    pki-tomcat services
    - ipactl: Do not start/stop/restart single service multiple times


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-9
changelog:
  - Resolves: #1257074 The KRA agent cert is stored in a PEM file that is not
    tracked
    - cert renewal: Include KRA users in Dogtag LDAP update
    - cert renewal: Automatically update KRA agent PEM file
  - Resolves: #1257163 renaming certificatte profile with --rename option leads
    to integrity issues
    - certprofile: remove 'rename' option
  - Resolves: #1257968 kinit stop working after ipa-restore
    - Backup: back up the hosts file
  - Resolves: #1258926 Remove 'DNSSEC is experimental' warnings
    - DNSSEC: remove "DNSSEC is experimental" warnings
  - Resolves: #1258929 Uninstallation of IPA leaves extra entry in /etc/hosts
    - Installer: do not modify /etc/hosts before user agreement
  - Resolves: #1258944 DNSSEC daemons may deadlock when processing more than 1
    zone
    - DNSSEC: backup and restore opendnssec zone list file
    - DNSSEC: remove ccache and keytab of ipa-ods-exporter
    - DNSSEC: prevent ipa-ods-exporter from looping after service auto-restart
    - DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction
    - DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC
      key master
    - DNSSEC: Fix key metadata export
    - DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.
  - Resolves: #1258964 revert to use ldapi to add kra agent in KRA install
    - Using LDAPI to setup CA and KRA agents.
  - Resolves: #1259848 server closes connection and refuses commands after
    deleting user that is still logged in
    - ldap: Make ldap2 connection management thread-safe again
  - Resolves: #1259996 AttributeError: 'NameSpace' object has no attribute
    'ra_certprofile' while ipa-ca-install
    - load RA backend plugins during standalone CA install on CA-less IPA master


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-10
changelog:
  - Resolves: #1260663 crash of ipa-dnskeysync-replica component during
    ipa-restore
    - IPA Restore: allows to specify files that should be removed
  - Resolves: #1261806 Installing ipa-server package breaks httpd
    - Handle timeout error in ipa-httpd-kdcproxy
  - Resolves: #1262322 Failed to backup CS.cfg message in upgrade.
    - Server Upgrade: backup CS.cfg when dogtag is turned off


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-11
changelog:
  - Resolves: #1258965 ipa vault: set owner of vault container
    - baseldap: make subtree deletion optional in LDAPDelete
    - vault: add vault container commands
    - vault: set owner to current user on container creation
    - vault: update access control
    - vault: add permissions and administrator privilege
    - install: support KRA update
  - Resolves: #1261586 ipa config-mod addattr fails for ipauserobjectclasses
    - config: allow user/host attributes with tagging options
  - Resolves: #1262315 Unable to establish winsync replication
    - winsync: Add inetUser objectclass to the passsync sysaccount


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-12
changelog:
  - Resolves: #1204205 [RFE] ID Views: Automated migration tool from Winsync to
    Trusts
    - winsync-migrate: Convert entity names to posix friendly strings
    - winsync-migrate: Properly handle collisions in the names of external groups
  - Resolves: #1261074 Adjust Firefox configuration to new extension signing
    policy
    - webui: use manual Firefox configuration for Firefox >= 40
  - Resolves: #1263337 IPA Restore failed with installed KRA
    - ipa-backup: Add mechanism to store empty directory structure
  - Resolves: #1264793 CVE-2015-5284 ipa: ipa-kra-install includes certificate
    and private key in world readable file [rhel-7.2]
    - install: fix KRA agent PEM file permissions
  - Resolves: #1265086 Mark IdM API Browser as experimental
    - WebUI: add API browser is experimental warning
  - Resolves: #1265277 Fix kdcproxy user creation
    - install: create kdcproxy user during server install
    - platform: add option to create home directory when adding user
    - install: fix kdcproxy user home directory
  - Resolves: #1265559 GSS failure after ipa-restore
    - destroy httpd ccache after stopping the service


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-13
changelog:
  - Resolves: #1217009 OTP sync in UI does not work for TOTP tokens
    - Fix an integer underflow bug in libotp
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - install: always export KRA agent PEM file
    - vault: select a server with KRA for vault operations
  - Resolves: #1269777 IPA restore overwrites /etc/passwd and /etc/group files
    - do not overwrite files with local users/groups when restoring authconfig
  - Renamed patch 1011 to 0138, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-14
changelog:
  - Resolves: #1262996 ipa vault internal error on replica without KRA
    - upgrade: make sure ldap2 is connected in export_kra_agent_pem
  - Resolves: #1270608 IPA upgrade fails for server with CA cert signed by
    external CA
    - schema: do not derive ipaVaultPublicKey from ipaPublicKey


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-15
changelog:
  - Resolves: #1252556 Missing CLI param and ACL for vault service operations
    - vault: fix private service vault creation


author: Jan Cholasta <jcholast@redhat.com> - 4.2.0-16
changelog:
  - Resolves: #1277696 IPA certificate auto renewal fail with "Invalid
    Credential"
    - cert renewal: make renewal of ipaCert atomic
  - Resolves: #1278330 installer options are not validated at the beginning of
    installation
    - install: fix command line option validation
  - Resolves: #1282845 sshd_config change on ipa-client-install can prevent sshd
    from starting up
    - client install: do not corrupt OpenSSH config with Match sections
  - Resolves: #1282935 ipa upgrade causes vault internal error
    - install: export KRA agent PEM file in ipa-kra-install
  - Resolves: #1283429 Default CA ACL rule is not created during
    ipa-replica-install
    - TLS and Dogtag HTTPS request logging improvements
    - Avoid race condition caused by profile delete and recreate
    - Do not erroneously reinit NSS in Dogtag interface
    - Add profiles and default CA ACL on migration
    - disconnect ldap2 backend after adding default CA ACL profiles
    - do not disconnect when using existing connection to check default CA ACLs
  - Resolves: #1283430 ipa-kra-install: fails to apply updates
    - suppress errors arising from adding existing LDAP entries during KRA
      install
  - Resolves: #1283748 Caching of ipaconfig does not work in framework
    - fix caching in get_ipa_config
  - Resolves: #1283943 IPA DNS Zone/DNS Forward Zone details missing after
    upgrade from RHEL 7.0 to RHEL 7.2
    - upgrade: fix migration of old dns forward zones
    - Fix upgrade of forwardzones when zone is in realmdomains
  - Resolves: #1284413 ipa-cacert-manage renew fails on nonexistent ldap
    connection
    - ipa-cacert-renew: Fix connection to ldap.
  - Resolves: #1284414 ipa-otptoken-import fails on nonexistent ldap connection
    - ipa-otptoken-import: Fix connection to ldap.
  - Resolves: #1286635 IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using
    "yum update ipa* sssd"
    - Set minimal required version for openssl
  - Resolves: #1286781 ipa-nis-manage does not update ldap with all NIS maps
    - Upgrade: Fix upgrade of NIS Server configuration
  - Resolves: #1289311 umask setting causes named-pkcs11 issue with directory
    permissions on /var/lib/ipa/dnssec
    - DNS: fix file permissions
    - Explicitly call chmod on newly created directories
    - Fix: replace mkdir with chmod
  - Resolves: #1290142 Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
    - Fix version comparison
    - use FFI call to rpmvercmp function for version comparison
  - Resolves: #1292595 In IPA-AD trust environment some secondary IPA based Posix
    groups are missing
    - ipa-kdb: map_groups() consider all results
  - Resolves: #1293870 User should be notified for wrong password in password
    reset page
    - Fixed login error message box in LoginScreen page
  - Resolves: #1296196 Sysrestore did not restore state if a key is specified in
    mixed case
    - Allow to used mixed case for sysrestore
  - Resolves: #1296214 DNSSEC key purging is not handled properly
    - DNSSEC: Improve error reporting from ipa-ods-exporter
    - DNSSEC: Make sure that current state in OpenDNSSEC matches key state in
      LDAP
    - DNSSEC: Make sure that current key state in LDAP matches key state in BIND
    - DNSSEC: remove obsolete TODO note
    - DNSSEC: add debug mode to ldapkeydb.py
    - DNSSEC: logging improvements in ipa-ods-exporter
    - DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP
    - DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
    - DNSSEC: ipa-ods-exporter: add ldap-cleanup command
    - DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal
    - DNSSEC: Log debug messages at log level DEBUG
  - Resolves: #1296216 ipa-server-upgrade fails if certmonger is not running
    - prevent crash of CA-less server upgrade due to absent certmonger
    - always start certmonger during IPA server configuration upgrade
  - Resolves: #1297811 The ipa -e skip_version_check=1 still issues
    incompatibility error when called against RHEL 6 server
    - ipalib: assume version 2.0 when skip_version_check is enabled
  - Resolves: #1298289 install fails when locale is "fr_FR.UTF-8"
    - Do not decode HTTP reason phrase from Dogtag
  - Resolves: #1300252 shared certificateProfiles container is missing on a
    freshly installed RHEL7.2 system
    - upgrade: unconditional import of certificate profiles into LDAP
  - Resolves: #1301674 --setup-dns and other options is forgotten for using an
    external PKI
    - installer: Propagate option values from components instead of copying them.
    - installer: Fix logic of reading option values from cache.
  - Resolves: #1301687 issues with migration from RHEL 6 self-signed to RHEL 7 CA
    IPA setup
    - ipa-ca-install: print more specific errors when CA is already installed
    - cert renewal: import all external CA certs on IPA CA cert renewal
    - CA install: explicitly set dogtag_version to 10
    - fix standalone installation of externally signed CA on IPA master
    - replica install: validate DS and HTTP server certificates
    - replica install: improvements in the handling of CA-related IPA config
      entries
  - Resolves: #1301901 [RFE] compat tree: show AD members of IPA groups
    - slapi-nis: update configuration to allow external members of IPA groups
  - Resolves: #1305533 ipa trust-add succeded but after that ipa trust-find
    returns "0 trusts matched"
    - upgrade: fix config of sidgen and extdom plugins
    - trusts: use ipaNTTrustPartner attribute to detect trust entries
    - Warn user if trust is broken
    - fix upgrade: wait for proper DS socket after DS restart
    - Insure the admin_conn is disconnected on stop
    - Fix connections to DS during installation
    - Fix broken trust warnings
  - Resolves: #1321092 Installers fail when there are multiple versions of the
    same certificate
    - certdb: never use the -r option of certutil
  - Related: #1317381 Crash during IPA upgrade due to slapd
    - spec file: update minimum required version of slapi-nis
  - Related: #1322691 CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112
    CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws
    [rhel-7.3]
    - Rebuild against newer Samba version


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37
changelog:
  - Resolves: #837369 [RFE] Switch to client promotion to replica model
  - Resolves: #1199516 [RFE] Move replication topology to the shared tree
  - Resolves: #1206588 [RFE] Visualize FreeIPA server replication topology
  - Resolves: #1211602 Hide ipa-server-install KDC master password option (-P)
  - Resolves: #1212713 ipa-csreplica-manage: it could be nice to have also
    list-ruv / clean-ruv / abort-clean-ruv for o=ipaca backend
  - Resolves: #1267206 ipa-server-install uninstall should warn if no
    installation found
  - Resolves: #1295865 The Domain option is not correctly set in idmapd.conf when
    ipa-client-automount is executed.
  - Resolves: #1327092 URI details missing and OCSP-URI details are incorrectly
    displayed when certificate generated using IPA on RHEL 7.2up2.
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605191449GITf8edf37


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605191449GITf8edf37.1
changelog:
  - Resolves: #1332809 ipa-server-4.2.0-15.el7_2.6.1.x86_64 fails to install
    because of missing dependencies
    - Rebuild with krb5-1.14.1


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3
changelog:
  - Resolves: #1339233 CA installed on replica is always marked as renewal master
  - Related: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.3.1.201605241723GIT1b427d3


author: Jan Cholasta <jcholast@redhat.com> - 4.3.1-0.201605241723GIT1b427d3.1
changelog:
  - Resolves: #1339483 ipa-server-install fails with ERROR pkinit_cert_files
    - Fix incorrect rebase of patch 1001


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.1.alpha1
changelog:
  - Resolves: #712109 "krbExtraData not allowed" is logged in DS error log while
    setting password for default sudo binddn.
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #768316 [RFE] ipa-getkeytab should auto-detect the ipa server name
  - Resolves: #825391 [RFE] Replica installation should provide a means for
    inheriting nssldap security access settings
  - Resolves: #921497 Incorrect *.py[co] files placement
  - Resolves: #1029640 RHEL7 IPA to add DNA Plugin config for dnaRemote support
  - Resolves: #1029905 389 DS cache sizes not replicated to IPA replicas
  - Resolves: #1196958 IPA replica installation failing with high number of users
    (160000).
  - Resolves: #1219402 IPA suggests to uninstall a client when the user needs to
    uninstall a replica
  - Resolves: #1224057 [RFE] TGS authorization decisions in KDC based on
    Authentication Indicator
  - Resolves: #1234222 [WebUI] UI error message is not appropriate for "Kerberos
    principal expiration"
  - Resolves: #1234223 [WebUI] General invalid password error message appearing
    for "Locked user"
  - Resolves: #1254267 ipa-server-install failure applying ldap updates with
    limits exceeded
  - Resolves: #1258626 realmdomains-mod --add-domain command throwing error when
    doamin already is in forwardzone.
  - Resolves: #1259020 ipa-server-adtrust-install doesn't allow
    NetBIOS-name=EXAMPLE-TEST.COM (dash character)
  - Resolves: #1260993 DNSSEC signing enablement on dnszone should throw error
    message when DNSSEC master not installed
  - Resolves: #1262747 dnssec options missing in ipa-dns-install man page
  - Resolves: #1265900 Fail installation immediately after dirsrv fails to
    install using ipa-server-install
  - Resolves: #1265915 idoverrideuser-find fails if any SID anchor is not
    resolvable anymore
  - Resolves: #1268027 ipa-dnskeysync-replica crash with backtrace -
    LimitsExceeded: limits exceeded for this query
  - Resolves: #1269089 Certificate of managed-by host/service fails to resubmit
  - Resolves: #1269200 ipa-server crashing while trying to preserve admin user
  - Resolves: #1271321 Reduce ioblocktimeout and idletimeout defaults
  - Resolves: #1271579 Automember rule expressions disappear from tables on
    single expression delete
  - Resolves: #1275816 Incomplete ports for IPA ad-trust
  - Resolves: #1276351 [RFE] Remove
    /usr/share/ipa/updates/50-lockout-policy.update file from IPA releases
  - Resolves: #1277109 Add tool tips for Revert, Refresh, Undo, and Undo All in
    the IPA UI
  - Resolves: #1278426 Better error message needed for invalid ca-signing-algo
    option
  - Resolves: #1279932 ipa-client-install --request-cert needs workaround in
    anaconda chroot
  - Resolves: #1282521 Creating a user w/o private group fails when doing so in
    WebUI
  - Resolves: #1283879 ipa-winsync-migrate: Traceback message should be replaced
    by "IPA is not configured on this system"
  - Resolves: #1285071 ipa-kra-install fails on replica looking for admin cert
    file
  - Resolves: #1287194 [RFE] Support of UPN for trusted domains
  - Resolves: #1288967 Normalize Manager entry in ipa user-add
  - Resolves: #1289487 Priority field missing in Password Policy detail tab
  - Resolves: #1291140 ipa client should configure kpasswd_server directive in
    krb5.conf
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0.alpha1
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1300576 Browser setup page includes instructions for Internet
    Explorer
  - Resolves: #1301586 ipa host-del --updatedns should remove related dns
    entries.
  - Resolves: #1304618 Residual Files After IPA Server Uninstall
  - Resolves: #1305144 ipa-python does not require its dependencies
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
  - Resolves: #1313798 Console output post ipa-winsync-migrate command should be
    corrected.
  - Resolves: #1314786 [RFE] External Trust with Active Directory domain
  - Resolves: #1319023 Include description for 'status' option in man page for
    ipactl command.
  - Resolves: #1319912 ipa-server-install does not completely change hostname and
    named-pkcs11 fails
  - Resolves: #1320891 IPA Error 3009: Validation error: Invalid 'ptrrecord':
    Reverse zone in-addr.arpa. requires exactly 4 IP address compnents, 5 given
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1328549 "ipa-kra-install" command reports incorrect message when
    it is executed on server already installed with KRA.
  - Resolves: #1329209 ipa-nis-manage enable: change service name from 'portmap'
    to 'rpcbind'
  - Resolves: #1329275 ipa-nis-manage command should include status option
  - Resolves: #1330843 'man ipa' should be updated with latest commands
  - Resolves: #1333755 ipa cert-request causes internal server error while
    requesting certificate
  - Resolves: #1337484 EOF is not handled for ipa-client-install command
  - Resolves: #1338031 Insufficient 'write' privilege on some attributes for the
    members of the role which has "User Administrators" privilege.
  - Resolves: #1343142 IPA DNS should do better verification of DNS zones
  - Resolves: #1347928 Frontpage exposes runtime error with no cookies enabled in
    browser


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-0.2.alpha1
changelog:
  - Resolves: #1348948 IPA server install fails with build
    ipa-server-4.4.0-0.el7.1.alpha1
    - Revert "Increased mod_wsgi socket-timeout"


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-1
changelog:
  - Resolves: #747612 [RFE] IPA should support and manage DNS sites
  - Resolves: #826790 Disabling password expiration (--maxlife=0 and --minlife=0)
    in the default global_policy in IPA sets user's password expiration
    (krbPasswordExpiration) to be 90 days
  - Resolves: #896699 ipa-replica-manage -H does not delete DNS SRV records
  - Resolves: #1084018 [RFE] Add IdM user password change support for legacy
    client compat tree
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - Fix incorrect check for principal type when evaluating CA ACLs
  - Resolves: #1146860 [RFE] Offer OTP generation for host enrollment in the UI
  - Resolves: #1238190 ipasam unable to lookup group in directory yet manual
    search works
  - Resolves: #1250110 search by users which don't have read rights for all attrs
    in search_attributes fails
  - Resolves: #1263764 Show Certificate displays in useless format
  - Resolves: #1272491 [WebUI] Certificate action dropdown does not display all
    the options after adding new certificate
  - Resolves: #1292141 Rebase to FreeIPA 4.4+
    - Rebase to 4.4.0
  - Resolves: #1294503 IPA fails to issue 3rd party certs
  - Resolves: #1298242 [RFE] API compatibility - compatibility of clients
  - Resolves: #1298848 [RFE] Centralized topology management
  - Resolves: #1298966 [RFE] Extend Smart Card support
  - Resolves: #1315146 Multiple clients cannot join domain simultaneously:
    /var/run/httpd/ipa/clientcaches race condition?
  - Resolves: #1318903 ipa server install failing when SUBCA signs the cert
  - Resolves: #1319003 ipa-winsync-migrate: Traceback should be fixed with proper
    console output
  - Resolves: #1324055 IPA always qualify requests for admin
  - Resolves: #1328552 [RFE] Allow users to authenticate with alternative names
  - Resolves: #1334582 Inconsistent UI and CLI options for removing certificate
    hold
  - Resolves: #1346321 Exclude o=ipaca subtree from Retro Changelog (syncrepl)
  - Resolves: #1349281 Fix `Conflicts` with ipa-python
  - Resolves: #1350695 execution of copy-schema script fails
  - Resolves: #1351118 upgrade failed for RHEL-7.3 from RHEL-7.2.z
  - Resolves: #1351153 AVC seen on Replica during ipa-server upgrade test
    execution to 7.3
  - Resolves: #1351276 ipa-server-install with dns cannot resolve itself to
    create ipa-ca entry
  - Related: #1343422 [RFE] Add GssapiImpersonate option


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2
changelog:
  - Resolves: #1356102 Server uninstall does not stop tracking lightweight sub-CA
    with certmonger
    - uninstall: untrack lightweight CA certs
  - Resolves: #1351807 ipa-nis-manage config.get_dn missing
    - ipa-nis-manage: Use server API to retrieve plugin status
  - Resolves: #1353452 ipa-compat-manage command failed,
    exception: NotImplementedError: config.get_dn()
    - ipa-compat-manage: use server API to retrieve plugin status
  - Resolves: #1353899 ipa-advise: object of type 'type' has no len()
    - ipa-advise: correct handling of plugin namespace iteration
  - Resolves: #1356134 'kinit -E' does not work for IPA user
    - kdb: check for local realm in enterprise principals
  - Resolves: #1353072 ipa unknown command vault-add
    - Enable vault-* commands on client
    - vault-add: set the default vault type on the client side if none was given
  - Resolves: #1353995 Default CA can be used without a CA ACL
    - caacl: expand plugin documentation
  - Resolves: #1356144 host-find should not print SSH keys by default, only
    SSH fingerprints
    - host-find: do not show SSH key by default
  - Resolves: #1353506 ipa migrate-ds command fails for IPA in RHEL 7.3
    - Removed unused method parameter from migrate-ds


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-2.1
changelog:
  - Resolves: #1274524 [RFE] Qualify up to 60 IdM replicas
  - Resolves: #1320838 [RFE] Support IdM Client in a DNS domain controlled by AD
  - Related: #1356134 'kinit -E' does not work for IPA user


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-3
changelog:
  - Resolves: #1296140 Remove redhat-access-plugin-ipa support
    - Obsolete and conflict redhat-access-plugin-ipa
  - Resolves: #1351119 Multiple issues while uninstalling ipa-server
    - server uninstall fails to remove krb principals
  - Resolves: #1351758 ipa commands not showing expected error messages
    - frontend: copy command arguments to output params on client
    - Show full error message for selinuxusermap-add-hostgroup
  - Resolves: #1352883 Traceback on adding default automember group and hostgroup
    set
    - allow 'value' output param in commands without primary key
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - schema: Fix subtopic -> topic mapping
  - Resolves: #1354348 ipa trustconfig-show throws internal error.
    - allow 'value' output param in commands without primary key
  - Resolves: #1354381 ipa trust-add with raw option gives internal error.
    - trust-add: handle `--all/--raw` options properly
  - Resolves: #1354493 Replica install fails with old IPA master
    - DNS install: Ensure that DNS servers container exists
  - Resolves: #1354628 ipa hostgroup-add-member does not return error message
    when adding itself as member
    - frontend: copy command arguments to output params on client
  - Resolves: #1355856 ipa otptoken-add --type=totp gives internal error
    - messages: specify message type for ResultFormattingError
  - Resolves: #1356063 "ipa radiusproxy-add" command needs to prompt to enter
    secret key
    - expose `--secret` option in radiusproxy-* commands
    - prevent search for RADIUS proxy servers by secret
  - Resolves: #1356099 Bug in the ipapwd plugin
    - Heap corruption in ipapwd plugin
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
  - Resolves: #1356964 Renaming a user removes all of his principal aliases
    - Preserve user principal aliases during rename operation


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-4
changelog:
  - Resolves: #1117306 [RFE] Allow multiple Principals per host entry (Kerberos
    aliases)
    - harden the check for trust namespace overlap in new principals
  - Resolves: #1351142 CLI is not using session cookies for communication with
    IPA API
    - Fix session cookies
  - Resolves: #1353888 Fix the help for ipa otp and other topics
    - help: Add dnsserver commands to help topic 'dns'
  - Resolves: #1354406 host-del updatedns options complains about missing ptr
    record for host
    - Host-del: fix behavior of --updatedns and PTR records
  - Resolves: #1355718 ipa-replica-manage man page example output differs actual
    command output
    - Minor fix in ipa-replica-manage MAN page
  - Resolves: #1358229 Traceback message should be fixed, seen while editing
    winsync migrated user information in Default trust view.
    - baseldap: Fix MidairCollision instantiation during entry modification
  - Resolves: #1358849 CA replica install logs to wrong log file
    - unite log file name of ipa-ca-install
  - Resolves: #1359130 ipa-server-install command fails to install IPA server.
    - DNS Locations: fix update-system-records unpacking error
  - Resolves: #1359237 AVC on dirsrv config caused by IPA installer
    - Use copy when replacing files to keep SELinux context
  - Resolves: #1359692 ipa-client-install join fail with traceback against
    RHEL-6.8 ipa-server
    - compat: fix ping call
  - Resolves: #1359738 ipa-replica-install --domain=<IPA primary domain> option
    does not work
    - replica-install: Fix --domain
  - Resolves: #1360778 Vault commands are available in CLI even when the server
    does not support them
    - Revert "Enable vault-* commands on client"
    - client: fix hiding of commands which lack server support
  - Related: #1281704 Rebase to softhsm 2.1.0
    - Remove the workaround for softhsm bug #1293340
  - Related: #1298288 [RFE] Improve performance in large environments.
    - Create indexes for krbCanonicalName attribute


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-5
changelog:
  - Resolves: #1353829 traceback message seen in ipaserver-uninstall.log file.
    - Do not initialize API in ipa-client-automount uninstall
  - Resolves: #1356899 com.redhat.idm.trust.fetch_domains need update after thin
    client changes
    - idrange: fix unassigned global variable
  - Resolves: #1360792 Migrating users doesn't update krbCanonicalName
    - re-set canonical principal name on migrated users
  - Resolves: #1362012 ipa hbactest produces error about cannot concatenate 'str'
    and 'bool' objects
    - Fix ipa hbactest output
  - Resolves: #1362260 ipa vault-mod no longer allows defining salt
    - vault: add missing salt option to vault_mod
  - Resolves: #1362312 ipa vault-retrieve internal error when using the wrong
    public key
    - vault: Catch correct exception in decrypt
  - Resolves: #1362537 ipa-server-install fails to create symlink from
    /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
    - Correct path to HTTPD's systemd service directory
  - Resolves: #1363756 Increase length of passwords generated by installer
    - Increase default length of auto generated passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-6
changelog:
  - Resolves: #1309700 Process /usr/sbin/winbindd was killed by signal 6
    - Revert "spec: add conflict with bind-chroot to freeipa-server-dns"
  - Resolves: #1341249 Subsequent external CA installation fails
    - install: fix external CA cert validation
  - Resolves: #1353831 ipa-server-install fails in container because of
    hostnamectl set-hostname
    - server-install: Fix --hostname option to always override api.env values
    - install: Call hostnamectl set-hostname only if --hostname option is used
  - Resolves: #1356091 ipa-cacert-manage --help and man differ
    - Improvements for the ipa-cacert-manage man and help
  - Resolves: #1360631 ipa-backup is not keeping the
    /etc/tmpfiles.d/dirsrv-<instance>.conf
    - ipa-backup: backup /etc/tmpfiles.d/dirsrv-<instance>.conf
  - Resolves: #1361047 ipa-replica-install --help usage line suggests the replica
    file is needed
    - Update ipa-replica-install documentation
  - Resolves: #1361545 ipa-client-install starts rhel-domainname.service but does
    not rpm-require it
    - client: RPM require initscripts to get *-domainname.service
  - Resolves: #1364197 caacl: error when instantiating rules with service
    principals
    - caacl: fix regression in rule instantiation
  - Resolves: #1364310 ipa otptoken-add bytes object has no attribute confirm
    - parameters: move the `confirm` kwarg to Param
  - Resolves: #1364464 Topology graph: ca and domain adders shows question marks
    instead of plus icon
    - Fix unicode characters in ca and domain adders
  - Resolves: #1365083 Incomplete output returned for command ipa vault-add
    - client: add missing output params to client-side commands
  - Resolves: #1365526 build fails during "make check"
    - ipa-kdb: Fix unit test after packaging changes in krb5


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-7
changelog:
  - Resolves: #1361119 UPN-based search for AD users does not match an entry in
    slapi-nis map cache
    - support multiple uid values in schema compatibility tree


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-8
changelog:
  - Resolves: #1298288 [RFE] Improve performance in large environments.
    - cert: speed up cert-find
  - Resolves: #1317379 [EXPERIMENTAL][RFE] Web UI: allow Smart Card
    authentication
    - service: add flag to allow S4U2Self
    - Add 'trusted to auth as user' checkbox
    - Added new authentication method
  - Resolves: #1353881 ipa-replica-install suggests about
    non-existent --force-ntpd option
    - Don't show --force-ntpd option in replica install
  - Resolves: #1354441 DNS forwarder check is too strict: unable to add
    sub-domain to already-broken domain
    - DNS: allow to add forward zone to already broken sub-domain
  - Resolves: #1356146 performance regression in CLI help
    - schema: Speed up schema cache
    - frontend: Change doc, summary, topic and NO_CLI to class properties
    - schema: Introduce schema cache format
    - schema: Generate bits for help load them on request
    - help: Do not create instances to get information about commands and topics
    - schema cache: Do not reset ServerInfo dirty flag
    - schema cache: Do not read fingerprint and format from cache
    - Access data for help separately
    - frontent: Add summary class property to CommandOverride
    - schema cache: Read server info only once
    - schema cache: Store API schema cache in memory
    - client: Do not create instance just to check isinstance
    - schema cache: Read schema instead of rewriting it when SchemaUpToDate
  - Resolves: #1360769 ipa-server-certinstall couldnt unlock private key file
    - server install: do not prompt for cert file PIN repeatedly
  - Resolves: #1364113 ipa-password: ipa: ERROR: RuntimeError: Unable to create
    cache directory: [Errno 13] Permission denied: '/home/test_user'
    - schema: Speed up schema cache
  - Resolves: #1366604 `cert-find` crashes on invalid certificate data
    - cert: do not crash on invalid data in cert-find
  - Resolves: #1366612 Middle replica uninstallation in line topology works
    without '--ignore-topology-disconnect'
    - Fail on topology disconnect/last role removal
  - Resolves: #1366626 caacl-add-service: incorrect error message when service
    does not exists
    - Fix ipa-caalc-add-service error message
  - Resolves: #1367022 The ipa-server-upgrade command failed when named-pkcs11
    does not happen to run during dnf upgrade
    - DNS server upgrade: do not fail when DNS server did not respond
  - Resolves: #1367759 [RFE] [webui] warn admin if there is only one IPA server
    with CA
    - Add warning about only one existing CA server
    - Set servers list as default facet in topology facet group
  - Resolves: #1367773 thin client ignores locale change
    - schema check: Check current client language against cached one


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-9
changelog:
  - Resolves: #1081561 CA not start during ipa server install in pure IPv6 env
    - Fix ipa-server-install in pure IPv6 environment
  - Resolves: #1318169 Tree-root domains in a trusted AD forest aren't marked as
    reachable via the forest root
    - trust: make sure ID range is created for the child domain even if it exists
    - ipa-kdb: simplify trusted domain parent search
  - Resolves: #1335567 Update Warning in IdM Web UI API browser
    - WebUI: add API browser is tech preview warning
  - Resolves: #1348560 Mulitple domain Active Directory Trust conflict
    - ipaserver/dcerpc: reformat to make the code closer to pep8
    - trust: automatically resolve DNS trust conflicts for triangle trusts
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)
  - Resolves: #1353936 custodia.conf and server.keys file is world-readable.
    - Remove Custodia server keys from LDAP
    - Secure permissions of Custodia server.keys
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
    - custodia: include known CA certs in the PKCS#12 file for Dogtag
    - custodia: force reconnect before retrieving CA certs from LDAP
  - Resolves: #1362333 ipa vault container owner cannot add vault
    - Fix: container owner should be able to add vault
  - Resolves: #1365546 External trust with root domain is transitive
    - trust: make sure external trust topology is correctly rendered
  - Resolves: #1365572 IPA server broken after upgrade
    - Require pki-core-10.3.3-7
  - Resolves: #1367864 Server assumes latest version of command instead of
    version 1 for old / 3rd party clients
    - rpcserver: assume version 1 for unversioned command calls
    - rpcserver: fix crash in XML-RPC system commands
  - Resolves: #1367773 thin client ignores locale change
    - schema cache: Fallback to 'en_us' when locale is not available
  - Resolves: #1368754 ipa server uninstall fails with Python "Global Name error"
    - Fail on topology disconnect/last role removal
  - Resolves: #1368981 ipa otptoken-add --type=hotp --key creates wrong OTP
    - otptoken, permission: Convert custom type parameters on server
  - Resolves: #1369414 ipa server-del fails with Python stack trace
    - Handled empty hostname in server-del command
  - Resolves: #1369761 ipa-server must depend on a version of httpd that support
    mod_proxy with UDS
    - Require httpd 2.4.6-31 with mod_proxy Unix socket support
  - Resolves: #1370512 Received ACIError instead of DuplicatedError in
    stageuser_tests
    - Raise DuplicatedEnrty error when user exists in delete_container
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add missing param values to cert-find output
  - Renamed patch 1011 to 0100, as it was merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-10
changelog:
  - Resolves: #1355753 adding two way non transitive(external) trust displays
    internal error on the console
    - Always fetch forest info from root DCs when establishing two-way trust
    - factor out `populate_remote_domain` method into module-level function
    - Always fetch forest info from root DCs when establishing one-way trust
  - Resolves: #1356101 Lightweight sub-CA certs are not tracked by certmonger
    after `ipa-replica-install`
    - Track lightweight CAs on replica installation
  - Resolves: #1357488 ipa command stuck forever on higher versioned client with
    lower versioned server
    - compat: Save server's API version in for pre-schema servers
    - compat: Fix ping command call
    - schema cache: Store and check info for pre-schema servers
  - Resolves: #1363905 man page for ipa-replica-manage has a typo in -c flag
    - Fix man page ipa-replica-manage: remove duplicate -c option
      from --no-lookup
  - Resolves: #1367865 webui: cert_revoke should use --cacn to set correct CA
    when revoking certificate
    - cert: include CA name in cert command output
    - WebUI add support for sub-CAs while revoking certificates
  - Resolves: #1368424 Unable to view certificates issued by Sub CA in Web UI
    - Add support for additional options taken from table facet
    - WebUI: Fix showing certificates issued by sub-CA
  - Resolves: #1368557 dnsrecord-add does not prompt for missing record parts
    internactively
    - dns: normalize record type read interactively in dnsrecord_add
    - dns: prompt for missing record parts in CLI
    - dns: fix crash in interactive mode against old servers
  - Resolves: #1370519 Certificate revocation in service-del and host-del isn't
    aware of Sub CAs
    - cert: fix cert-find --certificate when the cert is not in LDAP
    - Make host/service cert revocation aware of lightweight CAs
  - Resolves: #1371901 Use OAEP padding with custodia
    - Use RSA-OAEP instead of RSA PKCS#1 v1.5
  - Resolves: #1371915 When establishing external two-way trust, forest root
    Administrator account is used to fetch domain info
    - do not use trusted forest name to construct domain admin principal
  - Resolves: #1372597 Incorrect CA ACL evaluation of SAN DNS names in
    certificate request
    - Fix CA ACL Check on SubjectAltNames
  - Resolves: #1373272 CLI always sends default command version
    - cli: use full name when executing a command
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix ipa-certupdate for CA-less installation
  - Resolves: #1373540 client-install with IPv6 address fails on link-local
    address (always)
    - Fix parse errors with link-local addresses


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-11
changelog:
  - Resolves: #1373359 ipa-certupdate fails with "CA is not configured"
    - Fix regression introduced in ipa-certupdate


author: Petr Vobornik <pvoborni@redhat.com> - 4.4.0-12
changelog:
  - Resolves: #1373910 IPA server upgrade fails with DNS timed out errors.
  - Resolves: #1375269 ipa trust-fetch-domains throws internal error


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-13
changelog:
  - Resolves: #1318616 CA fails to start after doing ipa-ca-install --external-ca
    - Keep NSS trust flags of existing certificates
  - Resolves: #1360813 ipa-server-certinstall does not update all certificate
    stores and doesn't set proper trust permissions
    - Add cert checks in ipa-server-certinstall
  - Resolves: #1371479 cert-find --all does not show information about revocation
    - cert: add revocation reason back to cert-find output
  - Resolves: #1375133 WinSync users who have First.Last casing creates users who
    can have their password set
    - ipa passwd: use correct normalizer for user principals
  - Resolves: #1377858 Users with 2FA tokens are not able to login to IPA servers
    - Properly handle LDAP socket closures in ipa-otpd
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Make httpd publish its CA certificate on DL1


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14
changelog:
  - Resolves: #1378353 Replica install fails with old IPA master sometimes during
    replication process
    - spec file: bump minimal required version of 389-ds-base
  - Resolves: #1387779 Make httpd publish CA certificate on Domain Level 1
    - Fix missing file that fails DL1 replica installation
  - Resolves: #1387782 WebUI: Services are not displayed correctly after upgrade
    - WebUI: services without canonical name are shown correctly
  - Resolves: #1389709 Traceback seen in error_log when trustdomain-del is run
    - trustdomain-del: fix the way how subdomain is searched


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.1
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - password policy: Add explicit default password policy for hosts and
      services
  - Resolves: #1395311 CVE-2016-9575 ipa: Insufficient permission check in
    certprofile-mod
    - certprofile-mod: correctly authorise config update


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.2
changelog:
  - Resolves: #1382812 Creation of replica for disconnected environment is
    failing with CA issuance errors; Need good steps.
    - gracefully handle setting replica bind dn group on old masters
  - Resolves: #1397439 ipa-ca-install on promoted replica hangs on creating a
    temporary CA admin
    - replication: ensure bind DN group check interval is set on replica config
    - add missing attribute to ipaca replica during CA topology update
  - Resolves: #1401088 IPA upgrade of replica without DNS fails during restart of
    named-pkcs11
    - bindinstance: use data in named.conf to determine configuration status


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.3
changelog:
  - Resolves: #1398670 Check IdM Topology for broken record caused by replication
    conflict before upgrading it
    - Check for conflict entries before raising domain level


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.4
changelog:
  - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services
    by abusing password policy
    - ipa-kdb: search for password policies globally
  - Renamed patches 1011 and 1012 to 0151 and 0150, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.5
changelog:
  - Resolves: #1365858 ipa-ca-install fails on replica when IPA Master is
    installed without CA
    - Set up DS TLS on replica in CA-less topology
  - Resolves: #1398600 IPA replica install fails with dirsrv errors.
    - Do not configure PKI ajp redirection to use "::1"
  - Resolves: #1413137 CVE-2017-2590 ipa: Insufficient permission check for
    ca-del, ca-disable and ca-enable commands
    - ca: correctly authorise ca-del, ca-enable and ca-disable


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.6
changelog:
  - Resolves: #1416454 replication race condition prevents IPA to install
    - wait_for_entry: use only DN as parameter
    - Wait until HTTPS principal entry is replicated to replica
    - Use proper logging for error messages


author: Jan Cholasta <jcholast@redhat.com> - 4.4.0-14.7
changelog:
  - Resolves: #1419735 ipa-replica-install fails promotecustodia.create_replica
    with cert errors (untrusted)
    - added ssl verification using IPA trust anchor
  - Resolves: #1428472 batch param compatibility is incorrect
    - compat: fix `Any` params in `batch` and `dnsrecord`
  - Renamed patches 1011 and 1012 to 0159 and 0157, as they were merged upstream


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-1.el7
changelog:
  - Resolves: #828866 [RFE] enhance --subject option for ipa-server-install
  - Resolves: #1160555 ipa-server-install: Cannot handle double hyphen "--" in
    hostname
  - Resolves: #1286288 Insufficient 'write' privilege to the 'ipaExternalMember'
    attribute
  - Resolves: #1321652 ipa-server-install fails when using external certificates
    that encapsulate RDN components in double quotes
  - Resolves: #1327207 ipa cert-revoke --help doesn't provide enough info on
    revocation reasons
  - Resolves: #1340880 ipa-server-install: improve prompt on interactive
    installation
  - Resolves: #1353841 ipa-replica-install fails to install when resolv.conf
    incomplete entries
  - Resolves: #1356104 cert-show command does not display Subject Alternative
    Names
  - Resolves: #1357511 Traceback message seen when ipa is provided with invalid
    configuration file name
  - Resolves: #1358752 ipa-ca-install fails on replica when IPA server is
    converted from CA-less to CA-full
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
  - Resolves: #1367572 improve error message in ipa migrate-ds: mention ipa
    config-mod --enable-migration=TRUE
  - Resolves: #1367868 Add options to retrieve lightweight CA certificate/chain
  - Resolves: #1371927 Implement ca-enable/disable commands.
  - Resolves: #1372202 Add Users into User Group editors fails to show Full names
  - Resolves: #1373091 Adding an auth indicator from the CLI creates an extra
    check box in the UI
  - Resolves: #1375596 Ipa-server WebUI - long user/group name show wrong error
    message
  - Resolves: #1375905 "Normal" group type in the UI is confusing
  - Resolves: #1376040 IPA client ipv6 - invalid --ip-address shows traceback
  - Resolves: #1376630 IDM admin password gets written to
    /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
  - Resolves: #1376729 ipa-server-install script option --no_hbac_allow should
    match other options
  - Resolves: #1378461 IPA Allows Password Reuse with History value defined when
    admin resets the password.
  - Resolves: #1379029 conncheck failing intermittently during single step
    replica installs
  - Resolves: #1379858 [RFE] better debugging for ipa-replica-conncheck
  - Resolves: #1384310 ipa dnsrecord-add fails with Keyerror stack trace
  - Resolves: #1392778 Update man page for ipa-adtrust-install by
    removing --no-msdcs option
  - Resolves: #1392858 Rebase to FreeIPA 4.5+
    - Rebase to 4.5.0
  - Resolves: #1399133 Delete option shouldn't be available for hosts applied to
    view.
  - Resolves: #1399190 [RFE] Certificates issued by externally signed IdM CA
    should contain full trust chain
  - Resolves: #1400416 RFE: Provide option to take backup of IPA server before
    uninstalling IPA server
  - Resolves: #1400529 cert-request is not aware of Kerberos principal aliases
  - Resolves: #1401526 IPA WebUI certificates are grayed out on overview page but
    not on details page
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
  - Resolves: #1404750 ipa-client-install fails to get CA cert via LDAP when
    non-FQDN name of IPA server is first in /etc/hosts
  - Resolves: #1409628 [RFE] Semi-automatic integration with external DNS using
    nsupdate
  - Resolves: #1413742 Backport request for bug/issue Change IP address
    validation errors to warnings
  - Resolves: #1415652 IPA replica install log shows password in plain text
  - Resolves: #1427897 different behavior regarding system wide certs in master
    and replica.
  - Resolves: #1430314 The ipa-managed-entries command failed, exception:
    AttributeError: ldap2


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-2.el7
changelog:
  - Resolves: #1432630 python2-jinja2 needed for python2-ipaclient
    - Remove csrgen
  - Resolves: #1432903 Set GssProxy options to enable caching of ldap tickets
    - Add options to allow ticket caching


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-3.el7
changelog:
  - Resolves: #800545 [RFE] Support SUDO command rename
    - Reworked the renaming mechanism
    - Allow renaming of the sudorule objects
  - Resolves: #872671 IPA WebUI login for AD Trusted User fails
    - WebUI: check principals in lowercase
    - WebUI: add method for disabling item in user dropdown menu
    - WebUI: Add support for login for AD users
  - Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
    certificates on smart cards (pkinit)
    - ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
    - IPA certauth plugin
    - ipa-kdb: do not depend on certauth_plugin.h
    - spec file: bump krb5-devel BuildRequires for certauth
  - Resolves: #1264370 RFE: disable last successful authentication by default in
    ipa.
    - Set "KDC:Disable Last Success" by default
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - certs: do not implicitly create DS pin.txt
    - httpinstance: clean up /etc/httpd/alias on uninstall
  - Resolves: #1366572 [RFE] Web UI: allow Smart Card authentication
    - configure: fix --disable-server with certauth plugin
    - rpcserver.login_x509: Actually return reply from __call__ method
    - spec file: Bump requires to make Certificate Login in WebUI work
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - extdom: do reverse search for domain separator
    - extdom: improve cert request
  - Resolves: #1430363 [RFE] HBAC rule names command rename
    - Reworked the renaming mechanism
    - Allow renaming of the HBAC rule objects
  - Resolves: #1433082 systemctl daemon-reload needs to be called after
    httpd.service.d/ipa.conf is manipulated
    - tasks: run `systemctl daemon-reload` after httpd.service.d updates
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Use Custodia 0.3.1 features
  - Resolves: #1434384 RPC client should use HTTP persistent connection
    - Use connection keep-alive
    - Add debug logging for keep-alive
    - Increase Apache HTTPD's default keep alive timeout
  - Resolves: #1434729 man ipa-cacert-manage install needs clarification
    - man ipa-cacert-manage install needs clarification
  - Resolves: #1434910 replica install against IPA v3 master fails with ACIError
    - Fixing replica install: fix ldap connection in domlvl 0
  - Resolves: #1435394 Ipa-kra-install fails with weird output when backspace is
    used during typing Directory Manager password
    - ipapython.ipautil.nolog_replace: Do not replace empty value
  - Resolves: #1435397 ipa-replica-install can't install replica file produced by
    ipa-replica-prepare on 4.5
    - replica prepare: fix wrong IPA CA nickname in replica file
  - Resolves: #1435599 WebUI: in self-service Vault menu item is shown even if
    KRA is not installed
    - WebUI: Fix showing vault in selfservice view
  - Resolves: #1435718 As a ID user I cannot call a command with --rights option
    - ldap2: use LDAP whoami operation to retrieve bind DN for current connection
  - Resolves: #1436319 "Truncated search results" pop-up appears in user details
    in WebUI
    - WebUI: Add support for suppressing warnings
    - WebUI: suppress truncation warning in select widget
  - Resolves: #1436333 Uninstall fails with No such file or directory:
    '/var/run/ipa/services.list'
    - Create temporaty directories at the begining of uninstall
  - Resolves: #1436334 WebUI: Adding certificate mapping data using certificate
    fails
    - WebUI: Allow to add certs to certmapping with CERT LINES around
  - Resolves: #1436338 CLI doesn't work after ipa-restore
    - Backup ipa-specific httpd unit-file
    - Backup CA cert from kerberos folder
  - Resolves: #1436342 Bump samba version, required for FIPS mode and privilege
    separation
    - Bump samba version for FIPS and priv. separation
  - Resolves: #1436642 [ipalib/rpc.py] - "maximum recursion depth exceeded" with
    ipa vault commands
    - Avoid growing FILE ccaches unnecessarily
    - Handle failed authentication via cookie
    - Work around issues fetching session data
    - Prevent churn on ccaches
  - Resolves: #1436657 Add workaround for pki_pin for FIPS
    - Generate PIN for PKI to help Dogtag in FIPS
  - Resolves: #1436714 [vault] cache KRA transport cert
    - Simplify KRA transport cert cache
  - Resolves: #1436723 cert-find does not find all certificates without
    sizelimit=0
    - cert: do not limit internal searches in cert-find
  - Resolves: #1436724 Renewal of IPA RA fails on replica
    - dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
  - Resolves: #1436753 Master tree fails to install
    - httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not
      available


