ciq EL8 sbat 5

.grub2.checksum

@@ -1 +1 @@
-8d7f5f4b18a7c50b2a4258333f144052f33f9a0502e1da1efd21f497f94074e3
+Direct Git Import

.grub2.metadata

@@ -1,9 +1,3 @@
-c6d43c94bcbc73c81df3026bc201a88886b8ceebe98188cdb69bdd61bd6be287 SOURCES/redhatsecureboot701.cer
-9996c73616ee42f13396c9abfb4b646b538c3c80940474b710afdbe53bf17d32 SOURCES/redhatsecurebootca3.cer
 810b3798d316394f94096ec2797909dbf23c858e48f7b3830826b8daa06b7b0f SOURCES/grub-2.02.tar.xz
-40175d4c7c5ab4bd753a493f47952f1d8dcf1c219b836968a693e48bd4766135 SOURCES/redhatsecurebootca5.cer
 1fddd06b4854598a18ff3742c472c6a5c609929ce1ab74ec9901812aaf30be02 SOURCES/theme.tar.bz2
 122b9c470f29b70223b0e07404a6dfa7f339fcfa6ae74c024f478945af7a9a63 SOURCES/unifont-5.1.20080820.pcf.gz
-224f7059328df355810fee105e79af2e9fc7e520504f9f545c08ca4e32e8c200 SOURCES/redhatsecureboot301.cer
-3f564ef41227562f9ea45c3fd8f96bea9ab8205247ef72dd025fdcd728373a00 SOURCES/redhatsecureboot502.cer
-8f435a96261e571ed557f9243e7fe7db5b93bc8f7eefcfc5b0c154d5d29292fb SOURCES/redhatsecureboot601.cer

SOURCES/0579-Regenerate-kernelopts-if-missing-on-ppc.patch

@@ -0,0 +1,36 @@
+From 8c74431327e0c7d7fe47462b0e69fcbe3bbac56e Mon Sep 17 00:00:00 2001
+From: Marta Lewandowska <mlewando@redhat.com>
+Date: Fri, 24 Mar 2023 09:14:29 -0400
+Subject: [PATCH] Regenerate kernelopts if missing on ppc
+
+Signed-off-by: Marta Lewandowska <mlewando@redhat.com>
+---
+ util/grub.d/10_linux_bls.in | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/util/grub.d/10_linux_bls.in b/util/grub.d/10_linux_bls.in
+index 855dbdd..f2281bc 100644
+--- a/util/grub.d/10_linux_bls.in
++++ b/util/grub.d/10_linux_bls.in
+@@ -117,6 +117,18 @@ cat <<EOF
+ # This section was generated by a script. Do not modify the generated file - all changes
+ # will be lost the next time file is regenerated. Instead edit the BootLoaderSpec files.
+
++# The kernelopts variable should be defined in the grubenv file. But to ensure that menu
++# entries populated from BootLoaderSpec files that use this variable work correctly even
++# without a grubenv file, define a fallback kernelopts variable if this has not been set.
++#
++# The kernelopts variable in the grubenv file can be modified using the grubby tool or by
++# executing the grub2-mkconfig tool. For the latter, the values of the GRUB_CMDLINE_LINUX
++# and GRUB_CMDLINE_LINUX_DEFAULT options from /etc/default/grub file are used to set both
++# the kernelopts variable in the grubenv file and the fallback kernelopts variable.
++if [ -z "\${kernelopts}" ]; then
++  set kernelopts="root=${linux_root_device_thisversion} ro ${args}"
++fi
++
+ EOF
+ }
+
+-- 
+2.39.1
+

