Add redkernel specfile

2023-09-28 17:39:17 -04:00 · 2023-09-28 17:39:17 -04:00 · f0a658642a
commit f0a658642a
parent ae006ee8d0
81 changed files with 213596 additions and 0 deletions
--- a/redkernel/0001-HID-uclogic-Add-support-for-XP-PEN-Artist-22R-Pro.patch
+++ b/redkernel/0001-HID-uclogic-Add-support-for-XP-PEN-Artist-22R-Pro.patch
@ -0,0 +1,446 @@
+From 09f4d9f9e5d8e2c3fd3c4056173af689f6afa345 Mon Sep 17 00:00:00 2001
+From: Joshua Goins <josh@redstrate.com>
+Date: Mon, 2 Jan 2023 13:48:56 -0500
+Subject: [PATCH] HID: uclogic: Add support for XP-PEN Artist 22R Pro
+
+Adds support for the XP-PEN Artist 22R Pro in uclogic, including the
+stylus, tablet frame and pen pressure support.
+
+Signed-off-by: Joshua Goins <josh@redstrate.com>
+---
+ drivers/hid/hid-ids.h            |   1 +
+ drivers/hid/hid-uclogic-core.c   |  66 +++++++++++-
+ drivers/hid/hid-uclogic-params.c | 180 +++++++++++++++++++++++++++++++
+ drivers/hid/hid-uclogic-params.h |   5 +
+ drivers/hid/hid-uclogic-rdesc.c  |  50 +++++++++
+ drivers/hid/hid-uclogic-rdesc.h  |   9 ++
+ 6 files changed, 307 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 82713ef3aaa6..81d04054229a 100644
+--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
+@@ -1298,6 +1298,7 @@
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L	0x0935
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S	0x0909
+ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06	0x0078
+#define USB_DEVICE_ID_UGEE_XPPEN_TABLET_22R_PRO	0x091b
+ #define USB_DEVICE_ID_UGEE_TABLET_G5		0x0074
+ #define USB_DEVICE_ID_UGEE_TABLET_EX07S		0x0071
+ #define USB_DEVICE_ID_UGEE_TABLET_RAINBOW_CV720	0x0055
+diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c
+index 7fa6fe04f1b2..8d92e984f984 100644
+--- a/drivers/hid/hid-uclogic-core.c
+++ b/drivers/hid/hid-uclogic-core.c
+@@ -81,6 +81,30 @@ static __u8 *uclogic_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 	return rdesc;
+ }
+ 
+/* Buttons considered valid tablet pad inputs. */
+static const unsigned int uclogic_extra_input_mapping[] = {
+	BTN_0,
+	BTN_1,
+	BTN_2,
+	BTN_3,
+	BTN_4,
+	BTN_5,
+	BTN_6,
+	BTN_7,
+	BTN_8,
+	BTN_RIGHT,
+	BTN_MIDDLE,
+	BTN_SIDE,
+	BTN_EXTRA,
+	BTN_FORWARD,
+	BTN_BACK,
+	BTN_B,
+	BTN_A,
+	BTN_BASE,
+	BTN_BASE2,
+	BTN_X
+};
+
+ static int uclogic_input_mapping(struct hid_device *hdev,
+ 				 struct hid_input *hi,
+ 				 struct hid_field *field,
+@@ -91,9 +115,27 @@ static int uclogic_input_mapping(struct hid_device *hdev,
+ 	struct uclogic_drvdata *drvdata = hid_get_drvdata(hdev);
+ 	struct uclogic_params *params = &drvdata->params;
+ 
+-	/* Discard invalid pen usages */
+-	if (params->pen.usage_invalid && (field->application == HID_DG_PEN))
+-		return -1;
+	if (field->application == HID_GD_KEYPAD) {
+		/*
+		 * Remap input buttons to sensible ones that are not invalid.
+		 * This only affects previous behavior for devices with more than ten or so buttons.
+		 */
+		const int key = (usage->hid & HID_USAGE) - 1;
+
+		if (key > 0 && key < ARRAY_SIZE(uclogic_extra_input_mapping)) {
+			hid_map_usage(hi,
+				      usage,
+				      bit,
+				      max,
+				      EV_KEY,
+				      uclogic_extra_input_mapping[key]);
+			return 1;
+		}
+	} else if (field->application == HID_DG_PEN) {
+		/* Discard invalid pen usages */
+		if (params->pen.usage_invalid)
+			return -1;
+	}
+ 
+ 	/* Let hid-core decide what to do */
+ 	return 0;
+@@ -403,8 +445,22 @@ static int uclogic_raw_event_frame(
+ 
+ 	/* If need to, and can, transform the bitmap dial reports */
+ 	if (frame->bitmap_dial_byte > 0 && frame->bitmap_dial_byte < size) {
+-		if (data[frame->bitmap_dial_byte] == 2)
+		switch (data[frame->bitmap_dial_byte]) {
+		case 2:
+ 			data[frame->bitmap_dial_byte] = -1;
+			break;
+
+		/* Everything below here is for tablets that shove multiple dials into 1 byte */
+		case 16:
+			data[frame->bitmap_dial_byte] = 0;
+			data[frame->bitmap_second_dial_destination_byte] = 1;
+			break;
+
+		case 32:
+			data[frame->bitmap_dial_byte] = 0;
+			data[frame->bitmap_second_dial_destination_byte] = -1;
+			break;
+		}
+ 	}
+ 
+ 	return 0;
+@@ -531,6 +587,8 @@ static const struct hid_device_id uclogic_devices[] = {
+ 				USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_UGEE,
+ 				USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_UGEE,
+				USB_DEVICE_ID_UGEE_XPPEN_TABLET_22R_PRO) },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(hid, uclogic_devices);
+diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
+index cd1233d7e253..d53c464a1b15 100644
+--- a/drivers/hid/hid-uclogic-params.c
+++ b/drivers/hid/hid-uclogic-params.c
+@@ -103,6 +103,8 @@ static void uclogic_params_frame_hid_dbg(
+ 		frame->touch_flip_at);
+ 	hid_dbg(hdev, "\t\t.bitmap_dial_byte = %u\n",
+ 		frame->bitmap_dial_byte);
+	hid_dbg(hdev, "\t\t.bitmap_second_dial_destination_byte = %u\n",
+			frame->bitmap_second_dial_destination_byte);
+ }
+ 
+ /**
+@@ -1418,6 +1420,174 @@ static int uclogic_params_ugee_v2_init(struct uclogic_params *params,
+ 	return rc;
+ }
+ 
+/**
+ * uclogic_params_parse_ugee_xppen_pro_desc - parse the string descriptor
+ * containing pen and frame parameters returned by XP-PEN Pro devices.
+ *
+ * @str_desc:		String descriptor, cannot be NULL.
+ * @str_desc_size:	Size of the string descriptor.
+ * @desc_params:	Output description params list.
+ * @desc_params_size:	Size of the output description params list.
+ *
+ * Returns:
+ *	Zero, if successful. A negative errno code on error.
+ */
+static int uclogic_params_parse_ugee_xppen_pro_desc(const __u8 *str_desc,
+					     size_t str_desc_size,
+					     s32 *desc_params,
+					     size_t desc_params_size)
+{
+	s32 pen_x_lm, pen_y_lm;
+	s32 pen_x_pm, pen_y_pm;
+	s32 pen_pressure_lm;
+	s32 resolution;
+
+	/* Minimum descriptor length required, maximum seen so far is 14 */
+	const int min_str_desc_size = 12;
+
+	if (!str_desc || str_desc_size < min_str_desc_size)
+		return -EINVAL;
+
+	if (desc_params_size != UCLOGIC_RDESC_PH_ID_NUM)
+		return -EINVAL;
+
+	pen_x_lm = get_unaligned_le16(str_desc + 2);
+	pen_y_lm = get_unaligned_le16(str_desc + 4);
+	pen_pressure_lm = get_unaligned_le16(str_desc + 8);
+
+	resolution = get_unaligned_le16(str_desc + 10);
+	if (resolution == 0) {
+		pen_x_pm = 0;
+		pen_y_pm = 0;
+	} else {
+		pen_x_pm = pen_x_lm * 1000 / resolution;
+		pen_y_pm = pen_y_lm * 1000 / resolution;
+	}
+
+	desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_LM] = pen_x_lm;
+	desc_params[UCLOGIC_RDESC_PEN_PH_ID_X_PM] = pen_x_pm;
+	desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_LM] = pen_y_lm;
+	desc_params[UCLOGIC_RDESC_PEN_PH_ID_Y_PM] = pen_y_pm;
+	desc_params[UCLOGIC_RDESC_PEN_PH_ID_PRESSURE_LM] = pen_pressure_lm;
+
+	return 0;
+}
+
+/*
+ * uclogic_params_init_ugee_xppen_pro() - Initializes a UGEE XP-Pen Pro tablet device.
+ *
+ * @hdev:	The HID device of the tablet interface to initialize and get
+ *		parameters from. Cannot be NULL.
+ * @params:	Parameters to fill in (to be cleaned with
+ *		uclogic_params_cleanup()). Not modified in case of error.
+ *		Cannot be NULL.
+ *
+ * Returns:
+ *	Zero, if successful. A negative errno code on error.
+ */
+static int uclogic_params_init_ugee_xppen_pro(struct uclogic_params *params,
+					      struct hid_device *hdev,
+					      const u8 rdesc_frame_arr[],
+					      const size_t rdesc_frame_size)
+{
+	int rc = 0;
+	struct usb_interface *iface;
+	__u8 bInterfaceNumber;
+	const int str_desc_len = 12;
+	u8 *str_desc = NULL;
+	__u8 *rdesc_pen = NULL;
+	s32 desc_params[UCLOGIC_RDESC_PH_ID_NUM];
+	/* The resulting parameters (noop) */
+	struct uclogic_params p = {0, };
+
+	if (!hdev || !params) {
+		rc = -EINVAL;
+		goto cleanup;
+	}
+
+	iface = to_usb_interface(hdev->dev.parent);
+	bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;
+
+	/* Ignore non-pen interfaces */
+	if (bInterfaceNumber != 2) {
+		uclogic_params_init_invalid(&p);
+		goto output;
+	}
+
+	/*
+	 * Initialize the interface by sending magic data.
+	 * This magic data is the same as other UGEE v2 tablets.
+	 */
+	rc = uclogic_probe_interface(hdev,
+				     uclogic_ugee_v2_probe_arr,
+				     uclogic_ugee_v2_probe_size,
+				     0x03);
+	if (rc) {
+		uclogic_params_init_invalid(&p);
+		goto output;
+	}
+
+	/**
+	 * Read the string descriptor containing pen and frame parameters.
+	 * These are slightly different than typical UGEE v2 devices.
+	 */
+	rc = uclogic_params_get_str_desc(&str_desc, hdev, 100, str_desc_len);
+	if (rc != str_desc_len) {
+		hid_err(hdev, "failed retrieving pen and frame parameters: %d\n", rc);
+		uclogic_params_init_invalid(&p);
+		goto output;
+	}
+
+	rc = uclogic_params_parse_ugee_xppen_pro_desc(str_desc, str_desc_len,
+						      desc_params,
+						      ARRAY_SIZE(desc_params));
+	if (rc)
+		goto cleanup;
+
+	kfree(str_desc);
+	str_desc = NULL;
+
+	/* Initialize the pen interface */
+	rdesc_pen = uclogic_rdesc_template_apply(
+				uclogic_rdesc_ugee_v2_pen_template_arr,
+				uclogic_rdesc_ugee_v2_pen_template_size,
+				desc_params, ARRAY_SIZE(desc_params));
+	if (!rdesc_pen) {
+		rc = -ENOMEM;
+		goto cleanup;
+	}
+
+	p.pen.desc_ptr = rdesc_pen;
+	p.pen.desc_size = uclogic_rdesc_ugee_v2_pen_template_size;
+	p.pen.id = 0x02;
+	p.pen.subreport_list[0].value = 0xf0;
+	p.pen.subreport_list[0].id = UCLOGIC_RDESC_V1_FRAME_ID;
+
+	/* Initialize the frame interface */
+	rc = uclogic_params_frame_init_with_desc(
+		&p.frame_list[0],
+		rdesc_frame_arr,
+		rdesc_frame_size,
+		UCLOGIC_RDESC_V1_FRAME_ID);
+	if (rc < 0) {
+		hid_err(hdev, "initializing frame params failed: %d\n", rc);
+		goto output;
+	}
+
+	p.frame_list[0].bitmap_dial_byte = 7;
+	p.frame_list[0].bitmap_second_dial_destination_byte = 8;
+
+output:
+	/* Output parameters */
+	memcpy(params, &p, sizeof(*params));
+	memset(&p, 0, sizeof(p));
+	rc = 0;
+cleanup:
+	kfree(str_desc);
+	uclogic_params_cleanup(&p);
+	return rc;
+}
+
+ /**
+  * uclogic_params_init() - initialize a tablet interface and discover its
+  * parameters.
+@@ -1728,6 +1898,16 @@ int uclogic_params_init(struct uclogic_params *params,
+ 			uclogic_params_init_invalid(&p);
+ 		}
+ 
+		break;
+	case VID_PID(USB_VENDOR_ID_UGEE,
+			USB_DEVICE_ID_UGEE_XPPEN_TABLET_22R_PRO):
+		rc = uclogic_params_init_ugee_xppen_pro(&p,
+			hdev,
+			uclogic_rdesc_xppen_artist_22r_pro_frame_arr,
+			uclogic_rdesc_xppen_artist_22r_pro_frame_size);
+		if (rc != 0)
+			goto cleanup;
+
+ 		break;
+ 	}
+ 
+diff --git a/drivers/hid/hid-uclogic-params.h b/drivers/hid/hid-uclogic-params.h
+index a97477c02ff8..6621a75a4b1a 100644
+--- a/drivers/hid/hid-uclogic-params.h
+++ b/drivers/hid/hid-uclogic-params.h
+@@ -171,6 +171,11 @@ struct uclogic_params_frame {
+ 	 * counterclockwise, as opposed to the normal 1 and -1.
