%global security_hardening none Summary: Kernel Name: linux Version: 4.9.0 Release: 2%{?dist} License: GPLv2 URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. Distribution: Photon #Source0: http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz Source0: http://www.kernel.org/pub/linux/kernel/v4.x/linux-4.9.tar.xz %define sha1 linux=fa46da077c077467776cdc45a7b50d327a081ab4 Source1: config-%{version} # common Patch0: x86-vmware-read-tsc_khz-only-once-at-boot-time.patch Patch1: x86-vmware-use-tsc_khz-value-for-calibrate_cpu.patch Patch2: x86-vmware-add-basic-paravirt-ops-support.patch Patch3: x86-vmware-add-paravirt-sched-clock.patch Patch4: x86-vmware-log-kmsg-dump-on-panic.patch Patch5: double-tcp_mem-limits.patch Patch6: linux-4.9-sysctl-sched_weighted_cpuload_uses_rla.patch Patch7: linux-4.9-watchdog-Disable-watchdog-on-virtual-machines.patch Patch8: linux-4.9-REVERT-sched-fair-Beef-up-wake_wide.patch Patch9: SUNRPC-Do-not-reuse-srcport-for-TIME_WAIT-socket.patch Patch10: SUNRPC-xs_bind-uses-ip_local_reserved_ports.patch Patch11: net-9p-vsock.patch Patch12: x86-vmware-sta.patch BuildRequires: bc BuildRequires: kbd BuildRequires: kmod BuildRequires: glib-devel BuildRequires: xerces-c-devel BuildRequires: xml-security-c-devel BuildRequires: libdnet BuildRequires: libmspack BuildRequires: Linux-PAM-devel BuildRequires: openssl-devel BuildRequires: procps-ng-devel Requires: filesystem kmod coreutils %define uname_r %{version}-%{release} %description The Linux package contains the Linux kernel. %package devel Summary: Kernel Dev Group: System Environment/Kernel Requires: python2 gawk %description devel The Linux package contains the Linux kernel dev files %package drivers-gpu Summary: Kernel GPU Drivers Group: System Environment/Kernel Requires: %{name} = %{version}-%{release} %description drivers-gpu The Linux package contains the Linux kernel drivers for GPU %package sound Summary: Kernel Sound modules Group: System Environment/Kernel Requires: %{name} = %{version}-%{release} %description sound The Linux package contains the Linux kernel sound support %package docs Summary: Kernel docs Group: System Environment/Kernel Requires: python2 %description docs The Linux package contains the Linux kernel doc files %package oprofile Summary: Kernel driver for oprofile, a statistical profiler for Linux systems Group: System Environment/Kernel Requires: %{name} = %{version}-%{release} %description oprofile Kernel driver for oprofile, a statistical profiler for Linux systems %prep #%setup -q -n linux-%{version} %setup -q -n linux-4.9 %patch0 -p1 %patch1 -p1 %patch2 -p1 %patch3 -p1 %patch4 -p1 %patch5 -p1 %patch6 -p1 %patch7 -p1 %patch8 -p1 %patch9 -p1 %patch10 -p1 %patch11 -p1 %patch12 -p1 %build make mrproper cp %{SOURCE1} .config sed -i 's/CONFIG_LOCALVERSION=""/CONFIG_LOCALVERSION="-%{release}"/' .config make LC_ALL= oldconfig make VERBOSE=1 KBUILD_BUILD_VERSION="1-photon" KBUILD_BUILD_HOST="photon" ARCH="x86_64" %{?_smp_mflags} %define __modules_install_post \ find %{buildroot}/lib/modules/%{uname_r} -name *.ko | xargs xz \ %{nil} # We want to compress modules after stripping. Extra step is added to # the default __spec_install_post. %define __spec_install_post\ %{?