SOURCES/0580-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch

@@ -0,0 +1,210 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stefan Berger <stefanb@linux.ibm.com>
+Date: Tue, 8 Aug 2023 12:21:55 -0400
+Subject: [PATCH] kern/ieee1275/init: ppc64: Restrict high memory in presence
+ of fadump
+
+This is a backport of the patch with the same name to grub 2.02.
+
+When a kernel dump is present then restrict the high memory regions to
+avoid allocating memory where the kernel dump resides. Use the
+ibm,kernel-dump node under /rtas to determine whether a kernel dump exists
+and up to which limit grub can use available memory. Set the
+upper_mem_limit to the size of the kernel dump section of type
+'REAL_MODE_REGION' and therefore only allow grub's memory usage for high
+addresses from 768MB to 'upper_mem_limit'. This means that grub can
+use high memory in the range of 768MB to upper_mem_limit and
+the kernel-dump memory regions above 'upper_mem_limit' remain untouched.
+This change has no effect on memory allocations below 640MB.
+
+Also, fall back to allocating below 640MB in case the chunk of
+memory there would be larger than the chunk of memory above 768MB.
+This can for example occur if a free memory area is found starting at 300MB
+extending up to 1GB but a kernel dump is located at 768MB and therefore
+does not allow the allocation of the high memory area but requiring to use
+the chunk starting at 300MB to avoid an unnecessary out-of-memory
+condition.
+
+Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
+Cc: Hari Bathini <hbathini@linux.ibm.com>
+Cc: Pavithra Prakash <pavrampu@in.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Carolyn Scherrer <cpscherr@us.ibm.com>
+Cc: Mahesh Salgaonkar <mahesh@linux.ibm.com>
+Cc: Sourabh Jain <sourabhjain@linux.ibm.com>
+---
+ grub-core/kern/ieee1275/init.c | 139 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 139 insertions(+)
+
+diff --git a/grub-core/kern/ieee1275/init.c b/grub-core/kern/ieee1275/init.c
+index 1fae84440403..31843ab70a62 100644
+--- a/grub-core/kern/ieee1275/init.c
++++ b/grub-core/kern/ieee1275/init.c
+@@ -17,6 +17,8 @@
+  *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+  */
+
++#include <stddef.h> /* offsetof() */
++
+ #include <grub/kernel.h>
+ #include <grub/dl.h>
+ #include <grub/disk.h>
+@@ -180,6 +182,97 @@ grub_claim_heap (void)
+ 				 + GRUB_KERNEL_MACHINE_STACK_SIZE), 0x200000);
+ }
+ #else
++
++/* ibm,kernel-dump data structures */
++struct kd_section
++{
++  grub_uint32_t flags;
++  grub_uint16_t src_datatype;
++#define KD_SRC_DATATYPE_REAL_MODE_REGION  0x0011
++  grub_uint16_t error_flags;
++  grub_uint64_t src_address;
++  grub_uint64_t num_bytes;
++  grub_uint64_t act_bytes;
++  grub_uint64_t dst_address;
++} GRUB_PACKED;
++
++#define MAX_KD_SECTIONS 10
++
++struct kernel_dump
++{
++  grub_uint32_t format;
++  grub_uint16_t num_sections;
++  grub_uint16_t status_flags;
++  grub_uint32_t offset_1st_section;
++  grub_uint32_t num_blocks;
++  grub_uint64_t start_block;
++  grub_uint64_t num_blocks_avail;
++  grub_uint32_t offet_path_string;
++  grub_uint32_t max_time_allowed;
++  struct kd_section kds[MAX_KD_SECTIONS]; /* offset_1st_section should point to kds[0] */
++} GRUB_PACKED;
++
++/*
++ * Determine if a kernel dump exists and if it does, then determine the highest
++ * address that grub can use for memory allocations.
++ * The caller must have initialized *highest to ~0. *highest will not
++ * be modified if no kernel dump is found.
++ */
++static int
++check_kernel_dump (grub_uint64_t *highest)
++{
++  struct kernel_dump kernel_dump;
++  grub_ssize_t kernel_dump_size;
++  grub_ieee1275_phandle_t rtas;
++  struct kd_section *kds;
++  grub_size_t i;
++
++  /* If there's a kernel-dump it must have at least one section */
++  if (grub_ieee1275_finddevice ("/rtas", &rtas) ||
++      grub_ieee1275_get_property (rtas, "ibm,kernel-dump", &kernel_dump,
++                                  sizeof (kernel_dump), &kernel_dump_size) ||
++      kernel_dump_size <= (grub_ssize_t) offsetof (struct kernel_dump, kds[1]))
++    return 0;
++
++  kernel_dump_size = grub_min (kernel_dump_size, (grub_ssize_t) sizeof (kernel_dump));
++
++  if (grub_be_to_cpu32 (kernel_dump.format) != 1)
++    {
++      grub_printf (_("Error: ibm,kernel-dump has an unexpected format version '%u'\n"),
++                   grub_be_to_cpu32 (kernel_dump.format));
++      return 0;
++    }
++
++  if (grub_be_to_cpu16 (kernel_dump.num_sections) > MAX_KD_SECTIONS)
++    {
++      grub_printf (_("Error: Too many kernel dump sections: %d\n"),
++                   grub_be_to_cpu32 (kernel_dump.num_sections));
++      return 0;
++    }
++
++  for (i = 0; i < grub_be_to_cpu16 (kernel_dump.num_sections); i++)
++    {
++      kds = (struct kd_section *) ((grub_addr_t) &kernel_dump +
++                                   grub_be_to_cpu32 (kernel_dump.offset_1st_section) +
++                                   i * sizeof (struct kd_section));
++      /* sanity check the address is within the 'kernel_dump' struct */
++      if ((grub_addr_t) kds > (grub_addr_t) &kernel_dump + kernel_dump_size + sizeof (*kds))
++        {
++          grub_printf (_("Error: 'kds' address beyond last available section\n"));
++          return 0;
++        }
++
++      if ((grub_be_to_cpu16 (kds->src_datatype) == KD_SRC_DATATYPE_REAL_MODE_REGION) &&
++          (grub_be_to_cpu64 (kds->src_address) == 0))
++        {
++          *highest = grub_min (*highest, grub_be_to_cpu64 (kds->num_bytes));
++          break;
++        }
++    }
++
++  return 1;
++}
++
+ /* Helper for grub_claim_heap on powerpc. */
+ static int
+ heap_size (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+@@ -207,7 +300,9 @@ static int
+ heap_init (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+ 	   void *data)
+ {
++  grub_uint64_t upper_mem_limit = ~0;
+   grub_uint32_t total = *(grub_uint32_t *)data;
++  int has_kernel_dump;
+
+   if (type != GRUB_MEMORY_AVAILABLE)
+     return 0;
+@@ -243,6 +338,50 @@ heap_init (grub_uint64_t addr, grub_uint64_t len, grub_memory_type_t type,
+       len = 0;
+     }
+
++  has_kernel_dump = check_kernel_dump (&upper_mem_limit);
++  if (has_kernel_dump)
++    {
++      grub_uint64_t lo_len = 0, hi_len = 0;
++
++      if (addr > upper_mem_limit || upper_mem_limit == (grub_uint64_t)~0)
++        return 0;
++
++      /* limit len to stay below upper_mem_limit */
++      if (addr < upper_mem_limit && (addr + len) > upper_mem_limit)
++        {
++           len = grub_min (len, upper_mem_limit - addr);
++        }
++
++      /* We can allocate below 640MB or above 768MB.
++       * Choose the bigger chunk below 640MB or above 768MB.
++       */
++      if (addr < 0x28000000)
++        {
++           lo_len = grub_min (len, 0x28000000 - addr);
++        }
++      if (addr + len > 0x30000000)
++        {
++           if (addr < 0x30000000)
++             hi_len = len - (0x30000000 - addr);
++           else
++             hi_len = len;
++        }
++
++      if (hi_len > lo_len)
++        {
++           len = hi_len;
++           if (addr < 0x30000000)
++             addr = 0x30000000;
++        }
++      else
++        {
++           len = lo_len;
++        }
++
++      if (len == 0)
++        return 0;
++    }
++
+   /* If this block contains 0x30000000 (768MB), do not claim below that.
+      Linux likes to claim memory at min(RMO top, 768MB) and works down
+      without reference to /memory/available. */