+ 	 */
+ 	unsigned int bitmap_dial_byte;
+	/*
+	 * Destination offset for the second bitmap dial byte, if the tablet
+	 * supports a second dial at all.
+	 */
+	unsigned int bitmap_second_dial_destination_byte;
+ };
+ 
+ /*
+diff --git a/drivers/hid/hid-uclogic-rdesc.c b/drivers/hid/hid-uclogic-rdesc.c
+index fb40775f5f5b..86293ae8c995 100644
+--- a/drivers/hid/hid-uclogic-rdesc.c
+++ b/drivers/hid/hid-uclogic-rdesc.c
+@@ -859,6 +859,12 @@ const __u8 uclogic_rdesc_v2_frame_dial_arr[] = {
+ const size_t uclogic_rdesc_v2_frame_dial_size =
+ 			sizeof(uclogic_rdesc_v2_frame_dial_arr);
+ 
+const __u8 uclogic_ugee_v2_probe_arr[] = {
+	0x02, 0xb0, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+};
+const size_t uclogic_ugee_v2_probe_size = sizeof(uclogic_ugee_v2_probe_arr);
+const int uclogic_ugee_v2_probe_endpoint = 0x03;
+
+ /* Fixed report descriptor template for UGEE v2 pen reports */
+ const __u8 uclogic_rdesc_ugee_v2_pen_template_arr[] = {
+ 	0x05, 0x0d,         /*  Usage Page (Digitizers),                */
+@@ -1185,6 +1191,50 @@ const __u8 uclogic_rdesc_xppen_deco01_frame_arr[] = {
+ const size_t uclogic_rdesc_xppen_deco01_frame_size =
+ 			sizeof(uclogic_rdesc_xppen_deco01_frame_arr);
+ 
+/* Fixed report descriptor for XP-Pen Arist 22R Pro frame */
+const __u8 uclogic_rdesc_xppen_artist_22r_pro_frame_arr[] = {
+	0x05, 0x01,         /*  Usage Page (Desktop),                       */
+	0x09, 0x07,         /*  Usage (Keypad),                             */
+	0xA1, 0x01,         /*  Collection (Application),                   */
+	0x85, UCLOGIC_RDESC_V1_FRAME_ID,
+	/*      Report ID (Virtual report),             */
+	0x05, 0x0D,         /*     Usage Page (Digitizer),                  */
+	0x09, 0x39,         /*      Usage (Tablet Function Keys),           */
+	0xA0,               /*      Collection (Physical),                  */
+	0x14,               /*          Logical Minimum (0),                */
+	0x25, 0x01,         /*          Logical Maximum (1),                */
+	0x75, 0x01,         /*          Report Size (1),                    */
+	0x95, 0x08,         /*          Report Count (8),                   */
+	0x81, 0x01,         /*          Input (Constant),                   */
+	0x05, 0x09,         /*          Usage Page (Button),                */
+	0x19, 0x01,         /*          Usage Minimum (01h),                */
+	0x29, 0x14,         /*          Usage Maximum (14h),                */
+	0x95, 0x14,         /*          Report Count (20),                  */
+	0x81, 0x02,         /*          Input (Variable),                   */
+	0x95, 0x14,         /*          Report Count (20),                  */
+	0x81, 0x01,         /*          Input (Constant),                   */
+	0x05, 0x01,         /*          Usage Page (Desktop),               */
+	0x09, 0x38,         /*          Usage (Wheel),                      */
+	0x75, 0x08,         /*          Report Size (8),                    */
+	0x95, 0x01,         /*          Report Count (1),                   */
+	0x15, 0xFF,         /*          Logical Minimum (-1),               */
+	0x25, 0x08,         /*          Logical Maximum (8),                */
+	0x81, 0x06,         /*          Input (Variable, Relative),         */
+	0x05, 0x0C,         /*          Usage Page (Consumer Devices),      */
+	0x0A, 0x38, 0x02,   /*          Usage (AC PAN),                     */
+	0x95, 0x01,         /*          Report Count (1),                   */
+	0x81, 0x06,         /*          Input (Variable, Relative),         */
+	0x26, 0xFF, 0x00,   /*          Logical Maximum (255),              */
+	0x75, 0x08,         /*          Report Size (8),                    */
+	0x95, 0x01,         /*          Report Count (1),                   */
+	0x81, 0x02,         /*          Input (Variable),                   */
+	0xC0,               /*      End Collection                          */
+	0xC0,               /*  End Collection                              */
+};
+
+const size_t uclogic_rdesc_xppen_artist_22r_pro_frame_size =
+				sizeof(uclogic_rdesc_xppen_artist_22r_pro_frame_arr);
+
+ /**
+  * uclogic_rdesc_template_apply() - apply report descriptor parameters to a
+  * report descriptor template, creating a report descriptor. Copies the
+diff --git a/drivers/hid/hid-uclogic-rdesc.h b/drivers/hid/hid-uclogic-rdesc.h
+index a1f78c07293f..c3cb2c75dda5 100644
+--- a/drivers/hid/hid-uclogic-rdesc.h
+++ b/drivers/hid/hid-uclogic-rdesc.h
+@@ -164,6 +164,11 @@ extern const size_t uclogic_rdesc_v2_frame_dial_size;
+ /* Report ID for tweaked UGEE v2 battery reports */
+ #define UCLOGIC_RDESC_UGEE_V2_BATTERY_ID 0xba
+ 
+/* Magic data expected by UGEEv2 devices on probe */
+extern const __u8 uclogic_ugee_v2_probe_arr[];
+extern const size_t uclogic_ugee_v2_probe_size;
+extern const int uclogic_ugee_v2_probe_endpoint;
+
+ /* Fixed report descriptor template for UGEE v2 pen reports */
+ extern const __u8 uclogic_rdesc_ugee_v2_pen_template_arr[];
+ extern const size_t uclogic_rdesc_ugee_v2_pen_template_size;
+@@ -205,4 +210,8 @@ extern const size_t uclogic_rdesc_ugee_g5_frame_size;
+ /* Least-significant bit of Ugee G5 frame rotary encoder state */
+ #define UCLOGIC_RDESC_UGEE_G5_FRAME_RE_LSB 38
+ 
+/* Fixed report descriptor for XP-Pen Arist 22R Pro frame */
+extern const __u8 uclogic_rdesc_xppen_artist_22r_pro_frame_arr[];
+extern const size_t uclogic_rdesc_xppen_artist_22r_pro_frame_size;
+
+ #endif /* _HID_UCLOGIC_RDESC_H */
+-- 
+2.38.2
+
--- a/redkernel/Makefile.rhelver
+++ b/redkernel/Makefile.rhelver
@ -0,0 +1,80 @@
+RHEL_MAJOR = 9
+RHEL_MINOR = 99
+
+#
+# RHEL_RELEASE
+# -------------
+#
+# Represents build number in 'release' part of RPM's name-version-release.
+#   name is <package_name>, e.g. kernel
+#   version is upstream kernel version this kernel is based on, e.g. 4.18.0
+#   release is <RHEL_RELEASE>.<dist_tag>[<buildid>], e.g. 100.el8
+#
+# Use this spot to avoid future merge conflicts.
+# Do not trim this comment.
+RHEL_RELEASE = 0
+
+#
+# RHEL_REBASE_NUM
+# ----------------
+#
+# Used in RPM version string for Gemini kernels, which dont use upstream
+# VERSION/PATCHLEVEL/SUBLEVEL. The number represents rebase number for
+# current MAJOR release.
+#
+# Use this spot to avoid future merge conflicts.
+# Do not trim this comment.
+RHEL_REBASE_NUM = 1
+
+
+#
+# ZSTREAM
+# -------
+#
+#  This variable controls whether we use zstream numbering or not for the
+#  package release. The zstream release keeps the build number of the last
+#  build done for ystream for the Beta milestone, and increments a second
+#  number for each build. The third number is used for branched builds
+#  (eg.: for builds with security fixes or hot fixes done outside of the
+#  batch release process).
+#
+#  For example, with ZSTREAM unset or set to "no", all builds will contain
+#  a release with only the build number, eg.: kernel-<kernel version>-X.el*,
+#  where X is the build number. With ZSTREAM set to "yes", we will have
+#  builds with kernel-<kernel version>-X.Y.Z.el*, where X is the last
+#  RHEL_RELEASE number before ZSTREAM flag was set to yes, Y will now be the
+#  build number and Z will always be 1 except if you're doing a branched build
+#  (when you give RHDISTGIT_BRANCH on the command line, in which case the Z
+#  number will be incremented instead of the Y).
+#
+ZSTREAM ?= no
+
+#
+# Early y+1 numbering
+# --------------------
+#
+# In early y+1 process, RHEL_RELEASE consists of 2 numbers: x.y
+# First is RHEL_RELEASE inherited/merged from y as-is, second number
+# is incremented with each build starting from 1. After merge from y,
+# it resets back to 1. This way y+1 nvr reflects status of last merge.
+#
+# Example:
+#
+# rhel8.0                        rhel-8.1
+#   kernel-4.18.0-58.el8   -->     kernel-4.18.0-58.1.el8
+#                                  kernel-4.18.0-58.2.el8
+#   kernel-4.18.0-59.el8           kernel-4.18.0-59.1.el8
+#   kernel-4.18.0-60.el8
+#   kernel-4.18.0-61.el8   -->     kernel-4.18.0-61.1.el8
+#
+#
+# Use this spot to avoid future merge conflicts.
+# Do not trim this comment.
+EARLY_YSTREAM ?= no
+EARLY_YBUILD:=
+EARLY_YRELEASE:=
+ifneq ("$(ZSTREAM)", "yes")
+  ifeq ("$(EARLY_YSTREAM)","yes")
+    RHEL_RELEASE:=$(RHEL_RELEASE).$(EARLY_YRELEASE)
+  endif
+endif
--- a/redkernel/Module.kabi_aarch64
+++ b/redkernel/Module.kabi_aarch64
--- a/redkernel/Module.kabi_dup_aarch64
+++ b/redkernel/Module.kabi_dup_aarch64
--- a/redkernel/Module.kabi_dup_ppc64le
+++ b/redkernel/Module.kabi_dup_ppc64le
--- a/redkernel/Module.kabi_dup_s390x
+++ b/redkernel/Module.kabi_dup_s390x
--- a/redkernel/Module.kabi_dup_x86_64
+++ b/redkernel/Module.kabi_dup_x86_64
--- a/redkernel/Module.kabi_ppc64le
+++ b/redkernel/Module.kabi_ppc64le
--- a/redkernel/Module.kabi_s390x
+++ b/redkernel/Module.kabi_s390x
--- a/redkernel/Module.kabi_x86_64
+++ b/redkernel/Module.kabi_x86_64
--- a/redkernel/Patchlist.changelog
+++ b/redkernel/Patchlist.changelog
@ -0,0 +1,120 @@
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/fe8fa52d7059d2dd7b171a0ad1a53bd55c7d449a
+ fe8fa52d7059d2dd7b171a0ad1a53bd55c7d449a iommu/apple-dart: Handle DMA_FQ domains in attach_dev()
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/d08eefa0932515ada7d972c51b99153a7ea3d6ac
+ d08eefa0932515ada7d972c51b99153a7ea3d6ac locking/atomic: scripts: fix fallback ifdeffery
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/d39b077dee33176ab97b22593fc8ae8a130ee768
+ d39b077dee33176ab97b22593fc8ae8a130ee768 btrfs: adjust overcommit logic when very close to full
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/a1c2565138b048b69ec731e22118ec1837fa5ceb
+ a1c2565138b048b69ec731e22118ec1837fa5ceb btrfs: properly report 0 avail for very full file systems
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/60528063540aabceb7c4d79c7938d229ed5efc4f
+ 60528063540aabceb7c4d79c7938d229ed5efc4f selinux: fix handling of empty opts in selinux_fs_context_submount()
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/80c615ec2edb4aadded21fe924e2caa172d59577
+ 80c615ec2edb4aadded21fe924e2caa172d59577 Revert "misc: rtsx: judge ASPM Mode to set PETXCFG Reg"
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/c53302b2ed77cf6f3a125135a1f85af8cbc0ba4b
+ c53302b2ed77cf6f3a125135a1f85af8cbc0ba4b tpm: Enable hwrng only for Pluton on AMD CPUs
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/065cd69d44a8c576d6ff671ceae019f991cee492
+ 065cd69d44a8c576d6ff671ceae019f991cee492 erofs: ensure that the post-EOF tails are all zeroed
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/b0da866f75833f1bb8570d7978a8d5179c8d9ab6
+ b0da866f75833f1bb8570d7978a8d5179c8d9ab6 drm/msm/a690: Switch to a660_gmu.bin
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/f3cdb1143146a65982f46846cd590affb2b87538
+ f3cdb1143146a65982f46846cd590affb2b87538 drivers/firmware: skip simpledrm if nvidia-drm.modeset=1 is set
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/ea332dbc69a256a04bd53fee92db956439acee06
+ ea332dbc69a256a04bd53fee92db956439acee06 scsi: sd: Add "probe_type" module parameter to allow synchronous probing
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/66721aea3aaa311bb78cf0947f06070f4101ee0e
+ 66721aea3aaa311bb78cf0947f06070f4101ee0e Revert "Remove EXPERT from ARCH_FORCE_MAX_ORDER for aarch64"
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/29cd90a2b4cade829ac1401ef13314620b6c38a1
+ 29cd90a2b4cade829ac1401ef13314620b6c38a1 Remove EXPERT from ARCH_FORCE_MAX_ORDER for aarch64
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/ff96030d973a1b9233402a64d48d53e0d9461781
+ ff96030d973a1b9233402a64d48d53e0d9461781 redhat: version two of Makefile.rhelver tweaks
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/66064bbf7222c53ef297bfa4a14ffe4193b0fe94
+ 66064bbf7222c53ef297bfa4a14ffe4193b0fe94 redhat:  adapt to upstream Makefile change
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/c42de182b354644930e07bc92257d586a6c4ed18
+ c42de182b354644930e07bc92257d586a6c4ed18 Change acpi_bus_get_acpi_device to acpi_get_acpi_dev
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/2e2a2e49f61d066d4bb8bfe0efde2d0f90b1491c
+ 2e2a2e49f61d066d4bb8bfe0efde2d0f90b1491c nvme: nvme_mpath_init remove multipath check
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/5481da71dd1b1b88c550492b28e8b250e299f24c
+ 5481da71dd1b1b88c550492b28e8b250e299f24c nvme: decouple basic ANA log page re-read support from native multipathing
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/184662e0b0701841ad0229caf0e6d0ddb2a96231
+ 184662e0b0701841ad0229caf0e6d0ddb2a96231 nvme: allow local retry and proper failover for REQ_FAILFAST_TRANSPORT
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/00eb6277b582c42373c536e70d13860f87522e38
+ 00eb6277b582c42373c536e70d13860f87522e38 nvme: Return BLK_STS_TARGET if the DNR bit is set
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/80063932c894c04a6266f2543dc8a8c66cf0f4b5
+ 80063932c894c04a6266f2543dc8a8c66cf0f4b5 REDHAT: coresight: etm4x: Disable coresight on HPE Apollo 70
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/90f006ba80d847b4c8c689616b07370c2292a804
+ 90f006ba80d847b4c8c689616b07370c2292a804 KEYS: Make use of platform keyring for module signature verify
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/856b4c54f954509436a51da2bfc0f0d44425d173
+ 856b4c54f954509436a51da2bfc0f0d44425d173 Input: rmi4 - remove the need for artificial IRQ in case of HID
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/9c10ed2c097b09b20c928d555bf030c56502cf88
+ 9c10ed2c097b09b20c928d555bf030c56502cf88 ARM: tegra: usb no reset
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/b136b0c2e0bf2f6f8f75f37fa00376563a78f6b2
+ b136b0c2e0bf2f6f8f75f37fa00376563a78f6b2 s390: Lock down the kernel when the IPL secure flag is set
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/8ffab3ce8c323b13cf4dbbd0291fb4748cae60a0
+ 8ffab3ce8c323b13cf4dbbd0291fb4748cae60a0 efi: Lock down the kernel if booted in secure boot mode
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/9cae435c2ee4380b4086fa3a7ef859090e9f70d2
+ 9cae435c2ee4380b4086fa3a7ef859090e9f70d2 efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/de90fd8131ce4ed22c547c2bd1af1c20ea173a46
+ de90fd8131ce4ed22c547c2bd1af1c20ea173a46 security: lockdown: expose a hook to lock the kernel down
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/6fa94ce53295ae4440005260005078d7c737b828
+ 6fa94ce53295ae4440005260005078d7c737b828 Make get_cert_list() use efi_status_to_str() to print error messages.
