From 3f9da74d45bd9806876106442abe0bceabc397e5 Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Fri, 6 Mar 2026 09:31:39 -0700 Subject: [PATCH] kernel-6.19.6-100 * Wed Mar 04 2026 Justin M. Forbes [6.19.6-0] - net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao) - net: macb: Replace open-coded device config retrieval with of_device_get_match_data() (Kevin Hao) - net: macb: convert to use .get_rx_ring_count (Breno Leitao) - net: cadence: macb: Discard pm_runtime_put() return value (Rafael J. Wysocki) - arm64: dts: broadcom: bcm2712: Add watchdog DT node (Stanimir Varbanov) - arm64: dts: broadcom: bcm2712: Enable RNG (Peter Robinson) - fedora: minor beeper cleanups (Peter Robinson) - Add config introduced in 6.19.4 (Justin M. Forbes) - Linux v6.19.6 Resolves: Signed-off-by: Justin M. Forbes --- dtbloader.sbat.template | 2 - kernel.spec | 188 ++++++++-------------------------------- sources | 4 +- 3 files changed, 39 insertions(+), 155 deletions(-) delete mode 100644 dtbloader.sbat.template diff --git a/dtbloader.sbat.template b/dtbloader.sbat.template deleted file mode 100644 index 0a1480bcc..000000000 --- a/dtbloader.sbat.template +++ /dev/null @@ -1,2 +0,0 @@ -sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md -kernel-dtbloader.@SBAT_SUFFIX,1,Red Hat,kernel-uki-virt,@KVER,mailto:secalert@redhat.com diff --git a/kernel.spec b/kernel.spec index 4deeae632..12ca375d7 100644 --- a/kernel.spec +++ b/kernel.spec @@ -342,17 +342,6 @@ Summary: The Linux kernel %define with_efiuki 0 %endif -%ifarch aarch64 -# dtbloader sub-package requires stubble which is only in Fedora for now -%if 0%{?fedora} -%define with_dtbloader %{?_without_dtbloader: 0} %{?!_without_dtbloader: 1} -%else -%define with_dtbloader 0 -%endif -%else -%define with_dtbloader 0 -%endif - %if 0%{?fedora} # Kernel headers are being split out into a separate package %define with_headers 0 @@ -461,7 +450,6 @@ Summary: The Linux kernel %define with_selftests 0 %define with_headers 0 %define with_efiuki 0 -%define with_dtbloader 0 %define with_zfcpdump 0 %define with_arm64_16k 0 %define with_arm64_64k 0 @@ -500,7 +488,6 @@ Summary: The Linux kernel %define with_selftests 0 %define with_headers 0 %define with_efiuki 0 -%define with_dtbloader 0 %define with_zfcpdump 0 %define with_vdso_install 0 %define with_kabichk 0 @@ -530,7 +517,6 @@ Summary: The Linux kernel %define with_arm64_16k 0 %define with_arm64_64k 0 %define with_efiuki 0 -%define with_dtbloader 0 %define with_doc 0 %define with_headers 0 %define with_cross_headers 0 @@ -781,8 +767,6 @@ Requires: %{name}-core-uname-r = %{KVERREL} Requires: %{name}-modules-uname-r = %{KVERREL} Requires: %{name}-modules-core-uname-r = %{KVERREL} Requires: ((%{name}-modules-extra-uname-r = %{KVERREL}) if %{name}-modules-extra-matched) -# Prefer the plain kernel-core pkg as core-uname-r provider -Suggests: %{name}-core = %{specversion}-%{release} Provides: installonlypkg(kernel) %endif @@ -964,22 +948,15 @@ BuildRequires: dracut BuildRequires: binutils # For the initrd BuildRequires: lvm2 +BuildRequires: systemd-boot-unsigned # For systemd-stub and systemd-pcrphase