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-4.el7
changelog:
  - Resolves: #1434032 Run ipa-custodia with custom SELinux context
    - Require correct custodia version


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-5.el7
changelog:
  - Resolves: #1318186 Misleading error message during external-ca IPA master
    install
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1331443 Re-installing ipa-server after uninstall fails with "ERROR
    CA certificate chain in ... incomplete"
    - httpinstance: make sure NSS database is backed up
  - Resolves: #1393726 Enumerate all available request type options in ipa
    cert-request help
    - Hide request_type doc string in cert-request help
  - Resolves: #1402959 [RFE] Universal Smart Card to Identity mapping
    - spec file: bump libsss_nss_idmap-devel BuildRequires
    - server: make sure we test for sss_nss_getlistbycert
  - Resolves: #1437378 ipa-adtrust-install produced an error and failed on
    starting smb when hostname is not FQDN
    - adtrust: make sure that runtime hostname result is consistent with the
      configuration
  - Resolves: #1437555 ipa-replica-install with DL0 fails to get annonymous
    keytab
    - Always check and create anonymous principal during KDC install
    - Remove duplicate functionality in upgrade
  - Resolves: #1437946 Upgrade to FreeIPA 4.5.0 does not configure anonymous
    principal for PKINIT
    - Upgrade: configure PKINIT after adding anonymous principal
    - Remove unused variable from failed anonymous PKINIT handling
    - Split out anonymous PKINIT test to a separate method
    - Ensure KDC is propery configured after upgrade
  - Resolves: #1437951 Remove pkinit-related options from server/replica-install
    on DL0
    - Fix the order of cert-files check
    - Don't allow setting pkinit-related options on DL0
    - replica-prepare man: remove pkinit option refs
    - Remove redundant option check for cert files
  - Resolves: #1438490 CA-less installation fails on publishing CA certificate
    - Get correct CA cert nickname in CA-less
    - Remove publish_ca_cert() method from NSSDatabase
  - Resolves: #1438838 Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
    - IPA-KDB: use relative path in ipa-certmap config snippet
  - Resolves: #1439038 Allow erasing ipaDomainResolutionOrder attribute
    - Allow erasing ipaDomainResolutionOrder attribute


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-6.el7
changelog:
  - Resolves: #1382053 Need to have validation for idrange names
    - idrange-add: properly handle empty --dom-name option
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - dsinstance: reconnect ldap2 after DS is restarted by certmonger
    - httpinstance: avoid httpd restart during certificate request
    - dsinstance, httpinstance: consolidate certificate request code
    - install: request service certs after host keytab is set up
    - renew agent: revert to host keytab authentication
    - renew agent, restart scripts: connect to LDAP after kinit
  - Resolves: #1436987 ipasam: gidNumber attribute is not created in the trusted
    domain entry
    - ipa-sam: create the gidNumber attribute in the trusted domain entry
    - Upgrade: add gidnumber to trusted domain entry
  - Resolves: #1438679 [ipa-replica-install] - IncorrectPasswordException:
    Incorrect client security database password
    - Add pki_pin only when needed
  - Resolves: #1438348 Console output message while adding trust should be
    mapped with texts changed in Samba.
    - ipaserver/dcerpc: unify error processing
  - Resolves: #1438366 ipa trust-fetch-domains: ValidationError: invalid
    'Credentials': Missing credentials for cross-forest communication
    - trust: always use oddjobd helper for fetching trust information
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - WebUI: cert login: Configure name of parameter used to pass username
  - Resolves: #1437879 [copr] Replica install failing
    - Create system users for FreeIPA services during package installation
  - Resolves: #1441316 WebUI cert auth fails after ipa-adtrust-install
    - Fix s4u2self with adtrust


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-7.el7
changelog:
  - Resolves: #1431520 ipa cert-find runs a large number of searches, so IPA
    WebUI is slow to display user details page
    - cert: defer cert-find result post-processing
  - Resolves: #1435611 Tracebacks seen from dogtag-ipa-ca-renew-agent-submit
    helper when installing replica
    - server-install: No double Kerberos install
  - Resolves: #1437502 ipa-replica-install fails with requirement to
    use --force-join that is a client install option.
    - Add the force-join option to replica install
    - replicainstall: better client install exception handling
  - Resolves: #1437953 Server CA-less impossible option check
    - server-install: remove broken no-pkinit check
  - Resolves: #1441160 FreeIPA client <= 4.4 fail to parse 4.5 cookies
    - Add debug log in case cookie retrieval went wrong
  - Resolves: #1441548 ipa server install fails with --external-ca option
    - ext. CA: correctly write the cert chain
  - Resolves: #1441718 Conversion of CA-less server to CA fails on CA instance
    spawn
    - Fix CA-less to CA-full upgrade
  - Resolves: #1442133 Do not link libkrad, liblber, libldap_r and
    libsss_nss_idmap to every binary in IPA
    - configure: fix AC_CHECK_LIB usage
  - Resolves: #1442815 Replica install fails during migration from older IPA
    master
    - Fix RA cert import during DL0 replication
  - Related: #1442004 Building IdM/FreeIPA internally on all architectures -
    filtering unsupported packages
    - Build all subpackages on all architectures


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-8.el7
changelog:
  - Resolves: #1443869 Command "openssl pkcs12 ..." failed during IPA upgrade
    - Fix CAInstance.import_ra_cert for empty passwords


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-9.el7
changelog:
  - Resolves: #1200767 [RFE] Allow Kerberos authentication for users with
    certificates on smart cards (pkinit)
    - spec file: bump krb5 Requires for certauth fixes
  - Resolves: #1438729 Configure local PKINIT on DL0 or when '--no-pkinit' option
    is used
    - separate function to set ipaConfigString values on service entry
    - Allow for configuration of all three PKINIT variants when deploying KDC
    - API for retrieval of master's PKINIT status and publishing it in LDAP
    - Use only anonymous PKINIT to fetch armor ccache
    - Stop requesting anonymous keytab and purge all references of it
    - Use local anchor when armoring password requests
    - Upgrade: configure local/full PKINIT depending on the master status
    - Do not test anonymous PKINIT after install/upgrade
  - Resolves: #1442427 ipa.ipaserver.install.plugins.adtrust.
    update_tdo_gidnumber: ERROR Default SMB Group not found
    - upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
      installed
  - Resolves: #1442932 ipa restore fails to restore IPA user
    - restore: restart/reload gssproxy after restore
  - Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
    - Fix CA/server cert validation in FIPS
  - Resolves: #1444947 Deadlock between topology and schema-compat plugins
    - compat-manage: behave the same for all users
    - Move the compat plugin setup at the end of install
    - compat: ignore cn=topology,cn=ipa,cn=etc subtree
  - Resolves: #1445358 ipa vault-add raises TypeError
    - vault: piped input for ipa vault-add fails
  - Resolves: #1445382 ipa vault-retrieve fails to retrieve data from vault
    - Vault: Explicitly default to 3DES CBC
  - Resolves: #1445432 uninstall ipa client automount failed with RuntimeWarning
    - automount install: fix checking of SSSD functionality on uninstall
  - Resolves: #1446137 pki_client_database_password is shown in
    ipaserver-install.log
    - Hide PKI Client database password in log file


author: Jan Cholasta <jcholast@redhat.com> - 4.5.0-10.el7
changelog:
  - Resolves: #1438833 [ipa-replica-install] - 406 Client Error: Failed to
    validate message: Incorrect number of results (0) searching forpublic key for
    host
    - Make sure remote hosts have our keys
  - Resolves: #1442815 Replica install fails during migration from older IPA
    master
    - Refresh Dogtag RestClient.ca_host property
    - Remove the cachedproperty class
  - Resolves: #1444787 Update warning message when KRA installation fails
    - kra install: update installation failure message
  - Resolves: #1444896 ipa-server-install with external-ca fails in FIPS mode
    - ipa-server-install with external CA: fix pkinit cert issuance
  - Resolves: #1445397 GET in KerberosSession.finalize_kerberos_acquisition()
    must use FreeIPA CA
    - kerberos session: use CA cert with full cert chain for obtaining cookie
  - Resolves: #1447375 ipa-client-install: extra space in pkinit_anchors
    definition
    - ipa-client-install: remove extra space in pkinit_anchors definition
  - Resolves: #1447703 Fix SELinux contex of http.keytab during upgrade
    - Use proper SELinux context with http.keytab


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-12.el7
changelog:
  - Resolves: #1447284 Upgrade from ipa-4.1 fails when enabling KDC proxy
    - python2-ipalib: add missing python dependency
    - installer service: fix typo in service entry
    - upgrade: add missing suffix to http instance
  - Resolves: #1444791 Update man page of ipa-kra-install 
    - ipa-kra-install manpage: document domain-level 1
  - Resolves: #1441493 ipa cert-show raises stack traces when
    --certificate-out=/tmp 
    - cert-show: writable files does not mean dirs 
  - Resolves: #1441192 Add the name of URL parameter which will be check for
    username during cert login
    - Bump version of ipa.conf file
  - Resolves: #1378797 Web UI must check OCSP and CRL during smartcard login
    - Turn on NSSOCSP check in mod_nss conf
  - Resolves: #1322963 Errors from AD when trying to sign ipa.csr, conflicting
    template on
    - renew agent: respect CA renewal master setting
    - server upgrade: always fix certmonger tracking request
    - cainstance: use correct profile for lightweight CA certificates
    - renew agent: allow reusing existing certs
    - renew agent: always export CSR on IPA CA certificate renewal
    - renew agent: get rid of virtual profiles
    - ipa-cacert-manage: add --external-ca-type
  - Resolves: #1441593 error adding authenticator indicators to host 
    - Fixing adding authenticator indicators to host
  - Resolves: #1449525 Set directory ownership in spec file 
    - Added plugins directory to ipaclient subpackages
    - ipaclient: fix missing RPM ownership
  - Resolves: #1451279 otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
    - otptoken-add-yubikey: When --digits not provided use default value


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-13.el7
changelog:
  - Resolves: #1451804 "AttributeError: 'tuple' object has no attribute 'append'"
    error observed during ipa upgrade with latest package. 
    - ipa-server-install: fix uninstall
  - Resolves: #1445390 ipa-[ca|kra]-install with invalid DM password break
    replica 
    - ca install: merge duplicated code for DM password
    - installutils: add DM password validator
    - ca, kra install: validate DM password


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-14.el7
changelog:
  - Resolves: #1438731 Extend ipa-server-certinstall and ipa-certupdate to 
    handle PKINIT certificates/anchors
    - certdb: add named trust flag constants
    - certdb, certs: make trust flags argument mandatory
    - certdb: use custom object for trust flags
    - install: trust IPA CA for PKINIT
    - client install: fix client PKINIT configuration
    - install: introduce generic Kerberos Augeas lens
    - server install: fix KDC PKINIT configuration
    - ipapython.ipautil.run: Add option to set umask before executing command
    - certs: do not export keys world-readable in install_key_from_p12
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
    - replica install: respect --pkinit-cert-file
    - cacert manage: support PKINIT
    - server certinstall: support PKINIT
  - Resolves: #1444432 CA-less pkinit not installable with --pkinit-cert-file
    option
    - certs: do not export CA certs in install_pem_from_p12
    - server install: fix KDC certificate validation in CA-less
  - Resolves: #1451228 ipa-kra-install fails when primary KRA server has been
    decommissioned
    - ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname 
  - Resolves: #1451712 KRA installation fails on server that was originally
    installed as CA-less
    - ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
  - Resolves: #1441499 ipa cert-show does not raise error if no file name
    specified
    - ca/cert-show: check certificate_out in options
  - Resolves: #1449522 Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
    - Remove pkinit-anonymous command
  - Resolves: #1449523 Provide an API command to retrieve PKINIT status
    in the FreeIPA topology
    - Allow for multivalued server attributes
    - Refactor the role/attribute member reporting code
    - Add an attribute reporting client PKINIT-capable servers
    - Add the list of PKINIT servers as a virtual attribute to global config
    - Add `pkinit-status` command
    - test_serverroles: Get rid of MockLDAP and use ldap2 instead
  - Resolves: #1452216 Replica installation grants HTTP principal access in WebUI
    - Fix rare race condition with missing ccache file
  - Resolves: #1455045 Simple service uninstallers must be able to handle
    missing service files gracefully
    - only stop/disable simple service if it is installed
  - Resolves: #1455541 after upgrade login from web ui breaks
    - krb5: make sure KDC certificate is readable
  - Resolves: #1455862 "ipa: ERROR: an internal error has occurred" on executing
    command "ipa cert-request --add" after upgrade
    - Change python-cryptography to python2-cryptography


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-15.el7
changelog:
  - Resolves: #1442233 IPA client commands fail when pointing to replica 
    - httpinstance: wait until the service entry is replicated
  - Resolves: #1456769 ipaAnchorUUID index incorrectly configured and then
    not indexed
    - Fix index definition for ipaAnchorUUID
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Avoid possible endless recursion in RPC call
    - rpc: preparations for recursion fix
    - rpc: avoid possible recursion in create_connection
  - Resolves: #1446087 services entries missing krbCanonicalName attribute.
    - Changing cert-find to do not use only primary key to search in LDAP.
  - Resolves: #1452763 ipa certmaprule change not reflected in krb5kdc workers
    - ipa-kdb: reload certificate mapping rules periodically
  - Resolves: #1455541 after upgrade login from web ui breaks
    - kdc.key should not be visible to all 
  - Resolves: #1435606 Add pkinit_indicator option to KDC configuration
    - ipa-kdb: add pkinit authentication indicator in case of a successful
      certauth
  - Resolves: #1455945 Enabling OCSP checks in mod_nss breaks certificate
    issuance when ipa-ca records are not resolvable
    - Turn off OCSP check
  - Resolves: #1454483 rhel73 ipa ui - cannot del server - IPA Error 903 -
    server_del - TypeError: 'NoneType' object is not iterable
    - fix incorrect suffix handling in topology checks


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-16.el7
changelog:
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces
    - Only warn when specified server IP addresses don't match intf
  - Resolves: #1438016 gssapi errors after IPA server upgrade
    - Bump version of python-gssapi
  - Resolves: #1457942 certauth: use canonical principal for lookups
    - ipa-kdb: use canonical principal in certauth plugin
  - Resolves: #1459153 Do not send Max-Age in ipa_session cookie to avoid
    breaking older clients
    - Add code to be able to set default kinit lifetime
    - Revert setting sessionMaxAge for old clients


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-17.el7
changelog:
  - Resolve: #1455946 Provide a tooling automating the configuration 
    of Smart Card authentication on a FreeIPA master
    - server certinstall: update KDC master entry
    - pkinit manage: introduce ipa-pkinit-manage
    - server upgrade: do not enable PKINIT by default
    - Extend the advice printing code by some useful abstractions
    - Prepare advise plugin for smart card auth configuration
  - Resolve: #1461053 allow to modify list of UPNs of a trusted forest
    - trust-mod: allow modifying list of UPNs of a trusted forest
    - WebUI: add support for changing trust UPN suffixes


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-18.el7
changelog:
  - Resolves: #1449189 ipa-kra-install timeouts on replica
    - kra: promote: Get ticket before calling custodia


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-19.el7
changelog:
  - Resolves: #1462112 ipaserver installation fails in FIPS mode: OpenSSL
    internal error, assertion failed: Digest MD4 forbidden in FIPS mode!
    - ipa-sam: replace encode_nt_key() with E_md4hash() 
    - ipa_pwd_extop: do not generate NT hashes in FIPS mode
  - Resolves: #1377973 ipa-server-install fails when the provided or resolved
    IP address is not found on local interfaces 
    - Fix local IP address validation 
    - ipa-dns-install: remove check for local ip address
    - refactor CheckedIPAddress class
    - CheckedIPAddress: remove match_local param
    - Remove ip_netmask from option parser
    - replica install: add missing check for non-local IP address
    - Remove network and broadcast address warnings


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-20.el7
changelog:
  - Resolves: #1452216 Replica installation grants HTTP principal
    access in WebUI
    - Make sure we check ccaches in all rpcserver paths


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.0-21.el7
changelog:
  - Resolves: #1470125 Replica install fails to configure IPA-specific
    temporary files/directories
    - replica install: drop-in IPA specific config to tmpfiles.d
  - Resolves: #1469978 bind package is not automatically updated during
    ipa-server upgrade process
    - Bumped Required version of bind-dyndb-ldap and bind package


author: Michal Ruprich <mruprich@redhat.com> - 3.1.7-1
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding latest version before including iperf3 in RHEL-7


author: Michal Ruprich - 3.1.7-2
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding requires to spec file for devel package


author: Helge Deller <hdeller@redhat.de>
changelog:
  - updated to iproute2-2.2.4-now-ss001007.tar.gz 
  - bzip2 source tar file
  - "License" replaces "Copyright"
  - added "BuildPrereq: tetex-latex tetex-dvips psutils"
  - rebuilt for 7.2


author: Phil Knirsch <pknirsch@redhat.com> 2.4.7-3
changelog:
  - Fixed missing diffserv and atm support in config (#57278).
  - Fixed inconsistent numeric base problem for command line (#65473).


author: Phil Knirsch <pknirsch@redhat.com>
changelog:
  - Updated to latest version. Used by other distros, so seems stable. ;-)
  - Quite a few patches needed updating in that turn.
  - Added ss (#107363) and several other new nifty tools.


author: Phil Knirsch <pknirsch@redhat.com> 2.4.7-14
changelog:
  - Fixed -f option for ss (#118355).
  - Small description fix (#110997).
  - Added initialization of some vars (#74961). 
  - Added patch to initialize "default" rule as well (#60693).


author: Radek Vokal <rvokal@redhat.com> - 2.6.18-1
changelog:
  - upgrade to upstream 2.6.18
  - initcwnd patch merged
  - bug fix for xfrm monitor
  - alignment fixes for cris
  - documentation corrections


author: Marcela Maslanova <mmaslano@redhat.com> - 2.6.23-2
changelog:
  - rebuild with fix tetex and linuxdoc-tools -> manual pdf
  - clean unnecessary patches
  - add into spec *.so objects, new BR linux-atm-libs-devel


author: Marcela Maslanova <mmaslano@redhat.com> - 2.6.23-3
changelog:
  - rebuild without tetex files. It isn't working in rawhide yet. Added
    new source for ps files. 
  - #431179 backward compatibility for previous iproute versions


author: Marcela Maslanova <mmaslano@redhat.com> - 2.6.27-1
changelog:
  - aead support was included into upstream version
  - patch for moving libs is now deprecated
  - update to 2.6.27


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.27-2
changelog:
  - 475130 - Negative preferred lifetimes of IPv6 prefixes/addresses
    displayed incorrectly
  - 472878 - “ip maddr show” in IB interface causes a stack corruption
  - both patches will be probably in iproute v2.6.28


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.28-2
changelog:
  - 483484 install distribution files into /usr/share and also fixed
   install paths in spec
  - add the latest change from git which add DRR support
   c86f34942a0ce9f8203c0c38f9fe9604f96be706


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.29-1
changelog:
  - update to 2.6.29
  - remove DDR patch which became part of sourc
  - add patch with correct headers 1957a322c9932e1a1d2ca1fd37ce4b335ceb7113


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.29-2
changelog:
  - c3651bf4763d7247e3edd4e20526a85de459041b ip6tunnel: Fix no default 
   display of ip4ip6 tunnels
  - e48f73d6a5e90d2f883e15ccedf4f53d26bb6e74 missing arpd directory


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.29-3
changelog:
  - new iptables (xtables) bring problems to tc, when ipt is used. 
    rhbz#497344 still broken. tc_modules.patch brings correct paths to
    xtables, but that doesn't fix whole issue.
  - 497355 ip should allow creation of an IPsec SA with 'proto any' 
    and specified sport and dport as selectors


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.32-2
changelog:
  - add macvlan aka VESA support d63a9b2b1e4e3eab0d0577d0a0f412d50be1e0a7
  - kernel headers 2.6.33 ab322673298bd0b8927cdd9d11f3d36af5941b93
    are needed for macvlan features and probably for other added later.
  - fix number of release which contains 2.6.32 kernel headers and features
    but it was released as 2.6.31


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.6.33-2
changelog:
  - 578729 6rd tunnel correctly 3979ef91de9ed17d21672aaaefd6c228485135a2
  - change BR texlive to tex according to guidelines


author: Petr Sabata <psabata@redhat.com> - 2.6.38.1-2
changelog:
  - General cleanup
  - Use global instead of define
  - Buildroot removal
  - Correcting URL and Source links
  - Install genl, ifstat, routef, routel and rtpr (rhbz#697319)


author: Petr Sabata <psabata@redhat.com> - 2.6.38.1-3
changelog:
  - Install ctstat, rtstat and routef manpage symlinks
  - Install m_xt & m_ipt tc modules
  - Creating devel and virtual static subpackages with libnetlink


author: Petr Šabata <contyk@redhat.com> - 3.1.0-1
changelog:
  - 3.1.0 bump
  - Point URL and Source to the new location on kernel.org
  - Remove now obsolete defattr
  - Dropping various patches now included upstream
  - Dropping iproute2-2.6.25-segfault.patch; I fail to understand the reason for
    this hack


author: Petr Šabata <contyk@redhat.com> - 3.6.0-3
changelog:
  - Include section 7 manpages (#876857)
  - Fix ancient bogus dates in the changelog (correction based upon commits)
  - Explicitly require some TeX fonts no longer present in the base distribution


author: Petr Šabata <contyk@redhat.com> - 3.10.0-1
changelog:
  - 3.10.0 bump
  - Drop the SHAREDIR patch and revert to upstream ways (#966445)
  - Fix an XFRM regression with FORTIFY_SOURCE


author: Petr Šabata <contyk@redhat.com> - 3.10.0-6
changelog:
  - Fix lnstat -i (#1024426)
  - Support IPv6 peer addresses (#1017228)
  - Add the replace command to bridge fdb (#1024697)
  - Document link type vlan (#979326)


author: Pavel Šimerda <psimerda@redhat.com> - 3.10.0-19
changelog:
  - Resolves: #1081081 - lnstat man page references iproute-doc when it should
    reference iproute-<ver>


author: Phil Sutter - 3.10.0-47
changelog:
  - Related: #1215006 - backport current version of the ss command
  - Related: #1219280 - backport: iproute2: vti6 support


author: Phil Sutter - 3.10.0-48
changelog:
  - Related: #1215006 - backport current version of the ss command
  - Resolves: #1247315 - Fix limitation in iproute/ss regarding dual-stack sockets


author: Phil Sutter - 3.10.0-49
changelog:
  - Resolves: bz#1241486 - backport: tc: fq scheduler
  - Related: #1215006 - backport current version of the ss command


author: Phil Sutter - 3.10.0-50
changelog:
  - Resolves: #1244851 - vti tunnel does not work
  - Resolves: #1155116 - iproute2: implement "-d" option for "ip mon"


author: Phil Sutter - 3.10.0-51
changelog:
  - Resolves: bz#1251451 - can't change the remote/local address of tunnel
    interface to "any" in ipip mode
  - Related: #1213869 - [6wind 7.2 Feat]: backport: iproute2: various netns
    features
  - Related: #1215006 - [RFE] backport current version of the ss command
  - Resolves: #1251070 - Fix multiple programming errors in iproute package
  - Related: #1198456 - backport: dynamic precision, human readable, and IEC
    output to ip stats
  - Related: #1210402 - [6wind 7.2 Feat]: backport: vxlan: unable to configure
    UDP checksums
  - Related: #1213869 - [6wind 7.2 Feat]: backport: iproute2: various netns
    features


author: Phil Sutter - 3.10.0-52
changelog:
  - Resolves: #1254095 - bridge: Add master device name to bridge fdb show
  - Resolves: #1255316 - tc does not allow to attach pfifo_fast qdisc
  - Related: #1251070 - Fix multiple programming errors in iproute package


author: Phil Sutter - 3.10.0-53
changelog:
  - Related: #1212026 - [6wind 7.2 Feat]: backport: ipxfrm: unable to configure
    SPD hash table - reverted this backport due to unmet dependencies


author: Phil Sutter <psutter@redhat.com> [3.10.0-56.el7]
changelog:
  - ipaddress: fix ipaddr_flush for Linux >= 3.1 (Phil Sutter) [1291825]
  - ipaddress: simplify ipaddr_flush() (Phil Sutter) [1291825]
  - libnetlink: introduce nc_flags (Phil Sutter) [1291825]
  - iproute2: Ignore EADDRNOTAVAIL errors during address flush operation (Phil Sutter) [1291825]
  - lnstat: fix header displaying mechanism (Phil Sutter) [1263392]
  - man: lnstat: rewrite manpage (Phil Sutter) [1269133]


author: Phil Sutter <psutter@redhat.com> [3.10.0-57.el7]
changelog:
  - route: Fix printing of locked entries (Phil Sutter) [1291832]
  - route: ignore RTAX_HOPLIMIT of value -1 (Phil Sutter) [1291832]
  - ip-link: remove warning message (Phil Sutter) [1291832]
  - ip: route: add congestion control metric (Phil Sutter) [1291832]
  - ip route: enable per-route ecn settings via 'features' option (Phil Sutter) [1291832]
  - iproute2: ip-route.8.in: minor fixes (Phil Sutter) [1291832]
  - iproute: restrict hoplimit values to be in range [0; 255] (Phil Sutter) [1291832]
  - man ss: Fix explanation when no options specified (Phil Sutter) [1291818]
  - libnetlink: don't confuse variables in rtnl_talk() (Phil Sutter) [1288042]
  - libnetlink: add size argument to rtnl_talk (Phil Sutter) [1288042]
  - ip: fix exit code for rule failures (Phil Sutter) [1288042]
  - ip: return correct exit code on route failure (Phil Sutter) [1288042]
  - link dump filter (Phil Sutter) [1288042]
  - ip: fix exit code for addrlabel (Phil Sutter) [1288042]
  - fix ip -force -batch to continue on errors (Phil Sutter) [1288042]
  - Allow specifying bridge port STP state by name rather than number. (Phil Sutter) [1288042]
  - gre: raising the size of the buffer holding nl messages. (Phil Sutter) [1288042]
  - neighbor: check return values (Phil Sutter) [1277094]
  - ip-address: fix oneline mode for interfaces with VF (Phil Sutter) [1272405]
  - ss: add support for segs_in and segs_out (Phil Sutter) [1269114]
  - ss: add support for bytes_acked & bytes_received (Phil Sutter) [1269114]
  - ss: return -1 if an unrecognized option was given (Phil Sutter) [1265238]
  - man: ip-address: document mngtmpaddr and noprefixroute flags (Phil Sutter) [1231898]
  - man: ip-address: align synopsis with help output (Phil Sutter) [1231898]
  - ip-address.8.in: fix BNF syntax error (Phil Sutter) [1231898]
  - ip-address: fix and extend documentation (Phil Sutter) [1231898]
  - ip: extend "ip-address" man page to reflect the recent flag extensions (Phil Sutter) [1231898]
  - ip: allow ip address show to list addresses with certain flags not being set (Phil Sutter) [1231898]
  - bridge fdb: add 'use' option to set NTF_USE flag in fdb add requests (Phil Sutter) [1075692]
  - bridge: drop man page fragment (Phil Sutter) [1075692]
  - bridge: drop reference to unused option embedded from manpage (Phil Sutter) [1075692]


author: Phil Sutter <psutter@redhat.com> [3.10.0-58.el7]
changelog:
  - tc: ship filter man pages and refer to them in tc.8 (Phil Sutter) [1286711]
  - tc: add a man page for u32 filter (Phil Sutter) [1286711]
  - tc: add a man page for tcindex filter (Phil Sutter) [1286711]
  - tc: add a man page for route filter (Phil Sutter) [1286711]
  - tc: add a man page for fw filter (Phil Sutter) [1286711]
  - tc: add a man page for flow filter (Phil Sutter) [1286711]
  - tc: add a man page for cgroup filter (Phil Sutter) [1286711]
  - tc: add a man page for basic filter (Phil Sutter) [1286711]
  - batch: support quoted strings (Phil Sutter) [1272593]
  - man: fix whatis for fq (Phil Sutter) [1261520]
  - man: tc: add man page for fq pacer (Phil Sutter) [1261520]


author: Phil Sutter <psutter@redhat.com> [3.10.0-59.el7]
changelog:
  - iplink: add ageing_time, stp_state and priority for bridge (Phil Sutter) [1270759]
  - iplink: shortify printing the usage of link type (Phil Sutter) [1270759]
  - iplink: use the short format to print help info (Phil Sutter) [1270759]
  - iplink_bridge: add support for priority (Phil Sutter) [1270759]
  - iplink_bridge: add support for stp_state (Phil Sutter) [1270759]
  - iplink_bridge: add support for ageing_time (Phil Sutter) [1270759]
  - add bridge master device support (Phil Sutter) [1270759]
  - add bridge_slave device support (Phil Sutter) [1270759]
  - iplink: bond_slave: fix ad_actor/partner_oper_port_state output (Phil Sutter) [1269528]
  - ip: remove extra newlines at end-of-file (Phil Sutter) [1269528]
  - ip link: missing options in bond usage (Phil Sutter) [1269528]
  - bond: fix return after invarg (Phil Sutter) [1269528]
  - iplink: bonding: add support for IFLA_BOND_TLB_DYNAMIC_LB (Phil Sutter) [1269528]
  - bonding: export 3ad actor and partner port state (Phil Sutter) [1269528]
  - iplink_bond: add support for ad_actor and port_key options (Phil Sutter) [1269528]
  - ip link: Shortify printing the usage of link type (Phil Sutter) [1269528]
  - add help command to bonding master (Phil Sutter) [1269528]
  - iproute2: allow to change slave options via type_slave (Phil Sutter) [1269528]
  - ip: add nlmon as a device type to help message (Phil Sutter) [1269528]
  - iplink: can: fix help text and man page (Phil Sutter) [1269528]
  - iplink_bond_slave: show mii_status only once (Phil Sutter) [1269528]
  - iplink_bond: fix parameter value matching (Phil Sutter) [1269528]
  - iplink_bond: fix arp_all_targets parameter name in output (Phil Sutter) [1269528]
  - iplink: add support for bonding slave (Phil Sutter) [1269528]
  - introduce support for slave info data (Phil Sutter) [1269528]
  - iproute2: finish support for bonding attributes (Phil Sutter) [1269528]
  - iplink: add support for bonding netlink (Phil Sutter) [1269528]
  - iplink: update available type list (Phil Sutter) [1269528]
  - xfrm: revise man page and document ip xfrm policy set (Phil Sutter) [1269528]
  - xfrm: add command for configuring SPD hash table (Phil Sutter) [1212026]


author: Phil Sutter <psutter@redhat.com> [3.10.0-60.el7]
changelog:
  - man: ip-neighbour.8: Document all known nud states (Phil Sutter) [1276661]
  - fix indentation of ip neighbour man page (Phil Sutter) [1276661]
  - man: ip-*.8: drop any reference to generic ip options (Phil Sutter) [1251186]
  - man8: scrub trailing whitespace (Phil Sutter) [1251186]
  - TBF man page fix (tbf is not classless) (Phil Sutter) [1251186]
  - man tc-htb: Fix HRB -> HTB typo (Phil Sutter) [1251186]
  - man: Spelling fixes (Phil Sutter) [1251186]
  - fix spelling of Kuznetsov (Phil Sutter) [1251186]
  - man: ip-l2tp.8: Fix BNF syntax (Phil Sutter) [1251186]
  - man: ip.8: Add missing flags and token subcommand description (Phil Sutter) [1251186]
  - man: ip: add -h[uman-readable] option (Phil Sutter) [1251186]
  - man: ip-xfrm.8: Document missing parameters (Phil Sutter) [1251186]
  - man: ip-tunnel.8: Document missing 6rd action (Phil Sutter) [1251186]
  - add 'vti'/'vti6' tunnel modes to ip-tunnel manual page (Phil Sutter) [1251186]
  - man: ip-token.8: Review synopsis section (Phil Sutter) [1251186]
  - man: ip-rule.8: Review synopsis section (Phil Sutter) [1251186]
  - man: ip-ntable.8: Review synopsis section (Phil Sutter) [1251186]
  - man: ip-netns.8: Clarify synopsis a bit (Phil Sutter) [1251186]
  - man: ip-neighbour: Fix for missing NUD_STATE description (Phil Sutter) [1251186]
  - man: ip-link.8: Fix and improve synopsis (Phil Sutter) [1251186]
  - man: ip-link.8: minor font fix (Phil Sutter) [1251186]
  - man: ip-address.8: Minor syntax fixes (Phil Sutter) [1251186]
  - iprule: add missing nat keyword to help text (Phil Sutter) [1251186]
  - iproute: TYPE keyword is not optional, fix help text accordingly (Phil Sutter) [1251186]
  - ipntable: Fix typo in help text (Phil Sutter) [1251186]
  - ipneigh: add missing proxy keyword to help text (Phil Sutter) [1251186]
  - iplink: fix help text syntax (Phil Sutter) [1251186]
  - ipaddrlabel: Improve help text precision (Phil Sutter) [1251186]
  - ip: align help text with manpage (Phil Sutter) [1251186]
  - ipl2tp: Print help even on systems without l2tp support (Phil Sutter) [1251186]
  - iprule: Align help text with man page synopsis (Phil Sutter) [1251186]
  - iplink: macvtap: fix man page (Phil Sutter) [1013584]
  - man: ip-link: document MACVLAN/MACVTAP interface types (Phil Sutter) [1013584]
  - man: ip-link: fix a typo (Phil Sutter) [1013584]
  - man ip-link: Add missing link types - vti,ipvlan,nlmon (Phil Sutter) [1013584]
  - iproute2: ip-link.8.in: Spelling fixes (Phil Sutter) [1013584]
  - ip-link: Document IPoIB link type in the man page (Phil Sutter) [1013584]
  - iproute: Descriptions of fou and gue options in ip-link man pages (Phil Sutter) [1013584]
  - iproute2: ip6gre: update man pages (Phil Sutter) [1013584]
  - ip: macvlan: support MACVLAN_FLAG_NOPROMISC flag (Phil Sutter) [1013584]
  - ip: link: consolidate macvlan and macvtap (Phil Sutter) [1013584]


author: Phil Sutter <psutter@redhat.com> [3.10.0-61.el7]
changelog:
  - fix print_ipt: segfault if more then one filter with action -j MARK. (Phil Sutter) [1314403]
  - man: ip-link: Beef up VXLAN csum options a bit (Phil Sutter) [1254625]
  - libnetlink: Double the dump buffer size (Phil Sutter) [1304840]


author: Phil Sutter <psutter@redhat.com> [3.10.0-62.el7]
changelog:
  - tc: fix compilation warning on 32bits arch (Phil Sutter) [1315930]
  - whitespace cleanup (Phil Sutter) [1315930]
  - tc: minor spelling fixes (Phil Sutter) [1315930]
  - simple print newline (Phil Sutter) [1315930]
  - tc: introduce simple action (Phil Sutter) [1315930]
  - man: rtpr: add minimal manpage (Phil Sutter) [1316059]


author: Phil Sutter <psutter@redhat.com> [3.10.0-63.el7]
changelog:
  - doc/tc-filters.tex: Drop overly subjective paragraphs (Phil Sutter) [1275426]
  - doc: Add my article about tc, filters and actions (Phil Sutter) [1275426]
  - gitignore: Ignore 'doc' files generated at runtime (Phil Sutter) [1275426]
  - tests: Add runtime generated files to .gitignore (Phil Sutter) [1275426]
  - man: ship action man pages (Phil Sutter) [1275426]
  - man: tc-skbedit.8: Elaborate a bit on TX queues (Phil Sutter) [1275426]
  - man: tc-police.8: Emphasize on the two rate control mechanisms (Phil Sutter) [1275426]
  - man: tc-mirred.8: Reword man page a bit, add generic mirror example (Phil Sutter) [1275426]
  - man: tc-csum.8: Add an example (Phil Sutter) [1275426]
  - tc: connmark, pedit: Rename BRANCH to CONTROL (Phil Sutter) [1275426]
  - tc: pedit: document branch control in help output (Phil Sutter) [1275426]
  - man: tc-u32: Minor syntax fix (Phil Sutter) [1275426]
  - man: Add a man page for the xt action (Phil Sutter) [1275426]
  - man: Add a man page for the skbedit action (Phil Sutter) [1275426]
  - man: Add a man page for the simple action (Phil Sutter) [1275426]
  - man: Add a man page for the police action (Phil Sutter) [1275426]
  - man: Add a man page for the pedit action (Phil Sutter) [1275426]
  - man: Add a man page for the nat action (Phil Sutter) [1275426]
  - man: Add a man page for the mirred action (Phil Sutter) [1275426]
  - man: Add a man page for the csum action. (Phil Sutter) [1275426]


author: Phil Sutter <psutter@redhat.com> [3.10.0-65.el7]
changelog:
  - man: ip, ip-link: Fix ip option location (Phil Sutter) [1251186]
  - ip: enable configuring multicast group autojoin (Phil Sutter) [1333513]
  - ss: Fix accidental state filter override (Phil Sutter) [1318005]
  - ss: Drop silly assignment (Phil Sutter) [1318005]
  - ss: Fix wrong filter behaviour (Phil Sutter) [1318005]


author: Phil Sutter <psutter@redhat.com> [3.10.0-66.el7]
changelog:
  - ip-link: Support printing VF trust setting (Phil Sutter) [1302119]
  - iplink: Support VF Trust (Phil Sutter) [1302119]
  - add new IFLA_VF_TRUST netlink attribute (Phil Sutter) [1302119]
  - ipaddress: Allow listing addresses by type (Phil Sutter) [1341343]
  - man ip-link: Small example of 'ip link show master' (Phil Sutter) [1341343]
  - ip link: Show devices by type (Phil Sutter) [1341343]
  - ip link: Allow to filter devices by master dev (Phil Sutter) [1341343]


author: Phil Sutter <psutter@redhat.com> [3.10.0-67.el7]
changelog:
  - geneve: fix IPv6 remote address reporting (Phil Sutter) [1339178]
  - geneve: add support to set flow label (Phil Sutter) [1339178]
  - geneve: Add support for configuring UDP checksums. (Phil Sutter) [1339178]
  - geneve: add support for lwt tunnel creation and dst port selection (Phil Sutter) [1339178]
  - geneve: add support for IPv6 link partners (Phil Sutter) [1339178]
  - iplink_geneve: add tos configuration at link creation (Phil Sutter) [1339178]
  - iplink_geneve: add ttl configuration at link creation (Phil Sutter) [1339178]
  - iproute2: update ip-link.8 for geneve tunnels (Phil Sutter) [1339178]
  - iproute2: GENEVE support (Phil Sutter) [1339178]
  - man: ip-address, ip-link: Document 'type' quirk (Phil Sutter) [1341343]
  - man: ip-link.8: Fix 'ip link delete' description (Phil Sutter) [1341343]


author: Phil Sutter <psutter@redhat.com> [3.10.0-68.el7]
changelog:
  - devlink: add manpage for shared buffer (Phil Sutter) [1342515]
  - devlink: implement shared buffer occupancy control (Phil Sutter) [1342515]
  - devlink: implement shared buffer support (Phil Sutter) [1342515]
  - devlink: allow to parse both devlink and port handle in the same time (Phil Sutter) [1342515]
  - devlink: introduce dump filtering function (Phil Sutter) [1342515]
  - devlink: split dl_argv_parse_put to parse and put parts (Phil Sutter) [1342515]
  - devlink: introduce helper to print out nice names (ifnames) (Phil Sutter) [1342515]
  - devlink: introduce pr_out_port_handle helper (Phil Sutter) [1342515]
  - list: add list_add_tail helper (Phil Sutter) [1342515]
  - list: add list_for_each_entry_reverse macro (Phil Sutter) [1342515]
  - devlink: fix "devlink port" help message (Phil Sutter) [1342515]
  - devlink: ignore build result (Phil Sutter) [1342515]
  - add devlink tool (Phil Sutter) [1342515]
  - include: add linked list implementation from kernel (Phil Sutter) [1342515]
  - configure: cleanup (Phil Sutter) [1342515]
  - configure: Check for libmnl (Phil Sutter) [1342515]
  - configure: Add check for the doc tools (Phil Sutter) [1342515]
  - add if_macsec header (Davide Caratti) [1300765]
  - RH-INTERNAL: update kernel headers to v4.6.0 (Davide Caratti) [1300765]
  - utils: fix hex digits parsing in hexstring_a2n() (Davide Caratti) [1300765]
  - ip: add MACsec support (Davide Caratti) [1300765]
  - utils: provide get_hex to read a hex digit from a char (Davide Caratti) [1300765]
  - utils: add get_be{16, 32, 64}, use them where possible (Davide Caratti) [1300765]
  - utils: make hexstring_a2n provide the number of hex digits parsed (Davide Caratti) [1300765]
  - lib/ll_addr: improve ll_addr_n2a() a bit (Davide Caratti) [1300765]
  - iproute2: arpd: use ll_addr_a2n and ll_addr_n2a (Davide Caratti) [1300765]
  - iproute2: utils: change hexstring_n2a and hexstring_a2n to do not work with ":" (Davide Caratti) [1300765]


author: Phil Sutter <psutter@redhat.com> [3.10.0-69.el7]
changelog:
  - ip-address.8: Document autojoin flag (Phil Sutter) [1333513]
  - ip-link.8: Fix font choices (Phil Sutter) [1269528]
  - ip-link: fix man page warnings (Phil Sutter) [1269528]
  - vxlan: fix help and man text (Phil Sutter) [1269528]
  - ip-link: fix unterminated string in manpage (Phil Sutter) [1269528]
  - ip-link.8: Add slave type option descriptions (Phil Sutter) [1269528]
  - ip-link.8: Place 'ip link set' warning more prominently (Phil Sutter) [1269528]
  - ip-link.8: Extend type list in synopsis (Phil Sutter) [1269528]
  - man ip-link: Remove extra GROUP explanation (Phil Sutter) [1269528]
  - man ip-link: Add short description about 'group' (Phil Sutter) [1269528]
  - man ip-link: Add deleting links by group (Phil Sutter) [1269528]
  - iplink: bond_slave: Add missing help functions (Phil Sutter) [1269528]
  - iplink: List valid 'type' argument in ip link help text (Phil Sutter) [1269528]
  - ip link: Add group in usage() for 'ip link delete' (Phil Sutter) [1269528]
  - iproute: constify rtattr_cmp (Phil Sutter) [1348133]
  - ip route: restore route entries in correct order (Phil Sutter) [1348133]


author: Phil Sutter <psutter@redhat.com> [3.10.0-70.el7]
changelog:
  - man: ip-link: Document query_rss option (Phil Sutter) [1264146]
  - Document VF link state control in the ip-link man page (Phil Sutter) [1264146]
  - ipneigh: List all nud states in help output (Phil Sutter) [1276661]
  - iproute2: ip-route.8.in: Add expires option for ip route (Phil Sutter) [1357020]
  - ip route: timeout for routes has to be set in seconds (Phil Sutter) [1357020]
  - route: allow routes to be configured with expire values (Phil Sutter) [1357020]


author: Phil Sutter <psutter@redhat.com> [3.10.0-71.el7]
changelog:
  - ip: add paren to silence warning (Phil Sutter) [1340914]
  - Fix MAC address length check (Jakub Sitnicki) [1253767 1271580]
  - iplink: Check address length via netlink (Jakub Sitnicki) [1253767 1271580]
  - iplink: Add missing variable initialization (Jakub Sitnicki) [1253767 1271580]
  - ip link: Fix crash on older kernels when show VF dev (Jakub Sitnicki) [1340914]
  - ip link: Remove unnecessary device checking (Jakub Sitnicki) [1340914]
  - ip: check for missing dev arg when doing VF rate (Jakub Sitnicki) [1340914]
  - Add support to configure SR-IOV VF minimum and maximum Tx rate through ip tool (Jakub Sitnicki) [1340914]


author: Phil Sutter <psutter@redhat.com> [3.10.0-72.el7]
changelog:
  - macsec: cipher and icvlen can be set separately (Davide Caratti) [1354408]
  - ip {link,address}: add 'macsec' item to TYPE list (Davide Caratti) [1354702]
  - man: macsec: fix macsec related typos (Davide Caratti) [1354702 1354319]
  - Revert "Allow specifying bridge port STP state by name rather than number." (Phil Sutter) [1288042]
  - Revert "fix ip -force -batch to continue on errors" (Phil Sutter) [1288042]
  - Revert "ip: fix exit code for addrlabel" (Phil Sutter) [1288042]
  - Revert "link dump filter" (Phil Sutter) [1288042]
  - Revert "ip: return correct exit code on route failure" (Phil Sutter) [1288042]
  - Revert "ip: fix exit code for rule failures" (Phil Sutter) [1288042]
  - man: ip-link: Drop fou and gue related documentation (Phil Sutter) [1013584]
  - man: ip-link, ip-address: Drop references to ipvlan (Phil Sutter) [1013584]
  - doc, man: ip-rule: Remove incorrect statement about rule 0 (Phil Sutter) [1362561]


author: Phil Sutter <psutter@redhat.com> [3.10.0-73.el7]
changelog:
  - ip-link: add missing {min,max}_tx_rate to help text (Phil Sutter) [1340914]
  - man: ip-link.8: Document missing geneve options (Phil Sutter) [1339178]
  - iproute.spec: Fix for missing cbq.8 man page (Phil Sutter) [1362551]