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/6c671f6b733c4ee8b88e6c314208b90486b98446
+ 6c671f6b733c4ee8b88e6c314208b90486b98446 Add efi_status_to_str() and rework efi_status_to_err().
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/676e5b1fd3ede3a4d20157b2604dfd1d0e1405c3
+ 676e5b1fd3ede3a4d20157b2604dfd1d0e1405c3 iommu/arm-smmu: workaround DMA mode issues
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/adbf82278579ad712bbdf5d3eaabc4c7fbf3305c
+ adbf82278579ad712bbdf5d3eaabc4c7fbf3305c ipmi: do not configure ipmi for HPE m400
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/150baa5a728754cbf8f8c385a10af6b52a408cee
+ 150baa5a728754cbf8f8c385a10af6b52a408cee ahci: thunderx2: Fix for errata that affects stop engine
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/0a757157eddee28f46bec619cbaf9d2015fda707
+ 0a757157eddee28f46bec619cbaf9d2015fda707 Vulcan: AHCI PCI bar fix for Broadcom Vulcan early silicon
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/6ae5c032ab0cd35e82241c29e1f2bb1272b39fea
+ 6ae5c032ab0cd35e82241c29e1f2bb1272b39fea tags.sh: Ignore redhat/rpm
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/36c76ea8d8223e20d158ee0928e9e9798b5b878d
+ 36c76ea8d8223e20d158ee0928e9e9798b5b878d aarch64: acpi scan: Fix regression related to X-Gene UARTs
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/3ed45652209eeccc3918663abebc70001760111b
+ 3ed45652209eeccc3918663abebc70001760111b ACPI / irq: Workaround firmware issue on X-Gene based m400
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/92d7a8c46934f658c9017966a90a8745e4b085bd
+ 92d7a8c46934f658c9017966a90a8745e4b085bd ACPI: APEI: arm64: Ignore broken HPE moonshot APEI support
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/9e9a1ea80fc3ef4bf60f7ee2e41e1dbdd41f17cc
+ 9e9a1ea80fc3ef4bf60f7ee2e41e1dbdd41f17cc Pull the RHEL version defines out of the Makefile
+
+"https://gitlab.com/cki-project/kernel-ark/-/commit"/792dcdfdb07c00a91ad8f8c4624b057b84f5f2ae
+ 792dcdfdb07c00a91ad8f8c4624b057b84f5f2ae [initial commit] Add Red Hat variables in the top level makefile
+
--- a/redkernel/README.rst
+++ b/redkernel/README.rst
@ -0,0 +1,25 @@
+===================
+The Kernel dist-git
+===================
+
+The kernel is maintained in a `source tree`_ rather than directly in dist-git.
+The specfile is maintained as a `template`_ in the source tree along with a set
+of build scripts to generate configurations, (S)RPMs, and to populate the
+dist-git repository.
+
+The `documentation`_ for the source tree covers how to contribute and maintain
+the tree.
+
+If you're looking for the downstream patch set it's available in the source
+tree with "git log master..ark-patches" or
+`online`_.
+
+Each release in dist-git is tagged in the source repository so you can easily
+check out the source tree for a build. The tags are in the format
+name-version-release, but note release doesn't contain the dist tag since the
+source can be built in different build roots (Fedora, CentOS, etc.)
+
+.. _source tree: https://gitlab.com/cki-project/kernel-ark.git
+.. _template: https://gitlab.com/cki-project/kernel-ark/-/blob/os-build/redhat/kernel.spec.template
+.. _documentation: https://gitlab.com/cki-project/kernel-ark/-/wikis/home
+.. _online: https://gitlab.com/cki-project/kernel-ark/-/commits/ark-patches
--- a/redkernel/check-kabi
+++ b/redkernel/check-kabi
@ -0,0 +1,149 @@
+#!/usr/bin/python3
+#
+# check-kabi - Red Hat kABI reference checking tool
+#
+# We use this script to check against reference Module.kabi files.
+#
+# Author: Jon Masters <jcm@redhat.com>
+# Copyright (C) 2007-2009 Red Hat, Inc.
+#
+# This software may be freely redistributed under the terms of the GNU
+# General Public License (GPL).
+
+# Changelog:
+#
+# 2018/06/01 - Update for python3 by Petr Oros.
+# 2009/08/15 - Updated for use in RHEL6.
+# 2007/06/13 - Initial rewrite in python by Jon Masters.
+
+__author__ = "Jon Masters <jcm@redhat.com>"
+__version__ = "2.0"
+__date__ = "2009/08/15"
+__copyright__ = "Copyright (C) 2007-2009 Red Hat, Inc"
+__license__ = "GPL"
+
+import getopt
+import string
+import sys
+
+true = 1
+false = 0
+
+
+def load_symvers(symvers, filename):
+    """Load a Module.symvers file."""
+
+    symvers_file = open(filename, "r")
+
+    while true:
+        in_line = symvers_file.readline()
+        if in_line == "":
+            break
+        if in_line == "\n":
+            continue
+        checksum, symbol, directory, type = in_line.split()
+
+        symvers[symbol] = in_line[0:-1]
+
+
+def load_kabi(kabi, filename):
+    """Load a Module.kabi file."""
+
+    kabi_file = open(filename, "r")
+
+    while true:
+        in_line = kabi_file.readline()
+        if in_line == "":
+            break
+        if in_line == "\n":
+            continue
+        checksum, symbol, directory, type = in_line.split()
+
+        kabi[symbol] = in_line[0:-1]
+
+
+def check_kabi(symvers, kabi):
+    """Check Module.kabi and Module.symvers files."""
+
+    fail = 0
+    warn = 0
+    changed_symbols = []
+    moved_symbols = []
+
+    for symbol in kabi:
+        abi_hash, abi_sym, abi_dir, abi_type = kabi[symbol].split()
+        if symbol in symvers:
+            sym_hash, sym_sym, sym_dir, sym_type = symvers[symbol].split()
+            if abi_hash != sym_hash:
+                fail = 1
+                changed_symbols.append(symbol)
+
+            if abi_dir != sym_dir:
+                warn = 1
+                moved_symbols.append(symbol)
+        else:
+            fail = 1
+            changed_symbols.append(symbol)
+
+    if fail:
+        print("*** ERROR - ABI BREAKAGE WAS DETECTED ***")
+        print("")
+        print("The following symbols have been changed (this will cause an ABI breakage):")
+        print("")
+        for symbol in changed_symbols:
+            print(symbol)
+        print("")
+
+    if warn:
+        print("*** WARNING - ABI SYMBOLS MOVED ***")
+        print("")
+        print("The following symbols moved (typically caused by moving a symbol from being")
+        print("provided by the kernel vmlinux out to a loadable module):")
+        print("")
+        for symbol in moved_symbols:
+            print(symbol)
+        print("")
+
+    """Halt the build, if we got errors and/or warnings. In either case,
+       double-checkig is required to avoid introducing / concealing
+       KABI inconsistencies."""
+    if fail or warn:
+        sys.exit(1)
+    sys.exit(0)
+
+
+def usage():
+    print("""
+check-kabi: check Module.kabi and Module.symvers files.
+
+    check-kabi [ -k Module.kabi ] [ -s Module.symvers ]
+
+""")
+
+
+if __name__ == "__main__":
+
+    symvers_file = ""
+    kabi_file = ""
+
+    opts, args = getopt.getopt(sys.argv[1:], 'hk:s:')
+
+    for o, v in opts:
+        if o == "-s":
+            symvers_file = v
+        if o == "-h":
+            usage()
+            sys.exit(0)
+        if o == "-k":
+            kabi_file = v
+
+    if (symvers_file == "") or (kabi_file == ""):
+        usage()
+        sys.exit(1)
+
+    symvers = {}
+    kabi = {}
+
+    load_symvers(symvers, symvers_file)
+    load_kabi(kabi, kabi_file)
+    check_kabi(symvers, kabi)
--- a/redkernel/dracut-virt.conf
+++ b/redkernel/dracut-virt.conf
@ -0,0 +1,35 @@
+# generic + compressed please
+hostonly="no"
+compress="xz"
+
+# VMs can't update microcode anyway
+early_microcode="no"
+
+# modules: basics
+dracutmodules+=" base systemd systemd-initrd dracut-systemd dbus dbus-broker usrmount shutdown "
+
+# modules: storage support
+dracutmodules+=" dm lvm rootfs-block fs-lib "
+
+# modules: tpm and crypto
+dracutmodules+=" crypt crypt-loop tpm2-tss "
+
+# drivers: virtual buses, pci
+drivers+=" virtio-pci virtio-mmio "      # qemu-kvm
+drivers+=" hv-vmbus pci-hyperv "         # hyperv
+drivers+=" xen-pcifront "                # xen
+
+# drivers: storage
+drivers+=" ahci nvme sd_mod sr_mod "     # generic
+drivers+=" virtio-blk virtio-scsi "      # qemu-kvm
+drivers+=" hv-storvsc "                  # hyperv
+drivers+=" xen-blkfront "                # xen
+
+# root encryption
+drivers+=" dm_crypt "
+
+# filesystems
+filesystems+=" vfat ext4 xfs overlay "
+
+# systemd-pcrphase
+install_items+=" /lib/systemd/system/systemd-pcrphase-initrd.service /usr/lib/systemd/systemd-pcrphase /usr/lib/systemd/system/initrd.target.wants/systemd-pcrphase-initrd.service "
--- a/redkernel/filter-aarch64.sh.fedora
+++ b/redkernel/filter-aarch64.sh.fedora
@ -0,0 +1,18 @@
+#! /bin/bash
+
+# This is the aarch64 override file for the core/drivers package split.  The
+# module directories listed here and in the generic list in filter-modules.sh
+# will be moved to the resulting kernel-modules package for this arch.
+# Anything not listed in those files will be in the kernel-core package.
+#
+# Please review the default list in filter-modules.sh before making
+# modifications to the overrides below.  If something should be removed across
+# all arches, remove it in the default instead of per-arch.
+
+driverdirs="atm auxdisplay bcma bluetooth firewire fpga infiniband leds media memstick message mmc mtd nfc ntb pcmcia power ssb soundwire staging tty uio w1"
+
+ethdrvs="3com adaptec arc alteon atheros broadcom cadence calxeda chelsio cisco dec dlink emulex marvell micrel myricom neterion nvidia packetengines qlogic rdc sfc silan sis smsc stmicro sun tehuti ti via wiznet xircom"
+
+drmdrvs="amd arm bridge ast exynos hisilicon i2c imx mgag200 meson msm nouveau panel pl111 radeon rockchip tegra sun4i tiny vc4"
+
+singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwpoison-inject target_core_user sbp_target cxgbit chcr rnbd-client rnbd-server mlx5_vdpa dfl-emif octeontx2-cpt octeontx2-cptvf spi-altera-dfl rvu_cptpf rvu_cptvf regmap-sdw regmap-sdw-mbq hid-playstation hid-nintendo nvmem_u-boot-env intel-m10-bmc-pmci intel-m10-bmc-hwmon ptp_dfl_tod pds_vdpa"
--- a/redkernel/filter-aarch64.sh.rhel
+++ b/redkernel/filter-aarch64.sh.rhel
@ -0,0 +1,18 @@
+#! /bin/bash
+
+# This is the aarch64 override file for the core/drivers package split.  The
+# module directories listed here and in the generic list in filter-modules.sh
+# will be moved to the resulting kernel-modules package for this arch.
