diff --git a/.gitignore b/.gitignore
index ad81bef..7b2b76e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,3 @@
-SOURCES/kernel-rt-3.10.0-693.17.1.rt56.636.tar.xz
+SOURCES/kernel-rt-3.10.0-693.21.1.rt56.639.tar.xz
 SOURCES/rheldup3.x509
 SOURCES/rhelkpatch1.x509
diff --git a/.kernel-rt.metadata b/.kernel-rt.metadata
index 6e7a3fb..b3d0903 100644
--- a/.kernel-rt.metadata
+++ b/.kernel-rt.metadata
@@ -1,3 +1,3 @@
-562524dba4191792726177db50e39936efae25c5 SOURCES/kernel-rt-3.10.0-693.17.1.rt56.636.tar.xz
+6e49b4aeb8b2ac68c811f82fe56b807c694d7812 SOURCES/kernel-rt-3.10.0-693.21.1.rt56.639.tar.xz
 95b9b811c7b0a6c98b2eafc4e7d6d24f2cb63289 SOURCES/rheldup3.x509
 d90885108d225a234a5a9d054fc80893a5bd54d0 SOURCES/rhelkpatch1.x509
diff --git a/SOURCES/kernel-3.10.0-x86_64-rt-debug.config b/SOURCES/kernel-3.10.0-x86_64-rt-debug.config
index d8f9067..c801543 100644
--- a/SOURCES/kernel-3.10.0-x86_64-rt-debug.config
+++ b/SOURCES/kernel-3.10.0-x86_64-rt-debug.config
@@ -377,6 +377,7 @@ CONFIG_ZONE_DMA=y
 CONFIG_SMP=y
 CONFIG_X86_X2APIC=y
 CONFIG_X86_MPPARSE=y
+CONFIG_RETPOLINE=y
 CONFIG_INTEL_RDT_A=y
 CONFIG_X86_EXTENDED_PLATFORM=y
 # CONFIG_X86_NUMACHIP is not set
@@ -1503,6 +1504,7 @@ CONFIG_DEV_COREDUMP=y
 # CONFIG_DEBUG_DEVRES is not set
 # CONFIG_SYS_HYPERVISOR is not set
 # CONFIG_GENERIC_CPU_DEVICES is not set
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_I2C=m
 CONFIG_REGMAP_SPI=y
diff --git a/SOURCES/kernel-3.10.0-x86_64-rt-trace.config b/SOURCES/kernel-3.10.0-x86_64-rt-trace.config
index 2500c03..cf78227 100644
--- a/SOURCES/kernel-3.10.0-x86_64-rt-trace.config
+++ b/SOURCES/kernel-3.10.0-x86_64-rt-trace.config
@@ -376,6 +376,7 @@ CONFIG_ZONE_DMA=y
 CONFIG_SMP=y
 CONFIG_X86_X2APIC=y
 CONFIG_X86_MPPARSE=y
+CONFIG_RETPOLINE=y
 CONFIG_INTEL_RDT_A=y
 CONFIG_X86_EXTENDED_PLATFORM=y
 # CONFIG_X86_NUMACHIP is not set
@@ -1502,6 +1503,7 @@ CONFIG_DEV_COREDUMP=y
 # CONFIG_DEBUG_DEVRES is not set
 # CONFIG_SYS_HYPERVISOR is not set
 # CONFIG_GENERIC_CPU_DEVICES is not set
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_I2C=m
 CONFIG_REGMAP_SPI=y
diff --git a/SOURCES/kernel-3.10.0-x86_64-rt.config b/SOURCES/kernel-3.10.0-x86_64-rt.config
index b810b00..431a698 100644
--- a/SOURCES/kernel-3.10.0-x86_64-rt.config
+++ b/SOURCES/kernel-3.10.0-x86_64-rt.config
@@ -376,6 +376,7 @@ CONFIG_ZONE_DMA=y
 CONFIG_SMP=y
 CONFIG_X86_X2APIC=y
 CONFIG_X86_MPPARSE=y
+CONFIG_RETPOLINE=y
 CONFIG_INTEL_RDT_A=y
 CONFIG_X86_EXTENDED_PLATFORM=y
 # CONFIG_X86_NUMACHIP is not set
@@ -1502,6 +1503,7 @@ CONFIG_DEV_COREDUMP=y
 # CONFIG_DEBUG_DEVRES is not set
 # CONFIG_SYS_HYPERVISOR is not set
 # CONFIG_GENERIC_CPU_DEVICES is not set
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_I2C=m
 CONFIG_REGMAP_SPI=y
diff --git a/SPECS/kernel-rt.spec b/SPECS/kernel-rt.spec
index 60787ac..b855a01 100644
--- a/SPECS/kernel-rt.spec
+++ b/SPECS/kernel-rt.spec
@@ -3,16 +3,14 @@
 