author: Phil Sutter <psutter@redhat.com> [3.10.0-75.el7]
changelog:
  - ip: vfinfo: remove code duplication for IFLA_VF_RSS_QUERY_EN (Timothy Redaelli) [1264149]
  - ipaddress: Print IFLA_VF_QUERY_RSS_EN setting (Timothy Redaelli) [1264149]
  - ipaddress: Simplify vf_info parsing (Timothy Redaelli) [1264149]
  - ip-route: Prevent some double spaces in output (Timothy Redaelli) [1374446]
  - ip-route man: add usage and description for lwtunnel encap attributes (Phil Sutter) [1329730]
  - lwtunnel: implement support for ip6 encap (Phil Sutter) [1329730]
  - lwtunnel: fix argument parsing (Phil Sutter) [1329730]
  - lwtunnel: Add encapsulation support to ip route (Phil Sutter) [1329730]
  - libnetlink: introduce rta_nest and u8, u16, u64 helpers for nesting within rtattr (Phil Sutter) [1329730]
  - utils: add missing return value (Phil Sutter) [1329730]
  - remove unnecessary extern (Phil Sutter) [1329730]
  - ss: Add support for SCTP protocol (Phil Sutter) [1063934]
  - include: Add linux/sctp.h (Phil Sutter) [1063934]
  - update inet_diag.h header (Phil Sutter) [1063934]
  - macsec: fix byte ordering on input/display of 'sci' (Davide Caratti) [1355629]
  - macsec: fix input of 'port', improve documentation of 'address' (Davide Caratti) [1355629]
  - misc/ss: tcp cwnd should be unsigned (Davide Caratti) [1375215]


author: Phil Sutter <psutter@redhat.com> [3.10.0-76.el7]
changelog:
  - iplink: add missing link type (Phil Sutter) [1374493]
  - man: ip-link: Remove bits about proxy_arp and proxy_arp_wifi (Phil Sutter) [1374360]
  - iplink: bridge_slave: add support for IFLA_BRPORT_FAST_LEAVE (Phil Sutter) [1374360]
  - iplink: bridge_slave: add support for IFLA_BRPORT_MULTICAST_ROUTER (Phil Sutter) [1374360]
  - macsec: fix input range of 'icvlen' parameter (Phil Sutter) [1373121]


author: Phil Sutter <psutter@redhat.com> [3.10.0-77.el7]
changelog:
  - change of rtnetlink to use RTN_F_OFFLOAD (Phil Sutter) [1417289]
  - bridge: add support for the multicast flood flag (Phil Sutter) [1417289]
  - RH-INTERNAL: Update kernel headers to v4.10.0 (Phil Sutter) [1417289]
  - bridge: man: fix STP LISTENING description (Phil Sutter) [1417289]
  - bridge: man: fix BPUD typo (Phil Sutter) [1417289]
  - bridge: man: fix "brige" typo (Phil Sutter) [1417289]
  - bridge: vlan: fix a few "fdb" typos in vlan doc (Phil Sutter) [1417289]
  - bridge: vlan: add support to filter by vlan id (Phil Sutter) [1417289]
  - bridge: mdb: add support to filter by vlan id (Phil Sutter) [1417289]
  - bridge: fdb: add support to filter by vlan id (Phil Sutter) [1417289]
  - bridge: code cleanup (Phil Sutter) [1417289]
  - bridge: mdb: add support for extended router port information (Phil Sutter) [1417289]
  - bridge: mdb: add support for offloaded mdb entries (Phil Sutter) [1417289]
  - bridge: mdb: add user-space support for extended attributes (Phil Sutter) [1417289]
  - iplink: bridge: remove unnecessary returns (Phil Sutter) [1417289]
  - bridge: add support for dynamic fdb entries (Phil Sutter) [1417289]
  - iplink: bridge_slave: export read-only values (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_STARTUP_QUERY_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERY_RESPONSE_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERY_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERIER_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_MEMBERSHIP_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_LAST_MEMBER_INTVL (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_STARTUP_QUERY_CNT (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_LAST_MEMBER_CNT (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_HASH_MAX (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_HASH_ELASTICITY (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERIER (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_QUERY_USE_IFADDR (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_SNOOPING (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_MCAST_ROUTER (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_VLAN_DEFAULT_PVID (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_GROUP_ADDR (Phil Sutter) [1417289]
  - iplink: bridge: add support for IFLA_BR_GROUP_FWD_MASK (Phil Sutter) [1417289]
  - iplink: bridge: export read-only timers (Phil Sutter) [1417289]
  - iplink: bridge: export root_(port|path_cost), topology_change and change_detected (Phil Sutter) [1417289]
  - iplink: bridge: export bridge_id and designated_root (Phil Sutter) [1417289]
  - bridge: support for static fdb entries (Phil Sutter) [1417289]
  - bridge.8: minor formatting cleanup (Phil Sutter) [1417289]
  - bridge.8: document fdb replace command (Phil Sutter) [1417289]
  - bridge: fdb: minor syntax fix in help text (Phil Sutter) [1417289]
  - bridge: add calls to fflush in fdb and mdb print functions (Phil Sutter) [1417289]
  - ip, bridge: document -timestamp option (Phil Sutter) [1417289]
  - bridge: add batch command support (Phil Sutter) [1417289]
  - iplink: Add support for IFLA_BR_VLAN_PROTOCOL attribute (Phil Sutter) [1417289]
  - iplink: add support for IFLA_BR_VLAN_FILTERING attribute (Phil Sutter) [1417289]
  - bridge: mdb: add deleted when monitoring delmdb event (Phil Sutter) [1417289]
  - bridge: mdb: add support for vlans (Phil Sutter) [1417289]
  - ip link: proto_down config and display. (Phil Sutter) [1417289]
  - bridge: mdb: add support for router add/del notifications monitoring (Phil Sutter) [1417289]
  - ip: fix all the checkpatch warnings (Phil Sutter) [1417289]
  - iproute2: ipa: show switch id (Phil Sutter) [1417289]
  - ip: return correct exit code on route failure (Phil Sutter) [1417289]
  - iproute2: unify naming for entries offloaded to hardware (Phil Sutter) [1417289]
  - route: label externally offloaded routes (Phil Sutter) [1417289]
  - fix ip -force -batch to continue on errors (Phil Sutter) [1417289]
  - bridge link: add support to specify master (Phil Sutter) [1417289]
  - Allow specifying bridge port STP state by name rather than number. (Phil Sutter) [1417289]
  - iproute2: bridge vlan show new option to print ranges (Phil Sutter) [1417289]
  - iproute2: bridge: support vlan range adds (Phil Sutter) [1417289]
  - bridge/link: add learning_sync policy flag (Phil Sutter) [1417289]
  - bridge link: add option 'self' (Phil Sutter) [1417289]
  - bridge/fdb: add flag/indication for FDB entry synced from offload device (Phil Sutter) [1417289]
  - bridge/fdb: fix statistics output spacing (Phil Sutter) [1417289]
  - iproute2 bridge: bring to above par with brctl show macs (Phil Sutter) [1417289]
  - link dump filter (Phil Sutter) [1417289]
  - bridge: Make filter_index match in signedness (Phil Sutter) [1417289]
  - bridge: Add learning and flood support (Phil Sutter) [1417289]
  - iproute2: ipa: show port id (Phil Sutter) [1417289]
  - bridge: fix reporting of IPv6 addresses (Phil Sutter) [1417289]
  - iplink: bridge_slave: add support for IFLA_BRPORT_PROXYARP_WIFI (Phil Sutter) [1374360]
  - iplink: bridge_slave: add support for IFLA_BRPORT_PROXYARP (Phil Sutter) [1374360]
  - Revert "man: ip-link: Remove bits about proxy_arp and proxy_arp_wifi" (Phil Sutter) [1374360]


author: Phil Sutter <psutter@redhat.com> [3.10.0-78.el7]
changelog:
  - ip-address: Support filtering by slave type, too (Phil Sutter) [1375434]
  - tc: don't accept qdisc 'handle' greater than ffff (Davide Caratti) [1375393]
  - macsec: show usage even if the module is not available (Timothy Redaelli) [1367071]
  - libgenl: introduce genl_init_handle (Timothy Redaelli) [1367071]
  - tc: flower: Fix parsing ip address (Phil Sutter) [1422629]
  - tc: flower: support masked ICMP code and type match (Phil Sutter) [1422629]
  - tc: flower: provide generic masked u8 print helper (Phil Sutter) [1422629]
  - tc: flower: provide generic masked u8 parser helper (Phil Sutter) [1422629]
  - tc: flower: Update documentation to indicate ARP takes IPv4 prefixes (Phil Sutter) [1422629]
  - tc: flower: use correct type when calling flower_icmp_attr_type (Phil Sutter) [1422629]
  - f_flower: don't set TCA_FLOWER_KEY_ETH_TYPE for "protocol all" (Phil Sutter) [1422629]
  - tc: flower: Refactor matching flags to be more user friendly (Phil Sutter) [1422629]
  - tc: flower: Support matching ARP (Phil Sutter) [1422629]
  - kernel headers update (Phil Sutter) [1422629]
  - tc: flower: Fix incorrect error msg about eth type (Phil Sutter) [1422629]
  - tc: flower: Add missing err check when parsing flower options (Phil Sutter) [1422629]
  - tc: flower: Fix flower output for src and dst ports (Phil Sutter) [1422629]
  - tc: flower: Update dest UDP port documentation (Phil Sutter) [1422629]
  - tc: flower: support matching flags (Phil Sutter) [1422629]
  - tc/cls_flower: Add to the usage encapsulation dest UDP port (Phil Sutter) [1422629]
  - tc: flower: Allow *_mac options to accept a mask (Phil Sutter) [1422629]
  - tc: flower: document that *_ip parameters take a PREFIX as an argument. (Phil Sutter) [1422629]
  - tc: flower: Fix typo and style in flower man page (Phil Sutter) [1422629]
  - tc/cls_flower: Add dest UDP port to tunnel params (Phil Sutter) [1422629]
  - tc: flower: support matching on ICMP type and code (Phil Sutter) [1422629]
  - tc: flower: introduce enum flower_endpoint (Phil Sutter) [1422629]
  - tc: flower: make use of flower_port_attr_type() safe and silent (Phil Sutter) [1422629]
  - tc: flower: correct name of ip_proto parameter to flower_parse_port() (Phil Sutter) [1422629]
  - tc: flower: document SCTP ip_proto (Phil Sutter) [1422629]
  - tc: flower: remove references to eth_type in manpage (Phil Sutter) [1422629]
  - tc/cls_flower: Classify packet in ip tunnels (Phil Sutter) [1422629]
  - libnetlink: Introduce rta_getattr_be*() (Phil Sutter) [1422629]
  - tc: flower: Support matching on SCTP ports (Phil Sutter) [1422629]
  - tc: flower: Fix usage message (Phil Sutter) [1422629]
  - tc: flower checkpatch cleanups (Phil Sutter) [1422629]
  - tc: flower: Introduce vlan support (Phil Sutter) [1422629]
  - tc: flower: Add skip_{hw|sw} support (Phil Sutter) [1422629]
  - utils: add get_be{16, 32, 64}, use them where possible (Phil Sutter) [1422629]
  - lib/utils: introduce rt_addr_n2a_rta() (Phil Sutter) [1422629]
  - utils: make rt_addr_n2a() non-reentrant by default (Phil Sutter) [1422629]
  - make format_host non-reentrant by default (Phil Sutter) [1422629]
  - tc: flower no need to specify the ethertype (Phil Sutter) [1422629]
  - ip6tunnel: print local/remote addresses like iptunnel does (Phil Sutter) [1422629]
  - tc: ship filter man pages and refer to them in tc.8 (Phil Sutter) [1422629]
  - tc: add a man page for flower filter (Phil Sutter) [1422629]
  - tc: improve filter help texts a bit (Phil Sutter) [1422629]
  - tc: add support for Flower classifier (Phil Sutter) [1422629]
  - ip: make -resolve addr to print names rather than addresses (Phil Sutter) [1422629]


author: Phil Sutter <psutter@redhat.com> [3.10.0-80.el7]
changelog:
  - tc: m_xt: Drop needless parentheses from #if checks (Phil Sutter) [1326726]
  - tc: m_xt: Fix segfault with iptables-1.6.0 (Phil Sutter) [1326726]
  - m_xt: whitespace cleanup (Phil Sutter) [1326726]
  - tc: m_xt: Introduce get_xtables_target_opts() (Phil Sutter) [1326726]
  - tc: m_xt: Simplify argc adjusting in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of iargc variable in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of rargc in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Drop unused variable fw in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Get rid of one indentation level in parse_ipt() (Phil Sutter) [1326726]
  - tc: m_xt: Fix indenting (Phil Sutter) [1326726]
  - tc: m_xt: Fix segfault when adding multiple actions at once (Phil Sutter) [1326726]
  - tc: m_xt: Prevent segfault with standard targets (Phil Sutter) [1326726]
  - man: update doc after support of ESN and anti-replay window (Phil Sutter) [1425059]
  - xfrm: add support of ESN and anti-replay window (Phil Sutter) [1425059]


author: Phil Sutter <psutter@redhat.com> [3.10.0-81.el7]
changelog:
  - man: ip-link: Specify min/max values for bridge slave priority and cost (Phil Sutter) [1374360]
  - man: ip-link.8: document bridge options (Phil Sutter) [1373869]


author: Ivan Vecera <ivecera@redhat.com> [3.10.0-84.el7]
changelog:
  - tc: Add support for the matchall traffic classifier. (Ivan Vecera) [1435624]
  - tc: man: Add man entry for the matchall classifier. (Ivan Vecera) [1435624]
  - tc: add missing limits.h header (Ivan Vecera) [1435624]
  - tc: man: matchall: Fix example indentation (Ivan Vecera) [1435624]
  - tc: matchall: Print skip flags when dumping a filter (Ivan Vecera) [1435624]
  - tc, clsact: add clsact frontend (Ivan Vecera) [1435624]


author: Eric Garver <egarver@redhat.com> [3.10.0-86.el7]
changelog:
  - Revert "ip-route man: add usage and description for lwtunnel encap attributes" (Eric Garver) [1459975]
  - Revert "lwtunnel: implement support for ip6 encap" (Eric Garver) [1459975]
  - Revert "lwtunnel: fix argument parsing" (Eric Garver) [1459975]
  - Revert "lwtunnel: Add encapsulation support to ip route" (Eric Garver) [1459975]


author: Sabrina Dubroca <sdubroca@redhat.com> [3.10.0-87.el7]
changelog:
  - devlink: Add e-switch support (Sabrina Dubroca) [1459772]
  - devlink: whitespace cleanup (Sabrina Dubroca) [1459772]
  - devlink: Convert conditional in dl_argv_handle_port() to switch() (Sabrina Dubroca) [1459772]
  - devlink: write usage help messages to stderr (Sabrina Dubroca) [1459772]
  - devlink: Add usage help for eswitch subcommand (Sabrina Dubroca) [1459772]
  - devlink: Call dl_free in early exit case (Sabrina Dubroca) [1459772]


author: Jeremy Katz <katzj@redhat.com> - 2.0.13.2-1
changelog:
  - update to 2.0.13.2 (#139083)
    - fix firmware upload for firmware in /lib instead of /usr/lib
    - fix sysfs race


author: Will Woods <wwoods@redhat.com> - 2.2.13-2
changelog:
  - Fix iprdump startup - #483340
  - iprutils-swab-moved.patch - fix compilation with 2.6.29 kernels (#483643)


author: Jakub Čajka <jcajka@redhat.com> - 2.4.2-1
changelog:
  - Resolves: #1088562 - [7.1 FEAT] iprutils package update - ppc64
  - Resolves: #1044679 - iprutils should use systemd
  - Resolves: #1092519 - iprutils - PIE and RELRO check


author: Jakub Čajka <jcajka@redhat.com> - 2.4.8-1
changelog:
  - Resolves: #1182038 - [7.2 FEAT] iprutils package update - ppc64/ppc64le
  - Resolves: #1183460 - RHEL7.1 BE: iprutils: Set known zeroed after format


author: Sinny Kumari <skumari@redhat.com> - 2.4.11.1-1
changelog:
  - Resolves: #1274367 - [7.3 FEAT] iprutils package update
  - Resolves: #1297921 - IPR: Raid migration fails to kick while executing through command line


author: Sinny Kumari <skumari@redhat.com> - 2.4.12.1-1
changelog:
  - Resolves: #1364131 - Integrate various important bug fixes for iprutils in
    RHEL7.3 by updating iprutils to 2.4.12


author: Mathieu Bridon <bochecha@fedoraproject.org> - 6.11-1
changelog:
  - New upstream release.
  - Removed our patch, it has been integrated upstream. As such, we also don't
    need to re-run autoreconf any more.


author: Mathieu Bridon <bochecha@fedoraproject.org> - 6.14-1
changelog:
  - New upstream release.
  - Fix scriptlets, ldconfig is needed for the libs subpackage, not the main one.


author: Thomas Woerner <twoerner@redhat.com> - 6.19-5
changelog:
  - New service sub package to provide the ipset service (RHBZ#1136257)
    Service and start-stop script from F-24
  - Fixed ipset package summary (RHBZ#1195171)
    Spec file derived from F-24


author: Thomas Woerner <twoerner@redhat.com> - 6.19-6
changelog:
  - Use /etc/sysconfig/ipset-config in service as EnvironmentFile (RHBZ#1136257)
  - Use /etc/sysconfig/ipset for data as in RHEL-6 (RHBZ#1136257)
  - No save on reload, but legacy save action (RHBZ#1136257)


author: Thomas Woerner <twoerner@redhat.com> - 6.29-1
changelog:
  - Rebase to 6.29 (RHBZ#1351299)
  - Fixes:
    - Backport ipset capability to run in namespaces (RHBZ#1226051)
    - Fix service save with empty ipset list and existing ipset save file
      (RHBZ#1377621)
    - Fix internal error at printing to output buffer (RHBZ#1395865)


author: Preston Brown <pbrown@redhat.com>
changelog:
  - move iptables to /sbin.
  - excludearch alpha for now, not building there because of compiler bug(?)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 1.2
  - fix up ipv6 split
  - add init script
  - Move the plugins from /usr/lib/iptables to /lib/iptables.
    This needs to work before /usr is mounted...
  - Use -O1 on alpha (compiler bug)


author: Karsten Hopp <karsten@redhat.de>
changelog:
  - fix bugzilla #25986 (initscript not marked as config file)
  - fix bugzilla #25962 (iptables-restore)
  - mv chkconfig --del from postun to preun


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Yet another initscript fix (#30173)
  - Fix the fixes; they fixed some issues but broke more important
    stuff :/ (#30176)


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.2.4-1
changelog:
  - Update to 1.2.4 (various fixes, including security fixes; among others:
    - Fix init script (#31133)


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.2.5-2
changelog:
  - Merge ip6tables improvements from Ian Prowell <iprowell@prowell.org>
    - Update URL (#59354)
  - Use /sbin/chkconfig rather than chkconfig in %postun script


author: Karsten Hopp <karsten@redhat.de>
changelog:
  - fixed iptables and ip6tables initscript output, based on #70511
  - check return status of all iptables calls, not just the last one
    in a 'for' loop.


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - remove check for very old kernel versions in init scripts
  - sync up both init scripts and remove some further ugly things
  - add some docu into rpm


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-5
changelog:
  - new config option IPTABLES_SAVE_ON_RESTART
  - init script: new status, save and restart
  - fixes #44905, #65389, #80785, #82860, #91040, #91560 and #91374


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-6
changelog:
  - IPTABLES_SAVE_COUNTER defaults to no, now
  - install config file in /etc/sysconfig
  - exchange unload of ip_tables and ip_conntrack
  - fixed start function


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-12.1
changelog:
  - fixed lost udp port range in ip6tables-save (#104484)
  - fixed non numeric multiport port output in ipXtables-savs


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-13
changelog:
  - marked all messages in iptables init script for translation (#107462)
  - enabled devel package (#105884, #106101)
  - bumped build for fedora for libipt_recent.so (#106002)


author: Thomas Woerner <twoerner@redhat.com> 1.2.9-1
changelog:
  - vew version 1.2.9
  - new config options in ipXtables-config:
    IPTABLES_MODULES_UNLOAD
  - more documentation in ipXtables-config
  - fix for netlink security issue in libipq (devel package)
  - print fix for libipt_icmp (#109546)


author: Thomas Woerner <twoerner@redhat.com> 1.2.11-3.1
changelog:
  - changed default behaviour for IPTABLES_STATUS_NUMERIC to "yes" (#129731)
  - modified config file to match this change and un-commented variables with
    default values


author: Thomas Woerner <twoerner@redhat.com> 1.3.0-2
changelog:
  - Remove unnecessary explicit kernel dep (#146142)
  - Fixed out of bounds accesses (#131848): Thanks to Steve Grubb
    for the patch
  - Adapted iptables-config to reference to modprobe.conf (#150143)
  - Remove misleading message (#140154): Thanks to Ulrich Drepper
    for the patch


author: Thomas Woerner <twoerner@redhat.com> 1.3.4-1
changelog:
  - new version 1.3.4
  - dropped free_opts patch (upstream fixed)
  - made libipq PIC (#158623)
  - additional configuration options for iptables startup script (#172929)
    Thanks to Jan Gruenwald for the patch
  - spec file cleanup (dropped linux_header define and usage)


author: Thomas Woerner <twoerner@redhat.com> 1.3.4-2
changelog:
  - fix for plugin problem: link with "gcc -shared" instead of "ld -shared" and 
    replace "_init" with "__attribute((constructor)) my_init"


author: Thomas Woerner <twoerner@redhat.com> 1.3.7-1
changelog:
  - new verison 1.3.7
  - iptc is not a public interface and therefore not installed anymore
  - dropped upstream secmark patch


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-2
changelog:
  - fixed initscript for LSB conformance (rhbz#246953, rhbz#242459)
  - provide iptc interface again, but unsupported (rhbz#216733)
  - compile all extension, which are supported by the kernel-headers package
  - review fixes (rhbz#225906)


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-3
changelog:
  - do not depend on local_fs in lsb header - this delayes start after network
  - fixed exit code for initscript usage


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-4
changelog:
  - fixed IPv6 reject type (rhbz#295181)
  - fixed init script: start, stop and status
  - support netfilter compiled into kernel in init script (rhbz#295611)
  - dropped inversion for limit modules from man pages (rhbz#220780)
  - fixed typo in ip6tables man page (rhbz#236185)


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-4.1
changelog:
  - do not start ip6tables if ipv6 is blacklisted (rhbz#236888)
  - use simpler fix for (rhbz#295611)
    Thanks to Linus Torvalds for the patch.


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-5
changelog:
  - fixed error code for stopping a already stopped firewall (rhbz#321751)
  - moved blacklist test into start


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-6
changelog:
  - fixed leaked file descriptor before fork/exec (rhbz#312191)
  - blacklisting is not working, use "install X /bin/(true|false)" test instead
  - return private exit code 150 for disabled ipv6 support
  - use script name for output messages


author: Thomas Woerner <twoerner@redhat.com> 1.4.0-1
changelog:
  - new version 1.4.0
  - fixed condrestart (rhbz#428148)
  - report the module in rmmod_r if there is an error
  - use nf_ext_init instead of my_init for extension constructors


author: Thomas Woerner <twoerner@redhat.com> 1.4.0-3
changelog:
  - use the kernel headers from the build tree for iptables for now to be able to 
    compile this package, but this makes the package more kernel dependant
  - use s6_addr32 instead of in6_u.u6_addr32


author: Tom "spot" Callaway <tcallawa@redhat.com> 1.4.0-5
changelog:
  - use normal kernel headers, not linux/compiler.h
  - change BuildRequires: kernel-devel to kernel-headers
  - We need to do this to be able to build for both sparcv9 and sparc64 
    (there is no kernel-devel.sparcv9)


author: Thomas Woerner <twoerner@redhat.com> 1.4.1-1
changelog:
  - new version 1.4.1 with new build environment
  - additional ipv6 network mask patch from Jan Engelhardt
  - spec file cleanup
  - removed old patches


author: Thomas Woerner <twoerner@redhat.com> 1.4.2-1
changelog:
  - new version 1.4.2
  - removed TOS value mask patch (upstream)
  - more review fixes (rhbz#225906)
  - install all header files (rhbz#462207)
  - dropped nf_ext_init (rhbz#472548)


author: Thomas Woerner <twoerner@redhat.com> 1.4.2-3
changelog:
  - still more review fixes (rhbz#225906)
    - consistent macro usage
    - use sed instead of perl for rpath removal
    - use standard RPM CFLAGS, but also -fno-strict-aliasing (needed for libiptc*)


author: Thomas Woerner <twoerner@redhat.com> 1.4.3.1-1
changelog:
  - new version 1.4.3.1
    - libiptc is now shared
    - supports all new features of the 2.6.29 kernel
  - dropped typo_latter patch


author: Thomas Woerner <twoerner@redhat.com> 1.4.4-1
changelog:
  - new version 1.4.4 with support for all new features of 2.6.30
    - several man page fixes
    - iptables: replace open-coded sizeof by ARRAY_SIZE
    - libip6t_policy: remove redundant functions
    - policy: use direct xt_policy_info instead of ipt/ip6t
    - policy: merge ipv6 and ipv4 variant
    - extensions: add `cluster' match support
    - extensions: add const qualifiers in print/save functions
    - extensions: use NFPROTO_UNSPEC for .family field
    - extensions: remove redundant casts
    - iptables: close open file descriptors
    - fix segfault if incorrect protocol name is used
    - replace open-coded sizeof by ARRAY_SIZE
    - do not include v4-only modules in ip6tables manpage
    - use direct xt_policy_info instead of ipt/ip6t
    - xtables: fix segfault if incorrect protocol name is used
    - libxt_connlimit: initialize v6_mask
    - SNAT/DNAT: add support for persistent multi-range NAT mappings


author: Thomas Woerner <twoerner@redhat.com> 1.4.5-1
changelog:
  - new version 1.4.5 with support for all new features of 2.6.31
    - libxt_NFQUEUE: add new v1 version with queue-balance option
    - xt_conntrack: revision 2 for enlarged state_mask member
    - libxt_helper: fix invalid passed option to check_inverse
    - libiptc: split v4 and v6
    - extensions: collapse registration structures
    - iptables: allow for parse-less extensions
    - iptables: allow for help-less extensions
    - extensions: remove empty help and parse functions
    - xtables: add multi-registration functions
    - extensions: collapse data variables to use multi-reg calls
    - xtables: warn of missing version identifier in extensions
    - multi binary: allow subcommand via argv[1]
    - iptables: accept multiple IP address specifications for -s, -d
    - several build fixes
    - several man page fixes
  - fixed two leaked file descriptors on sockets (rhbz#521397)


author: Thomas Woerner <twoerner@redhat.com> 1.4.6-1
changelog:
  - new version 1.4.6 with support for all new features of 2.6.32
    - several man page fixes
    - Support for nommu arches
    - realm: remove static initializations
    - libiptc: remove unused functions
    - libiptc: avoid strict-aliasing warnings
    - iprange: do accept non-ranges for xt_iprange v1
    - iprange: warn on reverse range
    - iprange: roll address parsing into a loop
    - iprange: do accept non-ranges for xt_iprange v1 (log)
    - iprange: warn on reverse range (log)
    - libiptc: fix wrong maptype of base chain counters on restore
    - iptables: fix undersized deletion mask creation
    - style: reduce indent in xtables_check_inverse
    - libxtables: hand argv to xtables_check_inverse
    - iptables/extensions: make bundled options work again
    - CONNMARK: print mark rules with mask 0xffffffff as set instead of xset
    - iptables: take masks into consideration for replace command
    - doc: explain experienced --hitcount limit
    - doc: name resolution clarification
    - iptables: expose option to zero packet/byte counters for a specific rule
    - build: restore --disable-ipv6 functionality on system w/o v6 headers
    - MARK: print mark rules with mask 0xffffffff as --set-mark instead of --set-xmark
    - DNAT: fix incorrect check during parsing
    - extensions: add osf extension
    - conntrack: fix --expires parsing


author: Thomas Woerner <twoerner@redhat.com> 1.4.6-2
changelog:
  - moved libip*tc and libxtables libs to /lib[64], added symlinks for .so libs
    to /usr/lib[64] for compatibility (rhbz#558796)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-1
changelog:
  - new version 1.4.7 with support for all new features of 2.6.33 (rhbz#570767)
    - libip4tc: Add static qualifier to dump_entry()
    - libipq: build as shared library
    - recent: reorder cases in code (cosmetic cleanup)
    - several man page and documentation fixes
    - policy: fix error message showing wrong option
    - includes: header updates
    - Lift restrictions on interface names
  - fixed license and moved iptables-xml into base package according to review


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-2
changelog:
  - added default values for IPTABLES_STATUS_VERBOSE and
    IPTABLES_STATUS_LINENUMBERS in init script
  - added missing lsb keywords Required-Start and Required-Stop to init script


author: Thomas Woerner <twoerner@redhat.com> 1.4.8-1
changelog:
  - new version 1.4.8 all new features of 2.6.34 (rhbz#)
    - extensions: REDIRECT: fix --to-ports parser
    - iptables: add noreturn attribute to exit_tryhelp()
    - extensions: MASQUERADE: fix --to-ports parser
    - libxt_comment: avoid use of IPv4-specific examples
    - libxt_CT: add a manpage
    - iptables: correctly check for too-long chain/target/match names
    - doc: libxt_MARK: no longer restricted to mangle table
    - doc: remove claim that TCPMSS is limited to mangle
    - libxt_recent: add a missing space in output
    - doc: add manpage for libxt_osf
    - libxt_osf: import nfnl_osf program
    - extensions: add support for xt_TEE
    - CT: fix --ctevents parsing
    - extensions: add CT extension
    - libxt_CT: print conntrack zone in ->print/->save
    - xtables: fix compilation when debugging is enabled
    - libxt_conntrack: document --ctstate UNTRACKED
    - iprange: fix xt_iprange v0 parsing


author: Thomas Woerner <twoerner@redhat.com> 1.4.9-1
changelog:
  - new version 1.4.9 with all new features of 2.6.35
    - doc: xt_hashlimit: fix a typo
    - doc: xt_LED: nroff formatting requirements
    - doc: xt_string: correct copy-and-pasting in manpage
    - extensions: add the LED target
    - extensions: libxt_quota.c: Support option negation
    - extensions: libxt_rateest: fix bps options for iptables-save
    - extensions: libxt_rateest: fix typo in the man page
    - extensions: REDIRECT: add random help
    - includes: sync header files from Linux 2.6.35-rc1
    - libxt_conntrack: do print netmask
    - libxt_hashlimit: always print burst value
    - libxt_set: new revision added
    - utils: add missing include flags to Makefile
    - xtables: another try at chain name length checking
    - xtables: remove xtables_set_revision function
    - xt_quota: also document negation
    - xt_sctp: Trace DATA chunk that supports SACK-IMMEDIATELY extension
    - xt_sctp: support FORWARD_TSN chunk type


author: Thomas Woerner <twoerner@redhat.com> 1.4.10-1
changelog:
  - new version 1.4.10 with all new features of 2.6.36
    - all: consistent syntax use in struct option
    - build: fix static linking
    - doc: let man(1) autoalign the text in xt_cpu
    - doc: remove extra empty line from xt_cpu
    - doc: minimal spelling updates to xt_cpu
    - doc: consistent use of markup
    - extensions: libxt_quota: don't ignore the quota value on deletion
    - extensions: REDIRECT: add random help
    - extensions: add xt_cpu match
    - extensions: add idletimer xt target extension
    - extensions: libxt_IDLETIMER: use xtables_param_act when checking options
    - extensions: libxt_CHECKSUM extension
    - extensions: libipt_LOG/libip6t_LOG: support macdecode option
    - extensions: fix compilation of the new CHECKSUM target
    - extensions: libxt_ipvs: user-space lib for netfilter matcher xt_ipvs
    - iptables-xml: resolve compiler warnings
    - iptables: limit chain name length to be consistent with targets
    - libiptc: add Libs.private to pkgconfig files
    - libiptc: build with -Wl,--no-as-needed
    - xtables: remove unnecessary cast
  - dropped xt_CHECKSUM, added upstream


author: Thomas Woerner <twoerner@redhat.com> 1.4.11-1
changelog:
  - new version 1.4.11 with all new features of 2.6.37-39 (not usable)
    - lots of changes and bugfixes for base and extensions
    - complete changelog:
      http://www.netfilter.org/projects/iptables/files/changes-iptables-1.4.11.txt


author: Thomas Woerner <twoerner@redhat.com> 1.4.11.1-1.1
changelog:
  -  added temporary provides for libxtables.so.5 to be able to rebuild iproute,
     which is part of the standard build environment


author: Thomas Woerner <twoerner@redhat.com> 1.4.11.1-3
changelog:
  - added support for native systemd file (rhbz#694738)
    - new iptables.service file
    - additional requires
    - moved sysv init scripts to /usr/libexec
    - added new post, preun and postun scripts and triggers


author: Thomas Woerner <twoerner@redhat.com> 1.4.12-1
changelog:
  - new version 1.4.12 with support of all new features of kernel 3.0
    - build: attempt to fix building under Linux 2.4
    - build: bump soversion for recent data structure change
    - build: install modules in arch-dependent location
    - doc: fix group range in libxt_NFLOG's man
    - doc: fix version string in ip6tables.8
    - doc: include matches/targets in manpage again
    - doc: mention multiple verbosity flags
    - doc: the -m option cannot be inverted
    - extensions: support for per-extension instance global variable space
    - iptables-apply: select default rule file depending on call name
    - iptables: consolidate target/match init call
    - iptables: Coverity: DEADCODE
    - iptables: Coverity: NEGATIVE_RETURNS
    - iptables: Coverity: RESOURCE_LEAK
    - iptables: Coverity: REVERSE_INULL
    - iptables: Coverity: VARARGS
    - iptables: restore negation for -f
    - libip6t_HL: fix option names from ttl -> hl
    - libipt_LOG: fix ignoring all but last flags
    - libxtables: ignore whitespace in the multiaddress argument parser
    - libxtables: properly reject empty hostnames
    - libxtables: set clone's initial data to NULL
    - libxt_conntrack: move more data into the xt_option_entry
    - libxt_conntrack: restore network-byte order for v1,v2
    - libxt_hashlimit: use a more obvious expiry value by default
    - libxt_rateest: abolish global variables
    - libxt_RATEEST: abolish global variables
    - libxt_RATEEST: fix userspacesize field
    - libxt_RATEEST: use guided option parser
    - libxt_state: fix regression about inversion of main option
    - option: remove last traces of intrapositional negation
  - complete changelog:
    http://www.netfilter.org/projects/iptables/files/changes-iptables-1.4.12.txt


author: Thomas Woerner <twoerner@redhat.com> 1.4.12-1.1
changelog:
  - added temporary provides for libxtables.so.6 to be able to rebuild iproute,
    which is part of the standard build environment


author: Thomas Woerner <twoerner@redhat.com> 1.4.12.1-1
changelog:
  - new version 1.4.12.1 with new pkgconfig/libipq.pc
    - build: abort autogen on subcommand failure
    - build: strengthen check for overlong lladdr components
    - build: workaround broken linux-headers on RHEL-5
    - doc: clarify libxt_connlimit defaults
    - doc: fix typo in libxt_TRACE
    - extensions: use multi-target registration
    - libip6t_dst: restore setting IP6T_OPTS_LEN flag
    - libip6t_frag: restore inversion support
    - libip6t_hbh: restore setting IP6T_OPTS_LEN flag
    - libipq: add pkgconfig file
    - libipt_ttl: document that negation is available
    - libxt_conntrack: fix --ctproto 0 output
    - libxt_conntrack: remove one misleading comment
    - libxt_dccp: fix deprecated intrapositional ordering of !
    - libxt_dccp: fix random output of ! on --dccp-option
    - libxt_dccp: provide man pages options in short help too
    - libxt_dccp: restore missing XTOPT_INVERT tags for options
    - libxt_dccp: spell out option name on save
    - libxt_dscp: restore inversion support
    - libxt_hashlimit: default htable-expire must be in milliseconds
    - libxt_hashlimit: observe new default gc-expire time when saving
    - libxt_hashlimit: remove inversion from hashlimit rev 0
    - libxt_owner: restore inversion support
    - libxt_physdev: restore inversion support
    - libxt_policy: remove superfluous inversion
    - libxt_set: put differing variable names in directly
    - libxt_set: update man page about kernel support on the feature
    - libxt_string: define _GNU_SOURCE for strnlen
    - libxt_string: escape the escaping char too
    - libxt_string: fix space around arguments
    - libxt_string: replace hex codes by char equivalents
    - libxt_string: simplify hex output routine
    - libxt_tcp: always print the mask parts
    - libxt_TCPMSS: restore build with IPv6-less libcs
    - libxt_TOS: update linux kernel version list for backported fix
    - libxt_u32: fix missing allowance for inversion
    - src: remove unused IPTABLES_MULTI define
    - tests: add negation tests for libxt_statistic
    - xtoptions: flag use of XTOPT_POINTER without XTOPT_PUT
  - removed include/linux/types.h before build to be able to compile


author: Thomas Woerner <twoerner@redhat.com> 1.4.12.2-1
changelog:
  - new version 1.4.12.2 with new pkgconfig/libip4tc.pc and pkgconfig/libip6tc.pc
    - build: make check stage not fail when building statically
    - build: restore build order of modules
    - build: scan for unreferenced symbols
    - build: sort file list before build
    - doc: clarification on the meaning of -p 0
    - doc: document iptables-restore's -T option
    - doc: fix undesired newline in ip6tables-restore(8)
    - ip6tables-restore: implement missing -T option
    - iptables: move kernel version find routing into libxtables
    - libiptc: provide separate pkgconfig files
    - libipt_SAME: set PROTO_RANDOM on all ranges
    - libxtables: Fix file descriptor leak in xtables_lmap_init on error
    - libxt_connbytes: fix handling of --connbytes FROM
    - libxt_CONNSECMARK: fix spacing in output
    - libxt_conntrack: improve error message on parsing violation
    - libxt_NFQUEUE: fix --queue-bypass ipt-save output
    - libxt_RATEEST: link with -lm
    - libxt_statistic: link with -lm
    - Merge branch 'stable'
    - Merge branch 'stable' of git://dev.medozas.de/iptables
    - nfnl_osf: add missing libnfnetlink_CFLAGS to compile process
    - xtoptions: fill in fallback value for nvals
    - xtoptions: simplify xtables_parse_interface


author: Thomas Woerner <twoerner@redhat.com> 1.4.14-1
changelog:
  - new version 1.4.14
    - extensions: add IPv6 capable ECN match extension
    - extensions: add nfacct match
    - extensions: add rpfilter module
    - extensions: libxt_rateest: output all options in save hook
    - iptables: missing free() in function cache_add_entry()
    - iptables: missing free() in function delete_entry()
    - libiptc: fix retry path in TC_INIT
    - libiptc: Returns the position the entry was inserted
    - libipt_ULOG: fix --ulog-cprange
    - libxt_CT: add --timeout option
    - ip(6)tables-restore: make sure argv is NULL terminated
    - Revert "libiptc: Returns the position the entry was inserted"
    - src: mark newly opened fds as FD_CLOEXEC (close on exec)
    - tests: add rateest match rules
  - dropped patch5 (cloexec), merged upstream


author: Thomas Woerner <twoerner@redhat.com> 1.4.15-1
changelog:
  - new version 1.4.15
    - extensions: add HMARK target
    - iptables-restore: fix parameter parsing (shows up with gcc-4.7)
    - iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)
    - libxtables: add xtables_ip[6]mask_to_cidr
    - libxt_devgroup: add man page snippet
    - libxt_hashlimit: add support for byte-based operation
    - libxt_recent: add --mask netmask
    - libxt_recent: remove unused variable
    - libxt_HMARK: correct a number of errors introduced by Pablo's rework
    - libxt_HMARK: fix ct case example
    - libxt_HMARK: fix output of iptables -L
    - Revert "iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)"


author: Thomas Woerner <twoerner@redhat.com> 1.4.16.2-1
changelog:
  - new version 1.4.16.2
    - build: support for automake-1.12
    - build: separate AC variable replacements from xtables.h
    - build: have `make clean` remove dep files too
    - doc: grammatical updates to libxt_SET
    - doc: clean up interpunction in state list for xt_conntrack
    - doc: deduplicate extension descriptions into a new manpage
    - doc: trim "state" manpage and reference conntrack instead
    - doc: have NOTRACK manpage point to CT instead
    - doc: mention iptables-apply in the SEE ALSO sections
    - extensions: libxt_addrtype: fix type in help message
    - include: add missing linux/netfilter_ipv4/ip_queue.h
    - iptables: fix wrong error messages
    - iptables: support for match aliases
    - iptables: support for target aliases
    - iptables-restore: warn about -t in rule lines
    - ip[6]tables-restore: cleanup to reduce one level of indentation
    - libip6t_frag: match any frag id by default
    - libxtables: consolidate preference logic
    - libxt_devgroup: consolidate devgroup specification parsing
    - libxt_devgroup: guard against negative numbers
    - libxt_LED: guard against negative numbers
    - libxt_NOTRACK: replace as an alias to CT --notrack
    - libxt_state: replace as an alias to xt_conntrack
    - libxt_tcp: print space before, not after "flags:"
    - libxt_u32: do bounds checking for @'s operands
    - libxt_*limit: avoid division by zero
    - Merge branch 'master' of git://git.inai.de/iptables
    - Merge remote-tracking branch 'nf/stable'
    - New set match revision with --return-nomatch flag support
  - dropped fixrestore patch, upstream


author: Thomas Woerner <twoerner@redhat.com> 1.4.16.2-2
changelog:
  - new sub package services providing the systemd services (RHBZ#862922)
  - new sub package utils: provides nfnl_osf and the pf.os database
  - using %{_libexecdir}/iptables as script path for the original init scripts
  - added service iptables save funcitonality using the new way provided by 
    initscripts 9.37.1 (RHBZ#748134)
  - added virtual provide for libxtables.so.7


author: Thomas Woerner <twoerner@redhat.com> 1.4.16.2-4
changelog:
  - fixed missing services for update of pre F-18 installations (rhbz#867960)
    - provide and obsolete old main package in services sub package
    - provide and obsolete old ipv6 sub package (pre F-17) in services sub package


author: Ville Skyttä <ville.skytta@iki.fi> - 1.4.16.2-6
changelog:
  - Own unowned -services libexec dirs (#894464, Michael Scherer).
  - Fix -services unit file permissions (#732936, Michal Schmidt).


author: Thomas Woerner <twoerner@redhat.com> 1.4.18-1
changelog:
  - new version 1.4.18 
    - lots of documentation changes
    - Introduce match/target aliases
    - Add the "state" alias to the "conntrack" match
    - iptables: remove unused leftover definitions
    - libxtables: add xtables_rule_matches_free
    - libxtables: add xtables_print_num
    - extensions: libip6t_DNPT: fix wording in DNPT target
    - extension: libip6t_DNAT: allow port DNAT without address
    - extensions: libip6t_DNAT: set IPv6 DNAT --to-destination
    - extensions: S/DNPT: add missing save function
  - changes of 1.4.17:
    - libxt_time: add support to ignore day transition
    - Convert the NAT targets to use the kernel supplied nf_nat.h header
    - extensions: add IPv6 MASQUERADE extension
    - extensions: add IPv6 SNAT extension
    - extensions: add IPv6 DNAT target
    - extensions: add IPv6 REDIRECT extension
    - extensions: add IPv6 NETMAP extension
    - extensions: add NPT extension
    - extensions: libxt_statistic: Fix save output


author: Thomas Woerner <twoerner@redhat.com> 1.4.19.1-1
changelog:
  - new version 1.4.19.1
    - libxt_NFQUEUE: fix bypass option documentation
    - extensions: add connlabel match
    - extensions: add connlabel match
    - ip[6]tables: show --protocol instead of --proto in usage
    - libxt_recent: Fix missing space in manpage for --mask option
    - extensions: libxt_multiport: Update manpage to list valid protocols
    - utils: nfnl_osf: use the right nfnetlink lib
    - libip6t_NETMAP: Use xtables_ip6mask_to_cidr and get rid of libip6tc dependency
    - Revert "build: resolve link failure for ip6t_NETMAP"
    - libxt_osf: fix missing --ttl and --log in save output
    - libxt_osf: fix bad location for location in --genre
    - libip6t_SNPT: add manpage
    - libip6t_DNPT: add manpage
    - utils: updates .gitignore to include nfbpf_compile
    - extensions: libxt_bpf: clarify --bytecode argument
    - libxtables: fix parsing of dotted network mask format
    - build: bump version to 1.4.19
    - libxt_conntrack: fix state match alias state parsing
    - extensions: add libxt_bpf extension
    - utils: nfbpf_compile
    - doc: mention SNAT in INPUT chain since kernel 2.6.36
  - fixed changelog date weekdays where needed


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-1
changelog:
  - no connlabel.conf upstream anymore
  - new version 1.4.21
    - doc: clarify DEBUG usage macro
    - iptables: use autoconf to process .in man pages
    - extensions: libipt_ULOG: man page should mention NFLOG as replacement
    - extensions: libxt_connlabel: use libnetfilter_conntrack
    - Introduce a new revision for the set match with the counters support
    - libxt_CT: Add the "NOTRACK" alias
    - libip6t_mh: Correct command to list named mh types in manpage
    - extensions: libxt_DNAT, libxt_REDIRECT, libxt_NETMAP, libxt_SNAT, libxt_MASQUERADE, libxt_LOG: rename IPv4 manpage and tell about IPv6 support
    - extensions: libxt_LED: fix parsing of delay
    - ip{6}tables-restore: fix breakage due to new locking approach
    - libxt_recent: restore minimum value for --seconds
    - iptables-xml: fix parameter parsing (similar to 2165f38)
    - extensions: add copyright statements
    - xtables: improve get_modprobe handling
    - ip[6]tables: Add locking to prevent concurrent instances
    - iptables: Fix connlabel.conf install location
    - ip6tables: don't print out /128
    - libip6t_LOG: target output is different to libipt_LOG
    - build: additional include path required after UAPI changes
    - iptables: iptables-xml: Fix various parsing bugs
    - libxt_recent: restore reap functionality to recent module
    - build: fail in configure on missing dependency with --enable-bpf-compiler
    - extensions: libxt_NFQUEUE: add --queue-cpu-fanout parameter
    - extensions: libxt_set, libxt_SET: check the set family too
    - ip6tables: Use consistent exit code for EAGAIN
    - iptables: libxt_hashlimit.man: correct address
    - iptables: libxt_conntrack.man extraneous commas
    - iptables: libip(6)t_REJECT.man default icmp types
    - iptables: iptables-xm1.1 correct man section
    - iptables: libxt_recent.{c,man} dead URL
    - iptables: libxt_string.man add examples
    - extensions: libxt_LOG: use generic syslog reference in manpage
    - iptables: extensions/GNUMakefile.in use CPPFLAGS
    - iptables: correctly reference generated file
    - ip[6]tables: fix incorrect alignment in commands_v_options
    - build: add software version to manpage first line at configure stage
    - extensions: libxt_cluster: add note on arptables-jf
    - utils: nfsynproxy: fix error while compiling the BPF filter
    - extensions: add SYNPROXY extension
    - utils: add nfsynproxy tool
    - iptables: state match incompatibilty across versions
    - libxtables: xtables_ipmask_to_numeric incorrect with non-CIDR masks
    - iptables: improve chain name validation
    - iptables: spurious error in load_extension
    - xtables: trivial spelling fix


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-2
changelog:
  - fixed system hang at shutdown if root device is network based (RHBZ#1007934)
    Thanks to Rodrigo A B Freire for the patch


author: Jiri Popelka <jpopelka@redhat.com> - 1.4.21-3
changelog:
  - no need to support the pre-systemd things
  - use systemd macros (#850166)
  - remove scriptlets for migrating to a systemd unit from a SysV initscripts
  - ./configure -> %configure
  - spec clean up
  - fix self-obsoletion


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-9
changelog:
  - fixed missing system hang at shutdown if root device is network based
    (RHBZ#1007934)
  - Fixed iptables-save man page completely wrong (RHBZ#1054871)
  - Fixed missing reload action for iptables service (RHBZ#1066007)
  - Fixed regressions from RHEL-6 iptables services (RHBZ#1067670)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-14
changelog:
  - Add cgroup support (RHBZ#1058660)
  - Add wait seonds support for commands (RHBZ#1156411)
  - Add dhcpv6-client in default IPv6 firewall rules (RHBZ#1169036)
  - Add message for init script error returns (RHBZ#1200415)
  - Use flock for wait option (RHBZ#1202435)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-16
changelog:
  - Fix important coverity findings: missing include for flock and use bash for
    init script (RHBZ#1264399)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-17
changelog:
  - Fixed init script not to fail on missing restorecon (RHBZ#1246380)
  - Adapted man page snipplet for TRACE to use proper logging backend names
    (RHBZ#1261238)
  - Warn about use of DROP in nat table (RHBZ#1298879)
  - Fixed modules unload in init script (RHBZ#1324102)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-18
changelog:
  - Add support for --wait options to restore commands (RHBZ#1438597)
  - Do not set changed flag for rule check operations with module targets
    (RHBZ#1438597)
  - Add version option to restore commands (RHBZ#1438597)


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - add remaining binaries.
  - casts to remove compilation warnings.
  - terminate if -w deadline is reached exactly (#8724).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - include README.ifenslave doco.
  - "ping -i N" was broke for N >= 3 (#9929).
  - update to ss000121:
  -- clockdiff: preserve raw socket errno.
  -- ping: change error exit code to 1 (used to be 92,93, ...)
  -- ping,ping6: if -w specified, transmit until -c limit is reached.
  -- ping,ping6: exit code non-zero if some packets not received within deadline.