+# Anything not listed in those files will be in the kernel-core package.
+#
+# Please review the default list in filter-modules.sh before making
+# modifications to the overrides below.  If something should be removed across
+# all arches, remove it in the default instead of per-arch.
+
+driverdirs="atm auxdisplay bcma bluetooth firewire fmc infiniband isdn leds media memstick message mmc mtd mwave nfc ntb pcmcia platform power ssb staging tty uio uwb w1"
+
+ethdrvs="3com adaptec arc alteon atheros broadcom cadence calxeda chelsio cisco dec dlink emulex icplus marvell micrel myricom neterion nvidia oki-semi packetengines qlogic rdc renesas sfc silan sis smsc stmicro sun tehuti ti via wiznet xircom"
+
+drmdrvs="amd arm bridge ast exynos hisilicon i2c imx mgag200 meson msm nouveau panel radeon rockchip tegra sun4i tinydrm vc4"
+
+singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr chtls"
--- a/redkernel/filter-modules.sh.fedora
+++ b/redkernel/filter-modules.sh.fedora
@ -0,0 +1,201 @@
+#! /bin/bash
+#
+# Called as filter-modules.sh list-of-modules Arch
+
+# This script filters the modules into the kernel-core and kernel-modules
+# subpackages.  We list out subsystems/subdirs to prune from the installed
+# module directory.  What is left is put into the kernel-core package.  What is
+# pruned is contained in the kernel-modules package.
+#
+# This file contains the default subsys/subdirs to prune from all architectures.
+# If an architecture needs to differ, we source a per-arch filter-<arch>.sh file
+# that contains the set of override lists to be used instead.  If a module or
+# subsys should be in kernel-modules on all arches, please change the defaults
+# listed here.
+
+# Overrides is individual modules which need to remain in kernel-core due to deps.
+overrides="cec"
+
+# Set the default dirs/modules to filter out
+driverdirs="atm auxdisplay bcma bluetooth firewire fpga infiniband leds media memstick mfd mmc mtd nfc ntb pcmcia platform power ssb soundwire staging tty uio w1"
+
+chardrvs="mwave pcmcia"
+
+netdrvs="appletalk can dsa hamradio ieee802154 ppp slip usb wireless"
+
+ethdrvs="3com adaptec alteon amd aquantia atheros broadcom cadence calxeda chelsio cisco dec dlink emulex marvell mellanox neterion nvidia packetengines qlogic rdc sfc silan sis smsc stmicro sun tehuti ti wiznet xircom"
+
+cryptdrvs="bcm caam cavium chelsio hisilicon marvell qat"
+
+iiodrvs="accel light pressure proximity"
+
+iiocommondrvs="cros_ec_sensors"
+
+inputdrvs="gameport tablet touchscreen"
+
+hiddrvs="surface-hid"
+
+scsidrvs="aacraid aic7xxx be2iscsi bfa bnx2i bnx2fc csiostor cxgbi esas2r fcoe fnic isci libsas lpfc megaraid mpt3sas mvsas pm8001 qla2xxx qla4xxx sym53c8xx_2 ufs qedf"
+
+usbdrvs="atm image misc serial"
+
+fsdrvs="affs befs coda cramfs dlm ecryptfs hfs hfsplus jfs jffs2 minix nilfs2 ocfs2 reiserfs romfs sysv ubifs ufs"
+
+netprots="6lowpan appletalk atm ax25 batman-adv bluetooth can dsa ieee802154 l2tp mac80211 mac802154 mpls netrom nfc rds rfkill rose sctp smc wireless"
+
+drmdrvs="amd ast bridge gma500 i2c i915 mgag200 nouveau panel radeon"
+
+singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwpoison-inject target_core_user sbp_target cxgbit  chcr parport_serial regmap-sdw regmap-sdw-mbq arizona-micsupp hid-asus iTCO_wdt rnbd-client rnbd-server mlx5_vdpa spi-altera-dfl nct6775 hid-playstation hid-nintendo asus_wmi_sensors asus_wmi_ec_sensors mlx5-vfio-pci video int3406_thermal apple_bl ptp_dfl_tod intel-m10-bmc-hwmon intel_rapl_tpmi pds_vdpa hp-wmi-sensors"
+
+# Grab the arch-specific filter list overrides
+source ./filter-$2.sh
+
+filter_dir() {
+	filelist=$1
+	dir=$2
+
+	grep -v -e "${dir}/" ${filelist} > ${filelist}.tmp
+
+	if [ $? -ne 0 ]
+	then
+		echo "Couldn't remove ${dir}.  Skipping."
+	else
+		grep -e "${dir}/" ${filelist} >> k-d.list
+		mv ${filelist}.tmp $filelist
+	fi
+	
+	return 0
+}
+
+filter_ko() {
+	filelist=$1
+	mod=$2
+
+	grep -v -e "${mod}.ko" ${filelist} > ${filelist}.tmp
+
+	if [ $? -ne 0 ]
+	then
+		echo "Couldn't remove ${mod}.ko  Skipping."
+	else
+		grep -e "${mod}.ko" ${filelist} >> k-d.list
+		mv ${filelist}.tmp $filelist
+	fi
+	
+	return 0
+}
+
+# Filter the drivers/ subsystems
+for subsys in ${driverdirs}
+do
+	filter_dir $1 drivers/${subsys}
+done
+
+# Filter the networking drivers
+for netdrv in ${netdrvs}
+do
+	filter_dir $1 drivers/net/${netdrv}
+done
+
+# Filter the char drivers
+for char in ${chardrvs}
+do
+	filter_dir $1 drivers/char/${char}
+done
+
+# Filter the ethernet drivers
+for eth in ${ethdrvs}
+do
+	filter_dir $1 drivers/net/ethernet/${eth}
+done
+
+# Filter the crypto drivers
+for crypt in ${cryptdrvs}
+do
+	filter_dir $1 drivers/crypto/${crypt}
+done
+
+# SCSI
+for scsi in ${scsidrvs}
+do
+	filter_dir $1 drivers/scsi/${scsi}
+done
+
+# IIO
+for iio in ${iiodrvs}
+do
+        filter_dir $1 drivers/iio/${iio}
+done
+
+# IIO Common
+for iio in ${iiocommondrvs}
+do
+        filter_dir $1 drivers/iio/common/${iio}
+done
+
+# Input
+for input in ${inputdrvs}
+do
+	filter_dir $1 drivers/input/${input}
+done
+
+# hid
+for hid in ${hiddrvs}
+do
+	filter_dir $1 drivers/hid/${hid}
+done
+
+# USB
+for usb in ${usbdrvs}
+do
+	filter_dir $1 drivers/usb/${usb}
+done
+
+# Filesystems
+for fs in ${fsdrvs}
+do
+	filter_dir $1 fs/${fs}
+done
+
+# Network protocols
+for prot in ${netprots}
+do
+	filter_dir $1 kernel/net/${prot}
+done
+
+# DRM
+for drm in ${drmdrvs}
+do
+	filter_dir $1 drivers/gpu/drm/${drm}
+done
+
+# Just kill sound.
+filter_dir $1 kernel/sound
+filter_dir $1 kernel/drivers/soundwire
+
+# Now go through and filter any single .ko files that might have deps on the
+# things we filtered above
+for mod in ${singlemods}
+do
+        filter_ko $1 ${mod}
+done
+
+# Now process the override list to bring those modules back into core
+for mod in ${overrides}
+do
+	grep -v -e "/${mod}.ko" k-d.list > k-d.list.tmp
+	if [ $? -ne 0 ]
+        then
+                echo "Couldn't save ${mod}.ko  Skipping."
+        else
+                grep -e "/${mod}.ko" k-d.list >> $filelist
+                mv k-d.list.tmp k-d.list
+        fi
+
+done
+
+# Go through our generated drivers list and remove the .ko files.  We'll
+# restore them later.
+for mod in `cat k-d.list`
+do
+	rm -rf $mod
+done
--- a/redkernel/filter-modules.sh.rhel
+++ b/redkernel/filter-modules.sh.rhel
@ -0,0 +1,177 @@
+#! /bin/bash
+#
+# Called as filter-modules.sh list-of-modules Arch
+
+# This script filters the modules into the kernel-core and kernel-modules
+# subpackages.  We list out subsystems/subdirs to prune from the installed
+# module directory.  What is left is put into the kernel-core package.  What is
+# pruned is contained in the kernel-modules package.
+#
+# This file contains the default subsys/subdirs to prune from all architectures.
+# If an architecture needs to differ, we source a per-arch filter-<arch>.sh file
+# that contains the set of override lists to be used instead.  If a module or
+# subsys should be in kernel-modules on all arches, please change the defaults
+# listed here.
+
+# Overrides is individual modules which need to remain in kernel-core due to deps.
+overrides="cec isst_if_common isst_tpmi_core isst_tpmi intel_vsec intel_vsec_tpmi"
+
+# Set the default dirs/modules to filter out
+driverdirs="atm auxdisplay bcma bluetooth firewire fmc iio infiniband isdn leds media memstick mfd mmc mtd nfc ntb pcmcia platform power ssb staging tty uio uwb w1"
+
+chardrvs="mwave pcmcia"
+
+netdrvs="appletalk can dsa hamradio ieee802154 irda ppp slip usb wireless"
+
+ethdrvs="3com adaptec alteon amd aquantia atheros broadcom cadence calxeda chelsio cisco dec dlink emulex icplus marvell neterion nvidia oki-semi packetengines qlogic rdc renesas sfc silan sis smsc stmicro sun tehuti ti wiznet xircom"
+
+cryptdrvs="bcm caam cavium chelsio hisilicon marvell qat"
+
+inputdrvs="gameport tablet touchscreen"
+
+scsidrvs="aacraid aic7xxx aic94xx be2iscsi bfa bnx2i bnx2fc csiostor cxgbi esas2r fcoe fnic hisi_sas isci libsas lpfc megaraid mpt2sas mpt3sas mvsas pm8001 qla2xxx qla4xxx sym53c8xx_2 ufs qedf"
+
+usbdrvs="atm image misc serial wusbcore"
+
+fsdrvs="affs befs coda cramfs ecryptfs hfs hfsplus jfs minix ncpfs nilfs2 ocfs2 reiserfs romfs smb squashfs sysv ubifs ufs"
+
+netprots="6lowpan appletalk atm ax25 batman-adv bluetooth can dccp dsa ieee802154 irda l2tp mac80211 mac802154 mpls netrom nfc rds rfkill rose sctp smc wireless"
+
+drmdrvs="amd ast gma500 i2c i915 mgag200 nouveau radeon via "
+
+singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject hid-sensor-hub target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr chtls parport_serial ism regmap-sdw regmap-sdw-mbq arizona-micsupp hid-asus nct6775 ntc_thermistor video apple_bl kasan_test intel-m10-bmc-hwmon"
+
+# Grab the arch-specific filter list overrides
+source ./filter-$2.sh
+
+filter_dir() {
+	filelist=$1
+	dir=$2
+
+	grep -v -e "${dir}/" ${filelist} > ${filelist}.tmp
+
+	if [ $? -ne 0 ]
+	then
+		echo "Couldn't remove ${dir}.  Skipping."
+	else
+		grep -e "${dir}/" ${filelist} >> k-d.list
+		mv ${filelist}.tmp $filelist
+	fi
+
+	return 0
+}
+
+filter_ko() {
+	filelist=$1
+	mod=$2
+
+	grep -v -e "${mod}.ko" ${filelist} > ${filelist}.tmp
+
+	if [ $? -ne 0 ]
+	then
+		echo "Couldn't remove ${mod}.ko  Skipping."
+	else
+		grep -e "${mod}.ko" ${filelist} >> k-d.list
+		mv ${filelist}.tmp $filelist
+	fi
+
+	return 0
+}
+
+# Filter the drivers/ subsystems
+for subsys in ${driverdirs}
+do
+	filter_dir $1 drivers/${subsys}
+done
+
+# Filter the networking drivers
+for netdrv in ${netdrvs}
+do
+	filter_dir $1 drivers/net/${netdrv}
+done
+
+# Filter the char drivers
+for char in ${chardrvs}
+do
+	filter_dir $1 drivers/char/${char}
+done
+
+# Filter the ethernet drivers
+for eth in ${ethdrvs}
+do
+	filter_dir $1 drivers/net/ethernet/${eth}
+done
+
+# Filter the crypto drivers
+for crypt in ${cryptdrvs}
+do
+	filter_dir $1 drivers/crypto/${crypt}
+done
+
+# SCSI
+for scsi in ${scsidrvs}
+do
+	filter_dir $1 drivers/scsi/${scsi}
+done
+
+# Input
+for input in ${inputdrvs}
+do
+	filter_dir $1 drivers/input/${input}
+done
+
+# USB
+for usb in ${usbdrvs}
+do
+	filter_dir $1 drivers/usb/${usb}
+done
+
+# Filesystems
+for fs in ${fsdrvs}
+do
+	filter_dir $1 fs/${fs}
+done
+
+# Network protocols
+for prot in ${netprots}
+do
+	filter_dir $1 kernel/net/${prot}
+done
+
+# DRM
+for drm in ${drmdrvs}
+do
+	filter_dir $1 drivers/gpu/drm/${drm}
+done
+
+# Just kill sound.
+filter_dir $1 kernel/sound
+filter_dir $1 kernel/drivers/soundwire
+
+# Now go through and filter any single .ko files that might have deps on the
+# things we filtered above
+for mod in ${singlemods}
+do
+        filter_ko $1 ${mod}
+done
+
+# Now process the override list to bring those modules back into core
+for mod in ${overrides}
+do
+	grep -v -e "/${mod}.ko" k-d.list > k-d.list.tmp
+	if [ $? -ne 0 ]
+        then
+                echo "Couldn't save ${mod}.ko  Skipping."
+        else
+                grep -e "/${mod}.ko" k-d.list >> $filelist
+                mv k-d.list.tmp k-d.list
+        fi
+
+done
+
+# Go through our generated drivers list and remove the .ko files.  We'll
+# restore them later.