BuildRequires: systemd-udev >= 252-1 # For systemd-repart BuildRequires: xfsprogs e2fsprogs dosfstools -# For TPM operations in UKI initramfs -BuildRequires: tpm2-tools -%endif - -%if %{with_dtbloader} -BuildRequires: stubble -%endif - -%if %{with_efiuki} || %{with_dtbloader} -BuildRequires: systemd-boot-unsigned # For UKI kernel cmdline addons BuildRequires: systemd-ukify +# For TPM operations in UKI initramfs +BuildRequires: tpm2-tools # For UKI sb cert %if 0%{?rhel}%{?centos} && !0%{?eln} %if 0%{?centos} @@ -1019,23 +996,18 @@ Source13: redhatsecureboot501.cer %define pesign_name_0 redhatsecureboot501 %define secureboot_ca_0 %{SOURCE10} %define secureboot_key_0 %{SOURCE13} -%define pesign_name_uki_0 %{pesign_name_0} -%define secureboot_key_uki_0 %{secureboot_key_0} %endif # RHEL/centos certs come from system-sb-certs %if 0%{?rhel} && !0%{?eln} %define secureboot_ca_0 %{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer %define secureboot_key_0 %{_datadir}/pki/sb-certs/secureboot-kernel-%{_arch}.cer -%define secureboot_key_uki_0 %{_datadir}/pki/sb-certs/secureboot-uki-virt-%{_arch}.cer %if 0%{?centos} %define pesign_name_0 centossecureboot201 -%define pesign_name_uki_0 centossecureboot204 %else %ifarch x86_64 aarch64 %define pesign_name_0 redhatsecureboot501 -%define pesign_name_uki_0 redhatsecureboot504 %endif %ifarch s390x %define pesign_name_0 redhatsecureboot302 @@ -1110,7 +1082,6 @@ Source77: partial-clang_lto-aarch64-debug-snip.config Source80: generate_all_configs.sh Source81: process_configs.sh -Source82: dtbloader.sbat.template Source83: uki.sbat.template Source84: uki-addons.sbat.template Source85: kernel.sbat.template @@ -1762,8 +1733,6 @@ Requires: %{name}-%{1}-core-uname-r = %{KVERREL}%{uname_suffix %{1}}\ Requires: %{name}-%{1}-modules-uname-r = %{KVERREL}%{uname_suffix %{1}}\ Requires: %{name}-%{1}-modules-core-uname-r = %{KVERREL}%{uname_suffix %{1}}\ Requires: ((%{name}-%{1}-modules-extra-uname-r = %{KVERREL}%{uname_suffix %{1}}) if %{name}-modules-extra-matched)\ -# Prefer the plain kernel--core pkg as core-uname-r provider\ -Suggests: %{name}-%{1}-core = %{specversion}-%{release}\ %if "%{1}" == "rt" || "%{1}" == "rt-debug" || "%{1}" == "rt-64k" || "%{1}" == "rt-64k-debug"\ Requires: realtime-setup\ %endif\ @@ -1826,19 +1795,6 @@ Provides: installonlypkg(kernel)\ Requires: %{name}%{?1:-%{1}}-uki-virt = %{specrpmversion}-%{release}\ Requires(pre): systemd >= 254-1\ %endif\ -%if %{with_dtbloader} && ("%{?1}" == "" || "%{1}" == "debug")\ -# This is not a full UKI, uki is in the name for compat with kernel_variant_posttrans -u\ -%package %{?1:%{1}-}uki-dtbloader\ -Summary: %{variant_summary} with systemd-stub for auto DTB loading\ -Provides: installonlypkg(kernel)\ -Provides: %{name}-uname-r = %{KVERREL}%{uname_suffix %{?1}}\ -Provides: %{name}%{?1:-%{1}}-core-uname-r = %{KVERREL}%{uname_suffix %{?1}}\ -Requires: %{name}%{?1:-%{1}}-modules-core-uname-r = %{KVERREL}%{uname_suffix %{?1}}\ -Requires(pre): %{kernel_prereq}\ -# "kernel-install add ..." treats this as a regular kernel, which is what we want.