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a bunch of compiler warnings (#37131)
  - Fixed wrong exit code for no packets and deadline (#40323)
  - Moved arping to /sbin from /usr/sbin due to ifup call (#45785). Symlink from
    /usr/sbin/ provided for backwards compatibility.


author: Phil Knirsch <pknirsch@redhat.com>
changelog:
  - Added a patch to activate the rdisc server (#64270).
  - Display the countermeasures warning only in verbose (#55236)


author: Phil Knirsch <pknirsch@redhat.com> 20020124-7
changelog:
  - Added new BuildPreReqs for docbook-utils and perl-SGMLSpm (#66661)
  - Fixed ipv6 error printing problem (#66659).


author: Phil Knirsch <pknirsch@redhat.com> 20020927-3
changelog:
  - Removed bonding tarball and replaced it with ifenslave.c and README
  - FHS compliance for all tools, now to be found in /bin with compat symlinks to
    old places.


author: Phil Knirsch <pknirsch@redhat.com> 20020927-4
changelog:
  - Fixed DNS lookup problems (#68212).
  - Added warning if binding problem failed on subinterface (#81640).


author: Martin Bacovsky <mbacovsk@redhat.com> - 20020927-40
changelog:
  - tracepath doesn't continue past destination host (#174032) 
    previous patch replaced by new one provided by <mildew@gmail.com>
    option -c added


author: Martin Bacovsky <mbacovsk@redhat.com>- 20020927-42
changelog:
  - Resolves: #218706 - now defines the destination address along RFC3484
  - Resolves: #229630 - ifenslave(8) man page added
  - Resolves: #213716 - arping doesn't work on InfiniBand ipoib interfaces


author: Martin Bacovsky <mbacovsk@redhat.com> - 20070202-1
changelog:
  - upgarde to new upstream iputils-s20070202
  - Resolves: #229995
  - Resolves: #225909 - Merge Review: iputils
  - patches revision


author: Martin Bacovsky <mbacovsk@redhat.com> - 20070202-2
changelog:
  - Resolves: #234060: [PATCH] IDN (umlaut domains) support for ping and ping6
    patch provided by Robert Scheck <redhat@linuxnetz.de>


author: Martin Bacovsky <mbacovsk@redhat.com> - 20070202-4
changelog:
  - resolves: #236725: ping does not work for subsecond intervals for ordinary user
  - resolves: #243197: RFE: Please sync ifenslave with current kernel
  - resolves: #246954: Initscript Review
  - resolves: #251124: can't build rdisc - OPEN_MAX undeclared


author: Martin Nagy <mnagy@redhat.com> - 20070202-6
changelog:
  - fix absolute symlinks and character encoding for RELNOTES (#225909)
  - preserve file timestamps (#225909)
  - use %{?_smp_mflags} (#225909)
  - fix service rdisc stop removing of lock file


author: Martin Nagy <mnagy@redhat.com> - 20071127-3
changelog:
  - major patch cleanup so it will be easier to get patches upstream
  - fix for #68212, previous fix actually didn't work for ping6
  - renewed the ia64 align patches
  - update README.bonding
  - clear up the code from warnings
  - spec file cleanup


author: Jiri Skala <jskala@redhat.com> - 20101006-3
changelog:
  - applied patch dropping capabilities of Ludwig Nussel
  - fixes building ping, pinpg6 with -pie option
  - moves most CFLAGS options from spec to Makefile


author: Jan Synáček <jsynacek@redhat.com> 20101006-15
changelog:
  - Ping fixes:
    + enable marking packets when the correct capabilities are set (#802197)
    + integer overflow (#834661)
    + Fallback to numeric addresses while exiting (#834661)


author: Jan Synáček <jsynacek@redhat.com> - 20121112-1
changelog:
  - Update to iputils-s20121112 (#875767)
    + drop unnecessary patches
    + update patches
    + wrap SO_BINDTODEVICE with the correct capability
    + fix incorrect free (hits when -lidn is used)


author: Jan Synáček <jsynacek@redhat.com> - 20121121-1
changelog:
  - Update to iputils-s20121121, drop unnecessary patches
  - Add capabilities to clockdiff and arping
  - Renumber patches
  - Fix arping's default device search logic


author: Jan Synáček <jsynacek@redhat.com> - 20121125-2
changelog:
  - Comment patches and cleanup
  - Update ifaddrs patch
  - Call usage() before limiting capabilities
  - Correct ifaddrs patch
  - Drop corr_type patch (gcc 4.4 build hack)
  - Fix missing end tags in sgml documentation


author: Jan Synáček <jsynacek@redhat.com> - 20121207-1
changelog:
  - Update to iputils-s20121207 (#884983) - fixes a ping segfault introduced
    by the previous update
  - Update ninfod-minor patch
  - Renumber patches
  - Fix -F switch (flowlabel patch)


author: Jan Synáček <jsynacek@redhat.com> - 20121221-7
changelog:
  - ping returns odd results with options inet6 in resolv.conf (#1210331)
  - count of "back" is not correct in tracepath (#1208372)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-7
changelog:
  - ping hung when it cannot receive echo reply (#1362463)
  - arping documentation inconsistency (#1351704)


author: Jan Synáček <jsynacek@redhat.com> - 20160308-9
changelog:
  - IPv4 vs IPv6 inconsistency on return value of ping (#1362388)
  - ping6 does not use device specified with -I parameter (#1371824, #1424965)
  - double cap_free call in ping_common.c (#1410114)
  - ping assumes EACCESS errors are due to broadcast addresses (#1387315)
  - ping -t with multicast address without effect on ppc64 (#1373333)
  - arping -c <n> does not exit when the device is deleted (#1387542)


author: Matt Domsch <mdomsch@fedoraproject.org> - 0.9.9-1
changelog:
  - new upstream version 0.9.9
  -- plus patches from git up to 20090818 which fix build errors and
     other release-critical bugs.
  -- 0.9.9: added Attansic L1E and sis190/191 ethernet drivers.  Fixes
     and updates to e1000 and 3c90x drivers.
  -- 0.9.8: new commands: time, sleep, md5sum, sha1sum. 802.11 wireless
     support with Realtek 8180/8185 and non-802.11n Atheros drivers.
     New Marvell Yukon-II gigabet Ethernet driver.  HTTP redirection
     support.  SYSLINUX floppy image type (.sdsk) with usable file
     system.  Rewrites, fixes, and updates to 3c90x, forcedeth, pcnet32,
     e1000, and hermon drivers.


author: Matt Domsch <mdomsch@fedoraproject.org> - 1.0.1-1
changelog:
  - New drivers: Intel e1000, e1000e, igb, EFI snpnet, JMicron jme,
    Neterion X3100, vxge, pcnet32.
  - Bug fixes and improvements to drivers, wireless, DHCP, iSCSI,
    COMBOOT, and EFI.


author: Daniel P. Berrange <berrange@redhat.com> - 20120319-2.git0b2c788
changelog:
  - Remove BuildRoot & rm -rf of it in install/clean sections
  - Remove defattr in file section
  - Switch to use global, instead of define for macros
  - Add note about Patch1 not going upstream
  - Split BRs across lines for easier readability


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-4.gitc4bce43
changelog:
  - ipxe-Use-next-server-from-filename-s-settings-block.patch [bz#1062644]
  - Resolves: bz#1062644
    (pxe boot fails if next-server details come from a different dhcp server)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-5.gitc4bce43.el7
changelog:
  - ipxe-Enable-infrastructure-to-specify-an-autoboot-device-.patch [bz#1031518]
  - ipxe-Allow-prefix-to-specify-a-PCI-autoboot-device-locati.patch [bz#1031518]
  - ipxe-Store-boot-bus-dev.fn-address-as-autoboot-device-loc.patch [bz#1031518]
  - ipxe-Ignore-PCI-autoboot-device-location-if-set-to-00-00..patch [bz#1031518]
  - ipxe-Revert-Remove-2-second-startup-wait.patch [bz#857123]
  - ipxe-Allow-ROM-banner-timeout-to-be-configured-independen.patch [bz#857123]
  - ipxe-Customize-ROM-banner-timeout.patch [bz#857123]
  - Resolves: bz#1031518
    (iPXE does not honor specified boot device)
  - Resolves: bz#857123
    (Guests never get an iPXE prompt)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20130517-6.gitc4bce43.el7
changelog:
  - ipxe-import-EfiRom-from-edk2-BaseTools-RHEL-only.patch [bz#1084561]
  - ipxe-add-custom-Makefile-for-EfiRom-RHEL-only.patch [bz#1084561]
  - ipxe-redhat-build-and-install-combined-legacy-UEFI-roms-f.patch [bz#1084561]
  - Resolves: bz#1084561
    (RFE: ship UEFI drivers for ipxe in RHEL-7.y)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-2.git6366fa7a.el7
changelog:
  - ipxe-Enable-IPv6-protocol-in-non-QEMU-builds.patch [bz#1350167]
  - Resolves: bz#1350167
    (ipxe: enable IPV6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-3.git6366fa7a.el7
changelog:
  - ipxe-Add-pci_find_next_capability.patch [bz#1242850]
  - ipxe-Add-virtio-1.0-constants-and-data-structures.patch [bz#1242850]
  - ipxe-Add-virtio-1.0-PCI-support.patch [bz#1242850]
  - ipxe-Add-virtio-net-1.0-support.patch [bz#1242850]
  - ipxe-Renumber-virtio_pci_region-flags.patch [bz#1242850]
  - ipxe-Fix-virtio-pci-logging.patch [bz#1242850]
  - Resolves: bz#1242850
    (Ipxe can not recognize "network device" when enable virtio-1 of virtio-net-pci)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-4.git6366fa7a.el7
changelog:
  - ipxe-Send-TCP-keepalives-on-idle-established-connections.patch [bz#1322056]
  - ipxe-enable-e1000e-rom.patch [bz#1361534]
  - Resolves: bz#1322056
    (ipxe freeze during HTTP download with last RPM)
  - Resolves: bz#1361534
    (RFE: Integrate e1000e implementation in downstream QEMU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20160127-5.git6366fa7a.el7
changelog:
  - ipxe-Strip-802.1Q-VLAN-0-priority-tags.patch [bz#1316329]
  - Resolves: bz#1316329
    ([RFE] Properly Handle 8021.Q VID 0 Frames, as new vlan model in linux kernel does.)


author: Jesse Keating <jkeating@redhat.com> - 1.13-2
changelog:
  - rebuilt with latest binutils to pick up 64K -z commonpagesize on ppc*
    (#203001)
  - Remove hack to use cvs checkin ID as release as it doesn't follow
    packaging guidelines


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.3-5
changelog:
  - Make irqbalance scan for new irqs when it detects new irqs (bz832815)
  - Fixes SIGFPE crash for some banning configuration (bz849792)
  - Fixes affinity_hint values processing (bz832815)
  - Adds banirq and bansript options (bz837049)
  - imake isn't needed for building any more (bz844359)
  - Fixes clogging of syslog (bz837646)
  - Added IRQBALANCE_ARGS variable for passing arguments via systemd(bz837048)
  - Fixes --hint-policy=subset behavior (bz844381)


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.6-5
changelog:
  - Fixed irqbalance web adresses in spec (bz1060810)
  - Default hintpolicy adjusted (bz1060814)
  - Missing autogen.sh call fixed


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.7-2
changelog:
  - fixed unused variable revealed by covscan
  - fixed ignored pid argument (#1155632)
  - warning when irqbalance started under non-root (#1155799)
  - more robust signal handling (#1158937)
  - fixed hostname in manpage (#1162251)


author: Hans de Goede <hdegoede@redhat.com> - 6.2.0.872-11
changelog:
  - Fix iscsid autostarting when upgrading from an older version
    (add iscsid.startup key to iscsid.conf on upgrade)
  - Fix printing of [ OK ] when successfully stopping iscsid
  - systemd related fixes:
   - Add Should-Start/Stop tgtd to iscsi init script to fix (re)boot from
     hanging when using locally hosted targets
   - %ghost /var/lock/iscsi and contents (#656605)


author: Hans de Goede <hdegoede@redhat.com> - 6.2.0.872-12
changelog:
  - Change iscsi init scripts to check for networking being actually up, rather
    then for NetworkManager being started (#692230)


author: Mike Christie <mchristi@redhat.com> 6.2.0.872.18
changelog:
  - 789683 Fix boot slow down when the iscsi service is started
    (regression added in 6.2.0.872.16 when the nm wait was added).


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-1
changelog:
  - rebase to new upstream code
  - systemd conversion
  - 565245 Fix multilib issues caused by timestamp in doxygen footers


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-4
changelog:
  - build with libkmod support, instead of calling out to modprobe
  - enable socket activation by default


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-7
changelog:
  - Use the systemd tmpfiles service to recreate lockfiles in /var/lock
  - 955167 build as a position independent executable
  - 894576 fix order of setuid/setgid and drop additional groups


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-10
changelog:
  - sync with upstream git, minor context fixes after rebase of out-of-tree patches
  - iscsiuio is merged upstream, remove old source archive and patches
  - spec cleanups to fix rpmlint issues


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-11
changelog:
  - iscsi boot related fixes
    make sure iscsid gets started if there are any boot sessions running
    add reload target to fix double session problem when restarting from NM
    don't rely on session list passed from initrd, never got fully implemented
    remove patches related to running iscsid from initrd, possible to revisit later


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-16
changelog:
  - fix iscsiuio socket activation
  - have systemd start socket units on iscsiadm use, if not already listening


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-19
changelog:
  - 1007388 fixes for iscsiadm to support qla4xxx
  - refresh boot session info patches to final version from upstream,
    fixes context issues with later patches
  - 1006156, 1006161 Add/Update entries in chap table through Open-iSCSI
  - 948134 extend support to set additional parameters for network configuration
  - 1049710 update open-iscsi to support host statistics
  - 1043019 iscsiuio fix for arp cache flush issue
  - 1059332 Fix broken discovery sessions over iser
  - 1017393 split out iscsiuio into a seperate sub-package


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-20
changelog:
  - 1049710 host0 being treated as an invalid in the host stats command
  - 1015563 revert change to return code when calling login_portal for sessions
    that already exist, as it impacts users scripting around iscsiadm


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-21
changelog:
  - 1069825
  - boot session handling improvements
  - Fix iscsi-mark-root for changed iscsiadm output
  - Make sure iscsiuio is running for boot session recovery when using the
    bnx2i transport by forcing iscsiuio.service start
  - Make NM dispatch triggered re-check for autostart sessions async
  - Accept exit code 21, no records, from iscsiadm as success in
    iscsi.service


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-22
changelog:
  - 1081798 retry login on host not found error
  - 1111925 ignore iscsiadm return in iscsi.service
  - 1126524 make sure systemd order against remote mounts is correct
  - 963039 add discovery as a valid mode in iscsiadm.8
  - sync with upstream


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-24
changelog:
  - 1040343 segfault from unexpected netlink event during discovery
  - inhibit strict aliasing optimizations in iscsiuio, rpmdiff error


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-29
changelog:
  - 1166713 1187792 add missing ExecStart, only newer systemd lets that be optional for oneshot services


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-32
changelog:
  - 1235684 apply safe_logout setting to flashnode sessions as well
    but only when logging out by session id, not by flashnode index


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-34
changelog:
  - 1322000 ensure TCP abort on session failure to prevent data corruption with link flap
  - 1294964, 1265073, 1213569 iscsiuio update, fix small ARP table issue
  - 1309488 remove broken sysfs cache code to speed up login of many sessions
  - 1330348 sync with upstream Open-iSCSI for minor fixes


author: Ben Skeggs <bskeggs@redhat.com> 20090106-2
changelog:
  - Add firmware needed for nouveau to operate correctly (this is Fedora
    only - do not upstream yet - we just moved it here from Fedora kernel)


author: Josh Boyer <jwboyer@redhat.com> 20120510-0.3.git375e954
changelog:
  - Fix location of BuildRequires so git is inclued in the buildroot
  - Create iwlXXXX-firmware subpackages (rhbz 828050)


author: Josh Boyer <jwboyer@redhat.com>
changelog:
  - Consolidate rt61pci-firmware and rt73usb-firmware packages (rhbz 864959)
  - Consolidate netxen-firmware and ql2[123]xx-firmware packages (rhbz 864959)


author: Jarod Wilson <jarod@redhat.com> - 20130820-0.3.git600caef
changelog:
  - Put in proper URL and URL-less Source0 location, and a note about how
    we generate the tarball by hand from a git tree


author: Jarod Wilson <jarod@redhat.com> - 20131106-0.1.git7d0c7a8
changelog:
  - Update to latest upstream linux-firmware to pick up bfa firmware (rhbz 1013426)
  - Fix up Obsoletes to all use <= comparisons


author: Jarod Wilson <jarod@redhat.com> - 20140911-0.1.git365e80c
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Adds Intel Quick Assist Technology firmware (rhbz 1127338)
  - Updates bnx2x adapter firmware to version 7.10.51 (rhbz 1089403)
  - Updates myri10ge adapter firmware to version 1.4.57 (rhbz 1063702)
  - Removes firmware for drivers not shipped with Red Hat Enterprise Linux 7 (rhbz 1016595)


author: Rafael Aquini <aquini@redhat.com> - 20150612-37.git3161bfa
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: Update firmware to revision 1.13.32.0 (rhbz 1189256)
  - qat: Update to the latest upstream firmware (rhbz 1173792)
  - Use a common version number for both the iwl*-firmware packages and linux-firmware itself


author: Rafael Aquini <aquini@redhat.com> - 20150904-42.git6ebf5d5
changelog:
  - Add Intel Omni-Path Architecture hfi1 Firmware (rhbz 1194910)
  - Update skl firmware for gpu (rhbz 1210012)


author: Jarod Wilson <jarod@redhat.com> - 20150904-43.git6ebf5d5
changelog:
  - Add more old chelsio firmwares, they nuked the one the driver in
    RHEL7.2 is expecting from upstream (rhbz 1262128)
  - Remove amd-ucode again, it simply breaks too many systems (rhbz 1246393)


author: Rafael Aquini <aquini@redhat.com> - 20160223-44.git8d1fd61
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update Intel Omni-Path Architecture hfi1 Firmware (rhbz 1267015)


author: Rafael Aquini <aquini@redhat.com> - 20160426-45.git986a5a8
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Restore AMD-ucode firmware blob again (rhbz 866700)
  - qat: Update to the latest upstream firmware (rhbz 1173792)
  - WiFi on Windstorm Peak Wireless Adapter 8265 - firmware support (rhbz 1315534)
  - WiFi on Sandy Peak Wireless Adapter 3168 - firmware support (rhbz 1315536)


author: Rafael Aquini <aquini@redhat.com> - 20160615-46.gita4bbc81
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Nuke old cxgb4 firmware blobs tarball (rhbz 1336906)
  - Update to latest Chelsio firmware release version (rhbz 1336906)


author: Rafael Aquini <aquini@redhat.com> - 20160728-47.git0daeaf3
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Core14 firmware release for 7265, 7260, 3160 wireless devices (rhbz 1358566)
  - Core19 firmware release for 7265D, 8260, 8265, 3168 wireless devices (rhbz 1358568)


author: Rafael Aquini <aquini@redhat.com> - 20160830-49.git7534e19
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update QCA6174/hw3.0/board-2.bin file to support ath10k devices (rhbz 1368159)


author: Rafael Aquini <aquini@redhat.com> - 20170217-50.git6d3bc88
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - chelsio: Update to the latest firmware released version (rhbz 1395322)
  - iwlwifi: Update to the latest firmware released version (rhbz 1385749)
  - ath10k: Update to the latest firmware released version (rhbz 1385743)
  - hfi1: Update to the latest firmware released version (rhbz 1382805)


author: Rafael Aquini <aquini@redhat.com> - 20170307-51.git87714d8
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - chelsio: Update to the latest firmware released version (rhbz 1385911)
  - drm: Update for radeon and amdgpu latest firmware released version (rhbz 1425197)


author: Rafael Aquini <aquini@redhat.com> - 20170328-52.git44d8e8d
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - nfp: add firmware for Netronome Ethernet Driver (rhbz 1432592)


author: Rafael Aquini <aquini@redhat.com> - 20170530-54.gitdf40d15
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - opa: HFI firmware problems with new OPA switch firmware (rhbz 1452253)


author: Sean Middleditch <sean@middleditch.us> 1.1.3-2
changelog:
  - Fix Changelog dates.
  - Mix autoheader warning.
  - Added make check.
  - Build and install HTML documentation in -devel package.


author: Rex Dieter <rdieter[AT]fedoraproject.org> 1.900.1-4
changelog:
  - -libs subpkg to be multilib friendlier
  - -utils subpkg for non-essential binaries jiv, tmrdemo (#244153)


author: Rex Dieter <rdieter@fedoraproject.org> - 1.900.1-13
changelog:
  - CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)
  - CVE-2008-3522 jasper: possible buffer overflow in 
    jas_stream_printf() (#461478)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-18
changelog:
  - CVE-2011-4516, CVE-2011-4517 jasper: heap buffer overflow flaws
    lead to arbitrary code execution (CERT VU#887409) (#765660)
  - Fixed problems found by static analysis of code (#761440)
  - spec file modernized


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-27
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1171211)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-28
changelog:
  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173569)
  - CVE-2014-8138 - heap overflow in jp2_decode (#1173569)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-29
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183674)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183682)


author: Josef Ridky <jridky@redhat.com> - 1.900.1-30
changelog:
  - Multiple security fixes (fixed by thoger):
    CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089
    CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692
    CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262
    CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391
    CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583
    CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
  - Fix implicit declaration warning caused by security fixes above


author: Omair Majid <omajid@redhat.com> - 1.7.0.19-2.3.9.12.el7
changelog:
  - Allowed multiple OpenJDKs to be installed in parallel
  - Removed archname
  - Added arch to all, not only multilib arches
  - uniquesuffix is now holding fully versioned name
  - Intorduced source11 remove-buildids.sh


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.19-2.3.9.13.el7
changelog:
  - javadoc put into fully versioned directory, but without arch (to be kept noarch)
   - uniquejavadocdir
  - updated to latest 2.3.9 tarball - fixing the rhbz#967436


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.19-2.3.9.14.fc19
changelog:
  - Added client/server directories so they can be owned
  - Renamed patch 107 to 200
  - Added nss support from 6.5
  - Added fix for RH857717, owned /etc/.java/ and /etc/.java/.systemPrefs
  - Removed ant-nodeps, should not be needed


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.19-2.3.10.0.el7
changelog:
  - fixed RH972717 by enabling patch110 java-1.7.0-openjdk-nss-icedtea-e9c857dcb964.patch
  - temporarly swithced to intree lcms as it have security fixes (patch 500)
   - added  GENSRCDIR="$PWD/generated.build" to be able to
   - removed (build)requires  lcms2(-devel)
  - Updated to latest IcedTea7-forest 2.3.10


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.25-2.3.10.3.el7
changelog:
  - update of IcedTea7-forest 2.3.10 tarball
  - removed patch1000 MBeanFix.patch to fix regressions caused by security patches


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.25-2.3.10.4.el7
changelog:
  - Sync with upstream IcedTea7-forest 2.3.10 tag
  - Fixes regressions as introduced with 1.7.0.25-2.3.10.3.el6:
    rhbz#978005, rhbz#977979, rhbz#976693, IcedTeaBZ#1487.
  - all patch commands repalced by patch macro
    - updated java-1.7.0-openjdk-ppc-zero-hotspot.patch to pass without loose patching


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.25-2.3.11.0.el7
changelog:
  - added new alternatives jre-1.7.0-openjdk and java-1.7.0-openjdk 
  - finally merged arm and main source tarballs
  - updated to icedtea 2.3.11
   - http://blog.fuseyism.com/index.php/2013/07/25/icedtea-2-3-11-released/
  - added removal of new jre-1.7.0-openjdk and java-1.7.0-openjdk alternatives
  - removed patch 400, rhino for 2.1 and other 2.1 conditional stuff
  - removed patch 103 arm-fixes.patch
  - removed "dir" from files which was duplicating jre in sdk


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.25-2.3.12.2.el7
changelog:
  - refreshed icedtea7-forest 2.3.12
  - fix broken jre_exports alternatives links (thanx to orion bug #979128)


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.40-2.4.2.7.el7
changelog:
  - fixed incorrect  _jvmdir/jre-javaver_origin to  _jvmdir/jre-javaver-origin link
  - Resolves:rhbz#875408


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.40-2.4.3.2.fel7
changelog:
  - added and applied patch121, FixPPC64StackOverflow.patch
  - all redundant ppc64 strings replaced by power64 macro
  - Resolves:rhbz#1018680


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.40-2.4.3.3.fel7
changelog:
  - just bumped release, need to confirm, that   patch121, FixPPC64StackOverflow.patch
    really works
  - Resolves:rhbz#1018680


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.40-2.4.3.4.fel7
changelog:
  - Removed obsoletes for java-1.6.0-openjdk* ,  until decided its presence in el7
  - Resolves:rhbz#1018680


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.51-2.4.4.0.el7
changelog:
  - updated to security icedtea 2.4.4
   - icedtea_version set to 2.4.4
   - updatever bumped to       51
   - release reset to 0
  - sync with fedora
   - added and applied patch411 1029588.patch (rh 1029588)
   - added aand applied patch410, 1015432 (rh 1015432)
   - and so removed patch121 FixPPC64StackOverflow.patch
  - added patch412 zero-x32.diff to try to fix zero builds build
  - Resolves: rhbz#1053280


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.51-2.4.5.0.el7
changelog:
  - updated to icedtea 2.4.5 + sync with f21
   - http://blog.fuseyism.com/index.php/2014/01/29/icedtea-2-4-5-released/
  - removed buildRequires: pulseaudio >= 0.9.11, as not neccessary
   -  but kept libs-devel)
  - removed upstreamed or unwonted patches (thanx to gnu_andrew to pointing them out)
   - patch410 1015432.patch (upstreamed)
   - patch411 1029588.patch
   - patch412 zero-x32.diff
   - patch104 java-1.7.0-ppc-zero-jdk.patch
   - patch105 java-1.7.0-ppc-zero-hotspot.patch
  - patch402 gstackbounds.patch and patch403 PStack-808293.patch applied always
   (again thanx to gnu_andrew)
  - merged other gnu_andrew's changes
   - FT2_CFLAGS and FT2_LIBS hardoced values replaced by correct pkg-config calls 
   - buildver bumbed to 31
  - added build requires  nss-devel
  - removed build requires mercurial
  - added JRE_RELEASE_VERSION and ALT_PARALLEL_COMPILE_JOBS into make call
  - Related: rhbz1038092


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.55-2.4.7.0.el7
changelog:
  - bumped to future icedtea-forest 2.4.7
  - updatever set to 55, buildver se to 13, release reset to 0
  - removed upstreamed patch402 gstackbounds.patch
  - removed Requires: rhino, BuildRequires is enough
  - ppc64 repalced by power64 macro
  - patch111 applied as dry-run (6.6 forward port)
  - nss enabled, but notused as default (6.6 forward port)
  - Resolves: rhbz#1099565


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1.7.0.55-2.4.7.2
changelog:
  - Remove NSS patches. Issues with PKCS11 provider mean it shouldn't be enabled.
  - Always setup nss.cfg and depend on nss-devel at build-time to do so.
  - This allows users who wish to use PKCS11+NSS to just add it to java.security.
  - Patches to PKCS11 provider will be included upstream in 2.4.8 (ETA July 2014)
  - Resolves: rhbz#1099565


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.65-2.5.1.2
changelog:
  - added and applied fix for samrtcard io patch405, pr1864_smartcardIO.patch
  - Resolves: rhbz#1115877


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.65-2.5.1.5
changelog:
  - Add workaround to build on ppc64le where arch directory is still ppc64le, not ppc64
  - Resolves: rhbz#1125557


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.65-2.5.1.7
changelog:
  - added and applied patch666 stackoverflow-ppc32_64-20140828.patch
  - returned ppc (rebuild in brew must be done by 2.4.x)
  - Resolves: rhbz#1125557


author: Severin Gehwolf <sgehwolf@redhat.com> - 1.7.0.65-2.5.1.10
changelog:
  - Add patches for PPC zero build.
  - Fixes stack overflow problem. See RHBZ#1015432.
  - Fixes missing memory barrier in Atomic::xchg*
  - Fixes missing PPC32/PPC64 defines for Zero builds on power.


author: Severin Gehwolf <sgehwolf@redhat.com> - 1.7.0.65-2.5.1.11
changelog:
  - Add hotspot compiler flag -fno-tree-vectorize which fixes the segfault in
    the bytecode verifier on ppc/ppc64.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.71-2.5.3.1
changelog:
  - Bump to 2.5.3 for latest security fixes.
  - Remove obsolete patches and CFLAGS which are now upstream.
  - Add hsbootstrap option to pre-build HotSpot when required.
  - Resolves: rhbz#1148894


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.71-2.5.3.3
changelog:
  - Set ENABLE_FULL_DEBUG_SYMBOLS=0 for aarch64 to retain debuginfo in files.
  - Resolves: rhbz#1148894


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.71-2.5.3.4
changelog:
  - aarch64 sources updated to most recent stable tag
  - adapted patch4030 PStack-808293-aarch64.patch
  - removed upstreamed CPU patches (patch500-509, 20141014*)
  - Resolves: rhbz#1125260


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.0
changelog:
  - Bump to 2.5.4 using OpenJDK 7u75 b13.
  - Bump AArch64 port to 2.6.0pre17.
  - Fix abrt_friendly_hs_log_jdk7.patch to apply again and enable on all archs.
  - Remove OpenJDK 8 / AArch64 version of PStack patch as this is no longer needed.
  - Resolves: rhbz#1180298


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.75-2.5.4.3
changelog:
  - removed source14 remove-origin-from-rpaths (1169097)
  - removed build requirement for chrpath
  - Resolves: rhbz#1180298


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.4
changelog:
  - Symlink ppc64 directory to ppc64le
  - Run test application to print architecture-specific paths stored in the JDK
  - Resolves: rhbz#1191652


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.5
changelog:
  - Fix patch for RH1191652 to override LIBARCH on ppc64le as there is no BUILDARCH
  - Resolves: rhbz#1191652


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.5
changelog:
  - Fix hsbootstrap option on ppc64le where JDK_TO_BUILD_WITH is changed.
  - Print uname to feedback to upstream OpenJDK.
  - Resolves: rhbz#1191652


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.79-2.5.5.0
changelog:
  - Bump to 2.5.5 using OpenJDK 7u79 b14.
  - Update OpenJDK tarball creation comments
  - Remove test case for RH1191652 now fix has been verified.
  - Drop AArch64 version of RH1191652 HotSpot patch as included upstream.
  - Resolves: rhbz#1209073


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.0
changelog:
  - Bump to 2.6.0 and u80b32.
  - Drop upstreamed patches and separate AArch64 HotSpot.
  - Add dependencies on pcsc-lite-devel (PR2496) and lksctp-tools-devel (PR2446)
  - Only run -Xshare:dump on JIT archs other than power64 as port lacks support
  - Update remove-intree-libraries script to cover LCMS and PCSC headers.
  - Resolves: rhbz#1194226


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.0
changelog:
  - Add GConf2-devel dependency for native proxy fallback support.
  - Remove libxslt dependency pulled in from IcedTea builds.
  - Reduce redhat-lsb dependency to redhat-lsb-core (lsb_release)
  - Resolves: rhbz#1194226


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.1
changelog:
  - Pass SYSTEM_GSETTINGS="true" to the OpenJDK build to explicitly enable the GSettings API.
  - Resolves: rhbz#1194226


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.91-2.6.2.1
changelog:
  - Bump to 2.6.2 and u91b00.
  - Disable system LCMS 2 for now until security of it can be verified.
  - Drop patches for PR2560/RH1245855 as now applied upstream.
  - Sync minor changes from RHEL 6 spec file.
  - Resolves: rhbz#1271923


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.91-2.6.2.4
changelog:
  - fixed headless to become headless again
   - jre/lib/archinstall/libjavagtk.so
   - jre/bin/policytool
   - jre-abrt/lib/archinstall/libjavagtk.so
   - all three added to not headless exclude list
  - see rhbz1141123
  - Resolves: rhbz#1278987


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.95-2.6.4.1
changelog:
  - Bump to 2.6.4 and u95b00.
  - Backport tarball creation script from OpenJDK 8 RPMs and update fsg.sh to work with it.
  - Drop 8072932or8074489 patch as applied upstream in u91b01.
  - Add MD5 checksums for last two version of the java.security file.
  - Correct date of ChangeLog entry below.
  - Resolves: rhbz#1295769


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.99-2.6.5.1
changelog:
  - Bump to 2.6.5 and u99b00.
  - Correct check for fsg.sh in tarball creation script
  - Drop AArch64 ADRP backports (8143067, 8146709) included in 2.6.5
  - Resolves: rhbz#1320659


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.101-2.6.6.1
changelog:
  - Bump to 2.6.6 and u101b00.
  - Drop AArch64 patch (PR2914) included in 2.6.6
  - Drop a leading zero from the priority as the update version is now three digits
  - Update PR2809 patch to apply against 2.6.6.
  - Resolves: rhbz#1325428


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.101-2.6.6.3
changelog:
  - added requires for copy-jdk-configs, to help with https://projects.engineering.redhat.com/browse/RCM-3654
  - Resolves: rhbz#1296441


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.101-2.6.6.4
changelog:
  - luascripts extracted and used from separate package
  - added requirement on at least build time nss
  - added --family and dependence on chkconfig >=1.7
  - in adition, family is restricted by arch
  - Resolves: rhbz#1296441
  - Resolves: rhbz#1296413


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.101-2.6.6.6
changelog:
  - Add fix for 8069181/PR3012 and pre-requisites from PR3013.
  - Add bug information for backports from last CPU.
  - Resolves: rhbz#1015612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.1
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (PR2938, PR2939, PR3012, PR3013 and PR1437) applied upstream.
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.2
changelog:
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.3
changelog:
  - Add additional changes to 8162344 to fix issues which only show up on a full build.
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.4
changelog:
  - Require a version of java-1.7.0-openjdk-devel with a working jar uf
  - Use readlink rather than a wildcard to resolve the system JDK directory
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.5
changelog:
  - Change to disable RC4 did not add MD5 checksum of previous java.security file from 2016/01
  - Resolves: rhbz#1350042


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.111-2.6.7.6
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.7
changelog:
  - Rebuild java-1.7.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372747)
  - Resolves: rhbz#1350042


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.0
changelog:
  - Bump to 2.6.8 and u121b00.
  - Drop patches (S7081817, S8140344, S8145017 and S8162344) applied upstream.
  - Update md5sum list with checksum for the new java.security file.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.1
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate PR2809 and RH1022017 against 2.6.9.
  - Update md5sum list with checksum for the new java.security file.
  - Add blacklisted.certs to installation file list.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.2
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Update jstack tapset to handle AArch64
  - Handle unsupported architectures by calling the error function rather than a parse failure
  - ABS_JAVA_HOME_DIR is no longer used in the updated tapsets
  - Resolves: rhbz#1373986


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.3
changelog:
  - Backport "8173783: IllegalArgumentException: jdk.tls.namedGroups"
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1422738


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.1
changelog:
  - Bump to 2.6.10 and u141b00.
  - Add more detailed output to fsg.sh and generate_source_tarball.sh.
  - Update md5sum list with checksum for the new java.security file.
  - Drop 8173783 backport which is now applied upstream.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.3
changelog:
  - Add support for using RSAandMGF1 with the SHA hash algorithms in the PKCS11 provider 
  - Resolves: rhbz#1273760


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.4
changelog:
  - Fix merge error with "native2ascii changes file permissions of input file"
  - Resolves: rhbz#1446700


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.141-2.6.10.5
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - aligned with this change, applied repackReproduciblePolycies.sh
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.151-2.6.11.1
changelog:
  - Bump to 2.6.11 and u151b00.
  - Update java-access-bridge-security.patch to apply against 2.6.11.
  - Drop 7177216 merge fix which is applied upstream.
  - Resolves: rhbz#1466509


author: Omair Majid <omajid@redhat.com> 1:1.8.0.0-0.5.b87
changelog:
  - Update to b87
  - Remove all rhino support; use nashorn instead
  - Remove upstreamed/unapplied patches


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.0-0.11.b89
changelog:
  - prelink dependence excluded also for aaech64
  - arm64 added to jitarches
  - added source100 config.guess to repalce the outdated one in-tree
  - added source101 config.sub  to repalce the outdated one in-tree
  - added patch2011 system-libjpegAARCH64.patch (as aarch64-port is little bit diferent)
  - added patch2031 system-lcmsAARCH64.patch (as aarch64-port is little bit diferent)
  - added gcc-c++ build depndece so builddep will  result to better situation


author: Deepak Bhole <dbhole@redhat.com> - 1:1.8.0.0-0.15.b89
changelog:
  - Added a missing includes patch (#302/%{name}-arm64-missing-includes.patch)
  - Added --disable-precompiled-headers for arm64 build


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.0-0.26.b129
changelog:
  - Add -headless subpackage based on java-1.7.0-openjdk
  - Add abrt connector support
  - Add -accessibility subpackage


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.0-0.31.b132
changelog:
  - updated to rc4 aarch64 tarball
  - outdated removed: patch2031 system-lcmsAARCH64.patch patch2011 system-libjpeg-aarch64.patch
    patch2021 system-libpng-aarch64.patch


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.0-2.b132
changelog:
  - Include version information in desktop files
  - Move desktop files from tarball to top level source


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-11.b12
changelog:
  - backporting old fixes:
  - get rid of jre-abrt, uniquesuffix, parallel install, jsa files,
    config(norepalce) bug, -fstack-protector-strong, OrderWithRequires,
    nss config, multilib arches, provides/requires excludes
  - some additional cosmetic changes


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-12.b12
changelog:
  - bumped release to build by previous release.
  - forcing rebuild by jdk8
  - uncommenting forgotten comment on tzdb link


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-17.b12
changelog:
  - added build requires and requires for headles  _datadir/javazi-1.8/tzdb.dat
  - restriction of tzdata provider, so we will be aware of another possible failure


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-1.b01
changelog:
  - updated to u40-b01
  - adapted  java-1.8.0-openjdk-accessible-toolkit.patch
  - adapted  system-lcms.patch
  - removed patch8 set-active-window.patch
  - removed patch9 javadoc-error-jdk-8029145.patch
  - removed patch10 javadoc-error-jdk-8037484.patch
  - removed patch99 applet-hole.patch - itw 1.5.1 is able to ive without it


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.40-1.b02
changelog:
  - adapted aarch64 patch
  - removed upstreamed patch  0001-PPC64LE-arch-support-in-openjdk-1.8.patch
  - added patch666 stackoverflow-ppc32_64-20140828.patch
  - commented out patch2 1015432.patch (does nearly the same as new patch666)
  - Resolves: rhbz#1125260


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.40-5.b26
changelog:
  - Update aarch64 hotspot to jdk7u40-b02 to match the rest of the JDK
  - Do not obsolete java-1.7.0-openjdk
  - Resolves: rhbz#1125260


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.20-2.b26
changelog:
  - moving all ppc64 to jit arches
  - using cpp interpreter for ppc64le
  - removing requirement on datadir/javazi-1.8/tzdb.dat
  - Resolves: rhbz#1125260


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.20-5.b26
changelog:
  - Update aarch64 hotspot to latest upstream version
  - Depend on java-1.7.0-openjdk to work around self-building issues
  - Resolves: rhbz#1125260


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.20-8.b26
changelog:
  - Add patches for PPC zero build.
  - Fixes stack overflow problem. See RHBZ#1015432.
  - Fixes missing memory barrier in Atomic::xchg*
  - Fixes missing PPC32/PPC64 defines for Zero builds on power.
  - Resolves: rhbz#1125260


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.20-9.b26
changelog:
  - Add hotspot compiler flag -fno-tree-vectorize which fixes the segfault in
    the bytecode verifier on ppc/ppc64.
  - Resolves: rhbz#1125260


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.20-10.b26
changelog:
  - Remove LIBDIR and funny definition of _libdir.
  - Fix rpmlint warnings about macros in comments.
  - Resolves: rhbz#1125260


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.25-3.b17
changelog:
  - added patch12,removeSunEcProvider-RH1154143
  - xdump excluded from ppc64le (rh1156151)
  - Add check for src.zip completeness. See RH1130490 (by sgehwolf@redhat.com)
  - Resolves: rhbz#1125260


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Fix configure script to use ppc64le, not ppc64.
  - Add ppc64le support to LIBJSOUND_CFLAGS.
  - Add a jvm.cfg for ppc64le
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Print contents of spec.gmk to see what is being passed to the HotSpot build.
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Set OPENJDK_TARGET_CPU_LEGACY to ppc64 so as not to mess up HotSpot build.
  - Add -DABI_ELFv2 to CFLAGS on ppc64le to match OpenJDK 7.
  - Print contents of hotspot-spec.gmk
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-4.b13
changelog:
  - Override ppc64le as ppc64 only in hotspot-spec.gmk so as not to disrupt JDK build.
  - Add property test case from java-1.7.0-openjdk build.
  - Resolves: rhbz#1194378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.31-6.b13
changelog:
  - Adjust ppc64le HotSpot patch for OpenJDK 8.
  - Enable AArch64 configure/JDK patch on all archs to minimise patching issues.
  - Adjust ppc64le patches to apply after the enableAArch64 patch.
  - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Resolves: rhbz#1194378


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-27.b13
changelog:
  - updated to security u45
  - minor sync with 7.2
   - generate_source_tarball.sh
   - adapted java-1.8.0-openjdk-s390-java-opts.patch and java-1.8.0-openjdk-size_t.patch
   - reworked (synced) zero patches (removed 103,11 added 204, 400-403)
   - family of 5XX patches renamed to 6XX
   - added upstreamed patch 501 and 505
   - included removeSunEcProvider-RH1154143.patch
  - returned java (jre only) provides
  - repacked policies (source20)
  - removed duplicated NVR provides
  - added automated test for priority (length7)
  - Resolves: RHBZ#1209077


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.45-34.b13
changelog:
  - Omit jsa files from power64 file list as well, as they are never generated
  - Resolves: rhbz#1202726


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-35.b13
changelog:
  - Make use of system timezone data for OpenJDK 8.
  - moved to boot build by openjdk8
  - priority set  gcj < lengthOffFour < otherJdks (RH1175457)
  - misusing already fixed bug
  - Resolves: rhbz#1189530


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.45-36.b13
changelog:
  - Correctly fix system timezone data issue by depending on correct tzdata version.
  - Remove reference to tz.properties which is no longer used.
  - Resolves: rhbz#1212571


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-0.b16
changelog:
  - July 2015 security update to u51b16.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Add patches for RH issues fixed in IcedTea 2.x and/or the upcoming u60.
  - Use 'openjdk' as directory prefix to allow patch interchange with IcedTea.
  - Re-generate EC disablement patch following CPU DH changes.
  - Resolves: rhbz#1235163