+for mod in `cat k-d.list`
+do
+	rm -rf $mod
+done
--- a/redkernel/filter-ppc64le.sh.fedora
+++ b/redkernel/filter-ppc64le.sh.fedora
@ -0,0 +1,14 @@
+#! /bin/bash
+
+# This is the ppc64le override file for the core/drivers package split.  The
+# module directories listed here and in the generic list in filter-modules.sh
+# will be moved to the resulting kernel-modules package for this arch.
+# Anything not listed in those files will be in the kernel-core package.
+#
+# Please review the default list in filter-modules.sh before making
+# modifications to the overrides below.  If something should be removed across
+# all arches, remove it in the default instead of per-arch.
+
+driverdirs="atm auxdisplay bcma bluetooth firewire fpga infiniband leds media memstick message mmc mtd nfc ntb pcmcia platform power ssb staging tty uio w1"
+
+singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwpoison-inject target_core_user sbp_target cxgbit chcr rnbd-client rnbd-server mlx5_vdpa hid-playstation hid-nintendo mlx5-vfio-pci nvmem_u-boot-env intel-m10-bmc-pmci intel-m10-bmc-hwmon ptp_dfl_tod pds_vdpa"
--- a/redkernel/filter-ppc64le.sh.rhel
+++ b/redkernel/filter-ppc64le.sh.rhel
@ -0,0 +1,14 @@
+#! /bin/bash
+
+# This is the ppc64le override file for the core/drivers package split.  The
+# module directories listed here and in the generic list in filter-modules.sh
+# will be moved to the resulting kernel-modules package for this arch.
+# Anything not listed in those files will be in the kernel-core package.
+#
+# Please review the default list in filter-modules.sh before making
+# modifications to the overrides below.  If something should be removed across
+# all arches, remove it in the default instead of per-arch.
+
+driverdirs="atm auxdisplay bcma bluetooth firewire fmc infiniband isdn leds media memstick message mmc mtd mwave nfc ntb pcmcia platform power ssb staging tty uio uwb w1"
+
+singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr chtls"
--- a/redkernel/filter-s390x.sh.fedora
+++ b/redkernel/filter-s390x.sh.fedora
@ -0,0 +1,12 @@
+#! /bin/bash
+
+# This is the s390x override file for the core/drivers package split.  The
+# module directories listed here and in the generic list in filter-modules.sh
+# will be moved to the resulting kernel-modules package for this arch.
+# Anything not listed in those files will be in the kernel-core package.
+#
+# Please review the default list in filter-modules.sh before making
+# modifications to the overrides below.  If something should be removed across
+# all arches, remove it in the default instead of per-arch.
+
+# Defaults work so no need to override
--- a/redkernel/filter-s390x.sh.rhel
+++ b/redkernel/filter-s390x.sh.rhel
@ -0,0 +1,12 @@
+#! /bin/bash
+
+# This is the s390x override file for the core/drivers package split.  The
+# module directories listed here and in the generic list in filter-modules.sh
+# will be moved to the resulting kernel-modules package for this arch.
+# Anything not listed in those files will be in the kernel-core package.
+#
+# Please review the default list in filter-modules.sh before making
+# modifications to the overrides below.  If something should be removed across
+# all arches, remove it in the default instead of per-arch.
+
+# Defaults work so no need to override
--- a/redkernel/filter-x86_64.sh.fedora
+++ b/redkernel/filter-x86_64.sh.fedora
@ -0,0 +1,12 @@
+#! /bin/bash
+
+# This is the x86_64 override file for the core/drivers package split.  The
+# module directories listed here and in the generic list in filter-modules.sh
+# will be moved to the resulting kernel-modules package for this arch.
+# Anything not listed in those files will be in the kernel-core package.
+#
+# Please review the default list in filter-modules.sh before making
+# modifications to the overrides below.  If something should be removed across
+# all arches, remove it in the default instead of per-arch.
+
+# Defaults work so no need to override
--- a/redkernel/filter-x86_64.sh.rhel
+++ b/redkernel/filter-x86_64.sh.rhel
@ -0,0 +1,12 @@
+#! /bin/bash
+
+# This is the x86_64 override file for the core/drivers package split.  The
+# module directories listed here and in the generic list in filter-modules.sh
+# will be moved to the resulting kernel-modules package for this arch.
+# Anything not listed in those files will be in the kernel-core package.
+#
+# Please review the default list in filter-modules.sh before making
+# modifications to the overrides below.  If something should be removed across
+# all arches, remove it in the default instead of per-arch.
+
+# Defaults work so no need to override
--- a/redkernel/flavors
+++ b/redkernel/flavors
@ -0,0 +1,2 @@
+rhel
+fedora
--- a/redkernel/gating.yaml
+++ b/redkernel/gating.yaml
@ -0,0 +1,9 @@
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: cki.tier1-aarch64.functional}
+  - !PassingTestCaseRule {test_case_name: cki.tier1-ppc64le.functional}
+  - !PassingTestCaseRule {test_case_name: cki.tier1-s390x.functional}
+  - !PassingTestCaseRule {test_case_name: cki.tier1-x86_64.functional}
--- a/redkernel/generate_all_configs.sh
+++ b/redkernel/generate_all_configs.sh
@ -0,0 +1,38 @@
+#!/bin/sh
+
+# Adjusts the configuration options to build the variants correctly
+
+test -n "$RHTEST" && exit 0
+
+DEBUGBUILDSENABLED=$1
+if [ -z "$DEBUGBUILDSENABLED" ]; then
+	exit 1
+fi
+
+if [ -z "$FLAVOR" ]; then
+	FLAVOR=rhel
+fi
+
+if [ "$FLAVOR" = "fedora" ]; then
+	SECONDARY=rhel
+else
+	SECONDARY=fedora
+fi
+
+# The +1 is to remove the - at the end of the SPECPACKAGE_NAME string
+specpackage_name_len=$((${#SPECPACKAGE_NAME} + 1))
+for i in "${SPECPACKAGE_NAME}"*-"$FLAVOR".config; do
+	# shellcheck disable=SC3057
+	NEW=${SPECPACKAGE_NAME}-"$SPECRPMVERSION"-$(echo "${i:$specpackage_name_len}" | sed s/-"$FLAVOR"//)
+	mv "$i" "$NEW"
+done
+
+rm -f kernel-*-"$SECONDARY".config
+
+if [ "$DEBUGBUILDSENABLED" -eq 0 ]; then
+	for i in "${SPECPACKAGE_NAME}"-*debug*.config; do
+		base=$(echo "$i" | sed -r s/-?debug//g)
+		NEW=${SPECPACKAGE_NAME}-$(echo "$base" | cut -d - -f2-)
+		mv "$i" "$NEW"
+	done
+fi
--- a/redkernel/kernel-aarch64-16k-debug-fedora.config
+++ b/redkernel/kernel-aarch64-16k-debug-fedora.config
--- a/redkernel/kernel-aarch64-16k-fedora.config
+++ b/redkernel/kernel-aarch64-16k-fedora.config
--- a/redkernel/kernel-aarch64-64k-debug-rhel.config
+++ b/redkernel/kernel-aarch64-64k-debug-rhel.config
--- a/redkernel/kernel-aarch64-64k-rhel.config
+++ b/redkernel/kernel-aarch64-64k-rhel.config
--- a/redkernel/kernel-aarch64-debug-fedora.config
+++ b/redkernel/kernel-aarch64-debug-fedora.config
--- a/redkernel/kernel-aarch64-debug-rhel.config
+++ b/redkernel/kernel-aarch64-debug-rhel.config
--- a/redkernel/kernel-aarch64-fedora.config
+++ b/redkernel/kernel-aarch64-fedora.config
--- a/redkernel/kernel-aarch64-rhel.config
+++ b/redkernel/kernel-aarch64-rhel.config
--- a/redkernel/kernel-aarch64-rt-debug-rhel.config
+++ b/redkernel/kernel-aarch64-rt-debug-rhel.config
--- a/redkernel/kernel-aarch64-rt-rhel.config
+++ b/redkernel/kernel-aarch64-rt-rhel.config
--- a/redkernel/kernel-local
+++ b/redkernel/kernel-local
@ -0,0 +1,2 @@
+# This file is intentionally left empty in the stock kernel. Its a nicety
+# added for those wanting to do custom rebuilds with altered config opts.
--- a/redkernel/kernel-ppc64le-debug-fedora.config
+++ b/redkernel/kernel-ppc64le-debug-fedora.config
--- a/redkernel/kernel-ppc64le-debug-rhel.config
+++ b/redkernel/kernel-ppc64le-debug-rhel.config
--- a/redkernel/kernel-ppc64le-fedora.config
+++ b/redkernel/kernel-ppc64le-fedora.config
--- a/redkernel/kernel-ppc64le-rhel.config
+++ b/redkernel/kernel-ppc64le-rhel.config
--- a/redkernel/kernel-s390x-debug-fedora.config
+++ b/redkernel/kernel-s390x-debug-fedora.config
--- a/redkernel/kernel-s390x-debug-rhel.config
+++ b/redkernel/kernel-s390x-debug-rhel.config
--- a/redkernel/kernel-s390x-fedora.config
+++ b/redkernel/kernel-s390x-fedora.config
--- a/redkernel/kernel-s390x-rhel.config
+++ b/redkernel/kernel-s390x-rhel.config
--- a/redkernel/kernel-s390x-zfcpdump-rhel.config
+++ b/redkernel/kernel-s390x-zfcpdump-rhel.config
--- a/redkernel/kernel-x86_64-debug-fedora.config
+++ b/redkernel/kernel-x86_64-debug-fedora.config
--- a/redkernel/kernel-x86_64-debug-rhel.config
+++ b/redkernel/kernel-x86_64-debug-rhel.config
--- a/redkernel/kernel-x86_64-fedora.config
+++ b/redkernel/kernel-x86_64-fedora.config
--- a/redkernel/kernel-x86_64-rhel.config
+++ b/redkernel/kernel-x86_64-rhel.config
--- a/redkernel/kernel-x86_64-rt-debug-rhel.config
+++ b/redkernel/kernel-x86_64-rt-debug-rhel.config
--- a/redkernel/kernel-x86_64-rt-rhel.config
+++ b/redkernel/kernel-x86_64-rt-rhel.config
--- a/redkernel/kernel.spec
+++ b/redkernel/kernel.spec
--- a/redkernel/kvm_stat.logrotate
+++ b/redkernel/kvm_stat.logrotate
@ -0,0 +1,11 @@
+/var/log/kvm_stat.csv {
+	size 10M
+	missingok
+	compress
+	maxage 30
+	rotate 5
+	nodateext
+	postrotate
+		/usr/bin/systemctl try-restart kvm_stat.service
+	endscript
+}
--- a/redkernel/linux-kernel-test.patch
+++ b/redkernel/linux-kernel-test.patch
--- a/redkernel/merge.py
+++ b/redkernel/merge.py
@ -0,0 +1,88 @@
+#!/usr/bin/python3
+# SPDX-License-Identifier: GPL-2.0
+# Author: Clark Williams <williams@redhat.com>
+# Copyright (C) 2022 Red Hat, Inc.
+#
+# merge.py - a direct replacement for merge.pl in the redhat/configs directory
+#
+# invocation:   python merge.py overrides baseconfig [arch]
+#
+# This script merges two kernel configuration files, an override file and a
+# base config file and writes the results to stdout.
+#
+# The script reads the overrides into a dictionary, then reads the baseconfig
+# file, looking for overrides and replacing any found, then printing the result
+# to stdout. Finally any remaining (new) configs in the override are appended to the
+# end of the output
+
+import sys
+import re
+import os.path
+
+def usage(msg):
+    '''print a usage message and exit'''
+    sys.stderr.write(msg + "\n")
+    sys.stderr.write("usage: merge.py overrides baseconfig [arch]\n")
+    sys.exit(1)
+
+isset = re.compile(r'^(CONFIG_\w+)=')
+notset = re.compile(r'^#\s+(CONFIG_\w+)\s+is not set')
+
+# search an input line for a config (set or notset) pattern
+# if we get a match return the config that is being changed
+def find_config(line):
+    '''find a configuration line in the input and return the config name'''
+    m = isset.match(line)
+    if (m is not None):
+        return m.group(1)
+
+    m = notset.match(line)
+    if (m is not None):
+        return m.group(1)
+
+    return None
+
+#########################################################
+
+if len(sys.argv) < 3:
+    usage("must have two input files")
+
+override_file = sys.argv[1]
+baseconfig_file = sys.argv[2]
+
+if not os.path.exists(override_file):
+    usage(f"overrides config file {override_file:s} does not exist!")
+
+if not os.path.exists(baseconfig_file):
+    usage(f"base configs file {baseconfig_file:s} does not exist")
+
+if len(sys.argv) == 4:
+    print(f"# {sys.argv[3]:s}")
+
+# read each line of the override file and store any configuration values
+# in the overrides dictionary, keyed by the configuration name.
+overrides = {}
+with open(override_file, "rt", encoding="utf-8") as f:
+    for line in [l.strip() for l in f.readlines()]:
+        c = find_config(line)
+        if c and c not in overrides:
+            overrides[c] = line
+
+# now read and print the base config, checking each line
+# that defines a config value and printing the override if
+# it exists
+with open(baseconfig_file, "rt", encoding="utf-8") as f:
+    for line in [ l.strip() for l in f.readlines() ]:
+        c = find_config(line)
+        if c and c in overrides:
+            print(overrides[c])
+            del overrides[c]
+        else:
+            print(line)
+
+# print out the remaining configs (new values)
+# from the overrides file
+for v in overrides.values():
+    print (v)
+
+sys.exit(0)
--- a/redkernel/mod-denylist.sh
+++ b/redkernel/mod-denylist.sh
@ -0,0 +1,153 @@
+#! /bin/bash
+# shellcheck disable=SC2164
+
+RpmDir=$1
+ModDir=$2
+Dir="$1/$2"
+# Note the list filename must have the format mod-[PACKAGE].list, for example,
+# mod-internal.list or mod-extra.list.  The PACKAGE is used to create a
+# override directory for the modules.