__debug_package:%{__debug_install_post}}\ %{__arch_install_post}\ %{__os_install_post}\ %{__modules_install_post}\ %{nil} %install install -vdm 755 %{buildroot}/etc install -vdm 755 %{buildroot}/boot install -vdm 755 %{buildroot}%{_defaultdocdir}/%{name}-%{uname_r} install -vdm 755 %{buildroot}/etc/modprobe.d install -vdm 755 %{buildroot}/usr/src/%{name}-headers-%{uname_r} install -vdm 755 %{buildroot}/usr/lib/debug/lib/modules/%{uname_r} make INSTALL_MOD_PATH=%{buildroot} modules_install # Verify for build-id match # We observe different IDs sometimes # TODO: debug it ID1=`readelf -n vmlinux | grep "Build ID"` ./scripts/extract-vmlinux arch/x86/boot/bzImage > extracted-vmlinux ID2=`readelf -n extracted-vmlinux | grep "Build ID"` if [ "$ID1" != "$ID2" ] ; then echo "Build IDs do not match" echo $ID1 echo $ID2 exit 1 fi install -vm 644 arch/x86/boot/bzImage %{buildroot}/boot/vmlinuz-%{uname_r} # Restrict the permission on System.map-X file install -vm 400 System.map %{buildroot}/boot/System.map-%{uname_r} install -vm 644 .config %{buildroot}/boot/config-%{uname_r} cp -r Documentation/* %{buildroot}%{_defaultdocdir}/%{name}-%{uname_r} install -vm 644 vmlinux %{buildroot}/usr/lib/debug/lib/modules/%{uname_r}/vmlinux-%{uname_r} # `perf test vmlinux` needs it ln -s vmlinux-%{uname_r} %{buildroot}/usr/lib/debug/lib/modules/%{uname_r}/vmlinux cat > %{buildroot}/boot/%{name}-%{uname_r}.cfg << "EOF" # GRUB Environment Block photon_cmdline=init=/lib/systemd/systemd ro loglevel=3 quiet plymouth.enable=0 no-vmw-sta photon_linux=vmlinuz-%{uname_r} photon_initrd=initrd.img-%{uname_r} EOF # Cleanup dangling symlinks rm -rf %{buildroot}/lib/modules/%{uname_r}/source rm -rf %{buildroot}/lib/modules/%{uname_r}/build find . -name Makefile* -o -name Kconfig* -o -name *.pl | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/%{name}-headers-%{uname_r}' copy find arch/x86/include include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/%{name}-headers-%{uname_r}' copy find $(find arch/x86 -name include -o -name scripts -type d) -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/%{name}-headers-%{uname_r}' copy find arch/x86/include Module.symvers include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/%{name}-headers-%{uname_r}' copy # CONFIG_STACK_VALIDATION=y requires objtool to build external modules install -vsm 755 tools/objtool/objtool %{buildroot}/usr/src/%{name}-headers-%{uname_r}/tools/objtool/ install -vsm 755 tools/objtool/fixdep %{buildroot}/usr/src/%{name}-headers-%{uname_r}/tools/objtool/ cp .config %{buildroot}/usr/src/%{name}-headers-%{uname_r} # copy .config manually to be where it's expected to be ln -sf "/usr/src/%{name}-headers-%{uname_r}" "%{buildroot}/lib/modules/%{uname_r}/build" find %{buildroot}/lib/modules -name '*.ko' -print0 | xargs -0 chmod u+x %post /sbin/depmod -aq %{uname_r} ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg %post drivers-gpu /sbin/depmod -aq %{uname_r} %post sound /sbin/depmod -aq %{uname_r} %post oprofile /sbin/depmod -aq %{uname_r} %files %defattr(-,root,root) /boot/System.map-%{uname_r} /boot/config-%{uname_r} /boot/vmlinuz-%{uname_r} %config(noreplace) /boot/%{name}-%{uname_r}.cfg /lib/firmware/* %defattr(0644,root,root) /lib/modules/%{uname_r}/* %exclude /lib/modules/%{uname_r}/build %exclude /lib/modules/%{uname_r}/kernel/drivers/gpu %exclude /lib/modules/%{uname_r}/kernel/sound %exclude /lib/modules/%{uname_r}/kernel/arch/x86/oprofile/ %files docs %defattr(-,root,root) %{_defaultdocdir}/%{name}-%{uname_r}/* %files devel %defattr(-,root,root) /lib/modules/%{uname_r}/build /usr/src/%{name}-headers-%{uname_r} %files drivers-gpu %defattr(-,root,root) %exclude /lib/modules/%{uname_r}/kernel/drivers/gpu/drm/cirrus/ /lib/modules/%{uname_r}/kernel/drivers/gpu %files sound %defattr(-,root,root) /lib/modules/%{uname_r}/kernel/sound %files oprofile %defattr(-,root,root) /lib/modules/%{uname_r}/kernel/arch/x86/oprofile/ %changelog * Mon Dec 19 2016 Xiaolin Li 4.9.0-2 - BuildRequires Linux-PAM-devel * Mon Dec 12 2016 Alexey Makhalov 4.9.0-1 - Update to linux-4.9.0 - Add paravirt stolen time accounting feature (from linux-esx), but disable it by default (no-vmw-sta cmdline parameter) * Thu Dec 8 2016 Alexey Makhalov 4.4.35-3 - net-packet-fix-race-condition-in-packet_set_ring.patch to fix CVE-2016-8655 * Wed Nov 30 2016 Alexey Makhalov 4.4.35-2 - Expand `uname -r` with release number - Check for build-id matching - Added syscalls tracing support - Compress modules * Mon Nov 28 2016 Alexey Makhalov 4.4.35-1 - Update to linux-4.4.35 - vfio-pci-fix-integer-overflows-bitmask-check.patch to fix CVE-2016-9083 * Tue Nov 22 2016 Alexey Makhalov 4.4.31-4 - net-9p-vsock.patch * Thu Nov 17 2016 Alexey Makhalov 4.4.31-3 - tty-prevent-ldisc-drivers-from-re-using-stale-tty-fields.patch to fix CVE-2015-8964 * Tue Nov 15 2016 Alexey Makhalov 4.4.31-2 - .config: add cgrup_hugetlb support - .config: add netfilter_xt_{set,target_ct} support - .config: add netfilter_xt_match_{cgroup,ipvs} support * Thu Nov 10 2016 Alexey Makhalov 4.4.31-1 - Update to linux-4.4.31 * Fri Oct 21 2016 Alexey Makhalov 4.4.26-1 - Update to linux-4.4.26 * Wed Oct 19 2016 Alexey Makhalov 4.4.20-6 - net-add-recursion-limit-to-GRO.patch - scsi-arcmsr-buffer-overflow-in-arcmsr_iop_message_xfer.patch * Tue Oct 18 2016 Alexey Makhalov 4.4.20-5 - ipip-properly-mark-ipip-GRO-packets-as-encapsulated.patch - tunnels-dont-apply-GRO-to-multiple-layers-of-encapsulation.patch * Mon Oct 3 2016 Alexey Makhalov 4.4.20-4 - Package vmlinux with PROGBITS sections in -debuginfo subpackage * Tue Sep 27 2016 Alexey Makhalov 4.4.20-3 - .config: CONFIG_IP_SET_HASH_{IPMARK,MAC}=m * Tue Sep 20 2016 Alexey Makhalov 4.4.20-2 - Add -release number for /boot/* files - Use initrd.img with version and release number - Rename -dev subpackage to -devel * Wed Sep 7 2016 Alexey Makhalov 4.4.20-1 - Update to linux-4.4.20 - apparmor-fix-oops-validate-buffer-size-in-apparmor_setprocattr.patch - keys-fix-asn.1-indefinite-length-object-parsing.patch * Thu Aug 25 2016 Alexey Makhalov 4.4.8-11 - vmxnet3 patches to bumpup a version to 1.4.8.0 * Wed Aug 10 2016 Alexey Makhalov 4.4.8-10 - Added VSOCK-Detach-QP-check-should-filter-out-non-matching-QPs.patch - .config: pmem hotplug + ACPI NFIT support - .config: enable EXPERT mode, disable UID16 syscalls * Thu Jul 07 2016 Alexey Makhalov 4.4.8-9 - .config: pmem + fs_dax support * Fri Jun 17 2016 Alexey Makhalov 4.4.8-8 - patch: e1000e-prevent-div-by-zero-if-TIMINCA-is-zero.patch - .config: disable rt group scheduling - not supported by systemd * Wed Jun 15 2016 Harish Udaiya Kumar 4.4.8-7 - fixed the capitalization for - System.map * Thu May 26 2016 Alexey Makhalov 4.4.8-6 - patch: REVERT-sched-fair-Beef-up-wake_wide.patch * Tue May 24 2016 Priyesh Padmavilasom 4.4.8-5 - GA - Bump release of all rpms * Mon May 23 2016 Harish Udaiya Kumar 4.4.8-4 - Fixed generation of debug symbols for kernel modules & vmlinux. * Mon May 23 2016 Divya Thaluru 4.4.8-3 - Added patches to fix CVE-2016-3134, CVE-2016-3135 * Wed May 18 2016 Harish Udaiya Kumar 4.4.8-2 - Enabled CONFIG_UPROBES in config as needed by ktap * Wed May 04 2016 Alexey Makhalov 4.4.8-1 - Update to linux-4.4.8 - Added net-Drivers-Vmxnet3-set-... patch * Tue May 03 2016 Vinay Kulkarni 4.2.0-27 - Compile Intel GigE and VMXNET3 as part of kernel. * Thu Apr 28 2016 Nick Shi 4.2.0-26 - Compile cramfs.ko to allow mounting cramfs image * Tue Apr 12 2016 Vinay Kulkarni 4.2.0-25 - Revert network interface renaming disable in kernel. * Tue Mar 29 2016 Alexey Makhalov 4.2.0-24 - Support kmsg dumping to vmware.log on panic - sunrpc: xs_bind uses ip_local_reserved_ports * Mon Mar 28 2016 Harish Udaiya Kumar 4.2.0-23 - Enabled Regular stack protection in Linux kernel in config * Thu Mar 17 2016 Harish Udaiya Kumar 4.2.0-22 - Restrict the permissions of the /boot/System.map-X file * Fri Mar 04 2016 Alexey Makhalov 4.2.0-21 - Patch: SUNRPC: Do not reuse srcport for TIME_WAIT socket. * Wed Mar 02 2016 Alexey Makhalov 4.2.0-20 - Patch: SUNRPC: Ensure that we wait for connections to complete before retrying * Fri Feb 26 2016 Alexey Makhalov 4.2.0-19 - Disable watchdog under VMware hypervisor. * Thu Feb 25 2016 Alexey Makhalov 4.2.0-18 - Added rpcsec_gss_krb5 and nfs_fscache * Mon Feb 22 2016 Alexey Makhalov 4.2.0-17 - Added sysctl param to control weighted_cpuload() behavior * Thu Feb 18 2016 Divya Thaluru 4.2.0-16 - Disabling network renaming * Sun Feb 14 2016 Alexey Makhalov 4.2.0-15 - veth patch: don’t modify ip_summed * Thu Feb 11 2016 Alexey Makhalov 4.2.0-14 - Full tickless -> idle tickless + simple CPU time accounting - SLUB -> SLAB - Disable NUMA balancing - Disable stack protector - No build_forced no-CBs CPUs - Disable Expert configuration mode - Disable most of debug features from 'Kernel hacking' * Mon Feb 08 2016 Alexey Makhalov 4.2.0-13 - Double tcp_mem limits, patch is added. * Wed Feb 03 2016 Anish Swaminathan 4.2.0-12 - Fixes for CVE-2015-7990/6937 and CVE-2015-8660. * Tue Jan 26 2016 Anish Swaminathan 4.2.0-11 - Revert CONFIG_HZ=250 * Fri Jan 22 2016 Alexey Makhalov 4.2.0-10 - Fix for CVE-2016-0728 * Wed Jan 13 2016 Alexey Makhalov 4.2.0-9 - CONFIG_HZ=250 * Tue Jan 12 2016 Mahmoud Bassiouny 4.2.0-8 - Remove rootfstype from the kernel parameter. * Mon Jan 04 2016 Harish Udaiya Kumar 4.2.0-7 - Disabled all the tracing options in kernel config. - Disabled preempt. - Disabled sched autogroup. * Thu Dec 17 2015 Harish Udaiya Kumar 4.2.0-6 - Enabled kprobe for systemtap & disabled dynamic function tracing in config * Fri Dec 11 2015 Harish Udaiya Kumar 4.2.0-5 - Added oprofile kernel driver sub-package. * Fri Nov 13 2015 Mahmoud Bassiouny 4.2.0-4 - Change the linux image directory. * Wed Nov 11 2015 Harish Udaiya Kumar 4.2.0-3 - Added the build essential files in the dev sub-package. * Mon Nov 09 2015 Vinay Kulkarni 4.2.0-2 - Enable Geneve module support for generic kernel. * Fri Oct 23 2015 Harish Udaiya Kumar 4.2.0-1 - Upgraded the generic linux kernel to version 4.2.0 & and updated timer handling to full tickless mode. * Tue Sep 22 2015 Harish Udaiya Kumar 4.0.9-5 - Added driver support for frame buffer devices and ACPI * Wed Sep 2 2015 Alexey Makhalov 4.0.9-4 - Added mouse ps/2 module. * Fri Aug 14 2015 Alexey Makhalov 4.0.9-3 - Use photon.cfg as a symlink. * Thu Aug 13 2015 Alexey Makhalov 4.0.9-2 - Added environment file(photon.cfg) for grub. * Wed Aug 12 2015 Sharath George 4.0.9-1 - Upgrading kernel version. * Wed Aug 12 2015 Alexey Makhalov 3.19.2-5 - Updated OVT to version 10.0.0. - Rename -gpu-drivers to -drivers-gpu in accordance to directory structure. - Added -sound package/ * Tue Aug 11 2015 Anish Swaminathan 3.19.2-4 - Removed Requires dependencies. * Fri Jul 24 2015 Harish Udaiya Kumar 3.19.2-3 - Updated the config file to include graphics drivers. * Mon May 18 2015 Touseef Liaqat 3.13.3-2 - Update according to UsrMove. * Wed Nov 5 2014 Divya Thaluru 3.13.3-1 - Initial build. First version