SOURCES/0581-util-Enable-default-kernel-for-updates.patch

@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nicolas Frayer <nfrayer@redhat.com>
+Date: Wed, 24 May 2023 11:22:47 +0200
+Subject: [PATCH] util: Enable default kernel for updates
+
+Several kernel variants can be installed on a system in parallel.
+In order to allow the user to choose which kernel will be set to
+default after an update, re-enable grub's usage of DEFAULTKERNEL as
+set in /etc/sysconfig/kernel
+
+Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
+---
+ util/grub-get-kernel-settings.in | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/util/grub-get-kernel-settings.in b/util/grub-get-kernel-settings.in
+index 7e87dfccc0e4..f71bc64360b0 100644
+--- a/util/grub-get-kernel-settings.in
++++ b/util/grub-get-kernel-settings.in
+@@ -68,6 +68,14 @@ if test -f /etc/sysconfig/kernel ; then
+     . /etc/sysconfig/kernel
+ fi
+
++GRUB_DEFAULT_KERNEL_TYPE=${DEFAULTKERNEL/-core/}
++if [ "$GRUB_DEFAULT_KERNEL_TYPE" != "kernel" ]; then
++    echo GRUB_NON_STANDARD_KERNEL=true
++    echo export GRUB_NON_STANDARD_KERNEL
++    GRUB_DEFAULT_KERNEL_TYPE=${GRUB_DEFAULT_KERNEL_TYPE/kernel-/}
++fi
++echo GRUB_DEFAULT_KERNEL_TYPE=$GRUB_DEFAULT_KERNEL_TYPE
++echo export GRUB_DEFAULT_KERNEL_TYPE
+ if [ "$MAKEDEBUG" = "yes" ]; then
+     echo GRUB_LINUX_MAKE_DEBUG=true
+     echo export GRUB_LINUX_MAKE_DEBUG