+List=$3
+Dest="$4"
+
+blacklist()
+{
+	cat > "$RpmDir/etc/modprobe.d/$1-blacklist.conf" <<-__EOF__
+	# This kernel module can be automatically loaded by non-root users. To
+	# enhance system security, the module is blacklisted by default to ensure
+	# system administrators make the module available for use as needed.
+	# See https://access.redhat.com/articles/3760101 for more details.
+	#
+	# Remove the blacklist by adding a comment # at the start of the line.
+	blacklist $1
+__EOF__
+}
+
+check_blacklist()
+{
+	mod=$(find "$RpmDir/$ModDir" -name "$1")
+	[ ! "$mod" ] && return 0
+	if modinfo "$mod" | grep -q '^alias:\s\+net-'; then
+		mod="${1##*/}"
+		mod="${mod%.ko*}"
+		echo "$mod has an alias that allows auto-loading. Blacklisting."
+		blacklist "$mod"
+	fi
+}
+
+find_depends()
+{
+	dep=$1
+	depends=$(modinfo "$dep" | sed -n -e "/^depends/ s/^depends:[ \t]*//p")
+	[ -z "$depends" ] && exit
+	for mod in ${depends//,/ }
+	do
+		match=$(grep "^$mod.ko" "$ListName")
+		[ -z "$match" ] && continue
+		# check if the module we are looking at is in mod-* too.
+		# if so we do not need to mark the dep as required.
+		mod2=${dep##*/}  # same as $(basename $dep), but faster
+		match2=$(grep "^$mod2" "$ListName")
+		if [ -n "$match2" ]
+		then
+			#echo $mod2 >> notreq.list
+			continue
+		fi
+		echo "$mod".ko >> req.list
+	done
+}
+
+foreachp()
+{
+	P=$(nproc)
+	bgcount=0
+	while read -r mod; do
+		$1 "$mod" &
+
+		bgcount=$((bgcount + 1))
+		if [ $bgcount -eq "$P" ]; then
+			wait -n
+			bgcount=$((bgcount - 1))
+		fi
+	done
+
+	wait
+}
+
+# Destination was specified on the command line
+test -n "$4" && echo "$0: Override Destination $Dest has been specified."
+
+pushd "$Dir"
+
+OverrideDir=$(basename "$List")
+OverrideDir=${OverrideDir%.*}
+OverrideDir=${OverrideDir#*-}
+mkdir -p "$OverrideDir"
+
+rm -rf modnames
+find . -name "*.ko" -type f > modnames
+# Look through all of the modules, and throw any that have a dependency in
+# our list into the list as well.
+rm -rf dep.list dep2.list
+rm -rf req.list req2.list
+touch dep.list req.list
+cp "$List" .
+
+# This variable needs to be exported because it is used in sub-script
+# executed by xargs
+ListName=$(basename "$List")
+export ListName
+
+foreachp find_depends < modnames
+
+sort -u req.list > req2.list
+sort -u "$ListName" > modules2.list
+join -v 1 modules2.list req2.list > modules3.list
+
+while IFS= read -r mod
+do
+    # get the path for the module
+    modpath=$(grep /"$mod" modnames)
+    [ -z "$modpath" ] && continue
+    echo "$modpath" >> dep.list
+done < modules3.list
+
+sort -u dep.list > dep2.list
+
+if [ -n "$Dest" ]; then
+    # now move the modules into the $Dest directory
+    while IFS= read -r mod
+    do
+	newpath=$(dirname "$mod" | sed -e "s/kernel\\//$Dest\//")
+	mkdir -p "$newpath"
+	mv "$mod" "$newpath"
+	echo "$mod" | sed -e "s/kernel\\//$Dest\//" | sed -e "s|^.|${ModDir}|g" >> "$RpmDir"/"$ListName"
+    done < dep2.list
+fi
+
+popd
+
+if [ -z "$Dest" ]; then
+	sed -e "s|^.|${ModDir}|g" "$Dir"/dep2.list > "$RpmDir/$ListName"
+	echo "$RpmDir/$ListName created."
+	[ -d "$RpmDir/etc/modprobe.d/" ] || mkdir -p "$RpmDir/etc/modprobe.d/"
+	foreachp check_blacklist < "$List"
+fi
+
+# Many BIOS-es export a PNP-id which causes the floppy driver to autoload
+# even though most modern systems don't have a 3.5" floppy driver anymore
+# this replaces the old die_floppy_die.patch which removed the PNP-id from
+# the module
+
+floppylist=("$RpmDir"/"$ModDir"/kernel/drivers/block/floppy.ko*)
+if [[ -n ${floppylist[0]} && -f ${floppylist[0]} ]]; then
+     blacklist "floppy"
+fi
+
+# avoid an empty kernel-extra package
+echo "$ModDir/$OverrideDir" >> "$RpmDir/$ListName"
+
+pushd "$Dir"
+rm modnames dep.list dep2.list req.list req2.list
+rm "$ListName" modules2.list modules3.list
+popd
--- a/redkernel/mod-extra.list.fedora
+++ b/redkernel/mod-extra.list.fedora
@ -0,0 +1,201 @@
+6pack.ko
+a3d.ko
+act200l-sir.ko
+actisys-sir.ko
+adi.ko
+aer_inject.ko
+af_802154.ko
+affs.ko
+ali-ircc.ko
+analog.ko
+appletalk.ko
+atm.ko
+avma1_cs.ko
+avm_cs.ko
+avmfritz.ko
+ax25.ko
+b1.ko
+bas_gigaset.ko
+batman-adv.ko
+baycom_par.ko
+baycom_ser_fdx.ko
+baycom_ser_hdx.ko
+befs.ko
+bpqether.ko
+br2684.ko
+capi.ko
+c_can.ko
+c_can_platform.ko
+clip.ko
+cobra.ko
+coda.ko
+cuse.ko
+db9.ko
+dccp_diag.ko
+dccp_ipv4.ko
+dccp_ipv6.ko
+dccp.ko
+dccp_probe.ko
+diva_idi.ko
+divas.ko
+dlm.ko
+dln2-adc.ko
+dln2.ko
+ds1wm.ko
+ds2482.ko
+ds2490.ko
+dss1_divert.ko
+elsa_cs.ko
+ems_pci.ko
+ems_usb.ko
+esd_usb2.ko
+esi-sir.ko
+floppy.ko
+gamecon.ko
+gf2k.ko
+gfs2.ko
+gigaset.ko
+girbil-sir.ko
+gpio-dln2.ko
+grip.ko
+grip_mp.ko
+guillemot.ko
+hdlcdrv.ko
+hfc4s8s_l1.ko
+hfcmulti.ko
+hfcpci.ko
+hisax.ko
+hwa-rc.ko
+hysdn.ko
+i2400m.ko
+i2400m-sdio.ko
+i2400m-usb.ko
+i2c-dln2.ko
+ieee802154.ko
+iforce.ko
+interact.ko
+ipddp.ko
+ipx.ko
+isdn.ko
+joydump.ko
+kingsun-sir.ko
+ks959-sir.ko
+ksdazzle-sir.ko
+kvaser_pci.ko
+l2tp_core.ko
+l2tp_debugfs.ko
+l2tp_eth.ko
+l2tp_ip.ko
+l2tp_netlink.ko
+l2tp_ppp.ko
+lec.ko
+ma600-sir.ko
+magellan.ko
+mcp2120-sir.ko
+mISDN_core.ko
+mISDN_dsp.ko
+mkiss.ko
+mptbase.ko
+mptctl.ko
+mptfc.ko
+nci.ko
+ncpfs.ko
+netjet.ko
+netrom.ko
+nfc.ko
+nilfs2.ko
+ocfs2_dlmfs.ko
+ocfs2_dlm.ko
+ocfs2.ko
+ocfs2_nodemanager.ko
+ocfs2_stackglue.ko
+ocfs2_stack_o2cb.ko
+ocfs2_stack_user.ko
+old_belkin-sir.ko
+orinoco_cs.ko
+orinoco.ko
+orinoco_nortel.ko
+orinoco_pci.ko
+orinoco_plx.ko
+orinoco_usb.ko
+pcspkr.ko
+plx_pci.ko
+pn_pep.ko
+pppoatm.ko
+rds.ko
+rds_rdma.ko
+rds_tcp.ko
+rose.ko
+sch_atm.ko
+sch_cbq.ko
+sch_choke.ko
+sch_drr.ko
+sch_dsmark.ko
+sch_etf.ko
+sch_gred.ko
+sch_mqprio.ko
+sch_multiq.ko
+sch_netem.ko
+sch_qfq.ko
+sch_red.ko
+sch_sfb.ko
+sch_teql.ko
+sctp.ko
+sctp_probe.ko
+sidewinder.ko
+sja1000.ko
+sja1000_platform.ko
+slcan.ko
+slip.ko
+softing_cs.ko
+softing.ko
+spaceball.ko
+spaceorb.ko
+spi-dln2.ko
+stinger.ko
+sysv.ko
+tcp_bic.ko
+tcp_highspeed.ko
+tcp_htcp.ko
+tcp_hybla.ko
+tcp_illinois.ko
+tcp_lp.ko
+tcp_scalable.ko
+tcp_vegas.ko
+tcp_veno.ko
+tcp_westwood.ko
+tcp_yeah.ko
+tekram-sir.ko
+tmdc.ko
+toim3232-sir.ko
+trancevibrator.ko
+turbografx.ko
+twidjoy.ko
+ubifs.ko
+ufs.ko
+umc.ko
+usbip-core.ko
+usbip-host.ko
+uwb.ko
+vcan.ko
+vhci-hcd.ko
+w1_bq27000.ko
+w1_ds2408.ko
+w1_ds2423.ko
+w1_ds2431.ko
+w1_ds2433.ko
+w1_ds2760.ko
+w1_ds2780.ko
+w1_ds2781.ko
+w1_ds28e04.ko
+w1_smem.ko
+w1_therm.ko
+w6692.ko
+walkera0701.ko
+wanrouter.ko
+warrior.ko
+whci.ko
+wire.ko
+wwan_hwsim.ko
+yam.ko
+zhenhua.ko
--- a/redkernel/mod-extra.list.rhel
+++ b/redkernel/mod-extra.list.rhel
@ -0,0 +1,327 @@
+6pack.ko
+a3d.ko
+act200l-sir.ko
+actisys-sir.ko
+adi.ko
+aer_inject.ko
+af_802154.ko
+affs.ko
+ali-ircc.ko
+analog.ko
+appletalk.ko
+arptable_filter.ko
+arp_tables.ko
+arpt_mangle.ko
+atm.ko
+avma1_cs.ko
+avm_cs.ko
+avmfritz.ko
+ax25.ko
+b1.ko
+bas_gigaset.ko
+batman-adv.ko
+baycom_par.ko
+baycom_ser_fdx.ko
+baycom_ser_hdx.ko
+befs.ko
+bpqether.ko
+br2684.ko
+br_netfilter.ko
+capi.ko
+c_can.ko
+c_can_platform.ko
+clip.ko
+cobra.ko
+coda.ko
+cuse.ko
+db9.ko
+dccp_diag.ko
+dccp_ipv4.ko
+dccp_ipv6.ko
+dccp.ko
+dccp_probe.ko
+diva_idi.ko
+divas.ko
+ds1wm.ko
+ds2482.ko
+ds2490.ko
+dss1_divert.ko
+ebt_802_3.ko
+ebtable_broute.ko
+ebtable_filter.ko
+ebtable_nat.ko
+ebtables.ko
+ebt_among.ko
+ebt_arp.ko
+ebt_arpreply.ko
+ebt_dnat.ko
+ebt_ip6.ko
+ebt_ip.ko
+ebt_limit.ko
+ebt_log.ko
+ebt_mark.ko
+ebt_mark_m.ko
+ebt_nflog.ko
+ebt_pkttype.ko
+ebt_redirect.ko
+ebt_snat.ko
+ebt_stp.ko
+ebt_vlan.ko
+elsa_cs.ko
+ems_pci.ko
+ems_usb.ko
+esd_usb2.ko
+esi-sir.ko
+gamecon.ko
+gf2k.ko
+gigaset.ko
+girbil-sir.ko
+grip.ko
+grip_mp.ko
+guillemot.ko
+hdlcdrv.ko
+hfc4s8s_l1.ko
+hfcmulti.ko
+hfcpci.ko
+hisax.ko
+hwa-rc.ko
+hysdn.ko
+i2400m.ko
+i2400m-sdio.ko
+i2400m-usb.ko
+ieee802154.ko
+iforce.ko
+interact.ko
+ip6table_filter.ko
+ip6table_mangle.ko
+ip6table_nat.ko
+ip6table_raw.ko
+ip6table_security.ko
+ip6_tables.ko
+ip6t_ah.ko
+ip6t_eui64.ko
+ip6t_frag.ko
+ip6t_hbh.ko
+ip6t_ipv6header.ko
+ip6t_mh.ko
+ip6t_NPT.ko
+ip6t_REJECT.ko
+ip6t_rpfilter.ko
+ip6t_rt.ko
+ipddp.ko
+ip_set_bitmap_ip.ko
+ip_set_bitmap_ipmac.ko
+ip_set_bitmap_port.ko
+ip_set_hash_ip.ko
+ip_set_hash_ipmac.ko
+ip_set_hash_ipmark.ko
+ip_set_hash_ipportip.ko
+ip_set_hash_ipport.ko
+ip_set_hash_ipportnet.ko
+ip_set_hash_mac.ko
+ip_set_hash_netiface.ko
+ip_set_hash_net.ko
+ip_set_hash_netnet.ko
+ip_set_hash_netport.ko
+ip_set_hash_netportnet.ko
+ip_set.ko
+ip_set_list_set.ko
+iptable_filter.ko
+iptable_mangle.ko
+iptable_nat.ko
+iptable_raw.ko
+iptable_security.ko
+ip_tables.ko
+ipt_ah.ko
+ipt_ECN.ko
+ipt_REJECT.ko
+ipt_rpfilter.ko
+ipx.ko
+isdn.ko
+joydump.ko
+kingsun-sir.ko
+ks959-sir.ko
+ksdazzle-sir.ko
+kvaser_pci.ko
+l2tp_core.ko
+l2tp_debugfs.ko
+l2tp_eth.ko
+l2tp_ip.ko
+l2tp_ip6.ko
+l2tp_netlink.ko
+l2tp_ppp.ko
+lec.ko
+ma600-sir.ko
+magellan.ko
+mcp2120-sir.ko
+mISDN_core.ko
+mISDN_dsp.ko
+mkiss.ko
+mptbase.ko
+mptctl.ko
+mptfc.ko
+nci.ko
+ncpfs.ko
+netjet.ko
+netrom.ko
+nfc.ko
+nft_compat.ko
+nilfs2.ko
+ocfs2_dlmfs.ko
+ocfs2_dlm.ko
+ocfs2.ko
+ocfs2_nodemanager.ko
+ocfs2_stackglue.ko
+ocfs2_stack_o2cb.ko
+ocfs2_stack_user.ko
+old_belkin-sir.ko
+orinoco_cs.ko
+orinoco.ko
+orinoco_nortel.ko
+orinoco_pci.ko