 Summary: The Linux Realtime kernel
 
-# catch building on Fedora
-%if "%{?dist}" == "" || "0%{?fedora}" != "0"
+# force the distro to RHEL7
 %global dist .el7
-%endif
 
 # realtimeN
-%global rtbuild 636
+%global rtbuild 639
 
 # RHEL7 build number
-%global rhel_build 693.17.1
+%global rhel_build 693.21.1
 
 # The preempt RT patch level
 %global rttag rt56
@@ -286,11 +284,12 @@ BuildRequires: module-init-tools, patch >= 2.5.4, bash >= 2.03, sh-utils, tar
 BuildRequires: xz, findutils, gzip, m4, perl, make >= 3.78, diffutils, gawk
 BuildRequires: gcc >= 3.4.2, binutils >= 2.25, redhat-rpm-config >= 9.1.0-55
 BuildRequires: hostname, net-tools, patchutils, bc
+%if %{builddoc}
 BuildRequires: xmlto, asciidoc
+%endif
 BuildRequires: openssl
 BuildRequires: hmaccalc
 BuildRequires: elfutils-libelf-devel
-BuildRequires: python-devel, newt-devel, perl(ExtUtils::Embed)
 %ifarch x86_64
 BuildRequires: pesign >= 0.109-4
 %endif
@@ -299,6 +298,7 @@ BuildRequires: sparse >= 0.4.1
 %endif
 %if %{buildrt}
 %if %{buildperf}
+BuildRequires: python-devel, newt-devel, perl(ExtUtils::Embed)
 BuildRequires: elfutils-devel zlib-devel binutils-devel bison
 BuildRequires: audit-libs-devel
 BuildRequires: java-devel
@@ -1265,10 +1265,13 @@ depmod %{KVERREL}%{?1:.%{1}} || exit $?\
 depmod %{KVERREL}%{?1:.%{1}} || exit $?\
 %{nil}
 
+%if %{with rt}
+# kernel-rt %post script
 %kernel_variant_preun
 %kernel_variant_post
 %kernel_kvm_variant_post
 %kernel_kvm_variant_postun
+%endif
 
 %if %{with debug}
 # kernel-rt-debug %post script
@@ -1409,14 +1412,18 @@ fi
 /lib/modules/%{KVERREL}%{?2:.%{2}}/modules.kvm\
 /lib/modules/%{KVERREL}%{?2:.%{2}}/kernel/arch/x86/kvm\
 /lib/modules/%{KVERREL}%{?2:.%{2}}/kernel/drivers/gpu/drm/i915/gvt\
+%if %{builddebuginfo}\
 %{expand:%%files %{?2:%{2}-}kvm-debuginfo}\
 %dir %{debuginfodir}/lib/modules/%{KVERREL}%{?2:.%{2}}/kernel/arch/x86/kvm\
 %{debuginfodir}/lib/modules/%{KVERREL}%{?2:.%{2}}/kernel/arch/x86/kvm\
 %{debuginfodir}/lib/modules/%{KVERREL}%{?2:.%{2}}/kernel/drivers/gpu/drm/i915/gvt\
 %endif\
+%endif\
 %{nil}
 
+%if %{buildrt}
 %kernel_variant_files %{buildrt}
+%endif
 
 %if %{builddebug}
 %kernel_variant_files %{builddebug} debug
@@ -1431,6 +1438,15 @@ fi
 %endif
 
 %changelog
+* Fri Feb 23 2018 Clark Williams <williams@redhat.com> [3.10.0-693.21.1.rt56.639.el7]
+- [rt] Update source tree to match RHEL 7.4 tree [1537671 1462329]
+
+* Fri Feb 02 2018 Clark Williams <williams@redhat.com> [3.10.0-693.19.1.rt56.638.el7]
+- [rt] Update source tree to match RHEL 7.4 tree [1537671 1462329]
+
+* Fri Feb 02 2018 Clark Williams <williams@redhat.com> [3.10.0-693.19.1.rt56.637.el7]
+- [rt] Update source tree to match RHEL 7.4 tree [1537671 1462329]
+
 * Tue Jan 16 2018 Clark Williams <williams@redhat.com> [3.10.0-693.17.1.rt56.636.el7]
 - [rt] Update source tree to match RHEL 7.4 tree [1519506 1462329]