\ -# This causes a /boot/vmlinuz-$(uname -r) and BLS .conf file conflict with kernel-core.\ -Conflicts: %{name}%{?1:-%{1}}-core = %{specrpmversion}-%{release}\ -%endif\ %if %{with_gcov}\ %{expand:%%kernel_gcov_package %{?1:%{1}}}\ %endif\ @@ -2066,16 +2022,6 @@ Prebuilt 64k unified kernel image for virtual machines. Prebuilt 64k unified kernel image addons for virtual machines. %endif -%if %{with_stock} && %{with_debug} && %{with_dtbloader} -%description debug-uki-dtbloader -Prebuilt debug kernel image with auto DTB selection for ARM64 UEFI devices. -%endif - -%if %{with_stock_base} && %{with_dtbloader} -%description uki-dtbloader -Prebuilt default kernel image with auto DTB selection for ARM64 UEFI devices. -%endif - %ifnarch noarch %{nobuildarches} %kernel_modules_extra_matched_package %endif @@ -2203,7 +2149,6 @@ rm -f localversion-next localversion-rt scripts/clang-tools 2> /dev/null # SBAT data -sed -e s,@KVER,%{KVERREL}, -e s,@SBAT_SUFFIX,%{sbat_suffix}, %{SOURCE82} > dtbloader.sbat sed -e s,@KVER,%{KVERREL}, -e s,@SBAT_SUFFIX,%{sbat_suffix}, %{SOURCE83} > uki.sbat sed -e s,@KVER,%{KVERREL}, -e s,@SBAT_SUFFIX,%{sbat_suffix}, %{SOURCE84} > uki-addons.sbat sed -e s,@KVER,%{KVERREL}, -e s,@SBAT_SUFFIX,%{sbat_suffix}, %{SOURCE85} > kernel.sbat @@ -2986,82 +2931,51 @@ BuildKernel() { rm -f $KernelUnifiedInitrd - KernelAddonsDirOut="$KernelUnifiedImage.extra.d" - mkdir -p $KernelAddonsDirOut - python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu} @uki-addons.sbat + KernelAddonsDirOut="$KernelUnifiedImage.extra.d" + mkdir -p $KernelAddonsDirOut + python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu} @uki-addons.sbat %if %{signkernel} %{log_msg "Sign the EFI UKI kernel"} - %pesign -s -i $KernelUnifiedImage -o $KernelUnifiedImage.signed -a %{secureboot_ca_0} -c %{secureboot_key_uki_0} -n %{pesign_name_uki_0} +%if 0%{?fedora}%{?eln} + %pesign -s -i $KernelUnifiedImage -o $KernelUnifiedImage.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0} +%else +%if 0%{?centos} + UKI_secureboot_name=centossecureboot204 +%else + UKI_secureboot_name=redhatsecureboot504 +%endif + UKI_secureboot_cert=%{_datadir}/pki/sb-certs/secureboot-uki-virt-%{_arch}.cer + + %pesign -s -i $KernelUnifiedImage -o $KernelUnifiedImage.signed -a %{secureboot_ca_0} -c $UKI_secureboot_cert -n $UKI_secureboot_name +# 0%{?fedora}%{?eln} +%endif if [ ! -s $KernelUnifiedImage.signed ]; then echo "pesigning failed" exit 1 fi mv $KernelUnifiedImage.signed $KernelUnifiedImage - for addon in "$KernelAddonsDirOut"/*; do - %pesign -s -i $addon -o $addon.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0} - rm -f $addon - mv $addon.signed $addon - done + for addon in "$KernelAddonsDirOut"/*; do + %pesign -s -i $addon -o $addon.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0} + rm -f $addon + mv $addon.signed $addon + done + +# signkernel %endif - # hmac sign the UKI for FIPS - KernelUnifiedImageHMAC="$KernelUnifiedImageDir/.$InstallName-virt.efi.hmac" - %{log_msg "hmac sign the UKI for FIPS"} - %{log_msg "Creating hmac file: $KernelUnifiedImageHMAC"} - (cd $KernelUnifiedImageDir && sha512hmac $InstallName-virt.efi) > $KernelUnifiedImageHMAC; + # hmac sign the UKI for FIPS + KernelUnifiedImageHMAC="$KernelUnifiedImageDir/.$InstallName-virt.efi.hmac" + %{log_msg "hmac sign the UKI for FIPS"} + %{log_msg "Creating hmac file: $KernelUnifiedImageHMAC"} + (cd $KernelUnifiedImageDir && sha512hmac $InstallName-virt.efi) > $KernelUnifiedImageHMAC; # with_efiuki %endif : # in case of empty block fi # "$Variant" == "rt" || "$Variant" == "rt-debug" || "$Variant" == "automotive" || "$Variant" == "automotive-debug" -%if %{with_dtbloader} - if [[ -z "$Variant" || "$Variant" == "debug" ]]; then - %{log_msg "Setup the DTB-loader kernel"} - DtbloaderImage="$RPM_BUILD_ROOT/lib/modules/$KernelVer/$InstallName-dtbloader.efi" - DtbPath=$RPM_BUILD_ROOT/%{image_install_path}/dtb-$KernelVer/qcom - - pushd $DtbPath - Dtbs="" - for i in x1 sc8?80x; do - Dtbs="$Dtbs $(ls $i*.dtb | grep -v -E 'el2|devkit|crd|qcp|primus')" - done - popd - - DevicetreeAuto="" - for i in $Dtbs; do - DevicetreeAuto="$DevicetreeAuto --devicetree-auto=$DtbPath/$i" - done - - # os-release is unset, so that this is not seen as a full UKI by - # "kernel-install add" and instead is treated as a normal kernel image, - # causing kernel-install to generate an initrd + standard BLS cfg. - # This is also required for systemd-stub to work with a GRUB provided - # initramfs. - ukify build --linux=$(realpath $KernelImage) \ - --sbat=@dtbloader.sbat --os-release="" --uname=$KernelVer \ - --hwids=/usr/share/stubble/hwids $DevicetreeAuto --output=$DtbloaderImage - -%if %{signkernel} - %{log_msg "Sign the DTB-loader kernel"} - %pesign -s -i $DtbloaderImage -o $DtbloaderImage.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0} - if [ ! -s $DtbloaderImage.signed ]; then - echo "pesigning failed" - exit 1 - fi - mv $DtbloaderImage.signed $DtbloaderImage -%endif - chmod 755 $DtbloaderImage - - %{log_msg "hmac sign the DTB-loader kernel for FIPS"} - pushd $(dirname $DtbloaderImage) - sha512hmac $(basename $DtbloaderImage) > .$(basename $DtbloaderImage).hmac - popd - fi # -z "$Variant" || "$Variant" == "debug" -# with_dtbloader -%endif # # Generate the modules files lists @@ -4285,11 +4199,6 @@ fi\ %kernel_variant_preun -u virt -e %endif -%if %{with_stock_base} && %{with_dtbloader} -%kernel_variant_posttrans -u dtbloader -%kernel_variant_preun -u dtbloader -%endif - %if %{with_stock_base} %kernel_variant_preun -e %kernel_variant_post @@ -4305,11 +4214,6 @@ fi\ %kernel_variant_preun -v debug -u virt -e %endif -%if %{with_stock} && %{with_debug} && %{with_dtbloader} -%kernel_variant_posttrans -v debug -u dtbloader -%kernel_variant_preun -v debug -u dtbloader -%endif - %if %{with_stock} && %{with_debug} %kernel_variant_preun -v debug -e %kernel_variant_post -v debug @@ -4633,7 +4537,6 @@ fi\ # - kernel-devel: headers and build infrastructure # - kernel-debuginfo: vmlinux with debug symbols (if with_debuginfo) # - kernel-uki-virt: unified kernel image for VMs (if with_efiuki) -# - kernel-uki-dtbloader: kernel with systemd-stub for auto DTB loading (if with_dtbloader) # %define kernel_variant_files(k:) \ %if %{2}\ @@ -4717,28 +4620,6 @@ fi\ %dir /lib/modules/%{KVERREL}%{?3:+%{3}}/%{?