+orinoco_plx.ko
+orinoco_usb.ko
+plx_pci.ko
+pn_pep.ko
+pppoatm.ko
+rds.ko
+rds_rdma.ko
+rds_tcp.ko
+rose.ko
+sch_atm.ko
+sch_cbq.ko
+sch_choke.ko
+sch_drr.ko
+sch_dsmark.ko
+sch_gred.ko
+sch_mqprio.ko
+sch_multiq.ko
+sch_netem.ko
+sch_qfq.ko
+sch_red.ko
+sch_sfb.ko
+sch_teql.ko
+sctp.ko
+sctp_diag.ko
+sctp_probe.ko
+sidewinder.ko
+sja1000.ko
+sja1000_platform.ko
+slcan.ko
+slip.ko
+softing_cs.ko
+softing.ko
+spaceball.ko
+spaceorb.ko
+stinger.ko
+sysv.ko
+tcp_bic.ko
+tcp_highspeed.ko
+tcp_htcp.ko
+tcp_hybla.ko
+tcp_illinois.ko
+tcp_lp.ko
+tcp_scalable.ko
+tcp_vegas.ko
+tcp_veno.ko
+tcp_westwood.ko
+tcp_yeah.ko
+tekram-sir.ko
+tmdc.ko
+toim3232-sir.ko
+trancevibrator.ko
+turbografx.ko
+twidjoy.ko
+ubifs.ko
+ufs.ko
+umc.ko
+usbip-core.ko
+usbip-host.ko
+uwb.ko
+vcan.ko
+vhci-hcd.ko
+w1_bq27000.ko
+w1_ds2408.ko
+w1_ds2423.ko
+w1_ds2431.ko
+w1_ds2433.ko
+w1_ds2760.ko
+w1_ds2780.ko
+w1_ds2781.ko
+w1_ds28e04.ko
+w1_smem.ko
+w1_therm.ko
+w6692.ko
+walkera0701.ko
+wanrouter.ko
+warrior.ko
+whci.ko
+wire.ko
+wwan_hwsim.ko
+xt_addrtype.ko
+xt_AUDIT.ko
+xt_bpf.ko
+xt_cgroup.ko
+xt_CHECKSUM.ko
+xt_CLASSIFY.ko
+xt_cluster.ko
+xt_comment.ko
+xt_connbytes.ko
+xt_connlabel.ko
+xt_connlimit.ko
+xt_connmark.ko
+xt_CONNSECMARK.ko
+xt_conntrack.ko
+xt_cpu.ko
+xt_CT.ko
+xt_dccp.ko
+xt_devgroup.ko
+xt_dscp.ko
+xt_DSCP.ko
+xt_ecn.ko
+xt_esp.ko
+xt_hashlimit.ko
+xt_helper.ko
+xt_hl.ko
+xt_HL.ko
+xt_HMARK.ko
+xt_IDLETIMER.ko
+xt_iprange.ko
+xt_ipvs.ko
+xt_length.ko
+xt_limit.ko
+xt_LOG.ko
+xt_mac.ko
+xt_mark.ko
+xt_MASQUERADE.ko
+xt_multiport.ko
+xt_nat.ko
+xt_NETMAP.ko
+xt_NFLOG.ko
+xt_NFQUEUE.ko
+xt_osf.ko
+xt_owner.ko
+xt_physdev.ko
+xt_pkttype.ko
+xt_policy.ko
+xt_quota.ko
+xt_rateest.ko
+xt_RATEEST.ko
+xt_realm.ko
+xt_recent.ko
+xt_REDIRECT.ko
+xt_sctp.ko
+xt_SECMARK.ko
+xt_set.ko
+xt_socket.ko
+xt_state.ko
+xt_statistic.ko
+xt_string.ko
+xt_tcpmss.ko
+xt_TCPMSS.ko
+xt_TCPOPTSTRIP.ko
+xt_TEE.ko
+xt_TPROXY.ko
+xt_TRACE.ko
+yam.ko
+zhenhua.ko
--- a/redkernel/mod-internal.list
+++ b/redkernel/mod-internal.list
@ -0,0 +1,88 @@
+bitfield_kunit
+checksum_kunit
+clk-gate_test
+clk_test
+cmdline_kunit
+cpumask_kunit
+cros_kunit
+dev_addr_lists_test
+dmatest
+drm_buddy_test
+drm_cmdline_parser_test
+drm_connector_test
+drm_damage_helper_test
+drm_dp_mst_helper_test
+drm_format_helper_test
+drm_format_test
+drm_framebuffer_test
+drm_kunit_helpers
+drm_managed_test
+drm_mm_test
+drm_modes_test
+drm_plane_helper_test
+drm_probe_helper_test
+drm_rect_test
+ext4-inode-test
+fat_test
+fortify_kunit
+gss_krb5_test
+handshake-test
+hashtable_test
+hid-uclogic-test
+iio-test-format
+iio-test-rescale
+input_test
+is_signed_type_kunit
+kasan_test
+kfence_test
+kunit
+kunit-test
+lib_test
+list-test
+locktorture
+mac80211_hwsim
+memcpy_kunit
+mptcp_crypto_test
+mptcp_token_test
+mtty
+netdevsim
+overflow_kunit
+pktgen
+rational-test
+rcuscale
+rcutorture
+refscale
+regmap-kunit
+resource_kunit
+rocker
+scftorture
+siphash_kunit
+slub_kunit
+soc-topology-test
+soc-utils-test
+stackinit_kunit
+strcat_kunit
+strscpy_kunit
+sysctl-test
+test_bits
+test_bpf
+test_hash
+test_hmm
+test_kasan
+test_klp_atomic_replace
+test_klp_callbacks_busy
+test_klp_callbacks_demo
+test_klp_callbacks_demo2
+test_klp_callbacks_mod
+test_klp_livepatch
+test_klp_shadow_vars
+test_klp_state
+test_klp_state2
+test_klp_state3
+test_kprobes
+test_linear_ranges
+test_list_sort
+test_sort
+test_vmalloc
+time_test
+torture
--- a/redkernel/mod-kvm.list
+++ b/redkernel/mod-kvm.list
@ -0,0 +1,5 @@
+kvm-amd
+kvm-intel
+kvm
+kvmgt
+ptp_kvm
--- a/redkernel/mod-partner.list
+++ b/redkernel/mod-partner.list
@ -0,0 +1,2 @@
+afs
+rxrpc
--- a/redkernel/mod-sign.sh
+++ b/redkernel/mod-sign.sh
@ -0,0 +1,37 @@
+#! /bin/bash
+
+# The modules_sign target checks for corresponding .o files for every .ko that
+# is signed. This doesn't work for package builds which re-use the same build
+# directory for every variant, and the .config may change between variants.
+# So instead of using this script to just sign lib/modules/$KernelVer/extra,
+# sign all .ko in the buildroot.
+
+# This essentially duplicates the 'modules_sign' Kbuild target and runs the
+# same commands for those modules.
+
+MODSECKEY=$1
+MODPUBKEY=$2
+moddir=$3
+
+modules=$(find "$moddir" -type f -name '*.ko')
+
+NPROC=$(nproc)
+[ -z "$NPROC" ] && NPROC=1
+
+# NB: this loop runs 2000+ iterations. Try to be fast.
+echo "$modules" | xargs -r -n16 -P "$NPROC" sh -c "
+for mod; do
+    ./scripts/sign-file sha256 $MODSECKEY $MODPUBKEY \$mod
+    rm -f \$mod.sig \$mod.dig
+done
+" DUMMYARG0   # xargs appends ARG1 ARG2..., which go into $mod in for loop.
+
+RANDOMMOD=$(echo "$modules" | sort -R | head -n 1)
+if [ "~Module signature appended~" != "$(tail -c 28 "$RANDOMMOD")" ]; then
+    echo "*****************************"
+    echo "*** Modules are unsigned! ***"
+    echo "*****************************"
+    exit 1
+fi
+
+exit 0
--- a/redkernel/partial-kgcov-snip.config
+++ b/redkernel/partial-kgcov-snip.config
@ -0,0 +1,4 @@
+# kgcov
+CONFIG_GCOV_KERNEL=y
+CONFIG_GCOV_PROFILE_ALL=y
+# CONFIG_GCOV_PROFILE_FTRACE is not set
--- a/redkernel/patch-6.5-redhat.patch
+++ b/redkernel/patch-6.5-redhat.patch
--- a/redkernel/process_configs.sh
+++ b/redkernel/process_configs.sh
@ -0,0 +1,412 @@
+#!/bin/bash
+#
+# This script takes the merged config files and processes them through oldconfig
+# and listnewconfig
+#
+# Globally disable suggestion of appending '|| exit' or '|| return' to cd/pushd/popd commands
+# shellcheck disable=SC2164
+
+test -n "$RHTEST" && exit 0
+
+usage()
+{
+	# alphabetical order please
+	echo "process_configs.sh [ options ] package_name kernel_version"
+	echo "     -a: report all errors, equivalent to [-c -n -w -i]"
+	echo "     -c: error on mismatched config options"
+	echo "     -i: continue on error"
+	echo "     -n: error on unset config options"
+	echo "     -t: test run, do not overwrite original config"
+	echo "     -w: error on misconfigured config options"
+	echo "     -z: commit new configs to pending directory"
+	echo ""
+	echo "     A special CONFIG file tag, process_configs_known_broken can be added as a"
+	echo "     comment to any CONFIG file.  This tag indicates that there is no way to "
+	echo "     fix a CONFIG's entry.  This tag should only be used in extreme cases"
+	echo "     and is not to be used as a workaround to solve CONFIG problems."
+	exit 1
+}
+
+die()
+{
+	echo "$1"
+	exit 1
+}
+
+get_cross_compile()
+{
+	arch=$1
+	if [[ "$CC_IS_CLANG" -eq 1 ]]; then
+		echo "$arch"
+	else
+		echo "scripts/dummy-tools/"
+	fi
+}
+
+# stupid function to find top of tree to do kernel make configs
+switch_to_toplevel()
+{
+	path="$(pwd)"
+	while test -n "$path"
+	do
+		test -e "$path"/MAINTAINERS && \
+			test -d "$path"/drivers && \
+			break
+
+		path=$(dirname "$path")
+	done
+
+	test -n "$path"  || die "Can't find toplevel"
+	echo "$path"
+}
+
+checkoptions()
+{
+	count=$3
+	variant=$4
+
+	/usr/bin/awk '
+
+		/is not set/ {
+			split ($0, a, "#");
+			split(a[2], b);
+			if (NR==FNR) {
+				configs[b[1]]="is not set";
+			} else {
+				if (configs[b[1]] != "" && configs[b[1]] != "is not set")
+					 print "Found # "b[1] " is not set, after generation, had " b[1] " " configs[b[1]] " in Source tree";
+			}
+		}
+
+		/=/     {
+			split ($0, a, "=");
+			if (NR==FNR) {
+				configs[a[1]]=a[2];
+			} else {
+				if (configs[a[1]] != "" && configs[a[1]] != a[2])
+					 print "Found "a[1]"="a[2]" after generation, had " a[1]"="configs[a[1]]" in Source tree";
+			}
+		}
+	' "$1" "$2" > .mismatches"${count}"
+
+	checkoptions_error=false
+	if test -s .mismatches"${count}"
+	then
+		while read -r LINE
+		do
+			if find "${REDHAT}"/configs -name "$(echo "$LINE" | awk -F "=" ' { print $1 } ' | awk ' { print $2 }')" -print0 | xargs -0 grep ^ | grep -q "process_configs_known_broken"; then
+				# This is a known broken config.
+				# See script help warning.
+				checkoptions_error=false
+			else
+				checkoptions_error=true
+				break
+			fi
+		done < .mismatches"${count}"
+
+		! $checkoptions_error && return
+
+		sed -i "1s/^/Error: Mismatches found in configuration files for ${arch} ${variant}\n/" .mismatches"${count}"
+	else
+		rm -f .mismatches"${count}"
+	fi
+}
+
+parsenewconfigs()
+{
+	tmpdir=$(mktemp -d)
+
+	# This awk script reads the output of make listnewconfig
+	# and puts it into CONFIG_FOO files. Using the output of
+	# listnewconfig is much easier to ensure we get the default
+	# output.
+        /usr/bin/awk -v BASE="$tmpdir" '
+                /is not set/ {
+                        split ($0, a, "#");
+                        split(a[2], b);
+                        OUT_FILE=BASE"/"b[1];
+                        print $0 >> OUT_FILE;
+                }
+
+                /=/     {
+                        split ($0, a, "=");
+                        OUT_FILE=BASE"/"a[1];
+                        if (a[2] == "n")
+                                print "# " a[1] " is not set" >> OUT_FILE;
+                        else
+                                print $0 >> OUT_FILE;
+                }
+
+        ' .newoptions
+
+	# This awk script parses the output of helpnewconfig.