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-1.b16
changelog:
  - Re-introduce handling of java.security updates, with new md5sum of Jan 2015 version.
  - Resolves: rhbz#1235163


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-0.b17
changelog:
  - October 2015 security update to u65b17.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Update RH1191652 patch to build against current AArch64 tree.
  - Use appropriate source ID to avoid unpacking both tarballs on AArch64.
  - Add MD5 checksums for java.security from 8u51 and 8u60 RPMs.
  - Resolves: rhbz#1257657


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.65-4.b17
changelog:
  - moved to integration forest 
  - sync with fedora (all but extracted luas and family)
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - October 2015 security update to u71b15.
  - Improve verbosity and helpfulness of tarball generation script.
  - Remove RH1290936 workaround as RHEL does not have the hardened flags nor ARM32.
  - Update patch documentation using version originally written for Fedora.
  - Drop prelink requirement as we no longer use execstack.
  - Drop ifdefbugfix patch as this is fixed upstream.
  - Temporarily enable a full bootcycle to ensure flag changes don't break anything.
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - Turn off additional CFLAGS/LDFLAGS on AArch64 as bootstrapping failed.
  - Add patch for size_t formatting on s390 as size_t != intptr_t there.
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - Add additional fixes for s390 warnings in arguments.cpp
  - Temporarily turn off -Werror on s390 to make progress
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - Make bootstrap build optional and turn it off by default.
  - Fix remaining warnings in s390 fix and re-enable -Werror
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - Change correct specifier in src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-2.b15
changelog:
  - Restore upstream version of system LCMS patch removed by 'sync with Fedora'
  - Add patch to turn off strict overflow on IndicRearrangementProcessor{,2}.cpp
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-4.b15
changelog:
  - Remove -fno-tree-vectorize now a GCC is available with this bug fixed.
  - Add build requirement on a GCC with working tree vectorization.
  - Enable bootstrap temporarily to ensure the JDK is functional.
  - Resolves: rhbz#1146897


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-5.b15
changelog:
  - Backport S8148351: Only display resolved symlink for compiler, do not change path
  - Resolves: rhbz#1256464


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-6.b15
changelog:
  - Define EXTRA_CPP_FLAGS again, after it was removed in the fix for 1146897.
  - Resolves: rhbz#1146897


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-0.b15
changelog:
  - Replace s390 Java options patch with general version from IcedTea.
  - Apply s390 patches unconditionally to avoid arch-specific patch failures.
  - Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-0.b15
changelog:
  - Remove fragment of s390 size_t patch that unnecessarily removes a cast, breaking ppc64le.
  - Remove aarch64-specific suffix as update/build version are now the same as for other archs.
  - Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-0.b15
changelog:
  - Remove unnecessary AArch64 port divergence on parsing jvm.cfg, broken by 9399aa7ef558
  - Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-1.b15
changelog:
  - Add backport of 8147805: aarch64: C1 segmentation fault due to inline Unsafe.getAndSetObject
  - Resolves: rhbz#1300630


author: jvanek <jvanek@redhat.com> - 1:1.8.0.72-3.b15
changelog:
  - returning accidentlay removed hunk from renamed and so wrongly merged remove_aarch64_jvm.cfg_divergence.patch
  - Resolves: rhbz#1300630


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-4.b15
changelog:
  - Add patches to allow the SunEC provider to be built with the system NSS install.
  - Re-generate source tarball so it includes ecc_impl.h.
  - Adjust tarball generation script to allow ecc_impl.h to be included.
  - Bring over NSS changes from java-1.7.0-openjdk spec file (NSS_CFLAGS/NSS_LIBS)
  - Remove patch which disables the SunEC provider as it is now usable.
  - Correct spelling mistakes in tarball generation script.
  - Resolves: rhbz#1245810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-5.b16
changelog:
  - Update to u72b16.
  - Drop 8147805 and jvm.cfg fix which are applied upstream.
  - Resolves: rhbz#1307108


author: Omair Majid <omajid@redhat.com> - 1:1.8.0.72-12.b15
changelog:
  - Use a simple backport for PR2462/8074839.
  - Don't backport the crc check for pack.gz. It's not tested well upstream.
  - Resolves: rhbz#1307108


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.72-13.b16
changelog:
  - When using a compositing WM, the overlay window should be used, not the root window.
  - Resolves: rhbz#1176206


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-2.b03
changelog:
  - Avoid WithSeed versions of NSS functions as they do not fully process the seed
  - List current java.security md5sum so that java.security is replaced and ECC gets enabled.
  - Resolves: rhbz#1245810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Use basename of test file to avoid misinterpretation of full path as a package
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Enable a full bootstrap on JIT archs. Full build held back by Zero archs anyway.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Add 8132051 port to Zero.
  - Turn on bootstrap build for all to ensure we are now good to go.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Revert settings to production defaults so we can at least get a build.
  - Switch to a slowdebug build to try and unearth remaining issue on s390x.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Turn off -Werror so s390 can build in slowdebug mode.
  - Add fix for formatting issue found by previous s390 build.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Temporarily remove power64 from JIT arches to see if endian issue appears on Zero.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Add additional fix to Zero patch to properly handle result on 64-bit big-endian
  - Revert debugging options (aarch64 back to JIT, product build, no -Wno-error)
  - Enable full bootstrap on all architectures to check we are good to go.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Roll back release number as release 1 never succeeded, even with tests disabled.
  - Resolves: rhbz#1325423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-1.b14
changelog:
  - Update to u92b14.
  - Remove upstreamed patches for AArch64 byte behaviour and template issue.
  - Remove upstreamed patches for Zero build failures 8087120 & 8143855.
  - Replace 8132051 Zero fix with version upstreamed as 8154210 in 8u112.
  - Add upstreamed patch 6961123 from u102 to fix application name in GNOME Shell.
  - Add upstreamed patches 8044762 & 8049226 from u112 to fix JDI issues.
  - Regenerate java-1.8.0-openjdk-rh1191652-root.patch against u92
  - Resolves: rhbz#1335322


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-2.b14
changelog:
  - Add fix for PKCS#10 output regression, adding -systemlineendings option.
  - Move S8150954/RH1176206/PR2866 fix to correct section, as not in 9 yet.
  - Resolves: rhbz#1337583


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.92-4.b14
changelog:
  - added requires for copy-jdk-configs, to help with https://projects.engineering.redhat.com/browse/RCM-3654
  - Resolves: rhbz#1296442


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.92-5.b14
changelog:
  - added --family option with chkconfig version full dependence
  - added nss restricting requires
  - added zipped javadoc subpackage
  - extracted lua scripts
  - Resolves: rhbz#1296442
  - Resolves: rhbz#1296414


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-9.b14
changelog:
  - Add additional fixes (S6260348, S8159244) for u92 update.
  - Add bug ID to Javadoc patch.
  - Resolves: rhbz#1335322


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-1.b13
changelog:
  - Update to u101b13.
  - Document REPOS option in generate_source_tarball.sh
  - Drop a leading zero from the priority as the update version is now three digits
  - Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-3.b13
changelog:
  - Add missing hunk from 8147771, missed due to inclusion of unneeded 8138811
  - Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-4.b13
changelog:
  - Replace bad 8159244 patch from upstream 8u with fresh backport from OpenJDK 9.
  - Resolves: rhbz#1335322


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.101-7.b13
changelog:
  - added patch532 hotspot-1358661.patch - to fix performance of bimorphic inlining may be bypassed by type speculation
  - rhbz1358661
  - added patch301 bz1204159_java8.patch - to fix systemtap on multiple jdks
  - rhbz1204159
  - added patch531 hotspot-8157306.changeset - to fix rare NPE injavac on aarch64
  - rhbz1360863
  - added all virtual provides of java-devel
  - Resolves: rhbz#1216018


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-8.b13
changelog:
  - Replace patch for S8157306 with upstream version, documented & applied on all archs with conditional in patch
  - Resolves: rhbz#1360863


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-8.b13
changelog:
  - Replace patch for S8162384 with upstream version. Document correctly along with SystemTap RH1204159 patch.
  - Resolves: rhbz#1358661


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-9.b15
changelog:
  - Update to aarch64-jdk8u101-b15.
  - Rebase SystemTap tarball on IcedTea 3.1.0 versions so as to avoid patching.
  - Drop additional hunk for 8147771 which is now applied upstream.
  - Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-0.b14
changelog:
  - Update to aarch64-jdk8u102-b14.
  - Drop 8140620, 8148752 and 6961123, all of which appear upstream in u102.
  - Move 8159244 to 8u111 section as it only appears to be in unpublished u102 b31.
  - Move 8158260 to 8u112 section following its backport to 8u.
  - Resolves: rhbz#1359857


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - @prefix@ in tapsetfiles substitued by prefix as necessary to work with systemtap3 (rhbz1371005)
  - Resolves: rhbz#1295754


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.102-2.b14
changelog:
  - declared check_sum_presented_in_spec and used in prep and check
  - it is checking that latest packed java.security is mentioned in listing
  - Resolves: rhbz#1295754


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-3.b14
changelog:
  - Rebuild java-1.8.0-openjdk for GCC aarch64 stack epilogue code generation fix (RH1372750)
  - Resolves: rhbz#1359857


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-4.b14
changelog:
  - Runtime native library requirements need to match the architecture of the JDK
  - Resolves: rhbz#1375224


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b14
changelog:
  - Update to aarch64-jdk8u111-b14.
  - Add latest md5sum for java.security file due to jar signing property addition.
  - Drop S8157306 and the CORBA typo fix, both of which appear upstream in u111.
  - Add LCMS 2 patch to fix Red Hat security issue RH1367357 in the local OpenJDK copy.
  - Resolves: rhbz#1350037


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-3.b15
changelog:
  - Add MD5 checksum from RHEL 7.2 security update so the 7.3 one overwrites it.
  - Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
  - Update to aarch64-jdk8u111-b18, synced with upstream u111, S8170873 and new AArch64 fixes
  - Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-4.b18
changelog:
  - Replace our correct version of 8159244 with the amendment to the 8u version from 8160122.
  - Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-5.b18
changelog:
  - Use java-1.7.0-openjdk to bootstrap on RHEL to allow us to use main build target
  - Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.112-1.b16
changelog:
  - Update to aarch64-jdk8u112-b16.
  - Drop upstreamed patches for 8044762, 8049226, 8154210, 8158260 and 8160122.
  - Re-generate size_t and key size (RH1163501) patches against u112.
  - Resolves: rhbz#1391132


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-1.b13
changelog:
  - Update to aarch64-jdk8u121-b13.
  - Add MD5 checksum for the new java.security file (EC < 224, DSA < 1024 restricted)
  - Update PR1834/RH1022017 fix to reduce curves reported by SSL to apply against u121.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-2.b13
changelog:
  - Backport "S8153711: [REDO] JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command"
  - Resolves: rhbz#1284948


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-3.b13
changelog:
  - Backport "8170888: [linux] Experimental support for cgroup memory limits in container (ie Docker) environments"
  - Resolves: rhbz#1390708


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-4.b14
changelog:
  - added shenandoah hotspot
  - sync with fedora
  - Resolves: rhbz#1400306
  - Resolves: rhbz#1390708
  - Resolves: rhbz#1388520
  - Resolves: rhbz#1403992


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-6.b14
changelog:
  - Regenerate tarball with correct version of PR2126 patch.
  - Update generate_source_tarball.sh script to download correct version.
  - Resolves: rhbz#1400306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-6.b14
changelog:
  - Patch OpenJDK to check the system cacerts database directly
  - Remove unneeded symlink to the system cacerts database
  - Drop outdated openssl dependency from when the RPM built the cacerts database
  - Resolves: rhbz#1319875


author: jvanek <jvanek@redhat.com> - 1:1.8.0.121-7.b14
changelog:
  - updated to aarch64-shenandoah-jdk8u121-b14-shenandoah-merge-2017-03-08 (from aarch64-port/jdk8u-shenandoah) of hotspot
  - used aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u121-b14-shenandoah-merge-2017-03-09.tar.xz as new sources for hotspot
  - Resolves: rhbz#1400306


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-9.b14
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - Update jstack tapset to handle AArch64
  - Resolves: rhbz#1373848


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-10.b14
changelog:
  - Move unprocessed nss.cfg to nss.cfg.in and add missing substitution to create nss.cfg for install
  - Resolves: rhbz#1429774


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-10.b14
changelog:
  - Add backports from 8u131 and 8u152 ahead of April CPU.
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-1.b11
changelog:
  - Update to aarch64-jdk8u131-b11 and aarch64-shenandoah-jdk8u131-b11.
  - Drop upstreamed patches for 8147910, 8161993, 8170888 and 8173783.
  - Update generate_source_tarball.sh to remove patch remnants.
  - Cleanup Shenandoah tarball referencing and document how to create it.
  - Add MD5 checksum for the new java.security file (MD5 disabled for JAR signing)
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-2.b11
changelog:
  - Update tapset tarball to include the better error handling in PR3348
  - http://icedtea.classpath.org/hg/icedtea8/rev/14fc67a5d5a3
  - Resolves: rhbz#1438514


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-4.b11
changelog:
  - Rename SystemTap tapset tarball to avoid conflicts with previous version.
  - Resolves: rhbz#1438514


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-6.b12
changelog:
  - Update to aarch64-jdk8u131-b12 and aarch64-shenandoah-jdk8u131-b12 for AArch64 8168699 fix
  - Resolves: rhbz#1443417


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-8.b12
changelog:
  - Restore cacerts symlink as some broken apps hardcode the path (see RH1448802)
  - Resolves: rhbz#1319875


author: Zhengyu Gu <zgu@redhat.com> - 1:1.8.0.131-10.b12
changelog:
  - Added 8181055-pr3394-rh1448880.patch to fix a corner case of previous change
  - Resolves: rhbz#1448880


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.131-11.b12
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-12.b12
changelog:
  - Add backports from 8u152 (8179084/RH1455694, 8181419/RH1463144, 8175887) ahead of July CPU.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b15
changelog:
  - Update to aarch64-jdk8u141-b15 and aarch64-shenandoah-jdk8u141-b15.
  - Update location of OpenJDK system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
  - Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-2.b16
changelog:
  - Update to aarch64-jdk8u141-b16 and aarch64-shenandoah-jdk8u141-b16.
  - Revert change to remove-intree-libraries.sh following backout of 8173207
  - Resolves: rhbz#1466509


author: Rob Crittenden <rcritten@redhat.com> 4.2.4-5
changelog:
  - Include the 3 license files
  - Remove Requires for nss and nspr. These libraries have versioned symbols
    so BuildRequires is enough to set the minimum.
  - Add sparc64 for the 64-bit list


author: Rob Crittenden <rcritten@redhat.com> 4.2.4-6
changelog:
  - Use _jnidir macro instead of _javadir for the jar files. This will break
    multilib installs but adheres to the jpackage spec.


author: Rob Crittenden <rcritten@redhat.com> 4.2.6-1
changelog:
  - Resolves: bug 455305 - <cfu@redhat.com>
    CA ECC Signing Key Failure
  - Resolves: bug 502111 - <cfu@redhat.com>
    Need JSS interface for NSS's PK11_GenerateKeyPairWithOpFlags() function
  - Resolves: bug 503809 - <mharmsen@redhat.com>
    Update JSS version to 4.2.6
  - Resolves: bug 503817 - <mharmsen@redhat.com>
    Create JSS Javadocs as their own RPM


author: Rob Crittenden <rcritten@redhat.com> 4.2.6-4
changelog:
  - Resolves: bug 224688 - <cfu@redhat.com>
    Support ECC POP on the server
  - Resolves: bug 469456 - <jmagne@redhat.com>
    Server Sockets are hard coded to IPV4
  - Resolves: bug 509183 - <mharmsen@redhat.com>
    Set NSS dependency >= 3.12.3.99


author: John Dennis <jdennis@redhat.com> - 4.2.6-10
changelog:
  - Resolves: bug 656094 - <jdennis@redhat.com>
    Rebase jss to at least jss-4.2.6-9
  - <jdennis@redhat.com>
    merge in updates from Fedora
    move jar location to %{_libdir}/jss and provide symlinks, on 32bit looks like this:
      /usr/lib/java/jss4.jar -> /usr/lib/jss/jss4.jar
      /usr/lib/jss/jss4-<version>.jar
      /usr/lib/jss/jss4.jar -> jss4-<version>.jar
      /usr/lib/jss/libjss4.so
  - bug 654657 - <jdennis@redhat.com>
    Incorrect socket accept error message due to bad pointer arithmetic
  - bug 647364 - <cfu@redhat.com>
    Expose updated certificate verification function in JSS
  - bug 529945 - <cfu@redhat.com>
    expose NSS calls for OCSP settings
  - bug 638833 - <cfu@redhat.com>
    rfe ecc - add ec curve name support in JSS and CS
  - <rcritten@redhat.com>
    Need to explicitly catch UnsatisfiedLinkError exception for System.load()
  - bug 533304 - <rcritten@redhat.com>
    Move location of libjss4.so to subdirectory and use System.load() to
    load it instead of System.loadLibrary() for Fedora packaging compliance


author: Christina Fu <cfu@redhat.com> - 4.2.6-11
changelog:
  - bug 654657 - <jdennis@redhat.com>
    Incorrect socket accept error message due to bad pointer arithmetic
  - bug 661142 - <cfu@redhat.com>
    Verification should fail when a revoked certificate is added


author: Jack Magne <jmagne@redhat.com> - 4.2.6-15.99
changelog:
  - bug 694661 - TKS instance crash during token enrollment.
    Back out of previous patch for #676083.


author: Christina Fu <cfu@redhat.com> - 4.2.6-17
changelog:
  - Bug 670980 - Cannot create system certs when using LunaSA HSM in FIPS Mode
    and ECC algorithms (support tokens that don't do ECDH)


author: Christina Fu <cfu@redhat.com> - 4.2.6-21
changelog:
  - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping
    unwrapping keys should be done in the token
  - support for PKCS5v2; support for secure PKCS12
  - Bugzilla Bug #744797 - KRA key recovery (retrieve pkcs#12) fails after the
    in-place upgrade( CS 8.0->8.1)


author: Christina Fu <cfu@redhat.com> - 4.2.6-23
changelog:
  - Bugzilla Bug #797351 - JSS - HSM token name was mistaken for manufacturer
    identifier (cfu)
  - Bugzilla Bug #804840 - [RFE] ECC encryption keys cannot be archived
    ECC phase2 work - support for ECC encryption key archival and recovery (cfu)
  - Bugzilla Bug #783007 - Un-deprecate previously deprecated methods in
    JSS 4.2.6 . . . (mharmsen)
  - Dogtag TRAC Task #109 (https://fedorahosted.org/pki/ticket/109) - add
    benign JNI jar file symbolic link from JNI libdir to JNI jar file (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.2.6-24
changelog:
  - Bugzilla Bug #783007 - Un-deprecate previously deprecated methods in
    JSS 4.2.6 . . . BadPaddingException (mharmsen)


author: Christina Fu <cfu@redhat.com> - 4.2.6-35
changelog:
  - Bugzilla Bug #1040640 - Incorrect OIDs for SHA2 algorithms
    (cfu for jnimeh@gmail.com)
  - Bugzilla Bug #1133718 - Key strength validation is not performed for RC4
    algorithm (nkinder)
  - Bugzilla Bug #816396 - Provide Tomcat support for TLS v1.1 and
    TLS v1.2 via NSS through JSS (cfu)


author: Christina Fu <cfu@redhat.com> - 4.2.6-40
changelog:
  - Bugzilla 1074208 - pass up exact JSS certificate validation errors from NSS
    (edewata)
  - Bugzilla 1331596 - Key archival fails when KRA is configured with lunasa.
    (cfu)
  - PKI ticket 801 - Merge pki-symkey into jss (phase 1)
    (jmagne)


author: Christina Fu <cfu@redhat.com> - 4.2.6-42
changelog:
  - Sync up patches from both Fedora and RHEL; adding two patches
    (cfu, edewata, mharmsen) from RHEL:
  - Bugzilla Bug #1238450 - UnsatisfiedLinkError on Windows (cfu)
  - make it compile on Windows platforms (cfu for nhosoi)


author: Elio Maldonado <emaldona@redhat.com> - 4.4.0-1
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - ## JSS 4.4.0 includes the following patches ported from downstream:
  - Mozilla Bugzilla #507536 - Add IPv6 functionality to JSS
  - Mozilla Bugzilla #1307872 - Expose NSS calls for OCSP settings
  - Mozilla Bugzilla #1307882 - RFE ecc - add ecc curve name support in JSS and
    CS interface
  - Mozilla Bugzilla #1307993 - Expose updated certificate verification function
    in JSS
  - Mozilla Bugzilla #1308000 - Incorrect socket accept error message due to bad
    pointer arithmetic
  - Mozilla Bugzilla #1308001 - Verification should fail when a revoked
    certificate is added
  - Mozilla Bugzilla #1308004 - Warnings should be cleaned up in JSS build
  - Mozilla Bugzilla #1308006 - DRM failed to recovery keys when in FIPS mode
    (HSM + NSS)
  - Mozilla Bugzilla #1308008 - Defects revealed by Coverity scan
  - Mozilla Bugzilla #1308009 - Add support for PKCS5v2; support for secure PKCS12
  - Mozilla Bugzilla #1308012 - DRM: during archiving and recovering, wrapping
    unwrapping keys should be done in the token
  - Mozilla Bugzilla #1308013 - JSS - HSM token name was mistaken for
    manufacturer identifier
  - Mozilla Bugzilla #1308017 - Un-deprecate previously deprecated methods in
    JSS 4.2.6
  - Mozilla Bugzilla #1308019 - Provide Tomcat support for TLS v1.1 and
    TLS v1.2 via NSS through JSS
  - Mozilla Bugzilla #1308026 - JSS certificate validation does not pass up exact
    error from NSS
  - Mozilla Bugzilla #1308027 - Merge pki-symkey into jss
  - Mozilla Bugzilla #1308029 - Resolve Javadoc build issues
  - Mozilla Bugzilla #1308047 - support ECC encryption key archival and recovery
  - Mozilla Bugzilla #1313122 - Remove bypass tests as latest NSS has removed
    PKCS#11 bypass support
  - Mozilla Bugzilla #1328675 - Simple problem unwrapping AES sym keys on token
  - Mozilla Bugzilla #1345174 - Cannot create system certs when using LunaSA HSM
    in FIPS Mode and ECC algorithms
  - Mozilla Bugzilla #1345613 - expose AES KeyWrap and add some useful OID
    functions
  - Mozilla Bugzilla #1346410 - Load JSS libraries appropriately
  - ## JSS 4.4.0 includes the following changes for building and testing:
  - Mozilla Bugzilla #1331765 - Simplify JSS Makefile build and test
  - Mozilla Bugzilla #1346420 - Document steps required to use the proper
    libjss4.so when running certain HMAC Algorithms tests


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-4
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - Updated build requirements for NSPR
  - Updated build and runtime requirements for NSS
  - ## 'jss-post-rebase.patch' resolves the following issues ported from
    - Mozilla Bugzilla #1337092 - CMC conformance update: Implement required ASN.1
    code for RFC5272+ (cfu)
  - Mozilla Bugzilla #1347394 - Eclipse project files for JSS (edewata)
  - Mozilla Bugzilla #1347429 - Deprecated SSL 3.0 cipher names in SSLSocket
    class. (edewata)
  - Mozilla Bugzilla #1348856 - SSL alert callback (edewata)
  - Mozilla Bugzilla #1349278 - SSL cipher enumeration (edewata)
  - Mozilla Bugzilla #1349349 - Problem with Password.readPasswordFromConsole().
    (edewata)
  - Mozilla Bugzilla #1349831 - Revise top-level README file (mharmsen)
  - Mozilla Bugzilla #1349836 - Changes to JSS Version Block (mharmsen)
  - Mozilla Bugzilla #1350130 - Missing
    CryptoManager.verifyCertificateNowCUNative() implementation. (emaldona)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-5
changelog:
  - Mozilla Bugzilla #1355268 - JSS 4.4 is incompatible with versions of
    idm-console-framework < 1.1.17-4
  - Red Hat Bugzilla #1435076 - Remove unused legacy lines from JSS spec files


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-6
changelog:
  - Mozilla Bugzilla #1352476 - RFE: Document on the README how to create a
    release tag (mharmsen)
  - Mozilla Bugzilla #1355358 - CryptoStore: add methods for importing and
    exporting EncryptedPrivateKeyInfo (ftweedal)
  - Mozilla Bugzilla #1359731 - CryptoStore.importPrivateKey enhancements
    (ftweedal)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-7
changelog:
  - Bump NSS dependencies from 4.28.3 to 4.28.4-6 to pick-up fix in
    Mozilla Bugzilla #1360207 - Fix incorrect if (ss->...) in SSL_ReconfigFD


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.05-2
changelog:
  - Build everything, obsoletes console-tools
  - s/Copyright:/License:/
  - License is GPL, not just distributable
  - Add our compose mappings from old console-tools
  - Add triggerpostun -- console-tools magic to get sane fonts and mappings


author: Than Ngo <than@redhat.com>
changelog:
  - update to 1.0.6
  - use %{_tmppath}
  - use find_lang
  - support new gettext
  - remove some patch files, which are included in 1.0.6
  - fix to use RPM_OPT_FLAGS


author: Jakub Jelinek <jakub@redhat.com> 1.06-24
changelog:
  - use cyr-sun16 cyrillic chars in latarcyrheb-sun16 font
    instead of old LatArCyrHeb-16 chars
  - add Euro character to latarcyrheb-sun16
  - use latarcyrheb-sun16 by default in unicode_start script


author: Nalin Dahyabhai <nalin@redhat.com> 1.06-27
changelog:
  - add detached signature
  - remove directory names from PAM configuration so that the same config file
    can be used for any arch on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 1.08-2
changelog:
  - only output terminal unicode init sequence if both stdout and stderr are
    connected to terminals, so that it doesn't show up when script outputs
    get piped to files


author: Adrian Havill <havill@redhat.com> 1.08-7
changelog:
  - make euro/latin-9 the default instead of latin-1 and 7-bit (#97013)
  - fix swedish keymap; se, not sv (#88791)
  - add fr-latin0 legacy alias of fr-latin-9 (#88324)
  - add ".map" ext to filename param of init script (#90562)


author: Adrian Havill <havill@redhat.com> 1.08-9
changelog:
  - don't print "plus before..." warnings about non-supported capslock
    in unimode <Andries.Brouwer@cwi.nl> (#81855)


author: Miloslav Trmac <mitr@redhat.com> - 1.12-4
changelog:
  - Don't ship a patch backup file
  - Mention in setfont.8 that 512-glyph fonts reduce the number of available
    colors (#140935, patch by Dmitry Butskoj)
  - Remove "Meta_acute" from German keymaps (#143124)
  - Make the %triggerun script condition more precise, ignore failure of the
    script


author: Miloslav Trmac <mitr@redhat.com> - 1.12-5
changelog:
  - Put "Meta_acute" back in German keymaps, just ignore it in (loadkeys -u)
    (patch by Jochen Schmitt)
  - Don't ship patch backup files, simpler way


author: Miloslav Trmac <mitr@redhat.com> - 1.12-11
changelog:
  - Don't ship character set lists (they are already in glibc-common) and an
    obsolete copy of kbd.FAQ


author: Miloslav Trmac <mitr@redhat.com> - 1.12-13
changelog:
  - Fix build with new coreutils
  - Hardcode paths in unicode_start to avoid a few file lookups (#178329)
  - Drop unnecessary Prereq: sed mktemp


author: Miloslav Trmac <mitr@redhat.com> - 1.12-19
changelog:
  - Ship "el" translation instead of the obsolete "gr" translation
    Resolves: #210749
  - Fix % quoting in %changelog


author: Miloslav Trmac <mitr@redhat.com> - 1.12-20
changelog:
  - Document that setkeycodes doesn't affect USB keyboards and that the kernel
    doesn't provide the raw scan codes by default
    Resolves: #211803


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.12-26
changelog:
  - Fix ro.map to generate right unicode for s, S, t, T with comma
  - Fix LatArCyrHeb-16 unicode mapping table to show comma-version
    of s, S, t, T and cedilla-version of s, S, t, T as the same glyph
    (because there is no font in kbd for comma-version)
    Resolves: #329071


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.12-28
changelog:
  - Fix ro.map.gz, add ro_std.map.gz, drop ro_win.map.gz,
    add Lat2-Terminus16.psf console font (many thanks to Alexandru Szasz
    <alexxed@gmail.com>)
    Resolves: #253892


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15-4
changelog:
  - Merge review (drop Provides/Obsoletes, change Prereq to Requires,
    add URL, convert ChangeLog to utf-8, replace locale destination
    with macro, add COPYING and add dvorak documentation)
    Resolves: #225958


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.2-1
changelog:
  - Update to kbd-1.15.2 (removed kbd-1.15-quiet_doc.patch and romanian keymaps, both are
    part of the upstream tarball now)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.3-4
changelog:
  - Ship double scaled latarcyrheb console font for high resolution screens
    (created by Tom Horsley)
    Resolves: #617768


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-1
changelog:
  - Update to kbd-1.15.5 (removed kbd-1.15-resizecon-x86_64.patch,
    kbd-1.15-defkeymap.patch, kbd-1.15.3-fix-es-translation.patch,
    kbd-1.15.3-loadkeys-d.patch)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-3
changelog:
  - Include xkb layouts from xkeyboard-config converted to console keymaps
  - Add version to vlock provides
    Resolves: #902564


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-8
changelog:
  - Fix vlock doesn't perform PAM account management or credential reinitialization
    Resolves: #1032140


author: Matthias Saou <http://freshrpms.net/> 1.1.13-1
changelog:
  - Update to 1.1.13.
  - Change mode of configuration file to 0600.
  - Don't include all of "doc" since it meant re-including all man pages.
  - Don't include samples in the main configuration path, they're in %doc.
  - Include patch to add an optional label to interfaces.


author: Matthias Saou <http://freshrpms.net/> 1.1.13-4
changelog:
  - Add missing \n to the kernel define, for when multiple kernels are installed.
  - Pass STRIP=/bin/true to "make" in order to get a useful debuginfo package.


author: Matthias Saou <http://freshrpms.net/> 1.1.13-5
changelog:
  - Include types patch to fix compile on F7 (David Woodhouse).
  - Fix up file modes (main binary 700 -> 755 and config 600 -> 640).


author: Matthias Saou <http://freshrpms.net/> 1.1.14-1
changelog:
  - Update to 1.1.14.
  - Remove all upstreamed patches.
  - Remove our init script and sysconfig files, use the same now provided by the
    upstream package (will need to patch for LSB stuff soonish).
  - Include new goodies/arpreset.pl in %doc.
  - Add missing scriplet requirements.


author: Matthias Saou <http://freshrpms.net/> 1.1.14-2
changelog:
  - Include patch from Shinji Tanaka to fix conf include from inside some
    directives like vrrp_instance.


author: Matthias Saou <http://freshrpms.net/> 1.1.19-3
changelog:
  - Update init script to have keepalived start after the local MTA (#526512).
  - Simplify the kernel source detection, to avoid running rpm from rpmbuild.


author: Matthias Saou <http://freshrpms.net/> 1.1.20-1
changelog:
  - Update to 1.1.20 (#589923).
  - Update BR conditional for RHEL6.
  - No longer include goodies/arpreset.pl, it's gone from the sources.


author: Ryan O'Hara <rohara@redhat.com> - 1.2.7-3
changelog:
  - Update spec file.
  - Add option to prevent respawn of child processes.
  - Remove duplicate command-line option code.
  - Use popt to generate usage message.
  - Fix pointer arithmetic for VRRP packets.
  - Fix comparison of primary IP address.
  - Fix loading of SSL certificate.
  - Fix typo in error message.
  - Update FSF address in GPLv2 license.
  - Remove debug message from if_get_by_ifname.


author: Jarod Wilson <jarod@redhat.com> [3.10.0-1.el7]
changelog:
  - [x86] fix !CONFIG_HYPERVISOR_GUEST compile (Andrew Jones)
  - [s390x] crash: Fuzzy live dump for Linux on System z (Hendrik Brueckner) [805120]
  - [xen] xenfv: fix hangs when kdumping (Andrew Jones) [845471]
  - [libata] export ata_port port_no attribute via /sys (David Milburn) [951181]
  - [s390x] kdump: Use 4 GiB for KEXEC_AUTO_THRESHOLD (Hendrik Brueckner) [953044]
  - [x86] hpet: allow user controlled mmap for user processes (Prarit Bhargava) [788727]
  - [mm] add memory tracking hooks (James Paradis) [725860]
  - [kernel] clocksource, fix !CONFIG_CLOCKSOURCE_WATCHDOG compile (Prarit Bhargava) [914709]
  - [x86] disable clocksource watchdog (Prarit Bhargava) [914709]
  - [kdump] x86, fix kdump and unsupported HW check (Prarit Bhargava) [923256]
  - [x86] support single cpu on guests only (Prarit Bhargava) [873806]
  - [kernel] Mark power5, power6, !Intel, and !AMD systems as unsupported (Prarit Bhargava) [870129]
  - [kernel] Backport RH specific TAINT flags (Prarit Bhargava) [870129]
  - [s390x] zfcpdump: Add user space tool (Hendrik Brueckner) [825189]
  - [kdump] crashkernel=auto fixes and cleanup (Dave Young) [804077]
  - [fedora] /dev/crash driver (Kyle McMartin) [808839]
  - [kdump] forward port crashkernel auto reservation code (Dave Young) [804077]
  - [block] Change scheduler to CFQ for ATA/SATA (Vivek Goyal) [811016]
  - [kernel] kbuild: AFTER_LINK (Roland McGrath)
  - [ppc64] disable INFINIBAND_EHCA temporarily, it ftbfs (Kyle McMartin)
  - [kernel] Add RHEL_{MAJOR,MINOR,RELEASE} to top level Makefile (Kyle McMartin)


author: Jarod Wilson <jarod@redhat.com> [3.10.0-2.el7]
changelog:
  - [scsi] sd: fix crash when UA received on DIF enabled device (Ewan Milne) [979440]
  - [md] dm-cache: add call to mark_tech_preview (Mike Snitzer) [982752]
  - [fs] nfs: have NFSv3 try server-specified auth flavors in turn (Jeff Layton) [977649]
  - [fs] nfs: have nfs_mount fake up a auth_flavs list when the server didn't provide it (Jeff Layton) [977649]
  - [fs] nfs: move server_authlist into nfs_try_mount_request (Jeff Layton) [977649]
  - [fs] nfs: refactor "need_mount" code out of nfs_try_mount (Jeff Layton) [977649]
  - [pci] ear: Reset link for devices below Root Port or Downstream Port (Myron Stowe) [797485]
  - [acpi] apei: Force fatal AER severity when component has been reset (Myron Stowe) [797485]
  - [pci] aer: Remove "extern" from function declarations (Myron Stowe) [797485]
  - [pci] aer: Move AER severity defines to aer.h (Myron Stowe) [797485]
  - [pci] aer: Set dev->__aer_firmware_first only for matching devices (Myron Stowe) [797485]
  - [pci] aer: Factor out HEST device type matching (Myron Stowe) [797485]
  - [pci] aer: Don't parse HEST table for non-PCIe devices (Myron Stowe) [797485]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-3.el7]
changelog:
  - [powerpc] mm/numa: Do not update sysfs cpu registration from invalid context (Steve Best) [967447]
  - [misc] MAINTAINERS: Add ACPI folks for ACPI-related things under drivers/pci (Myron Stowe) [984759]
  - [pci] Add CircuitCo vendor ID and subsystem ID (Myron Stowe) [984759]
  - [pci] Use pdev->pm_cap instead of pci_find_capability(.., PCI_CAP_ID_PM) (Myron Stowe) [984759]
  - [pci] Return early on allocation failures to unindent mainline code (Myron Stowe) [984759]
  - [pci] Simplify IOV implementation and fix reference count races (Myron Stowe) [984759]
  - [pci] Drop redundant setting of bus->is_added in virtfn_add_bus() (Myron Stowe) [984759]
  - [pci] pci-acpi: Use correct power state strings in messages (Myron Stowe) [984759]
  - [pci] Fix comment typo for pcie_pme_remove() (Myron Stowe) [984759]
  - [pci] Rename pci_release_bus_bridge_dev() to pci_release_host_bridge_dev() (Myron Stowe) [984759]
  - [pci] Fix refcount issue in pci_create_root_bus() error recovery path (Myron Stowe) [984759]
  - [pci] Convert alloc_pci_dev(void) to pci_alloc_dev(bus) (Myron Stowe) [984759]
  - [pci] Hide remove and rescan sysfs interfaces for SR-IOV virtual functions (Myron Stowe) [984759]
  - [pci] Add pcibios_release_device() (Myron Stowe) [984759]
  - [iommu] irq_remapping: Conserve interrupt resources when using multiple-MSIs (Myron Stowe) [984759]
  - [i2c] i2c-piix4: Add AMD CZ SMBus device ID (Myron Stowe) [984759]
  - [ata] ahci: Add AMD CZ SATA device ID (Myron Stowe) [984759]
  - [pci] Put Hudson-2 device IDs together (Myron Stowe) [984759]
  - [pci] Replace strict_strtoul() with kstrtoul() (Myron Stowe) [984759]
  - [pci] Finish SR-IOV VF setup before adding the device (Myron Stowe) [984759]
  - [pci] Fix comment typo for PCI_EXP_LNKCAP_CLKPM (Myron Stowe) [984759]
  - [acpi] pci_root: Use dev_printk(), acpi_handle_print(), pr_xxx() when possible (Myron Stowe) [984759]
  - [acpi] pci_root: Remove unused global list acpi_pci_roots (Myron Stowe) [984759]
  - [acpi] pci_root: Introduce "handle" local for economy of expression (Myron Stowe) [984759]
  - [acpi] pci_root: Combine duplicate adjacent "if" tests (Myron Stowe) [984759]
  - [pci] Allocate only as many MSI vectors as requested by driver (Myron Stowe) [984759]
  - [pci] Replace printks with appropriate pr_*() (Myron Stowe) [984759]
  - [pci] Fix kerneldoc for pci_disable_link_state() (Myron Stowe) [984759]
  - [x86] pci: Increase info->res_num before checking pci_use_crs (Myron Stowe) [984759]
  - [pci] Fix INTC comment typo for pci_swizzle_interrupt_pin() (Myron Stowe) [984759]
  - [pci] Convert ioapic.c to module_pci_driver (Myron Stowe) [984759]
  - [pci] Introduce pci_alloc_dev(struct pci_bus*) to replace alloc_pci_dev() (Myron Stowe) [984759]
  - [pci] Introduce pci_bus_{get|put}() to manage PCI bus reference count (Myron Stowe) [984759]
  - [pci] Unset resource if initial BAR value is invalid (Myron Stowe) [984759]
  - [pci] Consolidate calls to pcibios_bus_to_resource() in __pci_read_base() (Myron Stowe) [984759]
  - [pci] Add 0x prefix to BAR register position in __pci_read_base() (Myron Stowe) [984759]
  - [pci] aspm: Warn when driver asks to disable ASPM, but we can't do it (Myron Stowe) [984759]
  - [powerpc] pci: Use PCI_UNKNOWN for unknown power state (Myron Stowe) [984759]
  - [acpi] pci_root: Check acpi_resource_to_address64() return value (Myron Stowe) [984759]
  - [pci] Work around Ivytown NTB BAR size issue (Myron Stowe) [984759]
  - [net] sunrpc: Fix another issue with rpc_client_register() (Jeff Layton) [924649]
  - [net] sunrpc: Fix a deadlock in rpc_client_register() (Jeff Layton) [924649]
  - [net] sunrpc: PipeFS MOUNT notification optimization for dying clients (Jeff Layton) [924649]
  - [net] sunrpc: split client creation routine into setup and registration (Jeff Layton) [924649]
  - [net] sunrpc: fix races on PipeFS UMOUNT notifications (Jeff Layton) [924649]
  - [net] sunrpc: fix races on PipeFS MOUNT notifications (Jeff Layton) [924649]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-4.el7]
changelog:
  - [x86] signals: Merge EFLAGS bit clearing into a single statement (Jiri Olsa) [986216]
  - [x86] signals: Clear RF EFLAGS bit for signal handler (Jiri Olsa) [986216]
  - [x86] signals: Propagate RF EFLAGS bit through the signal restore call (Jiri Olsa) [986216]
  - [kernel] perf: Fix perf_lock_task_context() vs RCU (Jiri Olsa) [986216]
  - [kernel] perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid scenario (Jiri Olsa) [986216]
  - [kernel] perf: Clone child context from parent context pmu (Jiri Olsa) [986216]
  - [kernel] perf: Fix interrupt handler timing harness (Jiri Olsa) [986216]
  - [kernel] perf: Drop sample rate when sampling is too slow (Jiri Olsa) [986216]
  - [kernel] hw_breakpoint: Introduce "struct bp_cpuinfo" (Jiri Olsa) [986216]
  - [kernel] hw_breakpoint: Simplify *register_wide_hw_breakpoint() (Jiri Olsa) [986216]
  - [kernel] hw_breakpoint: Introduce cpumask_of_bp() (Jiri Olsa) [986216]
  - [kernel] hw_breakpoint: Simplify the "weight" usage in toggle_bp_slot() paths (Jiri Olsa) [986216]
  - [kernel] hw_breakpoint: Simplify list/idx mess in toggle_bp_slot() paths (Jiri Olsa) [986216]
  - [kernel] perf: Add simple Haswell PMU support (Jiri Olsa) [986216]
  - [kernel] perf: Add const qualifier to perf_pmu_register's 'name' arg (Jiri Olsa) [986216]
  - [kernel] perf: Fix hypervisor branch sampling permission check (Jiri Olsa) [986216]
  - [kernel] perf: Check branch sampling priv level in generic code (Jiri Olsa) [986216]
  - [kernel] perf: Add sysfs entry to adjust multiplexing interval per PMU (Jiri Olsa) [986216]
  - [kernel] perf: Use hrtimers for event multiplexing (Jiri Olsa) [986216]
  - [kernel] perf: Fix hw breakpoints overflow period sampling (Jiri Olsa) [986216]
  - [tools] perf/tests: Check proper prev_state size for sched_switch tp (Jiri Olsa) [984998]
  - [tools] perf/tests: Omit end of the symbol check failure for test 1 (Jiri Olsa) [984998]
  - [tools] perf/script: Fix broken include in Context.xs (Jiri Olsa) [984998]
  - [tools] perf: Fix -ldw/-lelf link test when static linking (Jiri Olsa) [984998]
  - [tools] perf: Fix perf version generation (Jiri Olsa) [984998]
  - [tools] perf/stat: Fix per-socket output bug for uncore events (Jiri Olsa) [984998]
  - [tools] perf/symbols: Fix vdso list searching (Jiri Olsa) [984998]
  - [tools] perf/evsel: Fix missing increment in sample parsing (Jiri Olsa) [984998]
  - [tools] perf: Update symbol_conf.nr_events when processing attribute events (Jiri Olsa) [984998]
  - [tools] perf: Fix new_term() missing free on error path (Jiri Olsa) [984998]
  - [tools] perf: Fix parse_events_terms() segfault on error path (Jiri Olsa) [984998]
  - [tools] perf/evsel: Fix count parameter to read call in event_format__new (Jiri Olsa) [984998]
  - [tools] perf: Fix -x/--exclude-other option for report command (Jiri Olsa) [984998]
  - [tools] perf/evlist: Enhance perf_evlist__start_workload() (Jiri Olsa) [984998]
  - [tools] perf/record: Remove -f/--force option (Jiri Olsa) [984998]
  - [tools] perf/record: Remove -A/--append option (Jiri Olsa) [984998]
  - [tools] perf/stat: Avoid sending SIGTERM to random processes (Jiri Olsa) [984998]
  - [tools] perf: Include termios.h explicitly (Jiri Olsa) [984998]
  - [tools] perf/bench: Fix memory allocation fail check in mem{set, cpy} workloads (Jiri Olsa) [984998]
  - [tools] perf: Fix build errors with O and DESTDIR make vars set (Jiri Olsa) [984998]
  - [tools] perf: Fix output directory of Documentation/ (Jiri Olsa) [984998]
  - [tools] perf: Get only verbose output with V=1 (Jiri Olsa) [984998]
  - [tools] perf: Add missing liblk.a dependency for python/perf.so (Jiri Olsa) [984998]
  - [tools] perf: Remove '?=' Makefile STRIP assignment (Jiri Olsa) [984998]
  - [tools] perf: Replace multiple line assignment with multiple statements (Jiri Olsa) [984998]
  - [tools] perf: Replace tabs with spaces for all non-commands statements (Jiri Olsa) [984998]
  - [tools] perf: Add NO_BIONIC variable to confiure bionic setup (Jiri Olsa) [984998]
  - [tools] perf: Switch to full path C include directories (Jiri Olsa) [984998]
  - [tools] perf: Merge all *LDFLAGS* make variable into LDFLAGS (Jiri Olsa) [984998]
  - [tools] perf: Merge all *CFLAGS* make variable into CFLAGS (Jiri Olsa) [984998]
  - [tools] perf/evlist: Reset SIGTERM handler in workload child process (Jiri Olsa) [984998]
  - [tools] perf: Remove cwdlen from struct perf_session (Jiri Olsa) [984998]
  - [tools] perf: Remove frozen from perf_header struct (Jiri Olsa) [984998]
  - [tools] perf/tests: Fix exclude_guest|exclude_host checking for attr tests (Jiri Olsa) [984998]
  - [tools] perf/tests: Fix attr test for record -d option (Jiri Olsa) [984998]
  - [tools] perf: Final touches for CHK config move (Jiri Olsa) [984998]
  - [tools] perf: Move paths config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libnuma check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move stdlib check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libbfd check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libpython check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libperl check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move gtk2 check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move slang check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libaudit check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libunwind check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libdw check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move libelf check config into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move compiler and linker flags check into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move programs check into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Move arch check into config/Makefile (Jiri Olsa) [984998]
  - [tools] perf: Add automated make test suite (Jiri Olsa) [984998]
  - [tools] perf: Save parent pid in thread struct (Jiri Olsa) [984998]
  - [tools] perf/stats: Fix divide by 0 in variance (Jiri Olsa) [984998]
  - [tools] perf/kvm: Handle realloc failures (Jiri Olsa) [984998]
  - [tools] perf/evsel: Fix printing of perf_event_paranoid message (Jiri Olsa) [984998]
  - [tools] perf/test: Fix typo (Jiri Olsa) [984998]
  - [tools] perf/hists: Rename hist_entry__add_pair arguments (Jiri Olsa) [984998]
  - [tools] perf/diff: Use internal rb tree for hists__precompute (Jiri Olsa) [984998]
  - [tools] perf/report: Add report.percent-limit config variable (Jiri Olsa) [984998]
  - [tools] perf/top: Add --percent-limit option (Jiri Olsa) [984998]
  - [tools] perf/report: Add --percent-limit option (Jiri Olsa) [984998]
  - [tools] perf/report: Don't bother locking when adding hist entries (Jiri Olsa) [984998]
  - [tools] perf/hists: Move locking to its call-sites (Jiri Olsa) [984998]
  - [tools] perf/top: Get rid of *_threaded() functions (Jiri Olsa) [984998]
  - [tools] perf/top: Fix percent output when no samples collected (Jiri Olsa) [984998]
  - [tools] perf/top: Fix -E option behavior (Jiri Olsa) [984998]
  - [tools] perf/record: handle death by SIGTERM (Jiri Olsa) [984998]
  - [tools] perf: Handle JITed code in shared memory (Jiri Olsa) [984998]
  - [tools] perf/tests: Fix compile errors in bp_signal files (Jiri Olsa) [984998]
  - [tools] perf: Fix tab vs spaces issue in Makefile ifdef/endif (Jiri Olsa) [984998]
  - [tools] perf/hists browser: Use sort__has_sym (Jiri Olsa) [984998]
  - [tools] perf/top: Use sort__has_sym (Jiri Olsa) [984998]
  - [tools] perf/sort: Cleanup sort__has_sym setting (Jiri Olsa) [984998]
  - [tools] perf/sort: Reorder HISTC_SRCLINE index (Jiri Olsa) [984998]
  - [tools] perf/archive: Fix typo on Documentation (Jiri Olsa) [984998]
  - [tools] perf/sort: Consolidate sort_entry__setup_elide() (Jiri Olsa) [984998]
  - [tools] perf/sort: Separate out memory-specific sort keys (Jiri Olsa) [984998]
  - [tools] perf/sort: Factor out common code in sort_dimension__add() (Jiri Olsa) [984998]
  - [tools] perf/sort: Introduce sort__mode variable (Jiri Olsa) [984998]
  - [tools] perf/report: Fix alignment of symbol column when -v is given (Jiri Olsa) [984998]
  - [tools] perf/hists: Free unused mem info of a matched hist entry (Jiri Olsa) [984998]
  - [tools] perf/hists: Fix an invalid memory free on he->branch_info (Jiri Olsa) [984998]
  - [tools] perf: Fix bug in isupper() and islower() (Jiri Olsa) [984998]
  - [mm] thp: define HPAGE_PMD_* constants as BUILD_BUG() if !THP (Steve Best) [947166]
  - [powerpc] mm: Fix build warnings with CONFIG_TRANSPARENT_HUGEPAGE disabled (Steve Best) [947166]
  - [powerpc] mm: Optimize hugepage invalidate (Steve Best) [947166]
  - [powerpc] thp: Enable THP on PPC64 (Steve Best) [947166]
  - [powerpc] mm: split hugepage when using subpage protection (Steve Best) [947166]
  - [powerpc] mm: disable assert_pte_locked for collapse_huge_page (Steve Best) [947166]
  - [powerpc] mm: Prevent gcc to re-read the pagetables (Steve Best) [947166]
  - [powerpc] mm: Make linux pagetable walk safe with THP enabled (Steve Best) [947166]
  - [powerpc] thp: Add code to handle HPTE faults for hugepages (Steve Best) [947166]
  - [powerpc] mm: Update gup_pmd_range to handle transparent hugepages (Steve Best) [947166]
  - [powerpc] kvm: Handle transparent hugepage in KVM (Steve Best) [947166]
  - [powerpc] mm: Replace find_linux_pte with find_linux_pte_or_hugepte (Steve Best) [947166]
  - [powerpc] mm: Update find_linux_pte_or_hugepte to handle transparent hugepages (Steve Best) [947166]
  - [powerpc] mm: move find_linux_pte_or_hugepte and gup_hugepte to common code (Steve Best) [947166]
  - [powerpc] thp: Implement transparent hugepages for ppc64 (Steve Best) [947166]
  - [powerpc] thp: Double the PMD table size for THP (Steve Best) [947166]
  - [powerpc] mm: handle hugepage size correctly when invalidating hpte entries (Steve Best) [947166]
  - [mm] thp: deposit the transpare huge pgtable before set_pmd (Steve Best) [947166]
  - [mm] thp: don't use HPAGE_SHIFT in transparent hugepage code (Steve Best) [947166]
  - [mm] thp: withdraw the pgtable after pmdp related operations (Steve Best) [947166]
  - [mm] thp: add pmd args to pgtable deposit and withdraw APIs (Steve Best) [947166]
  - [mm] thp: use the correct function when updating access flags (Steve Best) [947166]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-5.el7]
changelog:
  - [fs] cifs: fix bad error handling in crypto code (Jeff Layton) [988398]
  - [fs] cifs: Fix a deadlock when a file is reopened (Sachin Prabhu) [988398]
  - [fs] cifs: Reopen the file if reconnect durable handle failed (Sachin Prabhu) [988398]
  - [fs] cifs: Fix minor endian error in durable handle patch series (Sachin Prabhu) [988398]
  - [fs] cifs: Reconnect durable handles for SMB2 (Sachin Prabhu) [988398]
  - [fs] cifs: Make SMB2_open use cifs_open_parms struct (Sachin Prabhu) [988398]
  - [fs] cifs: Introduce cifs_open_parms struct (Sachin Prabhu) [988398]
  - [fs] cifs: Request durable open for SMB2 opens (Sachin Prabhu) [988398]
  - [fs] cifs: Simplify SMB2 create context handling (Sachin Prabhu) [988398]
  - [fs] cifs: Simplify SMB2_open code path (Sachin Prabhu) [988398]
  - [fs] cifs: Respect create_options in smb2_open_file (Sachin Prabhu) [988398]
  - [fs] cifs: Fix lease context buffer parsing (Sachin Prabhu) [988398]
  - [fs] cifs: use sensible file nlink values if unprovided (Sachin Prabhu) [988398]
  - [fs] cifs: Limit allocation of crypto mechanisms to dialect which requires (Sachin Prabhu) [988398]
  - [fs] cifs: Don't pass inode to ->d_hash() and ->d_compare() (Sachin Prabhu) [988398]
  - [fs] cifs: fill TRANS2_QUERY_FILE_INFO ByteCount fields (Sachin Prabhu) [988398]
  - [fs] cifs: fix SMB2 signing enablement in cifs_enable_signing (Sachin Prabhu) [988398]
  - [fs] cifs: Fix build warning (Sachin Prabhu) [988398]
  - [fs] cifs: SMB3 Signing enablement (Sachin Prabhu) [988398]
  - [fs] cifs: Do not set DFS flag on SMB2 open (Sachin Prabhu) [988398]
  - [fs] cifs: fix static checker warning (Sachin Prabhu) [988398]
  - [fs] cifs: try to handle the MUST SecurityFlags sanely (Sachin Prabhu) [988398]
  - [fs] cifs: When server doesn't provide SecurityBuffer on SMB2Negotiate pick default (Sachin Prabhu) [988398]
  - [fs] cifs: Handle big endianness in NTLM (ntlmv2) authentication (Sachin Prabhu) [988398]
  - [fs] cifs: revalidate directories instiantiated via FIND_* in order to handle DFS referrals (Sachin Prabhu) [988398]
  - [fs] cifs: SMB2 FSCTL and IOCTL worker function (Sachin Prabhu) [988398]
  - [fs] cifs: Charge at least one credit, if server says that it supports multicredit (Sachin Prabhu) [988398]
  - [fs] cifs: Remove typo (Sachin Prabhu) [988398]
  - [fs] cifs: Some missing share flags (Sachin Prabhu) [988398]
  - [fs] cifs: using strlcpy instead of strncpy (Sachin Prabhu) [988398]
  - [fs] cifs: Update headers to update various SMB3 ioctl definitions (Sachin Prabhu) [988398]
  - [fs] cifs: Update cifs version number (Sachin Prabhu) [988398]
  - [fs] cifs: Add ability to dipslay SMB3 share flags and capabilities for debugging (Sachin Prabhu) [988398]
  - [fs] cifs: Add some missing SMB3 and SMB3.02 flags (Sachin Prabhu) [988398]
  - [fs] cifs: Add SMB3.02 dialect support (Sachin Prabhu) [988398]
  - [fs] cifs: Fix endian error in SMB2 protocol negotiation (Sachin Prabhu) [988398]
  - [fs] cifs: clean up the SecurityFlags write handler (Sachin Prabhu) [988398]
  - [fs] cifs: update the default global_secflags to include "raw" NTLMv2 (Sachin Prabhu) [988398]
  - [fs] move sectype to the cifs_ses instead of TCP_Server_Info (Sachin Prabhu) [988398]
  - [fs] cifs: track the enablement of signing in the TCP_Server_Info (Sachin Prabhu) [988398]
  - [fs] add new fields to smb_vol to track the requested security flavor (Sachin Prabhu) [988398]
  - [fs] cifs: add new fields to cifs_ses to track requested security flavor (Sachin Prabhu) [988398]
  - [fs] cifs: track the flavor of the NEGOTIATE reponse (Sachin Prabhu) [988398]
  - [fs] cifs: add new "Unspecified" securityEnum value (Sachin Prabhu) [988398]
  - [fs] cifs: factor out check for extended security bit into separate function (Sachin Prabhu) [988398]
  - [fs] cifs: move handling of signed connections into separate function (Sachin Prabhu) [988398]
  - [fs] cifs: break out lanman NEGOTIATE handling into separate function (Sachin Prabhu) [988398]
  - [fs] cifs: break out decoding of security blob into separate function (Sachin Prabhu) [988398]
  - [fs] cifs: remove the cifs_ses->flags field (Sachin Prabhu) [988398]
  - [fs] cifs: throw a warning if negotiate or sess_setup ops are passed NULL server or session pointers (Sachin Prabhu) [988398]
  - [fs] cifs: make decode_ascii_ssetup void return (Sachin Prabhu) [988398]
  - [fs] cifs: remove useless memset in LANMAN auth code (Sachin Prabhu) [988398]
  - [fs] cifs: remove protocolEnum definition (Sachin Prabhu) [988398]
  - [fs] cifs: add a "nosharesock" mount option to force new sockets to server to be created (Sachin Prabhu) [988398]
  - [fs] fuse: readdirplus cleanup (Niels de Vos) [988312]
  - [fs] fuse: readdirplus change attributes once (Niels de Vos) [988312]
  - [fs] fuse: readdirplus fix instantiate (Niels de Vos) [988312]
  - [fs] fuse: readdirplus sanity checks (Niels de Vos) [988312]
  - [fs] fuse: fix readdirplus dentry leak (Niels de Vos) [988312]
  - [powerpc] hw_brk: Fix off by one error when validating DAWR region end (Steve Best) [843485]
  - [powerpc] hw_brk: Fix clearing of extraneous IRQ (Steve Best) [843485]
  - [powerpc] hw_brk: Fix setting of length for exact mode breakpoints (Steve Best) [843485]
  - [powerpc] perf: Add power8 EBB support (Steve Best) [969176]
  - [powerpc] perf: Core EBB support for 64-bit book3s (Steve Best) [969176]
  - [powerpc] perf: Don't enable if we have zero events (Steve Best) [969176]
  - [powerpc] powerpc/perf: Use existing out label in power_pmu_enable() (Steve Best) [969176]
  - [powerpc] perf: Freeze PMC5/6 if we're not using them (Steve Best) [969176]
  - [powerpc] powerpc/perf: Rework disable logic in pmu_disable() (Steve Best) [969176]
  - [powerpc] perf: Check that events only include valid bits on Power8 (Steve Best) [969176]
  - [ipc] sem: rename try_atomic_semop() to perform_atomic_semop(), docu update (Rik van Riel) [881820]
  - [ipc] sem: replace shared sem_otime with per-semaphore value (Rik van Riel) [881820]
  - [ipc] sem: always use only one queue for alter operations (Rik van Riel) [881820]
  - [ipc] sem: separate wait-for-zero and alter tasks into seperate queues (Rik van Riel) [881820]
  - [ipc] sem: cacheline align the semaphore structures (Rik van Riel) [881820]
  - [fs] gfs2: Add atomic_open support (Steven Whitehouse) [983098]
  - [fs] gfs2: Only do one directory search on create (Steven Whitehouse) [983098]
  - [fs] pstore: Add hsize argument in write_buf call of pstore_ftrace_call (Steve Best) [947161]
  - [powerpc] pseries: Support compression of oops text via pstore (Steve Best) [947161]
  - [powerpc] pseries: Re-organise the oops compression code (Steve Best) [947161]
  - [powerpc] pstore: Pass header size in the pstore write callback (Steve Best) [947161]
  - [powerpc] pseries: Read common partition via pstore (Steve Best) [947161]
  - [powerpc] pseries: Read of-config partition via pstore (Steve Best) [947161]
  - [powerpc] pseries: Distinguish between a os-partition and non-os partition (Steve Best) [947161]
  - [powerpc] pseries: Read rtas partition via pstore (Steve Best) [947161]
  - [powerpc] pseries: Read/Write oops nvram partition via pstore (Steve Best) [947161]
  - [powerpc] pseries: Introduce generic read function to read nvram-partitions (Steve Best) [947161]
  - [powerpc] pseries: Add version and timestamp to oops header (Steve Best) [947161]
  - [powerpc] pseries: Remove syslog prefix in uncompressed oops text (Steve Best) [947161]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-6.el7]
changelog:
  - [fs] locks: move file_lock_list to a set of percpu hlist_heads and convert file_lock_lock to an lglock (Jeff Layton) [976876]
  - [fs] seq_file: add seq_list_*_percpu helpers (Jeff Layton) [976876]
  - [fs] locks: give the blocked_hash its own spinlock (Jeff Layton) [976876]
  - [fs] locks: add a new "lm_owner_key" lock operation (Jeff Layton) [976876]
  - [fs] locks: turn the blocked_list into a hashtable (Jeff Layton) [976876]
  - [fs] locks: convert fl_link to a hlist_node (Jeff Layton) [976876]
  - [fs] locks: avoid taking global lock if possible when waking up blocked waiters (Jeff Layton) [976876]
  - [fs] locks: protect most of the file_lock handling with i_lock (Jeff Layton) [976876]
  - [fs] locks: encapsulate the fl_link list handling (Jeff Layton) [976876]
  - [fs] locks: make "added" in __posix_lock_file a bool (Jeff Layton) [976876]
  - [fs] locks: comment cleanups and clarifications (Jeff Layton) [976876]
  - [fs] locks: make generic_add_lease and generic_delete_lease static (Jeff Layton) [976876]
  - [fs] cifs: use posix_unblock_lock instead of locks_delete_block (Jeff Layton) [976876]
  - [fs] locks: drop the unused filp argument to posix_unblock_lock (Jeff Layton) [976876]
  - [scsi] ipr: IOA Status Code(IOASC) update (Steve Best) [731129]
  - [scsi] ipr: qc_fill_rtf() method should not store alternate status register (Steve Best) [731129]
  - [scsi] ipr: possible irq lock inversion dependency detected (Steve Best) [731129]
  - [fs] nfsd: when dentry_open returns an error do not propagate as struct file (Steve Dickson) [987090]
  - [net] sunrpc: underflow issue in decode_write_list() (Steve Dickson) [987090]
  - [fs] nfsd: fix minorversion support interface (Steve Dickson) [987090]
  - [fs] lockd: protect nlm_blocked access in nlmsvc_retry_blocked (Steve Dickson) [987090]
  - [fs] nfsd: support minorversion 1 by default (Steve Dickson) [987090]
  - [fs] nfsd: allow destroy_session over destroyed session (Steve Dickson) [987090]
  - [net] sunrpc: fix failures to handle -1 uid's (Steve Dickson) [987090]
  - [net] sunrpc: Don't schedule an upcall on a replaced cache entry (Steve Dickson) [987090]
  - [net] sunrpc: xpt_auth_cache should be ignored when expired (Steve Dickson) [987090]
  - [net] sunrpc/cache: ensure items removed from cache do not have pending upcalls (Steve Dickson) [987090]
  - [net] sunrpc/cache: use cache_fresh_unlocked consistently and correctly (Steve Dickson) [987090]
  - [net] sunrpc/cache: remove races with queuing an upcall (Steve Dickson) [987090]
  - [fs] nfsd: return delegation immediately if lease fails (Steve Dickson) [987090]
  - [fs] nfsd: do not throw away 4.1 lock state on last unlock (Steve Dickson) [987090]
  - [fs] nfsd: delegation-based open reclaims should bypass permissions (Steve Dickson) [987090]
  - [net] sunrpc: don't error out on small tcp fragment (Steve Dickson) [987090]
  - [net] sunrpc: fix handling of too-short rpc's (Steve Dickson) [987090]
  - [fs] nfsd: minor read_buf cleanup (Steve Dickson) [987090]
  - [fs] nfsd: fix decoding of compounds across page boundaries (Steve Dickson) [987090]
  - [fs] nfsd: clean up nfs4_open_delegation (Steve Dickson) [987090]
  - [fs] nfsd: Don't give out read delegations on creates (Steve Dickson) [987090]
  - [fs] nfsd: allow client to send no cb_sec flavors (Steve Dickson) [987090]
  - [fs] nfsd: fail attempts to request gss on the backchannel (Steve Dickson) [987090]
  - [fs] nfsd: implement minimal SP4_MACH_CRED (Steve Dickson) [987090]
  - [net] sunrpc: store gss mech in svc_cred (Steve Dickson) [987090]
  - [net] sunrpc: introduce init_svc_cred (Steve Dickson) [987090]
  - [fs] nfsd: avoid undefined signed overflow (Steve Dickson) [987090]
  - [net] sunrpc: the cache_detail in cache_is_valid is unused any more (Steve Dickson) [987090]
  - [net] sunrpc: server back channel needs no rpcbind method (Steve Dickson) [987090]
  - [fs] nfsd: fix compile in !CONFIG_NFSD_V4_SECURITY_LABEL case (Steve Dickson) [987090]
  - [fs] nfsd: Server implementation of MAC Labeling (Steve Dickson) [987090]
  - [fs] nfsd: Add NFS v4.2 support to the NFS server (Steve Dickson) [987090]
  - [security] fix cap_inode_getsecctx returning garbage (Steve Dickson) [987090]
  - [fs] nfsd: store correct client minorversion for >=4.2 (Steve Dickson) [987090]
  - [fs] nfsd: get rid of the unused functions in vfs (Steve Dickson) [987090]
  - [fs] nfs: Fix brainfart in attribute length calculation (Steve Dickson) [987090]
  - [fs] nfs: Fix a regression against the FreeBSD server (Steve Dickson) [987090]
  - [net] sunrpc/rpc_pipe: rpc_dir_inode_operations can be static (Steve Dickson) [987090]
  - [fs] nfs: Allow nfs_updatepage to extend a write under additional circumstances (Steve Dickson) [987090]
  - [fs] nfs: Make nfs_readdir revalidate less often (Steve Dickson) [987090]
  - [fs] nfs: Make nfs_attribute_cache_expired() non-static (Steve Dickson) [987090]
  - [net] sunrpc/rpc_pipe: set dentry operations at d_alloc time (Steve Dickson) [987090]
  - [fs] nfs: set verifier on existing dentries in nfs_prime_dcache (Steve Dickson) [987090]
  - [fs] nfs: Set NFS_CS_MIGRATION for NFSv4 mounts (Steve Dickson) [987090]
  - [fs] nfs: Refactor nfs4_init_session and nfs4_init_channel_attrs (Steve Dickson) [987090]
  - [fs] nfs: use pnfs_device maxcount for the objectlayout gdia_maxcount (Steve Dickson) [987090]
  - [fs] nfs: use pnfs_device maxcount for the blocklayout gdia_maxcount (Steve Dickson) [987090]
  - [fs] nfs: Fix gdia_maxcount calculation to fit in ca_maxresponsesize (Steve Dickson) [987090]
  - [fs] nfs: Improve legacy idmapping fallback (Steve Dickson) [987090]
  - [fs] nfs: end back channel session draining (Steve Dickson) [987090]
  - [fs] nfs: Apply v4.1 capabilities to v4.2 (Steve Dickson) [987090]
  - [fs] nfs: Clean up layout segment comparison helper names (Steve Dickson) [987090]
  - [fs] nfs: layout segment comparison helpers should take 'const' parameters (Steve Dickson) [987090]
  - [fs] nfs: Move the DNS resolver into the NFSv4 module (Steve Dickson) [987090]
  - [net] sunrpc/rpc_pipefs: only set rpc_dentry_ops if d_op isn't already set (Steve Dickson) [987090]
  - [fs] nfs: SETCLIENTID add the format string for the NETID (Steve Dickson) [987090]
  - [fs] nfs: Add in v4.2 callback operation (Steve Dickson) [987090]
  - [fs] nfs: Make callbacks minor version generic (Steve Dickson) [987090]
  - [fs] nfs: Add Kconfig entry for Labeled NFS V4 client (Steve Dickson) [987090]
  - [fs] nfs: Extend NFS xattr handlers to accept the security namespace (Steve Dickson) [987090]
  - [fs] nfs: Client implementation of Labeled-NFS (Steve Dickson) [987090]
  - [fs] nfs: Add label lifecycle management (Steve Dickson) [987090]
  - [fs] nfs: Add labels to client function prototypes (Steve Dickson) [987090]
  - [fs] nfs: Extend fattr bitmaps to support all 3 words (Steve Dickson) [987090]
  - [fs] nfs: Introduce new label structure (Steve Dickson) [987090]
  - [fs] nfs: Add label recommended attribute and NFSv4 flags (Steve Dickson) [987090]
  - [fs] nfs: Added NFS v4.2 support to the NFS client (Steve Dickson) [987090]
  - [security] selinux: Add new labeling type native labels (Steve Dickson) [987090]
  - [security] lsm: Add flags field to security_sb_set_mnt_opts for in kernel mount data (Steve Dickson) [987090]
  - [security] Add Hook to test if the particular xattr is part of a MAC model (Steve Dickson) [987090]
  - [security] Add hook to calculate context based on a negative dentry (Steve Dickson) [987090]
  - [fs] nfs: Close another NFSv4 recovery race (Steve Dickson) [987090]
  - [fs] nfs: Move dentry instantiation into the NFSv4-specific atomic open code (Steve Dickson) [987090]
  - [fs] nfs: Refactor _nfs4_open_and_get_state to set ctx->state (Steve Dickson) [987090]
  - [fs] nfs: pass the nfs_open_context to nfs4_do_open (Steve Dickson) [987090]
  - [fs] nfs: Remove redundant check for FMODE_EXEC in nfs_finish_open (Steve Dickson) [987090]
  - [net] sunrpc: Remove redundant call to rpc_set_running() in __rpc_execute() (Steve Dickson) [987090]
  - [net] sunrpc: Remove unused functions rpc_task_set/has_priority (Steve Dickson) [987090]
  - [net] sunrpc: Remove the unused helpers task_for_each() and task_for_first() (Steve Dickson) [987090]
  - [net] sunrpc: Remove unused function rpc_queue_empty (Steve Dickson) [987090]
  - [net] sunrpc: Fix a potential race in rpc_execute (Steve Dickson) [987090]
  - [fs] nfs: Simplify setting the layout header credential (Steve Dickson) [987090]
  - [fs] nfs: Enable state protection (Steve Dickson) [987090]
  - [fs] nfs: Use layout credentials for get_deviceinfo calls (Steve Dickson) [987090]
  - [fs] nfs: Ensure that test_stateid and free_stateid use correct credentials (Steve Dickson) [987090]
  - [fs] nfs: Ensure that reclaim_complete uses the right credential (Steve Dickson) [987090]
  - [fs] nfs: Ensure that layoutreturn uses the correct credential (Steve Dickson) [987090]
  - [fs] nfs: Ensure that layoutget is called using the layout credential (Steve Dickson) [987090]
  - [fs] nfs: Add NFSv4.2 protocol constants (Steve Dickson) [987090]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-7.el7]
changelog:
  - [vfio] type1: Fix leak on error path (Alex Williamson) [984081]
  - [vfio] Limit group opens (Alex Williamson) [984081]
  - [vfio] type1: Fix missed frees and zero sized removes (Alex Williamson) [984081]
  - [vfio] Provide module option to disable vfio_iommu_type1 hugepage support (Alex Williamson) [984081]
  - [vfio] hugepage support for vfio_iommu_type1 (Alex Williamson) [984081]
  - [vfio] Convert type1 iommu to use rbtree (Alex Williamson) [984081]
  - [iommu] Use pa and zx instead of casting (Alex Williamson) [984081]
  - [iommu] amd: Only unmap large pages from the first pte (Alex Williamson) [984081]
  - [iommu] Fix compiler warning on pr_debug (Alex Williamson) [984081]
  - [iommu] amd: Fix memory leak in free_pagetable (Alex Williamson) [984081]
  - [iommu] Split iommu_unmaps (Alex Williamson) [984081]
  - [iommu] intel, amd: Remove multifunction assumption around grouping (Alex Williamson) [984081]
  - [x86] spinlock: make ticket lock increment 2, unconditionally (Rik van Riel) [970737]
  - [virt] pvticketlock: When paravirtualizing ticket locks, increment by 2 (Rik van Riel) [970737]
  - [scsi] isci: Fix a race condition in the SSP task management path (David Milburn) [990201]
  - [netdrv] bnx2x: Wait for MCP validity during AER (Michal Schmidt) [797460]
  - [virt] virtio_scsi: Fix virtqueue affinity setup (Asias He) [971826]
  - [fs] nfs: fix open(O_RDONLY|O_TRUNC) in NFS4.0 (Jeff Layton) [987615]
  - [watchdog] hpwdt: Add check for UEFI bits (Linda Knippers) [985195]
  - [powerpc] mm/numa: VPHN topology change updates all siblings (Steve Best) [973594]
  - [powerpc] powernv: Fix iommu initialization again (Steve Best) [979523]
  - [firmware] efivars: If pstore_register fails, free unneeded pstore buffer (Lenny Szubowicz) [983597]
  - [acpi] Eliminate console msg if pstore.backend excludes ERST (Lenny Szubowicz) [983597]
  - [fs] pstore: Return unique error if backend registration excluded by kernel param (Lenny Szubowicz) [983597]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-8.el7]
changelog:
  - [net] ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size (Francesco Fusco) [994346] {CVE-2013-4163}
  - [net] ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data (Francesco Fusco) [988355] {CVE-2013-4162}
  - [kernel] sysctl: range checking in do_proc_dointvec_ms_jiffies_conv (Francesco Fusco) [972393]
  - [net] neigh: prevent overflowing params in /proc/sys/net/ipv4/neigh/ (Francesco Fusco) [972393]
  - [net] vhost-net: fix use-after-free in vhost_net_flush (Thomas Graf) [984723] {CVE-2013-4127}
  - [powerpc] tm: Fix return of active 64bit signals (Steve Best) [731886]
  - [powerpc] tm: Fix return of 32bit rt signals to active transactions (Steve Best) [731886]
  - [powerpc] tm: Fix restoration of MSR on 32bit signal return (Steve Best) [731886]
  - [powerpc] tm: Fix 32 bit non-rt signals (Steve Best) [731886]
  - [powerpc] tm: Fix writing top half of MSR on 32 bit signals (Steve Best) [731886]
  - [fs] nfs: verify open flags before allowing an atomic open (Jeff Layton) [984823]
  - [s390] zfcp: module parameter dbflevel for early debugging (Hendrik Brueckner) [994597]
  - [virt] virtio_net: fix the race between channels setting and refill (Jason Wang) [978153]
  - [kernel] audit: restore order of tty and ses fields in log output (Richard Guy Briggs) [983157]
  - [kernel] time/tick: Make oneshot broadcast robust vs. CPU offlining (Prarit Bhargava) [967464]
  - [virt] virtio_net: fix race in RX VQ processing (Jason Wang) [989409]
  - [virt] virtio: support unlocked queue poll (Jason Wang) [989409]
  - [powerpc] mm: Use the correct SLB(LLP) encoding in tlbie instruction (Steve Best) [993448]
  - [net] tuntap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS (Jason Wang) [982513]
  - [net] tuntap: correctly linearize skb when zerocopy is used (Jason Wang) [982513]
  - [virt] macvtap: do not zerocopy if iov needs more pages than MAX_SKB_FRAGS (Jason Wang) [990786]
  - [virt] macvtap: do not assume 802.1Q when send vlan packets (Jason Wang) [990786]
  - [virt] macvtap: fix the missing ret value of TUNSETQUEUE (Jason Wang) [990786]
  - [virt] macvtap: correctly linearize skb when zerocopy is used (Jason Wang) [982513]
  - [virt] macvtap: Perform GSO on forwarding path (Jason Wang) [895484]
  - [virt] macvtap: Let TUNSETOFFLOAD actually controll offload features (Jason Wang) [895484]
  - [virt] macvtap: Consistently use rcu functions (Jason Wang) [895484]
  - [virt] macvtap: Convert to using rtnl lock (Jason Wang) [895484]
  - [virt] macvtap: fix uninitialized return value macvtap_ioctl_set_queue() (Jason Wang) [731550]
  - [virt] macvtap: slient sparse warnings (Jason Wang) [731550]
  - [virt] macvtap: enable multiqueue flag (Jason Wang) [731550]
  - [virt] macvtap: add TUNSETQUEUE ioctl (Jason Wang) [731550]
  - [virt] macvtap: eliminate linear search (Jason Wang) [731550]
  - [virt] macvtap: introduce macvtap_get_vlan() (Jason Wang) [731550]
  - [virt] macvtap: do not add self to waitqueue if doing a nonblock read (Jason Wang) [731550]
  - [virt] macvtap: fix a possible race between queue selection and changing queues (Jason Wang) [731550]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-9.el7]
changelog:
  - [kernel] sched: disable autogroups by default (Josh Poimboeuf) [989741]
  - [powerpc] pseries: Add backward compatibilty to read old kernel oops-log (Steve Best) [991831]
  - [powerpc] pseries: Fix buffer overflow when reading from pstore (Steve Best) [991831]
  - [crypto] nx: saves chaining value from co-processor (Steve Best) [972656]
  - [crypto] nx: fix limits to sg lists for SHA-2 (Steve Best) [972656]
  - [crypto] nx: fix physical addresses added to sg lists (Steve Best) [972656]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-10.el7]
changelog:
  - [block] blk-mq: blk-mq should free bios in pass through case (Mike Snitzer) [960150]
  - [block] blk-mq: add missing percpu_counter_destroy for mq_usage_counter (Mike Snitzer) [960150]
  - [fs] direct-io: only inc_dec inode->i_dio_count for file systems (Mike Snitzer) [960150]
  - [lib] percpu_counter: make APIs irq safe (Mike Snitzer) [960150]
  - [block] null_blk: multi queue aware block test driver (Mike Snitzer) [960150]
  - [kernel] smp: Export __smp_call_function_single() (Mike Snitzer) [960150]
  - [block] blk-mq: change sw <-> hw queue mappings on hotplug events (Mike Snitzer) [960150]
  - [block] blk-mq: re-initialize queue data structure after CPU hotplug (Mike Snitzer) [960150]
  - [block] blk-mq: add queue freeze/unfreeze support (Mike Snitzer) [960150]
  - [block] blk-mq: fix timer infinite loop after first timeout event (Mike Snitzer) [960150]
  - [block] blk-mq: timeout fixes (Mike Snitzer) [960150]
  - [block] blk-mq: cpu hot plug_unplug fixes (Mike Snitzer) [960150]
  - [block] blk-mq: flush handling (Mike Snitzer) [960150]
  - [block] blk-mq: new multi-queue block IO queueing mechanism (Mike Snitzer) [960150]
  - [block] make rq->cmd_flags be 64-bit (Mike Snitzer) [960150]
  - [kernel] smp: don't warn about csd->flags having CSD_FLAG_LOCK cleared for !wait (Mike Snitzer) [960150]
  - [mm] sched: Allow uaccess in atomic with pagefault_disable() (Michael S. Tsirkin) [988029]
  - [mm] sched: Drop voluntary schedule from might_fault() (Michael S. Tsirkin) [988029]
  - [x86] uaccess s/might_sleep/might_fault/ (Michael S. Tsirkin) [988029]
  - [powerpc] uaccess s/might_sleep/might_fault/ (Michael S. Tsirkin) [988029]
  - [misc] asm-generic: uaccess s/might_sleep/might_fault/ (Michael S. Tsirkin) [988029]
  - [x86] efi: Disable secure boot if shim is in insecure mode (Lenny Szubowicz) [903815]
  - [kernel] modsign: Import certificates from UEFI Secure Boot (Lenny Szubowicz) [903815]
  - [kernel] keys: Add a system blacklist keyring (Lenny Szubowicz) [903815]
  - [crypto] asymmetric_keys: Add an EFI signature blob parser and key loader (Lenny Szubowicz) [903815]
  - [kernel] modsign: Fix including certificate twice when the signing_key.x509 already exists (Lenny Szubowicz) [903815]
  - [kernel] keys: Add a 'trusted' flag and a 'trusted only' flag (Lenny Szubowicz) [903815]
  - [kernel] modsign: Separate the kernel signature checking keyring from module signing (Lenny Szubowicz) [903815]
  - [kernel] modsign: Load *.x509 files into kernel keyring (Lenny Szubowicz) [903815]
  - [efi] Add EFI signature data types (Lenny Szubowicz) [903815]
  - [kernel] modsign: Always enforce module signing in a Secure Boot environment (Lenny Szubowicz) [903815]
  - [kernel] hibernate: Disable in a Secure Boot environment (Lenny Szubowicz) [903815]
  - [kernel] kexec: Disable in a secure boot environment (Lenny Szubowicz) [903815]
  - [x86] Lock down MSR writing in secure boot (Lenny Szubowicz) [903815]
  - [acpi] Ignore acpi_rsdp kernel parameter in a secure boot environment (Lenny Szubowicz) [903815]
  - [char] mem: Restrict /dev/mem and /dev/kmem in secure boot setups (Lenny Szubowicz) [903815]
  - [platform] asus-wmi: Restrict debugfs interface (Lenny Szubowicz) [903815]
  - [acpi] Limit access to custom_method (Lenny Szubowicz) [903815]
  - [x86] Lock down IO port access in secure boot environments (Lenny Szubowicz) [903815]
  - [pci] Lock down BAR access in secure boot environments (Lenny Szubowicz) [903815]
  - [x86] efi: Enable secure boot lockdown automatically when enabled in firmware (Lenny Szubowicz) [903815]
  - [kernel] Add a kernel parameter that will force on Secure Boot mode (Lenny Szubowicz) [903815]
  - [security] selinux: define mapping for new Secure Boot capability (Lenny Szubowicz) [903815]
  - [uapi] Add new secure boot capability (Lenny Szubowicz) [903815]
  - [kernel] audit: fix mq_open and mq_unlink to add the MQ root as a hidden parent audit_names record (Jeff Layton) [908885 953186]
  - [kernel] audit: log the audit_names record type (Jeff Layton) [908885 953186]
  - [kernel] audit: add child record before the create to handle case where create fails (Jeff Layton) [908885 953186]
  - [md] dm-raid: silence compiler warning on rebuilds_per_group (Jonathan E Brassow) [970782]
  - [md] dm-raid: Fix raid_resume not reviving failed devices in all cases (Jonathan E Brassow) [970782]
  - [md] dm-raid: Break-up untidy function (Jonathan E Brassow) [970782]
  - [s390] zfcp: block queue limits with data router (Hendrik Brueckner) [976657]
  - [scsi] scsi_lib: Fix race between starved list and device removal (Ewan Milne) [986037]
  - [md] dm-switch: add switch target (Mike Snitzer) [983188]
  - [wireless] disable WiMAX support (John Linville) [915650]
  - [fs] gfs2: don't overrun reserved revokes (Benjamin Marzinski) [950622]
  - [fs] gfs2: Reserve journal space for quota change in do_grow (Robert S Peterson) [979131]
  - [x86] setup: Add cpu_has_hypervisor check to rh_check_supported() (Prarit Bhargava) [986048]
  - [x86] sched: Optimize switch_mm() for multi-threaded workloads (Rik van Riel) [990747]
  - [crypto] nx: fix concurrency issue (Steve Best) [996565]
  - [powerpc] mm: Fix fallthrough bug in hpte_decode (Steve Best) [993326]
  - [misc] Kconfig: enable building user namespace with xfs (Dave Chinner) [987255]
  - [fs] xfs: add capability check to free eofblocks ioctl (Dave Chinner) [987255]
  - [fs] xfs: create internal eofblocks structure with kuid_t types (Dave Chinner) [987255]
  - [fs] xfs: convert kuid_t to/from uid_t for internal structures (Dave Chinner) [987255]
  - [fs] xfs: ioctl check for capabilities in the current user namespace (Dave Chinner) [987255]
  - [fs] xfs: convert kuid_t to/from uid_t in ACLs (Dave Chinner) [987255]
  - [fs] xfs: create wrappers for converting kuid_t to/from uid_t (Dave Chinner) [987255]
  - [md] raid5: fix interaction of 'replace' and 'recovery' (Jes Sorensen) [978055]
  - [md] raid10: remove use-after-free bug (Jes Sorensen) [978055]
  - [md] raid1: fix bio handling problems in process_checks() (Jes Sorensen) [978055]
  - [md] Remove recent change which allows devices to skip recovery (Jes Sorensen) [978055]
  - [md] raid10: fix two problems with RAID10 resync (Jes Sorensen) [978055]
  - [md] raid10: fix bug which causes all RAID10 reshapes to move no data (Jes Sorensen) [978055]
  - [md] raid5: allow 5-device RAID6 to be reshaped to 4-device (Jes Sorensen) [978055]
  - [md] raid10: fix two bugs affecting RAID10 reshape (Jes Sorensen) [978055]
  - [md] Remember the last sync operation that was performed (Jes Sorensen) [978055]
  - [md] raid0: fix buglet in RAID5 -> RAID0 conversion (Jes Sorensen) [978055]
  - [md] raid10: check In_sync flag in 'enough()' (Jes Sorensen) [978055]
  - [md] raid10: locking changes for 'enough()' (Jes Sorensen) [978055]
  - [md] replace strict_strto*() with kstrto*() (Jes Sorensen) [978055]
  - [md] Wait for md_check_recovery before attempting device removal (Jes Sorensen) [978055]
  - [md] dm-raid: Add ability to restore transiently failed devices on resume (Jes Sorensen) [978055]
  - [net] ipv6: resend MLD report if a link-local address completes DAD (Flavio Leitner) [889455]
  - [net] ipv6: introduce per-interface counter for dad-completed ipv6 addresses (Flavio Leitner) [889455]
  - [net] ipv6: split duplicate address detection and router solicitation timer (Flavio Leitner) [889455]
  - [net] tcp: introduce a per-route knob for quick ack (Amerigo Wang) [984504]
  - [net] nlmon: use standard rtnetlink link api for add/del devices (Daniel Borkmann) [957721]
  - [net] nlmon: fix comparison in nlmon_is_valid_mtu (Daniel Borkmann) [957721]
  - [net] packet: nlmon: virtual netlink monitoring device for packet sockets (Daniel Borkmann) [957721]
  - [net] netlink: virtual tap device management (Daniel Borkmann) [957721]
  - [net] if_arp: add ARPHRD_NETLINK type (Daniel Borkmann) [957721]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-12.el7]
changelog:
  - [acpi] memhotplug: Fix a stale pointer in error path (Lenny Szubowicz) [995322]
  - [powerpc] Add second POWER8 PVR entry (Steve Best) [995355]
  - [acpi] power: add missing newline to debug messages (Myron Stowe) [998633]
  - [tools] cpupower: Add Haswell family 0x45 specific idle monitor to show PC8, 9, 10 states (Myron Stowe) [998633]
  - [tools] cpupower: Haswell also supports the C-states introduced with SandyBridge (Myron Stowe) [998633]
  - [tools] cpupower: Introduce idle-set subcommand and C-state enabling/disabling (Myron Stowe) [998633]
  - [tools] cpupower: Implement disabling of cstate interface (Myron Stowe) [998633]
  - [tools] cpupower: Make idlestate usage unsigned (Myron Stowe) [998633]
  - [acpi] fan: Initialize acpi_state variable (Myron Stowe) [998633]
  - [acpi] scan: remove unused LIST_HEAD(acpi_device_list) (Myron Stowe) [998633]
  - [acpi] dock: Actually define acpi_dock_init() as void (Myron Stowe) [998633]
  - [acpi] pm: Fix corner case in acpi_bus_update_power() (Myron Stowe) [998633]
  - [cpufreq] Fix serialization of frequency transitions (Myron Stowe) [998633]
  - [cpufreq] Fix cpufreq regression after suspend/resume (Myron Stowe) [991615]
  - [acpi] pm: Fix possible NULL pointer deref in acpi_pm_device_sleep_state() (Myron Stowe) [991615]
  - [kernel] power: Warn about system time after resume with pm_trace (Myron Stowe) [991615]
  - [cpufreq] don't leave stale policy pointer in cdbs->cur_policy (Myron Stowe) [991615]
  - [cpufreq] acpi-cpufreq: Add new sysfs attribute freqdomain_cpus (Myron Stowe) [991615]
  - [cpufreq] make sure frequency transitions are serialized (Myron Stowe) [991615]
  - [acpi] implement acpi_os_get_timer() according the spec (Myron Stowe) [991615]
  - [acpi] ec: Add HP Folio 13 to ec_dmi_table in order to skip DSDT scan (Myron Stowe) [991615]
  - [acpi] Add CMOS RTC Operation Region handler support (Myron Stowe) [991615]
  - [acpi] processor: Drop unused variable from processor_perflib.c (Myron Stowe) [991615]
  - [cpufreq] powernow-k8: call CPUFREQ_POSTCHANGE notfier in error cases (Myron Stowe) [991615]
  - [cpufreq] pcc: call CPUFREQ_POSTCHANGE notfier in error cases (Myron Stowe) [991615]
  - [cpufreq] acpi-cpufreq: call CPUFREQ_POSTCHANGE notfier in error cases (Myron Stowe) [991615]
  - [Documentation] power: Add pm_qos and dev_pm_qos to events-power.txt (Myron Stowe) [991615]
  - [base] power/qos: Add dev_pm_qos_request tracepoints (Myron Stowe) [991615]
  - [kernel] power/qos: Add pm_qos_request tracepoints (Myron Stowe) [991615]
  - [kernel] power/qos: Add pm_qos_update_target/flags tracepoints (Myron Stowe) [991615]
  - [acpi] processor: Remove unused macros in processor_driver.c (Myron Stowe) [991615]
  - [Documentation] power: Update Documentation/power/pm_qos_interface.txt (Myron Stowe) [991615]
  - [Documentation] cpu-hotplug: Rephrase the outdated description for MADT entries (Myron Stowe) [991615]
  - [cpufreq] make __cpufreq_notify_transition() static (Myron Stowe) [991615]
  - [cpufreq] Fix minor formatting issues (Myron Stowe) [991615]
  - [cpufreq] Fix governor start/stop race condition (Myron Stowe) [991615]
  - [kernel] power: Print last wakeup source on failed wakeup_count write (Myron Stowe) [991615]
  - [kernel] power/qos: correct the valid range of pm_qos_class (Myron Stowe) [991615]
  - [Documentation] video: update video_extension.txt for backlight control (Myron Stowe) [991615]
  - [Documentation] video: move video_extension.txt to Documentation/acpi (Myron Stowe) [991615]
  - [Documentation] video: add description for brightness_switch_enabled (Myron Stowe) [991615]
  - [Documentation] Add ACPI namespace documentation (Myron Stowe) [991615]
  - [Documentation] Add sysfs ABI documentation (Myron Stowe) [991615]
  - [Documentation] MAINTAINERS: include Documentation/acpi (Myron Stowe) [991615]
  - [acpi] acpica: Update version to 20130517 (Myron Stowe) [991615]
  - [acpi] acpica: _CST repair, handle null package entries (Myron Stowe) [991615]
  - [acpi] acpica: Add several repairs for _CST predefined name (Myron Stowe) [991615]
  - [acpi] acpica: Move _PRT repair into the standard complex repair module (Myron Stowe) [991615]
  - [acpi] scan: Do not bind ACPI drivers to objects with scan handlers (Myron Stowe) [991615]
  - [acpi] pm: Rework and clean up acpi_dev_pm_get_state() (Myron Stowe) [991615]
  - [acpi] pm: Replace ACPI_STATE_D3 with ACPI_STATE_D3_COLD in device_pm.c (Myron Stowe) [991615]
  - [acpi] pm: Rename function acpi_device_power_state() and make it static (Myron Stowe) [991615]
  - [acpi] pm: acpi_processor_suspend() can be static (Myron Stowe) [991615]
  - [virt] xen/acpi: Register an acpi_suspend_lowlevel callback (Myron Stowe) [991615]
  - [x86] acpi/sleep: Provide registration for acpi_suspend_lowlevel (Myron Stowe) [991615]
  - [acpi] Remove unused flags in acpi_device_flags (Myron Stowe) [991615]
  - [acpi] Remove useless initializers (Myron Stowe) [991615]
  - [acpi] battery: Make sure all spaces are in correct places (Myron Stowe) [991615]
  - [acpi] add _STA evaluation at do_acpi_find_child() (Myron Stowe) [991615]
  - [acpi] ec: access user space with get_user()/put_user() (Myron Stowe) [991615]
  - [cpufreq] Simplify userspace governor (Myron Stowe) [991615]
  - [acpi] lpss: override SDIO private register space size from ACPI tables (Myron Stowe) [991615]
  - [acpi] lpss: mask the UART TX completion interrupt (Myron Stowe) [991615]
  - [acpi] lpss: add support for Intel BayTrail (Myron Stowe) [991615]
  - [acpi] Do not use CONFIG_ACPI_HOTPLUG_MEMORY_MODULE (Myron Stowe) [991615]
  - [cpufreq] x86: make X86_AMD_FREQ_SENSITIVITY select CPU_FREQ_TABLE (Myron Stowe) [991615]
  - [cpufreq] powerpc: make CBE_RAS select CPU_FREQ_TABLE (Myron Stowe) [991615]
  - [cpufreq] blackfin: enable driver for CONFIG_BFIN_CPU_FREQ (Myron Stowe) [991615]
  - [acpi] acpica: Clear events initialized flag upon event component termination (Myron Stowe) [991615]
  - [acpi] acpica: Fix possible memory leak in GPE init error path (Myron Stowe) [991615]
  - [acpi] acpica: on termination, delete global lock pending lock (Myron Stowe) [991615]
  - [acpi] acpica: Update interface to acpi_ut_valid_acpi_name() (Myron Stowe) [991615]
  - [acpi] acpica: Do not use extended sleep registers unless HW-reduced bit is set (Myron Stowe) [991615]
  - [acpi] acpica: Split table print utilities to a new a separate file (Myron Stowe) [991615]
  - [acpi] acpica: Add option to disable loading of SSDTs from the RSDT/XSDT (Myron Stowe) [991615]
  - [acpi] acpica: Standardize all switch() blocks (Myron Stowe) [991615]
  - [acpi] acpica: Split internal error msg routines to a separate file (Myron Stowe) [991615]
  - [acpi] acpica: Split buffer dump routines into separate file (Myron Stowe) [991615]
  - [acpi] scan: Simplify ACPI driver probing (Myron Stowe) [991615]
  - [base] power/wakeup: Adjust messaging for wake events during suspend (Myron Stowe) [991615]
  - [cpuidle] Fix ARCH_NEEDS_CPU_IDLE_COUPLED dependency warning (Myron Stowe) [991615]
  - [cpuidle] Comment the driver's framework code (Myron Stowe) [991615]
  - [cpuidle] simplify multiple driver support (Myron Stowe) [991615]
  - [cpufreq] powerpc: move cpufreq driver to drivers/cpufreq (Myron Stowe) [991615]
  - [cpufreq] acpi-cpufreq: Add ACPI processor device IDs to acpi-cpufreq (Myron Stowe) [991615]
  - [cpufreq] remove unnecessary cpufreq_cpu_{get,put}() calls (Myron Stowe) [991615]
  - [Documentation] MAINTAINERS: Add git tree path for ARM specific updates to cpufreq (Myron Stowe) [991615]
  - [cpufreq] rename index as driver_data in cpufreq_frequency_table (Myron Stowe) [991615]
  - [Documentation] power: Update .runtime_idle() callback documentation (Myron Stowe) [991615]
  - [kernel] power: Rework the "runtime idle" helper routine (Myron Stowe) [991615]
  - [kernel] power: print physical addresses consistently with other parts of kernel (Myron Stowe) [991615]
  - [cpuidle] improve governor Kconfig options (Myron Stowe) [991615]
  - [Documentation] MAINTAINERS: update mailing list for devfreq(DVFS) (Myron Stowe) [991615]
  - [devfreq] fix typo "CPU_EXYNOS4.12" twice (Myron Stowe) [991615]
  - [devfreq] add comments and Documentation (Myron Stowe) [991615]
  - [devfreq] account suspend/resume for stats (Myron Stowe) [991615]
  - [mm] memory_hotplug: Move alternative function definitions to header (Myron Stowe) [991615]
  - [acpi] processor: Fix potential NULL pointer dereference in acpi_processor_add() (Myron Stowe) [991615]
  - [acpi] acpica: Update version to 20130418 (Myron Stowe) [991615]
  - [acpi] acpica: Update for "orphan" embedded controller _REG method support (Myron Stowe) [991615]
  - [acpi] acpica: Remove unused macros, no functional change (Myron Stowe) [991615]
  - [acpi] acpica: Predefined name support, remove unused local variable (Myron Stowe) [991615]
  - [acpi] acpica: Add argument typechecking for all predefined ACPI names (Myron Stowe) [991615]
  - [acpi] acpica: Add BIOS error interface for predefined name validation support (Myron Stowe) [991615]
  - [acpi] acpica: Change an exception code for the ASL UnLoad() operator (Myron Stowe) [991615]
  - [acpi] memhotplug: Simplify memory removal (Myron Stowe) [991615]
  - [acpi] scan: Add second pass of companion offlining to hot-remove code (Myron Stowe) [991615]
  - [base] memory: Drop offline_memory_block() (Myron Stowe) [991615]
  - [acpi] processor: Pass processor object handle to acpi_bind_one() (Myron Stowe) [991615]
  - [acpi] Drop removal_type field from struct acpi_device (Myron Stowe) [991615]
  - [base] memory: Simplify __memory_block_change_state() (Myron Stowe) [991615]
  - [acpi] processor: Initialize per_cpu(processors, pr->id) properly (Myron Stowe) [991615]
  - [base] cpu: Fix sysfs cpu/online of offlined CPUs (Myron Stowe) [991615]
  - [cpufreq] Don't create empty /sys/devices/system/cpu/cpufreq directory (Myron Stowe) [991615]
  - [cpufreq] Move get_cpu_idle_time() to cpufreq.c (Myron Stowe) [991615]
  - [cpufreq] governors: Move get_governor_parent_kobj() to cpufreq.c (Myron Stowe) [991615]
  - [cpufreq] Add EXPORT_SYMBOL_GPL for have_governor_per_policy (Myron Stowe) [991615]
  - [pnp] restore automatic resolution of DMA conflicts (Myron Stowe) [991615]
  - [net] af_unix: use freezable blocking calls in read (Myron Stowe) [991615]
  - [kernel] sigtimedwait: use freezable blocking call (Myron Stowe) [991615]
  - [kernel] nanosleep: use freezable blocking call (Myron Stowe) [991615]
  - [kernel] futex: use freezable blocking call (Myron Stowe) [991615]
  - [fs] select: use freezable blocking call (Myron Stowe) [991615]
  - [fs] epoll: use freezable blocking call (Myron Stowe) [991615]
  - [kernel] freezer: add new freezable helpers using freezer_do_not_count() (Myron Stowe) [991615]
  - [kernel] freezer: convert freezable helpers to static inline where possible (Myron Stowe) [991615]
  - [kernel] freezer: convert freezable helpers to freezer_do_not_count() (Myron Stowe) [991615]
  - [kernel] freezer: skip waking up tasks with PF_FREEZER_SKIP set (Myron Stowe) [991615]
  - [kernel] power: shorten freezer sleep time using exponential backoff (Myron Stowe) [991615]
  - [kernel] lockdep: check that no locks held at freeze time (Myron Stowe) [991615]
  - [kernel] lockdep: remove task argument from debug_check_no_locks_held (Myron Stowe) [991615]
  - [fs] cifs: add unsafe versions of freezable helpers for CIFS (Myron Stowe) [991615]
  - [fs] nfs: add unsafe versions of freezable helpers for NFS (Myron Stowe) [991615]
  - [base] memory: Introduce offline/online callbacks for memory blocks (Myron Stowe) [991615]
  - [acpi] memhotplug: Bind removable memory blocks to ACPI device nodes (Myron Stowe) [991615]
  - [acpi] processor: Use common hotplug infrastructure (Myron Stowe) [991615]
  - [acpi] hotplug: Use device offline/online for graceful hot-removal (Myron Stowe) [991615]
  - [base] cpu: Use generic offline/online for CPU offline/online (Myron Stowe) [991615]
  - [base] core: Add offline/online device operations (Myron Stowe) [991615]
  - [scsi] bnx2i: Fix bug on some bnx2x devices that don't support iSCSI (Tomas Henzl) [957024]
  - [x86] tracing: Add irq_enter/exit() in smp_trace_reschedule_interrupt() (Seiji Aguchi) [741673]
  - [x86] trace: Add config option checking to the definitions of mce handlers (Seiji Aguchi) [741673]
  - [x86] trace: Do not call local_irq_save() in load_current_idt() (Seiji Aguchi) [741673]
  - [x86] trace: Move creation of irq tracepoints from apic.c to irq.c (Seiji Aguchi) [741673]
  - [x86] trace: Add irq vector tracepoints (Seiji Aguchi) [741673]
  - [x86] trace: Rename variables for debugging (Seiji Aguchi) [741673]
  - [x86] trace: Introduce entering/exiting_irq() (Seiji Aguchi) [741673]
  - [tracing] Add DEFINE_EVENT_FN() macro (Seiji Aguchi) [741673]
  - [fs] pstore: Fail to unlink if a driver has not defined pstore_erase (Steve Best) [996930]
  - [powerpc] pseries: Inform the hypervisor we are using EBB regs (Steve Best) [997646]
  - [powerpc] perf: Export PERF_EVENT_CONFIG_EBB_SHIFT to userspace (Steve Best) [997646]
  - [powerpc] perf: Set PPC_FEATURE2_EBB when we register the power8 PMU (Steve Best) [997646]
  - [powerpc] Fix hypervisor facility unavaliable vector number (Steve Best) [995354]
  - [powerpc] Fix context switch DSCR on POWER8 (Steve Best) [995354]
  - [powerpc] Rework setting up H/FSCR bit definitions (Steve Best) [995354]
  - [powerpc] Wire up the HV facility unavailable exception (Steve Best) [995354]
  - [powerpc] Rename and flesh out the facility unavailable exception handler (Steve Best) [995354]
  - [powerpc] Remove KVMTEST from RELON exception handlers (Steve Best) [995354]
  - [powerpc] tm: Fix context switching TAR, PPR and DSCR SPRs (Steve Best) [988340]
  - [powerpc] Save the TAR register earlier (Steve Best) [988340]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-13.el7]
changelog:
  - [powerpc] pseries: Drop "select HOTPLUG" (Myron Stowe) [999178]
  - [misc] Finally eradicate CONFIG_HOTPLUG (Myron Stowe) [999178]
  - [vfio] vfio-pci: Avoid deadlock on remove (Alex Williamson) [912293]
  - [vfio] Ignore sprurious notifies (Alex Williamson) [912293]
  - [vfio] Don't overreact to DEL_DEVICE (Alex Williamson) [912293]
  - [s390] qeth: Fix crash on initial MTU size change (Hendrik Brueckner) [997607]
  - [s390] qeth: change default standard blkt settings for OSA (Hendrik Brueckner) [997635]
  - [s390] dasd: fix hanging devices after path events (Hendrik Brueckner) [996178]
  - [s390] zcrypt: Alias for new zcrypt device driver base module (Hendrik Brueckner) [996731]
  - [s390] zfcp: status read buffers on first adapter open with link down (Hendrik Brueckner) [976636]
  - [s390] zfcp: fix adapter (re)open recovery while link to SAN is down (Hendrik Brueckner) [889079]
  - [netdrv] be2net: Fix to avoid hardware workaround when not needed (Ivan Vecera) [982900]
  - [fs] gfs2: Take glock reference in examine_bucket() (Steven Whitehouse) [999897]
  - [fs] gfs2: Check for glock already held in gfs2_getxattr (Steven Whitehouse) [997604]
  - [crypto] nx: fix nx-aes-gcm verification (Steve Best) [997057]
  - [s390] zfcp: remove access control tables interface (Hendrik Brueckner) [994519]
  - [s390] zfcp: cfdc fops add owner (Hendrik Brueckner) [994519]
  - [scsi] fcoe: cleanup return codes from fcoe_rcv (Neil Horman) [984876]
  - [scsi] fcoe: make sure fcoe frames are unshared prior to manipulating them (Neil Horman) [984876]
  - [scsi] fcoe: ensure that skb placed on the fip_recv_list are unshared (Neil Horman) [984876]
  - [mm] zswap: add documentation (Steve Best) [731499]
  - [mm] zswap: add to mm (Steve Best) [731499]
  - [mm] zbud: add to mm (Steve Best) [731499]
  - [misc] MAINTAINERS: add zswap and zbud maintainer (Steve Best) [731499]
  - [fs] debugfs: add get/set for atomic types (Steve Best) [731499]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-14.el7]
changelog:
  - [net] openvswitch: optimize flow compare and mask functions (Thomas Graf) [1002051]
  - [net] openvswitch: Rename key_len to key_end (Thomas Graf) [1002051]
  - [net] openvswitch: Add SCTP support (Thomas Graf) [1002051]
  - [net] ipv6: Add NEXTHDR_SCTP to ipv6.h (Thomas Graf) [1002051]
  - [net] sctp: Refactor SCTP skb checksum computation (Thomas Graf) [1002051]
  - [net] sctp: prevent checksum.h from double inclusion (Thomas Graf) [1002051]
  - [net] openvswitch: Mega flow implementation (Thomas Graf) [1002051]
  - [net] openvswitch: Fix argument descriptions in vport.c (Thomas Graf) [1002051]
  - [net] openvswitch: link upper device for port devices (Thomas Graf) [1002051]
  - [net] openvswitch: Use non rcu hlist_del() flow table entry (Thomas Graf) [1002051]
  - [net] openvswitch: Use RCU lock for dp dump operation (Thomas Graf) [1002051]
  - [net] openvswitch: Use RCU lock for flow dump operation (Thomas Graf) [1002051]
  - [net] ipv6: prevent race between address creation and removal (Jiri Benc) [991392]
  - [net] ipv6: move peer_addr init into ipv6_add_addr() (Jiri Benc) [991392]
  - [net] ipv6: use ipv6_addr_scope() helper (Jiri Benc) [991392]
  - [net] ipv6: add support of peer address (Jiri Benc) [991392]
  - [net] rtm_to_ifaddr: free ifa if ifa_cacheinfo processing fails (Daniel Borkmann) [992908]
  - [net] net_sched: restore "linklayer atm" handling (Jesper Brouer) [998588]
  - [net] net_sched: psched_ratecfg_precompute() improvements (Jesper Brouer) [998588]
  - [net] ip_tunnel: Do not use inner ip-header-id for tunnel ip-header-id (Amerigo Wang) [989522]
  - [net] openvswitch: Add vxlan tunneling support (Amerigo Wang) [989522]
  - [net] vxlan: Add tx-vlan offload support (Amerigo Wang) [989522]
  - [net] vxlan: Improve vxlan headroom calculation (Amerigo Wang) [989522]
  - [net] vxlan: Factor out vxlan send api (Amerigo Wang) [989522]
  - [net] vxlan: Extend vxlan handlers for openvswitch (Amerigo Wang) [989522]
  - [net] vxlan: Add vxlan recv demux (Amerigo Wang) [989522]
  - [net] vxlan: Restructure vxlan receive (Amerigo Wang) [989522]
  - [net] vxlan: Restructure vxlan socket apis (Amerigo Wang) [989522]
  - [net] openvswitch: Reset tunnel key between input and output (Amerigo Wang) [989522]
  - [net] openvswitch: Use correct type while allocating flex array (Amerigo Wang) [989522]
  - [net] openvswitch: Fix bad merge resolution (Amerigo Wang) [989522]
  - [net] rtnetlink: Fix inverted check in ndo_dflt_fdb_del() (Amerigo Wang) [989522]
  - [net] rtnetlink: allow using zero MAC address in rtnl_fdb_{add, del} (Amerigo Wang) [989522]
  - [net] vxlan: fix a soft lockup in vxlan module removal (Amerigo Wang) [989522]
  - [net] vxlan: fix a regression of igmp join (Amerigo Wang) [989522]
  - [net] vxlan: fix rcu related warning (Amerigo Wang) [989522]
  - [net] vxlan: fdb: replace an existing entry (Amerigo Wang) [989522]
  - [net] vxlan: fix igmp races (Amerigo Wang) [989522]
  - [net] vxlan: unregister on namespace exit (Amerigo Wang) [989522]
  - [net] vxlan: add necessary locking on device removal (Amerigo Wang) [989522]
  - [net] vxlan: Fix kernel crash on rmmod (Amerigo Wang) [989522]
  - [net] vxlan: fix function name spelling (Amerigo Wang) [989522]
  - [net] vxlan: fdb: allow specifying multiple destinations for zero MAC (Amerigo Wang) [989522]
  - [net] vxlan: allow removal of single destination from fdb entry (Amerigo Wang) [989522]
  - [net] vxlan: introduce vxlan_fdb_parse (Amerigo Wang) [989522]
  - [net] vxlan: introduce vxlan_fdb_find_rdst (Amerigo Wang) [989522]
  - [net] vxlan: add implicit fdb entry for default destination (Amerigo Wang) [989522]
  - [net] vxlan: Fix sparse warnings (Amerigo Wang) [989522]
  - [net] vxlan: cosmetic cleanup's (Amerigo Wang) [989522]
  - [net] vxlan: Use initializer for dummy structures (Amerigo Wang) [989522]
  - [net] vxlan: port module param should be ushort (Amerigo Wang) [989522]
  - [net] vxlan: convert remotes list to list_rcu (Amerigo Wang) [989522]
  - [net] vxlan: make vxlan_xmit_one void (Amerigo Wang) [989522]
  - [net] vxlan: move cleanup to uninit (Amerigo Wang) [989522]
  - [net] vxlan: fix race caused by dropping rtnl_unlock (Amerigo Wang) [989522]
  - [net] vxlan: send notification when MAC migrates (Amerigo Wang) [989522]
  - [net] vxlan: move IGMP join/leave to work queue (Amerigo Wang) [989522]
  - [net] vxlan: fix crash from work pending on module removal (Amerigo Wang) [989522]
  - [net] vxlan: fix out of order operation on module removal (Amerigo Wang) [989522]
  - [net] vxlan: defer vxlan init as late as possible (Amerigo Wang) [989522]
  - [net] vxlan: use unsigned int instead of unsigned (Amerigo Wang) [989522]
  - [net] vxlan: remove the unused rcu head from struct vxlan_rdst (Amerigo Wang) [989522]
  - [net] vxlan: listen on multiple ports (Amerigo Wang) [989522]
  - [rhel] Kconfig: enable CONFIG_OPENVSWITCH_GRE (Amerigo Wang) [992917]
  - [net] ip_tunnel: embed hash list head (Amerigo Wang) [992917]
  - [net] sit: fix tunnel update via netlink (Amerigo Wang) [992917]
  - [net] ipv6: only apply anti-spoofing checks to not-pointopoint tunnels (Amerigo Wang) [992917]
  - [net] gre: Fix MTU sizing check for gretap tunnels (Amerigo Wang) [992917]
  - [net] ip_tunnels: Use skb-len to PMTU check (Amerigo Wang) [992917]
  - [net] gso: Update tunnel segmentation to support Tx checksum offload (Amerigo Wang) [992917]
  - [net] gre: move GSO functions to gre_offload (Amerigo Wang) [992917]
  - [net] gre: fix a regression in ioctl (Amerigo Wang) [992917]
  - [net] sit: add support of x-netns (Amerigo Wang) [992917]
  - [net] dev: introduce skb_scrub_packet() (Amerigo Wang) [992917]
  - [net] dev: remove duplicate 'skb->dev = dev' in dev_forward_skb() (Amerigo Wang) [992917]
  - [net] sit: fix an oops when IFLA_IPTUN_PROTO is not set (Amerigo Wang) [992917]
  - [net] sit: fix 4in4 + IPsec scenario (Amerigo Wang) [992917]
  - [net] openvswitch: Add Kconfig dependency on GRE-DEMUX (Amerigo Wang) [992917]
  - [net] ip_tunnel: Protect tunnel functions with CONFIG_INET guard (Amerigo Wang) [992917]
  - [net] openvswitch: Use correct config guard (Amerigo Wang) [992917]
  - [net] openvswitch: Add gre tunnel support (Amerigo Wang) [992917]
  - [net] openvswitch: Optimize flow key match for non tunnel flows (Amerigo Wang) [992917]
  - [net] openvswitch: Expand action buffer size (Amerigo Wang) [992917]
  - [net] openvswitch: Add tunneling interface (Amerigo Wang) [992917]
  - [net] openvswitch: Copy individual actions (Amerigo Wang) [992917]
  - [net] ip_tunnel: Add dont fragment flag (Amerigo Wang) [992917]
  - [net] ip_tunnel: push generic protocol handling to ip_tunnel module (Amerigo Wang) [992917]
  - [net] ip_tunnel: extend iptunnel_xmit() (Amerigo Wang) [992917]
  - [net] gre: export gre_handle_offloads() function (Amerigo Wang) [992917]
  - [net] gre: export gre_build_header() function (Amerigo Wang) [992917]
  - [net] gre: Allow multiple protocol listener for gre protocol (Amerigo Wang) [992917]
  - [net] gre: Simplify gre protocol registration locking (Amerigo Wang) [992917]
  - [net] openvswitch: make skb->csum consistent with rest of networking stack (Amerigo Wang) [992917]
  - [net] openvswitch: Simplify interface ovs_flow_metadata_from_nlattrs() (Amerigo Wang) [992917]
  - [net] openvswitch: Fix misspellings in comments and docs (Amerigo Wang) [992917]
  - [net] openvswitch: Unify vport error stats handling (Amerigo Wang) [992917]
  - [net] openvswitch: fix variable names in comment (Amerigo Wang) [992917]
  - [net] openvswitch: Immediately exit on error in ovs_vport_cmd_set() (Amerigo Wang) [992917]
  - [net] openvswitch: Remove unused get_config vport op (Amerigo Wang) [992917]
  - [net] iptunnel: specify protocol outside IP header (Amerigo Wang) [992917]
  - [net] sit: add IPv4 over IPv4 support (Amerigo Wang) [992917]
  - [net] export physical port id via sysfs (Jiri Pirko) [991026]
  - [net] rtnl: export physical port id via RT netlink (Jiri Pirko) [991026]
  - [net] add ndo to get id of physical port of the device (Jiri Pirko) [991026]
  - [net] busy_poll: revert unsupported bits from creation of BUSY_POLL socket option (Neil Horman) [958330]
  - [net] busy_poll: rename busy poll socket op and globals (Neil Horman) [958330]
  - [net] busy_poll: rename ll methods to busy-poll (Neil Horman) [958330]
  - [net] busy_poll: rename include/net/ll_poll.h to include/net/busy_poll.h (Neil Horman) [958330]
  - [net] busy_poll: change busy poll time accounting (Neil Horman) [958330]
  - [net] busy_poll: rename low latency sockets functions to busy poll (Neil Horman) [958330]
  - [net] busy_poll: lls fix build with allnoconfig (Neil Horman) [958330]
  - [net] busy_poll: convert lls to use time_in_range() (Neil Horman) [958330]
  - [net] busy_poll: avoid calling sched_clock when LLS is off (Neil Horman) [958330]
  - [net] busy_poll: fix LLS debug_smp_processor_id() warning (Neil Horman) [958330]
  - [net] busy_poll: poll/select low latency socket support (Neil Horman) [958330]
  - [net] busy_poll: add socket option for low latency polling (Neil Horman) [958330]
  - [net] busy_poll: remove NET_LL_RX_POLL config menu (Neil Horman) [958330]
  - [net] busy_poll: convert low latency sockets to sched_clock() (Neil Horman) [958330]
  - [net] busy_poll: change sysctl_net_ll_poll into an unsigned int (Neil Horman) [958330]
  - [netdrv] ixgbe: add extra stats for ndo_ll_poll (Neil Horman) [958330]
  - [netdrv] ixgbe: add support for ndo_ll_poll (Neil Horman) [958330]
  - [net] tcp: add low latency socket poll support (Neil Horman) [958330]
  - [net] udp: add low latency socket poll support (Neil Horman) [958330]
  - [net] busy_poll: add low latency socket poll (Neil Horman) [958330]
  - [net] add napi_id and hash (Neil Horman) [958330]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-15.el7]
changelog:
  - [drm] qxl: backport updates from v3.11-rc1 (Dave Airlie) [979176]
  - [drm] add hotspot support for cursors (Dave Airlie) [983312]
  - [virt] x86: Correctly detect hypervisor (Jason Wang) [985743]
  - [virt] kvm: Switch to use hypervisor_cpuid_base() (Jason Wang) [985743]
  - [virt] xen: Switch to use hypervisor_cpuid_base() (Jason Wang) [985743]
  - [virt] x86: Introduce hypervisor_cpuid_base() (Jason Wang) [985743]
  - [net] sunrpc: prepare NFS for 2038 (Harshula Jayasuriya) [847926]
  - [netdrv] macvtap: Ignore tap features when VNET_HDR is off (Vlad Yasevich) [1001053]
  - [netdrv] macvtap: Correctly set tap features when IFF_VNET_HDR is disabled (Vlad Yasevich) [1001053]
  - [netdrv] macvtap: simplify usage of tap_features (Vlad Yasevich) [1001053]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-16.el7]
changelog:
  - [powerpc] Avoid link stack corruption for MMU on exceptions (Steve Best) [999556]
  - [virt] net/hyperv: Fix the NETIF_F_SG flag setting in netvsc (Jason Wang) [984810]
  - [pci] Retry allocation of only the resource type that failed (Myron Stowe) [1001217]
  - [pci] pciehp: Convert pciehp to be builtin only, not modular (Myron Stowe) [1001217]
  - [pci] hotplug: Convert to be builtin only, not modular (Myron Stowe) [1001217]
  - [pci] pciehp: Fix null pointer deref when hot-removing SR-IOV device (Myron Stowe) [1001217]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-17.el7]
changelog:
  - [fs] lockd: Don't call utsname()->nodename from nlmclnt_setlockargs (Jan Stancek) [999289]
  - [scsi] ipr: Add sereral new CCIN definitions for new adapters support (Steve Best) [1002200]
  - [virt] x86/xen: Sync the CMOS RTC as well as the Xen wallclock (Radim Krcmar) [1003683]
  - [virt] x86/xen: Sync the wallclock when the system time is set (Radim Krcmar) [1003683]
  - [virt] x86: Increase precision of x86_platform.get/set_wallclock() (Radim Krcmar) [1003683]
  - [powerpc] Don't Oops when accessing /proc/powerpc/lparcfg without hypervisor (Steve Best) [1002206]
  - [virt] xen/smp: initialize IPI vectors before marking CPU online (Radim Krcmar) [1003683]
  - [virt] xen/events: mask events when changing their VCPU binding (Radim Krcmar) [1003683]
  - [virt] xen/events: initialize local per-cpu mask for all possible events (Radim Krcmar) [1003683]
  - [virt] x86/xen: do not identity map UNUSABLE regions in the machine E820 (Radim Krcmar) [1003683]
  - [virt] xen/evtchn: avoid a deadlock when unbinding an event channel (Radim Krcmar) [1003683]
  - [virt] xenbus: frontend resume cleanup (Radim Krcmar) [1003683]
  - [virt] xen-netfront: pull on receive skb may need to happen earlier (Radim Krcmar) [1003683]
  - [virt] xen: Use more current logging styles (Radim Krcmar) [1003683]
  - [virt] xen/time: remove blocked time accounting from xen "clockchip" (Radim Krcmar) [1003683]
  - [virt] xen: Convert printks to pr_<level> (Radim Krcmar) [1003683]
  - [virt] xen: ifdef CONFIG_HIBERNATE_CALLBACKS xen_*_suspend (Radim Krcmar) [1003683]
  - [virt] xen-blkfront: set blk_queue_max_hw_sectors correctly (Radim Krcmar) [1003683]
  - [virt] xen/io: new macro to detect whether there are too many requests on the ring (Radim Krcmar) [1003683]
  - [virt] xen-netfront: use skb_partial_csum_set() to simplify the codes (Radim Krcmar) [1003683]
  - [virt] xen/time: Free onlined per-cpu data structure if we want to online it again (Radim Krcmar) [1003683]
  - [virt] xen/time: Check that the per_cpu data structure has data before freeing (Radim Krcmar) [1003683]
  - [virt] xen/time: Don't leak interrupt name when offlining (Radim Krcmar) [1003683]
  - [virt] xen/time: Encapsulate the struct clock_event_device in another structure (Radim Krcmar) [1003683]
  - [virt] xen/spinlock: Don't leak interrupt name when offlining (Radim Krcmar) [1003683]
  - [virt] xen/smp: Don't leak interrupt name when offlining (Radim Krcmar) [1003683]
  - [virt] xen/smp: Set the per-cpu IRQ number to a valid default (Radim Krcmar) [1003683]
  - [virt] xen/smp: Introduce a common structure to contain the IRQ name and interrupt line (Radim Krcmar) [1003683]
  - [virt] xen/smp: Coalesce the free_irq calls in one function (Radim Krcmar) [1003683]
  - [virt] xen-blkback: Use physical sector size for setup (Radim Krcmar) [1003683]
  - [virt] xen-blkfront: Introduce a 'max' module parameter to alter the amount of indirect segments (Radim Krcmar) [1003683]
  - [virt] xen/netif: document feature-split-event-channels (Radim Krcmar) [1003683]
  - [virt] xen-netfront: split event channels support for Xen frontend driver (Radim Krcmar) [1003683]
  - [virt] xen-netfront: avoid leaking resources when setup_netfront fails (Radim Krcmar) [1003683]
  - [virt] xen-blkfront: use a different scatterlist for each request (Radim Krcmar) [1003683]
  - [virt] xen-block: implement indirect descriptors (Radim Krcmar) [1003683]
  - [acpi] Try harder to resolve _ADR collisions for bridges (Myron Stowe) [1003183]
  - [cpufreq] rename ignore_nice as ignore_nice_load (Myron Stowe) [1003183]
  - [acpi] processor: move try_offline_node() after acpi_unmap_lsapic() (Myron Stowe) [1003183]
  - [acpi] Drop physical_node_id_bitmap from struct acpi_device (Myron Stowe) [1003183]
  - [acpi] pm: Walk physical_node_list under physical_node_lock (Myron Stowe) [1003183]
  - [acpi] video: improve quirk check in acpi_video_bqc_quirk() (Myron Stowe) [1003183]
  - [kernel] freezer: set PF_SUSPEND_TASK flag on tasks that call freeze_processes (Myron Stowe) [1003183]
  - [acpi] battery: Fix parsing _BIX return value (Myron Stowe) [1003183]
  - [cpufreq] Fix cpufreq driver module refcount balance after suspend/resume (Myron Stowe) [1003183]
  - [cpufreq] intel_pstate: Change to scale off of max P-state (Myron Stowe) [1003183]
  - [acpi] video: ignore BIOS initial backlight value for Fujitsu E753 (Myron Stowe) [1003183]
  - [pnp] acpi: avoid garbage in resource name (Myron Stowe) [1003183]
  - [power] sleep: Fix comment typo in pm_wakeup.h (Myron Stowe) [1003183]
  - [power] sleep: avoid 'autosleep' in shutdown progress (Myron Stowe) [1003183]
  - [acpi] scan: Always call acpi_bus_scan() for bus check notifications (Myron Stowe) [1003183]
  - [acpi] scan: Do not try to attach scan handlers to devices having them (Myron Stowe) [1003183]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-18.el7]
changelog:
  - [net] ipv4: make snmp_mib_free static inline (Amerigo Wang) [970585]
  - [net] vxlan: include net/ip6_checksum.h for csum_ipv6_magic() (Amerigo Wang) [970585]
  - [net] vxlan: fix flowi6_proto value (Amerigo Wang) [970585]
  - [net] udp: unify skb_udp_tunnel_segment() and skb_udp6_tunnel_segment() (Amerigo Wang) [970585]
  - [net] ipv6: Add generic UDP Tunnel segmentation (Amerigo Wang) [970585]
  - [net] vxlan: add ipv6 proxy support (Amerigo Wang) [970585]
  - [net] ipv6: move in6_dev_finish_destroy() into core kernel (Amerigo Wang) [970585]
  - [net] ipv6: add include file to suppress sparse warnings (Amerigo Wang) [970585]
  - [net] vxlan: add ipv6 route short circuit support (Amerigo Wang) [970585]
  - [net] vxlan: add ipv6 support (Amerigo Wang) [970585]
  - [net] ipv6: do not call ndisc_send_rs() with write lock (Amerigo Wang) [970585]
  - [net] ipv6: export in6addr_loopback to modules (Amerigo Wang) [970585]
  - [net] ipv6: export a stub for IPv6 symbols used by vxlan (Amerigo Wang) [970585]
  - [net] ipv6: Remove extern function prototypes (Amerigo Wang) [970585]
  - [net] ipv6: always hold idev->lock before mca_lock (Amerigo Wang) [970585]
  - [net] ipv6: move ip6_local_out into core kernel (Amerigo Wang) [970585]
  - [net] ipv6: move ip6_dst_hoplimit() into core kernel (Amerigo Wang) [970585]
  - [net] udp: move GSO functions to udp_offload (Amerigo Wang) [970585]
  - [net] tcp: move GRO/GSO functions to tcp_offload (Amerigo Wang) [970585]
  - [net] tcp: use tcp_skb_mss helper in tcp_tso_segment (Amerigo Wang) [970585]
  - [scsi] csgb4i: convert skb->transport_header into skb_transport_header(skb) (Amerigo Wang) [970585]
  - [net] pass correct parameter to skb_headers_offset_update() (Amerigo Wang) [970585]
  - [netdrv] cxgb3: Correct comparisons and calculations using skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [net] clean up skb headers code (Amerigo Wang) [970585]
  - [net] Fix build warnings after mac_header and transport_header became __u16 (Amerigo Wang) [970585]
  - [net] netfilter: Correct calculation using skb->tail and skb-network_header (Amerigo Wang) [970585]
  - [net] Correct assignment of skb->network_header to skb->tail (Amerigo Wang) [970585]
  - [net] sctp: Correct access to skb->{network, transport}_header (Amerigo Wang) [970585]
  - [net] ipv4: Correct comparisons and calculations using skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [net] ipv6: Correct comparisons and calculations using skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [net] Correct comparisons and calculations using skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [netdrv] cxgb3: Correct comparisons and calculations using skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [netdrv] isdn: Correct comparison of skb->tail and skb-transport_header (Amerigo Wang) [970585]
  - [net] Copy inner_protocol in copy_skb_header() (Amerigo Wang) [970585]
  - [net] mpls: Add limited GSO support (Amerigo Wang) [970585]
  - [net] Use 16bits for *_headers fields of struct skbuff (Amerigo Wang) [970585]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-19.el7]
changelog:
  - [crypto] nx: fix SHA-2 for chunks bigger than block size (Steve Best) [999606]
  - [crypto] nx: fix GCM for zero length messages (Steve Best) [999606]
  - [crypto] nx: fix XCBC for zero length messages (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-CCM (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-XCBC (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-GCM (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-CTR (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-CBC (Steve Best) [999606]
  - [crypto] nx: fix limits to sg lists for AES-ECB (Steve Best) [999606]
  - [crypto] nx: add offset to nx_build_sg_lists() (Steve Best) [999606]
  - [virt] virtio_console: prevent use-after-free of port name in port unplug (Amit Shah) [990419]
  - [virt] virtio_console: fix locking around send_sigio_to_port() (Amit Shah) [986968]
  - [virt] virtio_console: add locking in port unplug path (Amit Shah) [990419]
  - [virt] virtio_console: add locks around buffer removal in port unplug path (Amit Shah) [990419]
  - [virt] virtio_console: return -ENODEV on all read operations after unplug (Amit Shah) [975716]
  - [virt] virtio_console: fix raising SIGIO after port unplug (Amit Shah) [986968]
  - [virt] virtio_console: clean up port data immediately at time of unplug (Amit Shah) [990419]
  - [virt] virtio_console: fix race in port_fops_open() and port unplug (Amit Shah) [990419]
  - [virt] virtio_console: fix race with port unplug and open/close (Amit Shah) [990419]
  - [virt] virtio_console: Add pipe_lock/unlock for splice_write (Amit Shah) [987722]
  - [virt] virtio_console: Quit from splice_write if pipe->nrbufs is 0 (Amit Shah) [987722]
  - [scsi] Generate uevents on certain unit attention codes (Ewan Milne) [740795]
  - [virt] kvm: update masterclock when kvmclock_offset is calculated (Marcelo Tosatti) [978425]
  - [acpi] pci_root: Fix _OSC ordering to allow PCIe hotplug use when available (Neil Horman) [990078]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-20.el7]
changelog:
  - [fs] gfs2: dirty inode correctly in gfs2_write_end (Benjamin Marzinski) [1004054]
  - [netdrv] bnx2x: Convert dma_alloc_coherent(...__GFP_ZERO) to dma_zalloc_coherent (Michal Schmidt) [819849]
  - [netdrv] bnx2x: clean up unnecessary MSI/MSI-X capability find (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Revising locking scheme for MAC configuration (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix VF stats sync (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix VF memory leak unload (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix functionality of configuring vlan list (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix move FP memory deallocations (Michal Schmidt) [819849]
  - [netdrv] bnx2x: vf mark stats started (Michal Schmidt) [819849]
  - [netdrv] bnx2x: set VF DMAE when first function has 0 supported VFs (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Protect against VFs' ndos when SR-IOV is disabled (Michal Schmidt) [819849]
  - [netdrv] bnx2x: prevent VF benign attentions (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Consider DCBX remote error (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Change DCB context handling (Michal Schmidt) [819849]
  - [netdrv] bnx2x: dropless flow control not always functional (Michal Schmidt) [819849]
  - [netdrv] bnx2x: prevent crash in shutdown flow with CNIC (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fix PTE write access error (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fix memory leak in VF (Michal Schmidt) [819849]
  - [netdrv] bnx2x: update fairness parameters following DCB negotiation (Michal Schmidt) [819849]
  - [netdrv] bnx2x: protect different statistics flows (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fix tunneling CSUM calculation (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fill in sane dump flag information (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fix dump flag handling (Michal Schmidt) [819849]
  - [netdrv] bnx2x: remove zeroing of dump data buffer (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Remove sparse and coccinelle warnings (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix compilation with no IOV support (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Fix 20G KR2 support claims (Michal Schmidt) [819849]
  - [netdrv] bnx2x: improve VF timings (Michal Schmidt) [819849]
  - [netdrv] bnx2x: VF ndo sanity (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Improve PF behaviour toward VF (Michal Schmidt) [819849]
  - [netdrv] bnx2x: remove redundant D0 power state set (Michal Schmidt) [819849]
  - [netdrv] bnx2x: replace mechanism to check for next available packet (Michal Schmidt) [819849]
  - [netdrv] bnx2x: add support for busy-poll (Michal Schmidt) [819849]
  - [netdrv] bnx2x: fix a power state test (Michal Schmidt) [819849]
  - [netdrv] bnx2x: semi-Semantic changes (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Revise prints (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Semantic removal and beautification (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Revise comments and alignment (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Semantic change of empty lines (Michal Schmidt) [819849]
  - [netdrv] bnx2x: use XPS if possible for bnx2x_select_queue instead of pure hash (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Change to D3hot only on removal (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Implement PCI shutdown (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Count number of possible FCoE interfaces (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Ack unknown VF messages (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Add and correct PCI link speed prints (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Zero VFs starting MACs (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Enable `set_phys_id' for all functions (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Link-flap avoidance in switch dependent mode (Michal Schmidt) [819849]
  - [netdrv] bnx2x: Add Private Flags Support (Michal Schmidt) [819849]
  - [netdrv] bnx2x: dont reload on GRO change (Michal Schmidt) [819849]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-21.el7]
changelog:
  - [net] net_sched: fix a typo in htb_change_class() (Jesper Brouer) [998588]
  - [net] tcp_probe: adapt tbuf size for recent changes (Daniel Borkmann) [1000470]
  - [net] tcp_probe: allow more advanced ingress filtering by mark (Daniel Borkmann) [1000470]
  - [net] tcp_probe: add IPv6 support (Daniel Borkmann) [1000470]
  - [net] tcp_probe: kprobes: adapt jtcp_rcv_established signature (Daniel Borkmann) [1000470]
  - [net] tcp_probe: also include rcv_wnd next to snd_wnd (Daniel Borkmann) [1000470]
  - [lib] vsprintf: add IPv4/v6 generic p[Ii]S[pfs] format specifier (Daniel Borkmann) [1000470]
  - [net] ipv6: fix potential use after free in tcp_v6_do_rcv (Jiri Benc) [1004165]
  - [net] netlabel: use domain based selectors when address based selectors are not available (Paul Moore) [983949]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-22.el7]
changelog:
  - [netdrv] bnx2: Convert dma_alloc_coherent(...__GFP_ZERO) to dma_zalloc_coherent (Neil Horman) [725061]
  - [netdrv] bnx2: clean up unnecessary MSI/MSI-X capability find (Neil Horman) [725061]
  - [netdrv] bnx2: Update version to 2.2.4 (Neil Horman) [725061]
  - [netdrv] bnx2: Add pci shutdown handler (Neil Horman) [725061]
  - [netdrv] bnx2: Use SIMPLE_DEV_PM_OPS (Neil Horman) [725061]
  - [netdrv] bnx2: Refactor WoL setup into a separate function (Neil Horman) [725061]
  - [netdrv] bnx2: Use kernel APIs for WoL and power state changes (Neil Horman) [725061]
  - [netdrv] bnx2: Handle error condition in ->slot_reset() (Neil Horman) [725061]
  - [netdrv] bnx2: use pdev->pm_cap instead of pci_find_capability(.., PCI_CAP_ID_PM) (Neil Horman) [725061]
  - [netdrv] bnx2: Use module_pci_driver to register driver (Neil Horman) [725061]
  - [netdrv] igb: Update version number (Stefan Assmann) [726817]
  - [netdrv] igb: Implementation to report advertised/supported link on i354 devices (Stefan Assmann) [726817]
  - [netdrv] igb: Get speed and duplex for 1G non_copper devices (Stefan Assmann) [726817]
  - [netdrv] igb: Support to get 2_5G link status for appropriate media type (Stefan Assmann) [726817]
  - [netdrv] igb: No PHPM support in i354 devices (Stefan Assmann) [726817]
  - [netdrv] igb: M88E1543 PHY downshift implementation (Stefan Assmann) [726817]
  - [netdrv] igb: New PHY_ID for i354 device (Stefan Assmann) [726817]
  - [netdrv] igb: Implementation of 1-sec delay for i210 devices (Stefan Assmann) [726817]
  - [netdrv] igb: Don't look for a PBA in the iNVM when flashless (Stefan Assmann) [726817]
  - [netdrv] igb: Expose RSS indirection table for ethtool (Stefan Assmann) [726817]
  - [netdrv] igb: Add macro for size of RETA indirection table (Stefan Assmann) [726817]
  - [netdrv] igb: Fix get_fw_version function for all parts (Stefan Assmann) [726817]
  - [netdrv] igb: Add device support for flashless SKU of i210 device (Stefan Assmann) [726817]
  - [netdrv] igb: Refactor NVM read functions to accommodate devices with no flash (Stefan Assmann) [726817]
  - [netdrv] igb: Refactor of init_nvm_params (Stefan Assmann) [726817]
  - [netdrv] igb: Update MTU so that it is always at least a standard frame size (Stefan Assmann) [726817]
  - [netdrv] igb: don't allow SR-IOV without MSI-X (Stefan Assmann) [726817]
  - [netdrv] igb: Added rcu_lock to avoid race (Stefan Assmann) [726817]
  - [netdrv] igb: Read register for latch_on without return value (Stefan Assmann) [726817]
  - [netdrv] igb: Reset the link when EEE setting changed (Stefan Assmann) [726817]
  - [netdrv] igb: fix vlan filtering in promisc mode when not in VT mode (Stefan Assmann) [726817]
  - [netdrv] igb: relase -> release (Stefan Assmann) [726817]
  - [netdrv] igb: Removed unused i2c function (Stefan Assmann) [726817]
  - [netdrv] igb: Implementation of i210/i211 LED support (Stefan Assmann) [726817]
  - [netdrv] igb: Fix possible panic caused by Rx traffic arrival while interface is down (Stefan Assmann) [726817]
  - [netdrv] igb: Fix set_ethtool function to call update nvm for entire image (Stefan Assmann) [726817]
  - [netdrv] igb: SerDes flow control setting (Stefan Assmann) [726817]
  - [netdrv] igb: Support for SFP modules discovery (Stefan Assmann) [726817]
  - [netdrv] igb: Add update to last_rx_timestamp in Rx rings (Stefan Assmann) [726817]
  - [netdrv] igb: Changed LEDs blink mechanism to include designs using cathode (Stefan Assmann) [726817]
  - [virt] kvm/mmu: avoid fast page fault fixing mmio page fault (Gleb Natapov) [981979]
  - [virt] kvm/vmx: mark unusable segment as nonpresent (Gleb Natapov) [981979]
  - [virt] kvm: get rid of $(addprefix ../../../virt/kvm/, ...) in Makefiles (Gleb Natapov) [981979]
  - [virt] kvm: Fix RTC interrupt coalescing tracking (Gleb Natapov) [981979]
  - [virt] kvm: Add a tracepoint write_tsc_offset (Gleb Natapov) [981979]
  - [virt] kvm: Inform users of mmio generation wraparound (Gleb Natapov) [981979]
  - [virt] kvm: document fast invalidate all mmio sptes (Gleb Natapov) [981979]
  - [virt] kvm: document fast invalidate all pages (Gleb Natapov) [981979]
  - [virt] kvm: document fast page fault (Gleb Natapov) [981979]
  - [virt] kvm: document mmio page fault (Gleb Natapov) [981979]
  - [virt] kvm: document write_flooding_count (Gleb Natapov) [981979]
  - [virt] kvm: document clear_spte_count (Gleb Natapov) [981979]
  - [virt] kvm: drop kvm_mmu_zap_mmio_sptes (Gleb Natapov) [981979]
  - [virt] kvm: init kvm generation close to mmio wrap-around value (Gleb Natapov) [981979]
  - [virt] kvm: add tracepoint for check_mmio_spte (Gleb Natapov) [981979]
  - [virt] kvm: fast invalidate all mmio sptes (Gleb Natapov) [981979]
  - [virt] kvm: make return value of mmio page fault handler more readable (Gleb Natapov) [981979]
  - [virt] kvm: store generation-number into mmio spte (Gleb Natapov) [981979]
  - [virt] kvm: retain more available bits on mmio spte (Gleb Natapov) [981979]
  - [virt] kvm: update the documentation for reverse mapping of parent_pte (Gleb Natapov) [981979]
  - [Documentation] kvm: fix section numbers (Gleb Natapov) [981979]
  - [virt] kvm: handle idiv overflow at kvm_write_tsc (Gleb Natapov) [981979]
  - [virt] kvm: reduce KVM_REQ_MMU_RELOAD when root page is zapped (Gleb Natapov) [981979]
  - [virt] kvm: reclaim the zapped-obsolete page first (Gleb Natapov) [981979]
  - [virt] kvm: collapse TLB flushes when zap all pages (Gleb Natapov) [981979]
  - [virt] kvm: zap pages in batch (Gleb Natapov) [981979]
  - [virt] kvm: do not reuse the obsolete page (Gleb Natapov) [981979]
  - [virt] kvm: add tracepoint for kvm_mmu_invalidate_all_pages (Gleb Natapov) [981979]
  - [virt] kvm: show mmu_valid_gen in shadow page related tracepoints (Gleb Natapov) [981979]
  - [virt] kvm: use the fast way to invalidate all pages (Gleb Natapov) [981979]
  - [virt] kvm: fast invalidate all pages (Gleb Natapov) [981979]
  - [virt] kvm: drop unnecessary kvm_reload_remote_mmus (Gleb Natapov) [981979]
  - [virt] kvm: drop calling kvm_mmu_zap_all in emulator_fix_hypercall (Gleb Natapov) [981979]
  - [virt] kvm: exclude ioeventfd from counting kvm_io_range limit (Gleb Natapov) [981979]
  - [virt] kvm: convert XADD to fastop (Gleb Natapov) [981979]
  - [virt] kvm: drop unused old-style inline emulation (Gleb Natapov) [981979]
  - [virt] kvm: convert DIV/IDIV to fastop (Gleb Natapov) [981979]
  - [virt] kvm: convert single-operand MUL/IMUL to fastop (Gleb Natapov) [981979]
  - [virt] kvm: Switch fastop src operand to RDX (Gleb Natapov) [981979]
  - [virt] kvm: switch MUL/DIV to DstXacc (Gleb Natapov) [981979]
  - [virt] kvm: decode extended accumulator explicity (Gleb Natapov) [981979]
  - [virt] kvm: add support for writing back the source operand (Gleb Natapov) [981979]
  - [virt] kvm: clenaup locking in mmu_free_roots() (Gleb Natapov) [981979]
  - [virt] kvm: limit difference between kvmclock updates (Gleb Natapov) [981979]
  - [virt] kvm: Remove support for reporting coalesced APIC IRQs (Gleb Natapov) [981979]
  - [virt] kvm: Use kvm_mmu_sync_roots() in kvm_mmu_load() (Gleb Natapov) [981979]
  - [virt] kvm: add missing misc_deregister() on error in kvm_init() (Gleb Natapov) [981979]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-24.el7]
changelog:
  - [Documentation] kvm: Add documentation on Hypercalls and features used for PV spinlock (Andrew Jones) [981581]
  - [virt] kvm: Simplify kvm_for_each_vcpu with kvm_irq_delivery_to_apic (Andrew Jones) [981581]
  - [virt] kvm: Add a hypercall to KVM hypervisor to support pv-ticketlocks (Andrew Jones) [981581]
  - [virt] kvm: Paravirtual ticketlocks support for linux guests running on KVM hypervisor (Andrew Jones) [981581]
  - [virt] kvm: Add configuration support to enable debug information for KVM Guests (Andrew Jones) [981581]
  - [virt] kvm: Add KICK_CPU and PV_UNHALT definition to uapi (Andrew Jones) [981581]
  - [virt] pvticketlock: Allow interrupts to be enabled while blocking (Andrew Jones) [981581]
  - [virt] ticketlock: Add slowpath logic (Andrew Jones) [981581]
  - [kernel] jump_label: Split jumplabel ratelimit (Andrew Jones) [981581]
  - [virt] pvticketlock: Use callee-save for lock_spinning (Andrew Jones) [981581]
  - [virt] pvticketlocks: Add xen_nopvspin parameter to disable xen pv ticketlocks (Andrew Jones) [981581]
  - [virt] pvticketlock: Xen implementation for PV ticket locks (Andrew Jones) [981581]
  - [virt] xen: Defer spinlock setup until boot CPU setup (Andrew Jones) [981581]
  - [virt] ticketlock: Collapse a layer of functions (Andrew Jones) [981581]
  - [virt] ticketlock: Don't inline _spin_unlock when using paravirt spinlocks (Andrew Jones) [981581]
  - [virt] spinlock: Replace pv spinlocks with pv ticketlocks (Andrew Jones) [981581]
  - [fs] proc/vmcore: support mmap() on /proc/vmcore (Nigel Croxon) [990298]
  - [fs] proc/vmcore: calculate vmcore file size from buffer size and total size of vmcore objects (Nigel Croxon) [990298]
  - [fs] proc/vmcore: allow user process to remap ELF note segment buffer (Nigel Croxon) [990298]
  - [fs] proc/vmcore: allocate ELF note segment in the 2nd kernel vmalloc memory (Nigel Croxon) [990298]
  - [mm] vmalloc: introduce remap_vmalloc_range_partial (Nigel Croxon) [990298]
  - [mm] vmalloc: make find_vm_area check in range (Nigel Croxon) [990298]
  - [fs] proc/vmcore: treat memory chunks referenced by PT_LOAD program header entries in page-size boundary in vmcore_list (Nigel Croxon) [990298]
  - [fs] proc/vmcore: allocate buffer for ELF headers on page-size alignment (Nigel Croxon) [990298]
  - [fs] proc/vmcore: clean up read_vmcore() (Nigel Croxon) [990298]
  - [mm] add PAGE_ALIGNED() helper (Nigel Croxon) [990298]
  - [fs] nfs Fix up nfs4_proc_lookup_mountpoint (Jeff Layton) [1007357]
  - [fs] nfs: Don't check lock owner compatability unless file is locked (part 2) (Jeff Layton) [1007035]
  - [fs] nfs: Don't check lock owner compatibility in writes unless file is locked (Jeff Layton) [1007035]
  - [pci] Remove pcie_cap_has_devctl() (Myron Stowe) [1005229]
  - [pci] Support PCIe Capability Slot registers only for ports with slots (Myron Stowe) [1005229]
  - [pci] Remove PCIe Capability version checks (Myron Stowe) [1005229]
  - [pci] Allow PCIe Capability link-related register access for switches (Myron Stowe) [1005229]
  - [pci] Add offsets of PCIe capability registers (Myron Stowe) [1005229]
  - [pci] Tidy bitmasks and spacing of PCIe capability definitions (Myron Stowe) [1005229]
  - [pci] Remove obsolete comment reference to pci_pcie_cap2() (Myron Stowe) [1005229]
  - [pci] Clarify PCI_EXP_TYPE_PCI_BRIDGE comment (Myron Stowe) [1005229]
  - [pci] Rename PCIe capability definitions to follow convention (Myron Stowe) [1005229]
  - [pci] Warn if unsafe MPS settings detected (Myron Stowe) [1005229]
  - [pci] Fix MPS peer-to-peer DMA comment syntax (Myron Stowe) [1005229]
  - [pci] Disable decoding for BAR sizing only when it was actually enabled (Myron Stowe) [1005229]
  - [pci] Add comment about needing pci_msi_off() even when CONFIG_PCI_MSI=n (Myron Stowe) [1005229]
  - [pci] Add pcibios_pm_ops for optional arch-specific hibernate functionality (Myron Stowe) [1005229]
  - [pci] Don't restrict MPS for slots below Root Ports (Myron Stowe) [1005229]
  - [pci] Simplify MPS test for Downstream Port (Myron Stowe) [1005229]
  - [pci] Remove unnecessary check for pcie_get_mps() failure (Myron Stowe) [1005229]
  - [pci] Simplify pcie_bus_configure_settings() interface (Myron Stowe) [1005229]
  - [pci] Drop "PCI-E" prefix from Max Payload Size message (Myron Stowe) [1005229]
  - [pci] Add pci_probe_reset_slot() and pci_probe_reset_bus() (Myron Stowe) [1005229]
  - [pci] Remove aer_do_secondary_bus_reset() (Myron Stowe) [1005229]
  - [pci] Tune secondary bus reset timing (Myron Stowe) [1005229]
  - [pci] Wake-up devices before saving config space for reset (Myron Stowe) [1005229]
  - [pci] Add pci_reset_slot() and pci_reset_bus() (Myron Stowe) [1005229]
  - [pci] Split out pci_dev lock/unlock and save/restore (Myron Stowe) [1005229]
  - [pci] Add slot reset option to pci_dev_reset() (Myron Stowe) [1005229]
  - [pci] pciehp: Add reset_slot() method (Myron Stowe) [1005229]
  - [pci] Add hotplug_slot_ops.reset_slot() (Myron Stowe) [1005229]
  - [pci] quirks: Use pci_wait_for_pending_transaction() instead of for loop (Myron Stowe) [1005229]
  - [netdrv] bnx2x: Use pci_wait_for_pending_transaction() instead of for loop (Myron Stowe) [1005229]
  - [pci] quirks: Enable Bus Master during Function-Level Reset on Chelsio (Myron Stowe) [1005229]
  - [pci] Add pci_wait_for_pending_transaction() (Myron Stowe) [1005229]
  - [pci] Add pci_reset_bridge_secondary_bus() (Myron Stowe) [1005229]
  - [pci] Align bridge I/O windows as required by downstream devices & bridges (Myron Stowe) [1005229]
  - [pci] Fix types in pbus_size_io() (Myron Stowe) [1005229]
  - [pci] Add comments for pbus_size_mem() parameters (Myron Stowe) [1005229]
  - [pci] Enumerate subordinate buses, not devices, in pci_bus_get_depth() (Myron Stowe) [1005229]
  - [pci] Fix comment typo for pci_add_cap_save_buffer() (Myron Stowe) [1005229]
  - [pci] Return -ENOSYS for SR-IOV operations on non-SR-IOV devices (Myron Stowe) [1005229]
  - [pci] Update NumVFs register when disabling SR-IOV (Myron Stowe) [1005229]
  - [pci] mmconfig: Check earlier for MMCONFIG region at address zero (Myron Stowe) [1005229]
  - [pci] Assign resources for hot-added host bridge more aggressively (Myron Stowe) [1005229]
  - [pci] Move resource reallocation code to non-__init (Myron Stowe) [1005229]
  - [pci] Delay enabling bridges until they're needed (Myron Stowe) [1005229]
  - [pci] Assign resources on a per-bus basis (Myron Stowe) [1005229]
  - [pci] Enable unassigned resource reallocation on per-bus basis (Myron Stowe) [1005229]
  - [pci] Turn on reallocation for unassigned resources with host bridge offset (Myron Stowe) [1005229]
  - [pci] Look for unassigned resources on per-bus basis (Myron Stowe) [1005229]
  - [pci] Drop temporary variable in pci_assign_unassigned_resources() (Myron Stowe) [1005229]
  - [pci] Claim ACS support for AMD southbridge devices (Myron Stowe) [1005229]
  - [pci] Differentiate ACS controllable from enabled (Myron Stowe) [1005229]
  - [pci] Check all ACS features for multifunction downstream ports (Myron Stowe) [1005229]
  - [pci] Convert class code to use dev_groups (Myron Stowe) [1005229]
  - [pci] mrst: Cleanup checkpatch.pl warnings (Myron Stowe) [1005229]
  - [pci] Rename "PCI Express support" kconfig title (Myron Stowe) [1005229]
  - [pci] Fix comment typo in iov.c (Myron Stowe) [1005229]
  - [fs] sysfs: use file mode defines from stat.h (Myron Stowe) [1005229]
  - [fs] sysfs: add more helper macro's for (bin_)attribute(_groups) (Myron Stowe) [1005229]
  - [misc] device: add default groups to struct class (Myron Stowe) [1005229]
  - [misc] device: Introduce device_create_groups (Myron Stowe) [1005229]
  - [fs] sysfs: prevent warning when only using binary attributes (Myron Stowe) [1005229]
  - [fs] sysfs: add support for binary attributes in groups (Myron Stowe) [1005229]
  - [misc] device: add RW and RO attribute macros (Myron Stowe) [1005229]
  - [misc] sysfs: add BIN_ATTR macro (Myron Stowe) [1005229]
  - [misc] sysfs: add ATTRIBUTE_GROUPS() macro (Myron Stowe) [1005229]
  - [misc] sysfs: add __ATTR_RW() macro (Myron Stowe) [1005229]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-25.el7]
changelog:
  - [scsi] mpt2sas: Bump driver version to v16.100.00.00 (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Remove phys on topology change (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Fix for kernel panic when driver loads with HBA connected to non LUN 0 configured expander (Tomas Henzl) [736230]
  - [scsi] mpt2sas: when Async scanning is enabled then while scanning, devices are removed but their transport layer entries are not removed (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Infinite loop can occur if MPI2_IOCSTATUS_CONFIG_INVALID_PAGE is not returned (Tomas Henzl) [736230]
  - [scsi] mpt2sas: The copyright in driver sources is updated for the year 2013 (Tomas Henzl) [736230]
  - [scsi] mpt2sas: MPI2 Rev X (2.00.16) specifications (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Change in MPI2_RAID_ACTION_SYSTEM_SHUTDOWN_INITIATED notification methodology (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Null pointer deference possibility in mpt2sas_ctl_event_callback function (Tomas Henzl) [736230]
  - [scsi] mpt2sas: fix cleanup on controller resource mapping failure (Tomas Henzl) [736230]
  - [scsi] mpt2sas: fix for unused variable 'event_data' warning (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Calulate the Reply post queue depth calculation as per the MPI spec (Tomas Henzl) [736230]
  - [scsi] mpt2sas: fix firmware failure with wrong task attribute (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Fix for device scan following host reset could get stuck in a infinite loop (Tomas Henzl) [736230]
  - [scsi] mpt2sas: Update the timing requirements for issuing a Hard Reset (Tomas Henzl) [736230]
  - [scsi] mpt2sas: MPI2 Rev W (2.00.15) specification (Tomas Henzl) [736230]
  - [powerpc] Fix possible deadlock on page fault (Steve Best) [999374]
  - [scsi] qla2xxx: Update driver version to 8.06.00.08.07.0-k (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Select link initialization option bits from current operating mode (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add loopback IDC-TIME-EXTEND aen handling support (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Set default critical temperature value in cases when ISPFX00 firmware doesn't provide it (Chad Dupuis) [725014]
  - [scsi] qla2xxx: QLAFX00 make over temperature AEN handling informational, add log for normal temperature AEN (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Correct Interrupt Register offset for ISPFX00 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove handling of Shutdown Requested AEN from qlafx00_process_aen() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Send all AENs for ISPFx00 to above layers (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add changes in initialization for ISPFX00 cards with BIOS (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add changes to support extended IOs for ISPFX00 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add missing FCP statistics to sysfs interface (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Make log message that prints when a completion status requires a port down more readable (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add critical temperature handling for ISPFX00 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Notify ISPFX00 firmware when driver is unloaded or system is shut down (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Reconfigure thermal temperature (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add setting of driver version string for vendor application (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove QL_DEBUG_LEVEL_17 defines from qla_nx.c (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add ISPFX00 specific bus reset routine (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Perform warm reset every 2 minutes if firmware load fails for ISPFX00 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Set factory reset recovery timeout to 10 min. for ISPFX00 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Correct multiqueue offset calculations (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Fix incorrect test after list_for_each_entry() exits (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Add support for ISP8044 (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Print some variables to hexadecimal string via *phN format (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Fix sparse warnings in qlafx00_fxdisc_iocb function (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Properly set the tagging for commands (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Fix a memory leak in an error path of qla2x00_process_els() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove an unused variable from qla2x00_remove_one() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Fix qla2xxx_check_risc_status() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Help Coverity with analyzing ct_sns_pkt initialization (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove redundant assignments (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove a dead assignment in qla24xx_build_scsi_crc_2_iocbs() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove two superfluous tests (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Remove dead code in qla2x00_configure_hba() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Clean up qla84xx_mgmt_cmd() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Clean up qla24xx_iidma() (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Fix sparse warning from qla_mr.c and qla_iocb.c (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Do not take a second firmware dump when intentionally generating one (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Do not query FC statistics during chip reset (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Move qla2x00_free_device to the correct location (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Set the index in outstanding command array to NULL when cmd is aborted when the request timeout (Chad Dupuis) [725014]
  - [scsi] qla2xxx: Clear the MBX_INTR_WAIT flag when the mailbox time-out happens (Chad Dupuis) [725014]
  - [scsi] mpt3sas: Bump driver version to v02.100.00.00 (Tomas Henzl) [889435]
  - [scsi] mpt3sas: Added a driver module parameter max_msix_vectors (Tomas Henzl) [889435]
  - [scsi] mpt3sas: fix cleanup on controller resource mapping failure (Tomas Henzl) [889435]
  - [scsi] mpt3sas: when async scanning is enabled then while scanning, devices are removed but their transport layer entries are not removed (Tomas Henzl) [889435]
  - [scsi] mpt3sas: MPI2.5 Rev F v2.5.1.1 specification (Tomas Henzl) [889435]
  - [scsi] mpt3sas: Infinite loops can occur if MPI2_IOCSTATUS_CONFIG_INVALID_PAGE is not returned (Tomas Henzl) [889435]
  - [scsi] mpt3sas: fix for kernel panic when driver loads with HBA conected to non LUN 0 configured expander (Tomas Henzl) [889435]
  - [scsi] mpt3sas: Updated the Hardware timing requirements (Tomas Henzl) [889435]
  - [scsi] mpt3sas: 2013 source code copyright (Tomas Henzl) [889435]
  - [netdrv] ixgbe: add support for older QSFP active DA cables (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: include QSFP PHY types in ixgbe_is_sfp() (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: add 1Gbps support for QSFP+ (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix SFF data dumps of SFP+ modules from an offset (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: cleanup some log messages (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: zero out mailbox buffer on init (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix link test when connected to 1Gbps link partner (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix incorrect limit value in ring transverse (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: Check return value on eeprom reads (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: disable link when adapter goes down (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: add support for quad-port x520 adapter (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: clear semaphore bits on timeouts (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: rename LL_EXTENDED_STATS to use queue instead of q (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix lockdep annotation issue for ptp's work item (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: call pcie_get_mimimum_link to check if device has enough bandwidth (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix SFF data dumps of SFP+ modules (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix semaphore lock for I2C read/writes on 82598 (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: bump version number (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: add new media type (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: fix fc autoneg ethtool reporting (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: Use pci_vfs_assigned instead of ixgbe_vfs_are_assigned (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: Retain VLAN filtering in promiscuous + VT mode (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: Fix Tx Hang issue with lldpad on 82598EB (Andy Gospodarek) [726818]
  - [netdrv] ixgbe: Set the SW prio_tc values at initialization to the HW setting (Andy Gospodarek) [726818]
  - [pci] expose pcie_link_speed and pcix_bus_speed arrays (Andy Gospodarek) [726818]
  - [pci] move enum pcie_link_width into pci.h (Andy Gospodarek) [726818]
  - [pci] Add function to obtain minimum link width and speed (Andy Gospodarek) [726818]
  - [netdrv] cnic: Update version to 2.5.18 (Tomas Henzl) [725064]
  - [netdrv] cnic: Eliminate local copy of pfid (Tomas Henzl) [725064]
  - [netdrv] cnic: Eliminate CNIC_PORT macro and port_mode in local struct (Tomas Henzl) [725064]
  - [netdrv] cnic: Redefine BNX2X_HW_CID using existing bnx2x macros (Tomas Henzl) [725064]
  - [netdrv] cnic: Use CHIP_NUM macros from bnx2x.h (Tomas Henzl) [725064]
  - [netdrv] cnic: Convert mac address uses of 6 to ETH_ALEN (Tomas Henzl) [725064]
  - [netdrv] cnic: Update version to 2.5.17 and copyright year (Tomas Henzl) [725064]
  - [netdrv] cnic: Add missing error checking for RAMROD_CMD_ID_CLOSE (Tomas Henzl) [725064]
  - [netdrv] cnic: Update TCP options setup for iSCSI (Tomas Henzl) [725064]
  - [netdrv] cnic: Reset tcp_flags during cnic_cm_create() (Tomas Henzl) [725064]
  - [netdrv] cnic: Simplify cnic_release() (Tomas Henzl) [725064]
  - [netdrv] cnic: Simplify netdev events handling (Tomas Henzl) [725064]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-26.el7]
changelog:
  - [net] tuntap: correctly handle error in tun_set_iff() (Jiri Benc) [1007739] {CVE-2013-4343}
  - [net] sctp: fix ipv6 ipsec encryption bug in sctp_v6_xmit (Daniel Borkmann) [998398] {CVE-2013-4350}
  - [net] netlink: filter particular protocols from analyzers (Daniel Borkmann) [957721]
  - [net] ipv6: accept tlv which includes only padding (Jiri Pirko) [990968]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-27.el7]
changelog:
  - [netdrv] i40e: include i40e in kernel proper (Stefan Assmann) [726825]
  - [netdrv] i40e: debugfs interface (Stefan Assmann) [726825]
  - [netdrv] i40e: init code and hardware support (Stefan Assmann) [726825]
  - [netdrv] i40e: implement virtual device interface (Stefan Assmann) [726825]
  - [netdrv] i40e: driver core headers (Stefan Assmann) [726825]
  - [netdrv] i40e: driver ethtool core (Stefan Assmann) [726825]
  - [netdrv] i40e: transmit, receive, and NAPI (Stefan Assmann) [726825]
  - [netdrv] i40e: main driver core (Stefan Assmann) [726825]
  - [netdrv] e1000e: balance semaphore put/get for 82573 (Dean Nelson) [726816]
  - [netdrv] e1000e: resolve checkpatch JIFFIES_COMPARISON warning (Dean Nelson) [726816]
  - [netdrv] e1000e: Avoid kernel crash during shutdown (Dean Nelson) [726816]
  - [netdrv] e1000e: Add code to check for failure of pci_disable_link_state call (Dean Nelson) [726816]
  - [netdrv] e1000e: cleanup whitespace in recent commit (Dean Nelson) [726816]
  - [netdrv] e1000e: fix I217/I218 PHY initialization flow (Dean Nelson) [726816]
  - [netdrv] e1000e: do not resume device from RPM suspend to read PHY status registers (Dean Nelson) [726816]
  - [netdrv] e1000e: enable support for new device IDs (Dean Nelson) [726816]
  - [netdrv] e1000e: ethtool unnecessarily takes device out of RPM suspend (Dean Nelson) [726816]
  - [netdrv] e1000e: Tx hang on I218 when linked at 100Half and slow response at 10Mbps (Dean Nelson) [726816]
  - [netdrv] e1000e: low throughput using 4K jumbos on I218 (Dean Nelson) [726816]
  - [netdrv] e1000e: iAMT connections drop on driver unload when jumbo frames enabled (Dean Nelson) [726816]
  - [netdrv] e1000e: disable ASPM L1 on 82583 (Dean Nelson) [726816]
  - [netdrv] e1000e: Use marco instead of digit for defining e1000_rx_desc_packet_split (Dean Nelson) [726816]
  - [netdrv] e1000e: Remove duplicate assignment of default rx/tx ring size (Dean Nelson) [726816]
  - [netdrv] e1000e: restore call to pci_clear_master() (Dean Nelson) [726816]
  - [netdrv] e1000e: Release mutex lock only if it has been initially acquired (Dean Nelson) [726816]
  - [netdrv] e1000e: prevent warning from -Wunused-parameter (Dean Nelson) [726816]
  - [netdrv] e1000e: cleanup whitespace (Dean Nelson) [726816]
  - [netdrv] bna: Staticize local functions (Ivan Vecera) [978045]
  - [netdrv] bna: switch to fixed_size_llseek() (Ivan Vecera) [978045]
  - [fs] read_write: new helper, fixed_size_llseek() (Ivan Vecera) [978045]
  - [netdrv] bna: Driver and Firmware Updated (Ivan Vecera) [978045]
  - [netdrv] bna: Enahncement to Identify Default IOC Function (Ivan Vecera) [978045]
  - [netdrv] bna: Fix Ucast Failure Handling (Ivan Vecera) [978045]
  - [netdrv] bna: Clear Driver Config Flags When HW Resets (Ivan Vecera) [978045]
  - [netdrv] tg3: Don't turn off led on 5719 serdes port 0 (Ivan Vecera) [1006987]
  - [netdrv] tg3: Convert dma_alloc_coherent(...__GFP_ZERO) to dma_zalloc_coherent (Ivan Vecera) [1006987]
  - [netdrv] tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset (Ivan Vecera) [1006987]
  - [netdrv] tg3: clean up unnecessary MSI/MSI-X capability find (Ivan Vecera) [1006987]
  - [netdrv] tg3: Fix warning from pci_disable_device() (Ivan Vecera) [1006987]
  - [netdrv] tg3: Fix kernel crash (Ivan Vecera) [1006987]
  - [netdrv] tg3: Update version to 3.133 (Ivan Vecera) [1006987]
  - [netdrv] tg3: Fix UDP fragments treated as RMCP (Ivan Vecera) [1006987]
  - [netdrv] tg3: Enable support for timesync gpio output (Ivan Vecera) [1006987]
  - [netdrv] tg3: Implement the shutdown handler (Ivan Vecera) [1006987]
  - [netdrv] tg3: Allow NVRAM programming when interface is down (Ivan Vecera) [1006987]
  - [netdrv] tg3: Remove incorrect switch to aux power (Ivan Vecera) [1006987]
  - [netdrv] tg3: Prevent system hang during repeated EEH errors (Ivan Vecera) [1006987]
  - [netdrv] tg3: remove redundant pm init code (Ivan Vecera) [1006987]
  - [netdrv] tg3: Remove unnecessary lock around tg3_flag_set (Ivan Vecera) [1006987]
  - [netdrv] tg3: Fix misplaced empty line (Ivan Vecera) [1006987]
  - [netdrv] tg3: Use descriptive label names in tg3_start (Ivan Vecera) [1006987]
  - [netdrv] tg3: Make tg3_rings_reset() more concise (Ivan Vecera) [1006987]
  - [netdrv] tg3: Simplify ring control block setup (Ivan Vecera) [1006987]
  - [netdrv] tg3: Split APE driver state change out of boot reset signature update (Ivan Vecera) [1006987]
  - [netdrv] tg3: Use module_pci_driver to register driver (Ivan Vecera) [1006987]
  - [netdrv] tg3: Implement set/get_eee handlers (Ivan Vecera) [1006987]
  - [netdrv] tg3: Simplify tg3_phy_eee_config_ok() by reusing tg3_eee_pull_config() (Ivan Vecera) [1006987]
  - [netdrv] tg3: Add tg3_eee_pull_config() function (Ivan Vecera) [1006987]
  - [netdrv] tg3: Add ethtool_eee struct and tg3_setup_eee() (Ivan Vecera) [1006987]
  - [netdrv] be2net: set and query VEB/VEPA mode of the PF interface (Ivan Vecera) [726160]
  - [netdrv] be2net: Convert dma_alloc_coherent(...__GFP_ZERO) to dma_zalloc_coherent (Ivan Vecera) [726160]
  - [netdrv] be2net: implement ethtool set/get_channel hooks (Ivan Vecera) [726160]
  - [netdrv] be2net: refactor be_setup() to consolidate queue creation routines (Ivan Vecera) [726160]
  - [netdrv] be2net: Fix be_cmd_if_create() to use MBOX if MCCQ is not created (Ivan Vecera) [726160]
  - [netdrv] be2net: refactor be_get_resources() code (Ivan Vecera) [726160]
  - [netdrv] be2net: Fixup profile management routines (Ivan Vecera) [726160]
  - [netdrv] be2net: use EQ_CREATEv2 for SH-R (Ivan Vecera) [726160]
  - [netdrv] be2net: Check for POST state in suspend-resume sequence (Ivan Vecera) [726160]
  - [netdrv] be2net: fix disabling TX in be_close() (Ivan Vecera) [726160]
  - [netdrv] be2net: Clear any capability flags that driver is not interested in (Ivan Vecera) [726160]
  - [netdrv] be2net: update driver version (Ivan Vecera) [726160]
  - [netdrv] be2net: Initialize "status" in be_cmd_get_die_temperature() (Ivan Vecera) [726160]
  - [netdrv] be2net: fixup log msgs for async events (Ivan Vecera) [726160]
  - [netdrv] be2net: Fix displaying supported speeds for BE2 (Ivan Vecera) [726160]
  - [netdrv] be2net: don't limit max MAC and VLAN counts (Ivan Vecera) [726160]
  - [netdrv] be2net: Do not call get_die_temperature cmd for VF (Ivan Vecera) [726160]
  - [netdrv] be2net: Adding more speeds reported by get_settings (Ivan Vecera) [726160]
  - [netdrv] be2net: Staticize local functions (Ivan Vecera) [726160]
  - [netdrv] be2net: don't use dev_err when AER enabling fails (Ivan Vecera) [726160]
  - [netdrv] be2net: delete primary MAC address while unloading (Ivan Vecera) [726160]
  - [netdrv] be2net: use SET/GET_MAC_LIST for SH-R (Ivan Vecera) [726160]
  - [netdrv] be2net: refactor MAC-addr setup code (Ivan Vecera) [726160]
  - [netdrv] be2net: fix pmac_id for BE3 VFs (Ivan Vecera) [726160]
  - [netdrv] be2net: allow VFs to program MAC and VLAN filters (Ivan Vecera) [726160]
  - [netdrv] be2net: fix MAC address modification for VF (Ivan Vecera) [726160]
  - [netdrv] be2net: replace numeric with standard PM state macros (Ivan Vecera) [726160]
  - [netdrv] be2net: use pci_vfs_assigned()/pci_num_vf() instead of be_find_vfs() (Ivan Vecera) [726160]
  - [netdrv] be2net: Implement initiate FW dump feature for Lancer (Ivan Vecera) [726160]
  - [netdrv] be2net: Trim padded packets for Lancer (Ivan Vecera) [726160]
  - [netdrv] be2net: Pad skb to meet min Tx pkt size in lancer (Ivan Vecera) [726160]
  - [netdrv] be2net: cleanup be_get_drvinfo() (Ivan Vecera) [726160]
  - [netdrv] be2net: refactor HW workarounds in be_xmit() (Ivan Vecera) [726160]
  - [netdrv] mlx5: remove unused MLX5_DEBUG param in Kconfig (Amir Vadai) [864578]
  - [netdrv] mlx5: Support MANAGE_PAGES and QUERY_PAGES firmware command changes (Amir Vadai) [864578]
  - [netdrv] mlx5: remove health handler plugin (Amir Vadai) [864578]
  - [infiniband] mlx5: Variable may be used uninitialized (Amir Vadai) [864578]
  - [netdrv] mlx5: Implement new initialization sequence (Amir Vadai) [864578]
  - [infiniband] mlx5: Fix stack info leak in mlx5_ib_alloc_ucontext() (Amir Vadai) [864578]
  - [infiniband] mlx5: Fix error return code in init_one() (Amir Vadai) [864578]
  - [netdrv] mlx5: fix error return code in mlx5_alloc_uuars() (Amir Vadai) [864578]
  - [netdrv] mlx5: use after free in mlx5_cmd_comp_handler() (Amir Vadai) [864578]
  - [netdrv] mlx5: Fix __udivdi3 when compiling for 32 bit arches (Amir Vadai) [864578]
  - [netdrv] mlx5: Return -EFAULT instead of -EPERM (Amir Vadai) [864578]
  - [netdrv] mlx5: Adjust hca_cap.uar_page_sz to conform to Connect-IB spec (Amir Vadai) [864578]
  - [netdrv] mlx5: Fixes for sparse warnings (Amir Vadai) [864578]
  - [infiniband] mlx5: Make profile[] static in main.c (Amir Vadai) [864578]
  - [infiniband] mlx5: Add driver for Mellanox Connect-IB adapters (Amir Vadai) [864578]
  - [infiniband] core: Add reserved values to enums for low-level driver use (Amir Vadai) [864578]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-28.el7]
changelog:
  - [fs] namei: Add missing unlocks to error paths of mountpoint_last (Jeff Layton) [980172]
  - [fs] autofs4: fix device ioctl mount lookup (Jeff Layton) [980172]
  - [fs] namei: introduce kern_path_mountpoint() (Jeff Layton) [980172]
  - [fs] namei: rename user_path_umountat() to user_path_mountpoint_at() (Jeff Layton) [980172]
  - [fs] namei: take unlazy_walk() into umount_lookup_last() (Jeff Layton) [980172]
  - [fs] vfs: allow umount to handle mountpoints without revalidating them (Jeff Layton) [980172]
  - [acpi] apei: Soft-offline a page on firmware GHES notification (Janet Morgan) [984133]
  - [acpi] apei: Add a boot option to disable ff mode for corrected errors (Janet Morgan) [984133]
  - [mcheck] mce: Honour Firmware First for MCA banks listed in APEI HEST CMC (Janet Morgan) [984133]
  - [fs] cifs: Respect epoch value from create lease context v2 (Sachin Prabhu) [1007981]
  - [fs] cifs: Add create lease v2 context for SMB3 (Sachin Prabhu) [1007981]
  - [fs] cifs: Move parsing lease buffer to ops struct (Sachin Prabhu) [1007981]
  - [fs] cifs: Move creating lease buffer to ops struct (Sachin Prabhu) [1007981]
  - [fs] cifs: Store lease state itself rather than a mapped oplock value (Sachin Prabhu) [1007981]
  - [fs] cifs: Replace clientCanCache* bools with an integer (Sachin Prabhu) [1007981]
  - [fs] cifs: quiet sparse compile warning (Sachin Prabhu) [1007981]
  - [fs] cifs: Start using per session key for smb2/3 for signature generation (Sachin Prabhu) [1007981]
  - [fs] cifs: Add a variable specific to NTLMSSP for key exchange (Sachin Prabhu) [1007981]
  - [fs] cifs: Process post session setup code in respective dialect functions (Sachin Prabhu) [1007981]
  - [fs] cifs: convert to use le32_add_cpu() (Sachin Prabhu) [1007981]
  - [fs] cifs: Fix missing lease break (Sachin Prabhu) [1007981]
  - [fs] cifs: Fix a memory leak when a lease break comes (Sachin Prabhu) [1007981]
  - [fs] cifs: convert case-insensitive dentry ops to use new case conversion routines (Sachin Prabhu) [1007981]
  - [fs] cifs: add new case-insensitive conversion routines that are based on wchar_t's (Sachin Prabhu) [1007981]
  - [fs] cifs: Move and expand MAX_SERVER_SIZE definition (Sachin Prabhu) [1007981]
  - [fs] cifs: Expand max share name length to 256 (Sachin Prabhu) [1007981]
  - [fs] cifs: Move string length definitions to uapi (Sachin Prabhu) [1007981]
  - [fs] cifs: Implement follow_link for nounix CIFS mounts (Sachin Prabhu) [1007981]
  - [fs] cifs: Implement follow_link for SMB2 (Sachin Prabhu) [1007981]
  - [fs] cifs: display iocharset= option in /proc/mounts (Sachin Prabhu) [1007981]
  - [fs] cifs: create a new Documentation/ directory and move docfiles into it (Sachin Prabhu) [1007981]
  - [fs] cifs: ensure that srv_mutex is held when dealing with ssocket pointer (Sachin Prabhu) [1007981]
  - [fs] cifs: don't instantiate new dentries in readdir for inodes that need to be revalidated immediately (Sachin Prabhu) [1007981]
  - [fs] cifs: set sb->s_d_op before calling d_make_root() (Sachin Prabhu) [1007981]
  - [fs] cifs: file, initialize oparms.reconnect before using it (Sachin Prabhu) [1007981]
  - [fs] cifs: Do not attempt to do cifs operations reading symlinks with SMB2 (Sachin Prabhu) [1007981]
  - [fs] cifs: extend the buffer length enought for sprintf() using (Sachin Prabhu) [1007981]
  - [fs] dlm: log an error for unmanaged lockspaces (David Teigland) [1008005]
  - [acpi] acpi_ipmi, replace mutex with spin_lock_irqsave (Tony Camuso) [1007574]
  - [kernel] sched: Micro-optimize the smart wake-affine logic (Larry Woodman) [947186]
  - [kernel] sched: Implement smarter wake-affine logic (Larry Woodman) [947186]
  - [net] sunrpc: rpcauth_create needs to know about rpc_clnt clone status (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Share all credential caches on a per-transport basis (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Share rpc_pipes when an rpc_clnt owns multiple rpcsec auth caches (Jeff Layton) [1002576]
  - [net] sunrpc: Add a helper to allow sharing of rpc_pipefs directory objects (Jeff Layton) [1002576]
  - [net] sunrpc: Remove the rpc_client->cl_dentry (Jeff Layton) [1002576]
  - [fs] nfs: Convert idmapper to use the new framework for pipefs dentries (Jeff Layton) [1002576]
  - [net] sunrpc: Remove the obsolete auth-only interface for pipefs dentry management (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Switch auth_gss to use the new framework for pipefs dentries (Jeff Layton) [1002576]
  - [net] sunrpc: Add a framework to clean up management of rpc_pipefs directories (Jeff Layton) [1002576]
  - [fs] nfs: Fix a potentially Oopsable condition in __nfs_idmap_unregister (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Fix an Oopsable condition when creating/destroying pipefs objects (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Further cleanups (Jeff Layton) [1002576]
  - [net] sunrpc: Replace clnt->cl_principal (Jeff Layton) [1002576]
  - [net] sunrpc: RPCSEC_GSS, Clean up upcall message allocation (Jeff Layton) [1002576]
  - [net] sunrpc: Cleanup rpc_setup_pipedir (Jeff Layton) [1002576]
  - [net] sunrpc: Remove unused struct rpc_clnt field cl_protname (Jeff Layton) [1002576]
  - [net] sunrpc: Deprecate rpc_client->cl_protname (Jeff Layton) [1002576]
  - [net] sunrpc/rpc_pipe: convert back to simple_dir_inode_operations (Jeff Layton) [1002576]
  - [fs] libfs: make simple_lookup() usable for filesystems that set ->s_d_op (Jeff Layton) [1002576]
  - [net] sunrpc: __rpc_lookup_create_exclusive, pass string instead of qstr (Jeff Layton) [1002576]
  - [net] sunrpc: rpc_create_*_dir, don't bother with qstr (Jeff Layton) [1002576]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-29.el7]
changelog:
  - [s390] zfcp: remove access control tables interface (keep sysfs files) (Hendrik Brueckner) [1006516]
  - [s390] zfcp: fix lock imbalance by reworking request queue locking (Hendrik Brueckner) [1006525]
  - [s390] zfcp: fix schedule-inside-lock in scsi_device list loops (Hendrik Brueckner) [1006524]
  - [x86] setup: avoid remapping data in parse_setup_data() (Nigel Croxon) [1004428]
  - [hid] validate HID report id size (Frantisek Hrbata) [1000454] {CVE-2013-2888}
  - [kernel] userns: prevent the use of user namespaces (Aristeu Rozanski) [993320]
  - [crypto] x509: don't reject not-yet-valid keys (kyle mcmartin) [905910]
  - [kernel] perf: Prevent race in unthrottling code (Jiri Olsa) [992941]
  - [s390] pci: use adapter interrupt vector helpers (Hendrik Brueckner) [1005896]
  - [s390] pci: cleanup function names (Hendrik Brueckner) [1005896]
  - [s390] airq: introduce adapter interrupt vector helper (Hendrik Brueckner) [1005896]
  - [s390] pci: use virtual memory for iommu bitmap (Hendrik Brueckner) [1005896]
  - [s390] cio: fix unlocked access of global bitmap (Hendrik Brueckner) [1005896]
  - [s390] pci: update function handle after resume from hibernate (Hendrik Brueckner) [1005896]
  - [s390] pci: try harder to modify a function (Hendrik Brueckner) [1005896]
  - [s390] pci: split lpf (Hendrik Brueckner) [1005896]
  - [s390] hibernate: add early resume function (Hendrik Brueckner) [1005896]
  - [s390] pci: add recover sysfs knob (Hendrik Brueckner) [1005896]
  - [s390] pci: use claim_resource (Hendrik Brueckner) [1005896]
  - [s390] pci/hotplug: convert to be builtin only (Hendrik Brueckner) [1005896]
  - [s390] airq: simplify adapter interrupt code (Hendrik Brueckner) [1005896]
  - [s390] qdio: cleanup chsc SADC usage (Hendrik Brueckner) [1005896]
  - [s390] qdio: cleanup chsc SSQD usage (Hendrik Brueckner) [1005896]
  - [s390] pci: remove per device debug attribute (Hendrik Brueckner) [1005896]
  - [s390] pci: sysfs remove strlen (Hendrik Brueckner) [1005896]
  - [s390] pci: remove pdev during unplug (Hendrik Brueckner) [1005896]
  - [s390] pci: cleanup hotplug code (Hendrik Brueckner) [1005896]
  - [s390] pci: implement pcibios_release_device (Hendrik Brueckner) [1005896]
  - [s390] pci: use to_pci_dev (Hendrik Brueckner) [1005896]
  - [netdrv] sfc: check for allocation failure (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Update copyright banners (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add support for Solarflare SFC9100 family (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Make efx_mcdi_{init, fini}() call efx_mcdi_drv_attach() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Allocate NVRAM partition ID range for PHY images (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add EF10 register and structure definitions (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Extend struct efx_tx_buffer to allow pushing option descriptors (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Use a global count of active queues instead of pending drains (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Prepare for RX scatter on EF10 (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Initialise IRQ moderation for all NIC types from efx_init_eventq() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Allow efx_nic_type::dimension_resources to fail (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Allow event queue initialisation to fail (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Document conditions for multicast replication vs filter replacement (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Implement asynchronous MCDI requests (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove unnecessary use of atomic_t (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Refactor efx_mcdi_rpc_start() and efx_mcdi_copyin() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add support for new board sensors (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Use extended MC_CMD_SENSOR_INFO and MC_CMD_READ_SENSORS (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Return an error code when a sensor is busy (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add support for reading packet length from prefix (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add TX merged completion counter (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Generalise packet hash lookup to support EF10 RX prefix (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rename EFX_PAGE_BLOCK_SIZE to EFX_VI_PAGE_SIZE and adjust comments (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove early call to efx_nic_type::reconfigure_mac in efx_reset_up() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: use MCDI epoch flag to improve MC reboot detection in the driver (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add EF10 support for TX/RX DMA error events handling (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add a function pointer to abstract write of host time into NIC shared memory (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: PTP MCDI requests need to initialise periph ID field (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Delegate MAC/NIC statistic description to efx_nic_type (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove driver-local struct ethtool_string (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove more left-overs from Falcon GMAC support (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move MTD operations into efx_nic_type (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move NIC-type-specific MTD partition date into separate structures (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Eliminate struct efx_mtd (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rename SPI stuff to show that it is Falcon-specific (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Cleanup Falcon-arch simple MAC filter state (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Define and use MCDI_POPULATE_DWORD_{1, 2, 3, 4, 5, 6, 7} (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add flag for stack-owned RX MAC filters (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Refactor Falcon-arch filter removal (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Make most filter operations NIC-type-specific (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Refactor Falcon-arch search limit reset (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Split Falcon-arch-specific and common filter state (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Extend and abstract efx_filter_spec to cover Huntington/EF10 (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Name the RX drop queue ID (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rename Falcon-arch filter implementation types and functions (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove unused filter_flags variables and efx_farch_filter_id_flags() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Do not assume efx_nic_type::ev_fini is idempotent (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: EFX_WORKAROUND_ALWAYS is really specific to Falcon-architecture (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Get rid of per-NIC-type phys_addr_channels and mem_map_size (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Update and improve kernel-doc for efx_mcdi_state & efx_mcdi_iface (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fix race in completion handling (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add support for MCDI v2 (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Update MCDI protocol definitions for EF10 (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Translate MCDI error numbers received in events (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move and rename Falcon/Siena common NIC operations (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Refactor queue teardown sequence to allow for EF10 flush behaviour (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove bogus call to efx_release_tx_buffers() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Stop RX refill before flushing RX queues (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Limit scope of a Falcon A1 IRQ workaround (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rework IRQ enable/disable (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Remove efx_process_channel_now() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rename Falcon-architecture register definitions (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Make struct efx_special_buffer less special (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add GFP flags to efx_nic_alloc_buffer() and make most callers allow blocking (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Make MCDI independent of Siena (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Make efx_mcdi_init() call efx_mcdi_handle_assertion() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Collect all MCDI port functions into mcdi_port.c (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move efx_mcdi_mac_reconfigure() to siena.c and rename (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move siena_reset_hw() and siena_map_reset_reason() into MCDI module (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Add and use MCDI_SET_QWORD() and MCDI_SET_ARRAY_QWORD() (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Ensure MCDI buffers, but not lengths, are dword aligned (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Use proper macros to declare and access MCDI arrays (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Introduce and use MCDI_CTL_SDU_LEN_MAX_V1 macro for Siena-specific code (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fill out the set of MCDI accessors (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Rationalise MCDI buffer accessors (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Introduce and use MCDI_DECLARE_BUF macro (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move more Falcon-specific code and definitions into falcon.c (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Move details of a Falcon bug workaround out of ethtool.c (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Use efx_mcdi_mon() to find efx_mcdi_mon structure from efx_nic (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: const-qualify source pointers for MMIO write functions (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fix lookup of default RX MAC filters when steered using ethtool (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Enable RX scatter for flows steered by RFS (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fix memory leak when discarding scattered packets (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Improve test for IOMMU in use (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fix IRQ cleanup in case of a probe failure (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Do not pass non-TCP packets into GRO code (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Define and set RX buffer flag for packets parsed as TCP (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Enable accelerated RFS on vlans (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Report software timestamping capabilities (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Increase size of RX SKB header area (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Enable RX checksum offload for packets not handled by GRO (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Fix EEH with legacy interrupts (Nikolay Aleksandrov) [1005248]
  - [netdrv] sfc: Store port number in private data, not net_device::dev_id (Nikolay Aleksandrov) [1005248]