-k:%{-k*}}%{!?-k:vmlinuz}-virt.efi.extra.d/ \ /lib/modules/%{KVERREL}%{?3:+%{3}}/%{?-k:%{-k*}}%{!?-k:vmlinuz}-virt.efi.extra.d/*.addon.efi\ %endif\ -%if %{with_dtbloader} && ("%{?3}" == "" || "%{3}" == "debug")\ -%{expand:%%files %{?3:%{3}-}uki-dtbloader}\ -%%license linux-%{KVERREL}/COPYING-%{version}-%{release}\ -%dir /lib/modules\ -%dir /lib/modules/%{KVERREL}%{?3:+%{3}}\ -/lib/modules/%{KVERREL}%{?3:+%{3}}/System.map\ -/lib/modules/%{KVERREL}%{?3:+%{3}}/config\ -/lib/modules/%{KVERREL}%{?3:+%{3}}/modules.builtin*\ -/lib/modules/%{KVERREL}%{?3:+%{3}}/symvers.%compext\ -/lib/modules/%{KVERREL}%{?3:+%{3}}/%{?-k:%{-k*}}%{!?-k:vmlinuz}-dtbloader.efi\ -/lib/modules/%{KVERREL}%{?3:+%{3}}/.%{?-k:%{-k*}}%{!?-k:vmlinuz}-dtbloader.efi.hmac\ -%ghost %attr(0644, root, root) /boot/System.map-%{KVERREL}%{?3:+%{3}}\ -%ghost %attr(0644, root, root) /boot/config-%{KVERREL}%{?3:+%{3}}\ -%ghost %attr(0600, root, root) /boot/initramfs-%{KVERREL}%{?3:+%{3}}.img\ -%ghost %attr(0644, root, root) /boot/symvers-%{KVERREL}%{?3:+%{3}}.%compext\ -%ghost %attr(0755, root, root) /%{image_install_path}/%{?-k:%{-k*}}%{!?-k:vmlinuz}-%{KVERREL}%{?3:+%{3}}\ -%ghost %attr(0644, root, root) /%{image_install_path}/.%{?-k:%{-k*}}%{!?-k:vmlinuz}-%{KVERREL}%{?3:+%{3}}.hmac\ -%ifarch aarch64 riscv64\ -/lib/modules/%{KVERREL}%{?3:+%{3}}/dtb \ -%ghost /%{image_install_path}/dtb-%{KVERREL}%{?3:+%{3}} \ -%endif\ -%endif\ %if %{?3:1} %{!?3:0}\ %{expand:%%files %{3}}\ %endif\ @@ -4811,7 +4692,12 @@ fi\ # # %changelog -* Wed Mar 04 2026 Justin M. Forbes [6.19.6-100] +* Fri Mar 06 2026 Justin M. Forbes [6.19.6-100] +- Revert "redhat/kernel.spec.template: Fix indentation of uki-virt generation code" (Justin M. Forbes) +- Revert "redhat/kernel.spec.template: Simplify uki-virt signing" (Justin M. Forbes) +- Revert "redhat/kernel.spec.template: Add kernel-uki-dtbloader sub-package" (Justin M. Forbes) +- Revert "redhat/kernel.spec.template: Make -uki-dtbloader provide kernel-core-uname-r" (Justin M. Forbes) +- Revert the UKI dtbloader for F42 (Justin M. Forbes) - Turn on release_targets for F43/F42 (Justin M. Forbes) * Wed Mar 04 2026 Justin M. Forbes [6.19.6-0] diff --git a/sources b/sources index 4176d2078..820286307 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (linux-6.19.6.tar.xz) = 93f896fe12f5155aa2cc1deea73dee0eebf09657b1a5b195cd960b4012ad0002c8620925e6869124edf80dfa50423b5731f0e9c037f8744b5ca8267949fa4d7b -SHA512 (kernel-abi-stablelists-6.19.6.tar.xz) = 1c77c5c3d1ef8d5770aaabd4e52515ae8b4b495ef4f8973f1a6a4218203d6ca3834a03cc21e60039fb03dd844a48e917d7dcef3c550eebbebe7dcb6ca47b09b2 -SHA512 (kernel-kabi-dw-6.19.6.tar.xz) = dd6ebbc436e8807fc4eca067e773de2db1ca0d31f1862a899271222df66ff099c1ead0627562049a687e331c576bf87845c292aa6534f7b8e7672789caccf7a3 +SHA512 (kernel-abi-stablelists-6.19.6.tar.xz) = a3f1d5e5e2cb8e78a71e8945329e32ff234be127a74a1f342671398de401aabcd0aae06ee78d887ab4a8916026b217a05f960ce8ba4e13ce76a9e44479ca2c32 +SHA512 (kernel-kabi-dw-6.19.6.tar.xz) = 65d671f697561d834cd7d66df0ba7800a7dd8f90cdda370cd2603e203a93ea4cc3da9a42d21ae3332e8e5c55a39f98fc777bc27663777fbfcfba72cf69f30106