+	# Each option is separated between ----- markers
+	# The goal is to put all the help text as a comment in
+	# each CONFIG_FOO file. Because of how awk works
+	# there's a lot of moving files around and catting to
+	# get what we need.
+        /usr/bin/awk -v BASE="$tmpdir" '
+                BEGIN { inpatch=0;
+			outfile="none";
+                        symbol="none"; }
+                /^Symbol: .*$/ {
+                        split($0, a, " ");
+                        symbol="CONFIG_"a[2];
+                        outfile=BASE "/fake_"symbol
+                }
+                /-----/ {
+			if (inpatch == 0) {
+				inpatch = 1;
+			}
+                        else {
+                                if (symbol != "none") {
+                                    system("cat " outfile " " BASE "/" symbol " > " BASE "/tmpf");
+                                    system("mv " BASE "/tmpf " BASE "/" symbol);
+                                    symbol="none"
+				}
+                                outfile="none"
+				inpatch = 0;
+                        }
+                }
+                !/-----/ {
+                        if (inpatch == 1 && outfile != "none") {
+                                print "# "$0 >> outfile;
+                        }
+                }
+
+
+        ' .helpnewconfig
+
+	pushd "$tmpdir" &> /dev/null
+	rm fake_*
+	popd &> /dev/null
+	for f in "$tmpdir"/*; do
+		[[ -e "$f" ]] || break
+		cp "$f" "$SCRIPT_DIR/pending$FLAVOR/generic/"
+	done
+
+	rm -rf "$tmpdir"
+}
+
+function commit_new_configs()
+{
+	# assume we are in $source_tree/configs, need to get to top level
+	pushd "$(switch_to_toplevel)" &>/dev/null
+
+	for cfg in "$SCRIPT_DIR/${SPECPACKAGE_NAME}${KVERREL}"*.config
+	do
+		arch=$(head -1 "$cfg" | cut -b 3-)
+		cfgtmp="${cfg}.tmp"
+		cfgorig="${cfg}.orig"
+		cat "$cfg" > "$cfgorig"
+
+		if [ "$arch" = "EMPTY" ]
+		then
+			# This arch is intentionally left blank
+			continue
+		fi
+		echo -n "Checking for new configs in $cfg ... "
+
+		# shellcheck disable=SC2086
+		make ${MAKEOPTS} ARCH="$arch" CROSS_COMPILE="$(get_cross_compile "$arch")" KCONFIG_CONFIG="$cfgorig" listnewconfig >& .listnewconfig
+		grep -E 'CONFIG_' .listnewconfig > .newoptions
+		if test -s .newoptions
+		then
+		# shellcheck disable=SC2086
+			make ${MAKEOPTS} ARCH="$arch" CROSS_COMPILE="$(get_cross_compile "$arch")" KCONFIG_CONFIG="$cfgorig" helpnewconfig >& .helpnewconfig
+			parsenewconfigs
+		fi
+		rm .newoptions
+		echo "done"
+	done
+
+	git add "$SCRIPT_DIR/pending$FLAVOR"
+	git commit -m "[redhat] AUTOMATIC: New configs"
+}
+
+function process_config()
+{
+	local cfg
+	local arch
+	local cfgtmp
+	local cfgorig
+	local count
+	local variant
+
+	cfg=$1
+	count=$2
+
+	arch=$(head -1 "$cfg" | cut -b 3-)
+
+	if [ "$arch" = "EMPTY" ]
+	then
+		# This arch is intentionally left blank
+		return
+	fi
+
+	variant=$(basename "$cfg" | cut -d"-" -f3- | cut -d"." -f1)
+
+	cfgtmp="${cfg}.tmp"
+	cfgorig="${cfg}.orig"
+	cat "$cfg" > "$cfgorig"
+
+	echo "Processing $cfg ... "
+
+	# shellcheck disable=SC2086
+	make ${MAKEOPTS} ARCH="$arch" CROSS_COMPILE="$(get_cross_compile "$arch")" KCONFIG_CONFIG="$cfgorig" listnewconfig >& .listnewconfig"${count}"
+	grep -E 'CONFIG_' .listnewconfig"${count}" > .newoptions"${count}"
+	if test -n "$NEWOPTIONS" && test -s .newoptions"${count}"
+	then
+		echo "Found unset config items in ${arch} ${variant}, please set them to an appropriate value" >> .errors"${count}"
+		cat .newoptions"${count}" >> .errors"${count}"
+		rm .newoptions"${count}"
+		RETURNCODE=1
+	fi
+	rm -f .newoptions"${count}"
+
+	grep -E 'config.*warning' .listnewconfig"${count}" > .warnings"${count}"
+	if test -n "$CHECKWARNINGS" && test -s .warnings"${count}"
+	then
+		echo "Found misconfigured config items in ${arch} ${variant}, please set them to an appropriate value" >> .errors"${count}"
+		cat .warnings"${count}" >> .errors"${count}"
+	fi
+	rm .warnings"${count}"
+
+	rm .listnewconfig"${count}"
+
+	# shellcheck disable=SC2086
+	make ${MAKEOPTS} ARCH="$arch" CROSS_COMPILE="$(get_cross_compile "$arch")" KCONFIG_CONFIG="$cfgorig" olddefconfig > /dev/null || exit 1
+	echo "# $arch" > "$cfgtmp"
+	cat "$cfgorig" >> "$cfgtmp"
+	if test -n "$CHECKOPTIONS"
+	then
+		checkoptions "$cfg" "$cfgtmp" "$count" "$variant"
+	fi
+	# if test run, don't overwrite original
+	if test -n "$TESTRUN"
+	then
+		rm -f "$cfgtmp"
+	else
+		mv "$cfgtmp" "$cfg"
+	fi
+	rm -f "$cfgorig"
+	echo "Processing $cfg complete"
+}
+
+function process_configs()
+{
+	# assume we are in $source_tree/configs, need to get to top level
+	pushd "$(switch_to_toplevel)" &>/dev/null
+
+	# The next line is throwaway code for transition to parallel
+	# processing.  Leaving this line in place is harmless, but it can be
+	# removed the next time anyone updates this function.
+	[ -f .mismatches ] && rm -f .mismatches
+
+	count=0
+	for cfg in "$SCRIPT_DIR/${SPECPACKAGE_NAME}${KVERREL}"*.config
+	do
+		if [ "$count" -eq 0 ]; then
+			# do the first one by itself so that tools are built
+			process_config "$cfg" "$count"
+		fi
+		process_config "$cfg" "$count" &
+		# shellcheck disable=SC2004
+		waitpids[${count}]=$!
+		((count++))
+		while [ "$(jobs | grep -c Running)" -ge "$RHJOBS" ]; do :; done
+	done
+	# shellcheck disable=SC2048
+	for pid in ${waitpids[*]}; do
+		wait "${pid}"
+	done
+
+	rm "$SCRIPT_DIR"/*.config*.old
+
+	if ls .errors* 1> /dev/null 2>&1; then
+		RETURNCODE=1
+		cat .errors*
+		rm .errors* -f
+	fi
+	if ls .mismatches* 1> /dev/null 2>&1; then
+		RETURNCODE=1
+		cat .mismatches*
+		rm .mismatches* -f
+	fi
+
+	popd > /dev/null
+
+	[ $RETURNCODE -eq 0 ] && echo "Processed config files are in $SCRIPT_DIR"
+}
+
+CHECKOPTIONS=""
+NEWOPTIONS=""
+TESTRUN=""
+CHECKWARNINGS=""
+MAKEOPTS=""
+CC_IS_CLANG=0
+
+RETURNCODE=0
+
+while [[ $# -gt 0 ]]
+do
+	key="$1"
+	case $key in
+		-a)
+			CHECKOPTIONS="x"
+			NEWOPTIONS="x"
+			CHECKWARNINGS="x"
+			;;
+		-c)
+			CHECKOPTIONS="x"
+			;;
+		-h)
+			usage
+			;;
+		-n)
+			NEWOPTIONS="x"
+			;;
+		-t)
+			TESTRUN="x"
+			;;
+		-w)
+			CHECKWARNINGS="x"
+			;;
+		-z)
+			COMMITNEWCONFIGS="x"
+			;;
+		-m)
+			shift
+			if [ "$1" = "CC=clang" ] || [ "$1" = "LLVM=1" ]; then
+				CC_IS_CLANG=1
+			fi
+			MAKEOPTS="$MAKEOPTS $1"
+			;;
+		*)
+			break;;
+	esac
+	shift
+done
+
+KVERREL="$(test -n "$1" && echo "-$1" || echo "")"
+FLAVOR="$(test -n "$2" && echo "-$2" || echo "-rhel")"
+# shellcheck disable=SC2015
+SCRIPT=$(readlink -f "$0")
+SCRIPT_DIR=$(dirname "$SCRIPT")
+
+# Config options for RHEL should target the pending-rhel directory, not pending-common.
+if [ "$FLAVOR" = "-rhel" ]
+then
+	FLAVOR="-rhel"
+fi
+
+# to handle this script being a symlink
+cd "$SCRIPT_DIR"
+
+if test -n "$COMMITNEWCONFIGS"; then
+	commit_new_configs
+else
+	process_configs
+fi
+
+exit $RETURNCODE
--- a/redkernel/redhatsecureboot301.cer
+++ b/redkernel/redhatsecureboot301.cer
--- a/redkernel/redhatsecureboot501.cer
+++ b/redkernel/redhatsecureboot501.cer
--- a/redkernel/redhatsecurebootca1.cer
+++ b/redkernel/redhatsecurebootca1.cer
--- a/redkernel/redhatsecurebootca5.cer
+++ b/redkernel/redhatsecurebootca5.cer
--- a/redkernel/rheldup3.x509
+++ b/redkernel/rheldup3.x509
--- a/redkernel/rhelkpatch1.x509
+++ b/redkernel/rhelkpatch1.x509
--- a/redkernel/rpminspect.yaml
+++ b/redkernel/rpminspect.yaml
@ -0,0 +1,31 @@
+# additional rpminspect configuration for this branch
+
+---
+inspections:
+    upstream: off
+
+badfuncs:
+    ignore:
+        - /usr/libexec/ksamples/*
+        - /usr/libexec/kselftests/*
+
+emptyrpm:
+    expected_empty:
+        - kernel
+        - kernel-debug
+        - kernel-debug-devel-matched
+        - kernel-devel-matched
+        - kernel-lpae
+        - kernel-zfcpdump
+        - kernel-zfcpdump-devel-matched
+        - kernel-zfcpdump-modules
+
+patches:
+    ignore_list:
+        - linux-kernel-test.patch
+        - patch-6.5-redhat.patch
+
+runpath:
+    ignore:
+        - /usr/libexec/kselftests/bpf/urandom_read
+        - /usr/libexec/kselftests/bpf/no_alu32/urandom_read
--- a/redkernel/secureboot_ppc.cer
+++ b/redkernel/secureboot_ppc.cer
--- a/redkernel/secureboot_s390.cer
+++ b/redkernel/secureboot_s390.cer
--- a/redkernel/sources
+++ b/redkernel/sources
@ -0,0 +1,3 @@
+SHA512 (linux-6.5.5.tar.xz) = 294823e4b3b787b2abb1d43318f799ad91391124b56c4b7e8c435f588ef9a68be657d97c3f0df6b33dc8a7e8f10385d0b3da7cf5fa4956f20a5856bb57090164
+SHA512 (kernel-abi-stablelists-6.5.5.tar.bz2) = 427a087b114cea4bbcb106c9587ebb646cc404d9bfbe9462b2e1de60479678d0000268e22cee23ce516ed891911cde065920fedc696f3501577019b475b6c863
+SHA512 (kernel-kabi-dw-6.5.5.tar.bz2) = 7d59a3a68172dd9480fc1bc3fa26696a89f1d88fbda0f18fda5a644e1bde0f3b960531ec54ed8ce1a6baee0fc4407a51377eb774a9b5a9ccf7cf0fb93854855b
--- a/redkernel/update_scripts.sh
+++ b/redkernel/update_scripts.sh
@ -0,0 +1,12 @@
+#!/bin/sh
+
+if [ -z "$1" ]; then
+	exit 1
+fi
+
+TARGET="$1"
+
+for i in "$RPM_SOURCE_DIR"/*."$TARGET"; do
+	NEW=${i%."$TARGET"}
+	cp "$i" "$(basename "$NEW")"
+done
--- a/redkernel/x509.genkey.centos
+++ b/redkernel/x509.genkey.centos
@ -0,0 +1,16 @@
+[ req ]
+default_bits = 3072
+distinguished_name = req_distinguished_name
+prompt = no
+x509_extensions = myexts
+
+[ req_distinguished_name ]
+O = The CentOS Project
+CN = CentOS Stream kernel signing key
+emailAddress = security@centos.org
+
+[ myexts ]
+basicConstraints=critical,CA:FALSE
+keyUsage=digitalSignature
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid
--- a/redkernel/x509.genkey.fedora
+++ b/redkernel/x509.genkey.fedora
@ -0,0 +1,16 @@
+[ req ]
+default_bits = 4096
+distinguished_name = req_distinguished_name
+prompt = no
+x509_extensions = myexts
+
+[ req_distinguished_name ]
+O = Fedora
+CN = Fedora kernel signing key
+emailAddress = kernel-team@fedoraproject.org
+
+[ myexts ]
+basicConstraints=critical,CA:FALSE
+keyUsage=digitalSignature
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid
--- a/redkernel/x509.genkey.rhel
+++ b/redkernel/x509.genkey.rhel
@ -0,0 +1,16 @@
+[ req ]
+default_bits = 3072
+distinguished_name = req_distinguished_name
+prompt = no
+x509_extensions = myexts
+
+[ req_distinguished_name ]
+O = Red Hat
+CN = Red Hat Enterprise Linux kernel signing key
+emailAddress = secalert@redhat.com
+
+[ myexts ]
+basicConstraints=critical,CA:FALSE
+keyUsage=digitalSignature
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid