Merge Linux v5.15.1

Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>

.gitlab-ci.yml

@@ -1,10 +1,284 @@
-# CI definitions for ark-patches and internal are maintained in a single file
-# outside the main repository because the two branches are regularly merged
-# together in release branches. Rather than trying to keep the two branches in
-# sync or have merge conflicts each time we merge the two branches, the
-# definition is stored externally and included in each branch.
-#
-# To update any CI jobs, please submit any merge requests to
-# https://gitlab.com/cki-project/kernel-ark-ci/.
+# This CI will only work for project members. CI for public contributors
+# runs via a webhook on the merge requests. There's nothing you have to do if
+# you want your changes tested -- created pipeline will be automatically
+# linked in the merge request and appropriate labels will be added to it.
+# Changes to this file will NOT be reflected in the webhook testing.
+
 include:
-  - remote: 'https://gitlab.com/cki-project/kernel-ark-ci/raw/master/gitlab-ci.yml'
+  - project: cki-project/pipeline-definition
+    ref: main
+    file: kernel_templates.yml
+
+stages:
+  - test
+  - build
+  - deploy
+
+workflow:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'   # ARK release pipelines
+    - if: '$CI_MERGE_REQUEST_PROJECT_PATH =~ /^cki-project.kernel-ark/'   # ARK MR CI
+      variables:
+        REQUESTED_PIPELINE_TYPE: 'ark-ci'
+    # We cannot merge rules through !reference and have to copy them over from the
+    # CKI pipeline: https://gitlab.com/gitlab-org/gitlab/-/issues/322992
+    - if: '$CI_MERGE_REQUEST_PROJECT_PATH =~ /^redhat.rhel/ || $CI_PROJECT_PATH =~ /^redhat.rhel/'
+      variables:
+        REQUESTED_PIPELINE_TYPE: 'internal'
+    - if: '$CI_MERGE_REQUEST_PROJECT_PATH =~ /^redhat.centos-stream/ || $CI_PROJECT_PATH =~ /^redhat.centos-stream/'
+      variables:
+        REQUESTED_PIPELINE_TYPE: '/^(trusted|centos-rhel)$/'
+
+# We need to differentiate between the pipeline types that are triggered from this
+# single file. Once the mirroring to c9s stops this anchor can be dropped and the
+# regular ".trusted" anchor and "trusted" type can be used. The template is added
+# here instead of into CKI to avoid having to clear up two places after mirror drop.
+.trusted-ark:
+  trigger:
+    project: redhat/red-hat-ci-tools/kernel/cki-internal-pipelines/cki-trusted-contributors
+    strategy: depend
+  variables:
+    PIPELINE_TYPE: 'ark-ci'
+    kernel_type: 'upstream'
+
+.trigger_ark_pipeline:
+  stage: test
+  trigger:
+    branch: kernel-ark
+  variables:
+    name: kernel-ark
+    builder_image: registry.gitlab.com/cki-project/containers/builder-rawhide
+    builder_image_tag: latest
+    srpm_make_target: dist-srpm
+    # We only need srpm so skip the rest of the stages
+    skip_build: 'true'
+    skip_publish: 'true'
+    skip_test: 'true'
+    skip_results: 'true'
+
+.9-common:
+  variables:
+    builder_image_tag: latest
+    srpm_make_target: dist-srpm
+    native_tools: 'true'
+    architectures: 'x86_64 ppc64le aarch64 s390x'
+    POWER_BUILDER_SUFFIX: '-p9'
+
+.trigger_c9s_pipeline:
+  trigger:
+    branch: c9s
+  variables:
+    name: centos-stream-9
+    builder_image: registry.gitlab.com/cki-project/containers/builder-stream9
+    kpet_tree_family: c9s
+    kernel_type: 'upstream'  # Needs to be overriden due to inheriting from .rhel_common
+
+.trigger_rhel9_pipeline:
+  trigger:
+    branch: rhel9
+  variables:
+    name: rhel9
+    builder_image: quay.io/cki/builder-rhel9
+    kpet_tree_family: rhel9
+
+.realtime_check_c9s:
+  trigger:
+    branch: c9s-rt
+  variables:
+    merge_branch: main-rt
+    name: kernel-rt-c9s
+
+.realtime_check_rhel9:
+  trigger:
+    branch: rhel9-rt
+  variables:
+    merge_branch: main-rt
+    name: kernel-rt-rhel9
+
+.trigger_rhel9_build:
+  extends: .trigger_rhel9_pipeline
+  variables:
+    skip_test: 'true'
+    skip_results: 'true'
+
+.realtime_full_c9s:
+  variables:
+    name: kernel-rt-c9s
+    kpet_tree_family: c9s-rt
+    RUN_ONLY_FOR_RT: 'true'
+
+.realtime_full_rhel9:
+  variables:
+    name: kernel-rt-rhel9
+    kpet_tree_family: rhel9-rt
+    RUN_ONLY_FOR_RT: 'true'
+
+# ARK CI
+ark_merge_request:
+  extends: [.trusted-ark, .merge_request, .trigger_ark_pipeline]
+
+# c9s CI
+c9s_merge_request:
+  extends: [.trusted, .merge_request, .rhel_common,
+            .9-common, .trigger_c9s_pipeline]
+
+c9s_realtime_check_merge_request:
+  extends: [.trusted, .merge_request,
+            .9-common,
+            .realtime_check_common,
+            .trigger_c9s_pipeline, .realtime_check_c9s]
+
+c9s_baseline:
+  extends: [.trusted, .baseline, .rhel_common,
+            .9-common, .trigger_c9s_pipeline]
+
+c9s_rhel9_compat_merge_request:
+  extends: [.centos_stream_rhel_internal, .merge_request, .rhel_common,
+            .9-common, .trigger_rhel9_build]
+
+c9s_rhel9_compat_baseline:
+  extends: [.centos_stream_rhel_internal, .baseline, .rhel_common,
+            .9-common, .trigger_rhel9_build]
+
+# c9s realtime branch CI
+c9s_realtime_merge_request:
+  extends: [.trusted, .merge_request,
+            .9-common,
+            .realtime_pipeline_common,
+            .trigger_c9s_pipeline, .realtime_full_c9s]
+
+c9s_realtime_baseline:
+  extends: [.trusted, .baseline,
+            .9-common,
+            .realtime_pipeline_common,
+            .trigger_c9s_pipeline, .realtime_full_c9s]
+
+# RHEL9 CI
+rhel9_merge_request:
+  extends: [.internal, .merge_request, .rhel_common,
+            .9-common, .trigger_rhel9_pipeline]
+
+rhel9_realtime_check_merge_request:
+  extends: [.internal, .merge_request,
+            .9-common,
+            .realtime_check_common,
+            .trigger_rhel9_pipeline, .realtime_check_rhel9]
+
+rhel9_baseline:
+  extends: [.internal, .baseline, .rhel_common,
+            .9-common, .trigger_rhel9_pipeline]
+
+# RHEL9 realtime branch CI
+rhel9_realtime_merge_request:
+  extends: [.internal, .merge_request,
+            .9-common,
+            .realtime_pipeline_common,
+            .trigger_rhel9_pipeline, .realtime_full_rhel9]
+
+rhel9_realtime_baseline:
+  extends: [.internal, .baseline,
+            .9-common,
+            .realtime_pipeline_common,
+            .trigger_rhel9_pipeline, .realtime_full_rhel9]
+
+# scheduled job
+.scheduled_setup:
+  image: registry.gitlab.com/cki-project/containers/builder-fedora
+  variables:
+    GIT_DEPTH: "0"
+    GIT_CLONE_PATH: $CI_BUILDS_DIR/$CI_CONCURRENT_ID/kernel-ark
+  before_script:
+    - echo "fastestmirror=true" >> /etc/dnf/dnf.conf
+    - dnf -y install python3-gitlab git openssh-clients dnf-utils gnupg2
+    - git config user.name "Fedora Kernel Team"
+    - git config user.email "kernel-team@fedoraproject.org"
+    - echo "$PYTHON_GITLAB_CONFIG" >> ~/.python-gitlab.cfg
+    # Need SSH since the clone is set up without write access.
+    - eval $(ssh-agent -s)
+    - echo "$PRIVATE_KEY" | tr -d '\r' | ssh-add - > /dev/null
+    - mkdir -p ~/.ssh
+    - chmod 700 ~/.ssh
+    - echo "$GITLAB_KNOWN_HOSTS" >> ~/.ssh/known_hosts
+    - chmod 644 ~/.ssh/known_hosts
+    - git remote add gitlab git@gitlab.com:cki-project/kernel-ark.git
+    - gpg2 --import "$TORVALDS_GPG_KEY"
+    - git checkout --track origin/master && git describe
+    - export PROJECT_ID="$CI_PROJECT_ID"
+
+merge_upstream:
+  extends: .scheduled_setup
+  script:
+    - git checkout --track origin/os-build && git describe
+    - make dist-merge-upstream-push || exit 1
+  retry: 2
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule" && $RAWHIDE_RELEASE == "false"'
+
+# scheduled job
+rawhide_release:
+  extends: .scheduled_setup
+  script:
+    - git checkout --track origin/ark-latest && git describe
+    - git checkout --track origin/ark-infra && git describe
+    - git checkout --track origin/os-build && git describe
+    - redhat/scripts/ci/ark-create-release.sh "master" "$CI_PROJECT_ID" || exit_code=$?
+    - if [ $exit_code -eq 3 ]; then echo "Tag exists, halting" && exit 0; fi;
+    - if [ $exit_code -ne 0 ]; then echo "Unable to create release tag" && exit 1; fi;
+    - git push gitlab os-build
+    # ark-create-release.sh creates a tag for ark-latest to be pushed.
+    # Make sure the ark-latest branch is checked out.
+    - git checkout ark-latest
+    - git push gitlab "$(git describe)"
+    - git push gitlab ark/*
+    - git push -f gitlab ark-latest
+    - git push -f gitlab ark-infra
+  retry: 2
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule" && $RAWHIDE_RELEASE == "true"'
+
+test_docs:
+  stage: test
+  image: registry.gitlab.com/cki-project/containers/python
+  before_script:
+    - python3 -m venv ~/docs-venv
+    - source ~/docs-venv/bin/activate
+    - pip install sphinx
+    - cd redhat/docs/
+  script: make SPHINXOPTS="-W" html
+  rules:
+    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "os-build"'
+      changes:
+        - redhat/docs/**/*
+
+
+docs:
+  stage: build
+  image: registry.gitlab.com/cki-project/containers/python
+  before_script:
+    - python3 -m venv ~/docs-venv
+    - source ~/docs-venv/bin/activate
+    - pip install sphinx
+    - cd redhat/docs/
+  script: make SPHINXOPTS="-W" html
+  artifacts:
+    paths:
+      - redhat/docs/_build/html/
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "os-build"'
+      changes:
+        - redhat/docs/**/*
+
+pages:
+  stage: deploy
+  image: registry.gitlab.com/cki-project/containers/python
+  dependencies:
+    - docs
+  script:
+    - mv redhat/docs/_build/html/ public/
+  artifacts:
+    paths:
+      - public
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "os-build"'
+      changes:
+        - redhat/docs/**/*

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 15
-SUBLEVEL = 0
+SUBLEVEL = 1
 EXTRAVERSION =
 NAME = Trick or Treat
 

Makefile.rhelver

@@ -1,4 +1,4 @@
-RHEL_MAJOR = 8
+RHEL_MAJOR = 9
 RHEL_MINOR = 99
 
 #

arch/arm/Kconfig

@@ -1470,9 +1470,9 @@ config HIGHMEM
 	  If unsure, say n.
 
 config HIGHPTE
-	bool "Allocate 2nd-level pagetables from highmem" if EXPERT
+	bool "Allocate 2nd-level pagetables from highmem"
 	depends on HIGHMEM
-	default y
+	default n
 	help
 	  The VM uses one page of physical memory for each page table.
 	  For systems with a lot of processes, this can use a lot of

arch/arm64/Kconfig

@@ -911,7 +911,7 @@ endchoice
 
 config ARM64_FORCE_52BIT
 	bool "Force 52-bit virtual addresses for userspace"
-	depends on ARM64_VA_BITS_52 && EXPERT
+	depends on ARM64_VA_BITS_52
 	help
 	  For systems with 52-bit userspace VAs enabled, the kernel will attempt
 	  to maintain compatibility with older software by providing 48-bit VAs
@@ -1152,6 +1152,7 @@ config XEN
 config FORCE_MAX_ZONEORDER
 	int
 	default "14" if ARM64_64K_PAGES
+	default "13" if (ARCH_THUNDER && !ARM64_64K_PAGES)
 	default "12" if ARM64_16K_PAGES
 	default "11"
 	help

arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts

@@ -385,10 +385,6 @@
 	};
 };
 
-&cdn_dp {
-	status = "okay";
-};
-
 &cpu_b0 {
 	cpu-supply = <&vdd_cpu_b>;
 };
@@ -711,7 +707,7 @@
 
 		connector {
 			compatible = "usb-c-connector";
-			data-role = "host";
+			data-role = "dual";
 			label = "USB-C";
 			op-sink-microwatt = <1000000>;
 			power-role = "dual";

arch/arm64/kernel/acpi.c

@@ -40,7 +40,7 @@ int acpi_pci_disabled = 1;	/* skip ACPI PCI scan and IRQ initialization */
 EXPORT_SYMBOL(acpi_pci_disabled);
 
 static bool param_acpi_off __initdata;
-static bool param_acpi_on __initdata;
+static bool param_acpi_on __initdata = true;
 static bool param_acpi_force __initdata;
 
 static int __init parse_acpi(char *arg)

arch/s390/include/asm/ipl.h

@@ -128,6 +128,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
 			     unsigned char flags, unsigned short cert);
 int ipl_report_add_certificate(struct ipl_report *report, void *key,
 			       unsigned long addr, unsigned long len);
+bool ipl_get_secureboot(void);
 
 /*
  * DIAG 308 support

arch/s390/kernel/ipl.c

@@ -2215,3 +2215,8 @@ int ipl_report_free(struct ipl_report *report)
 }
 
 #endif
+
+bool ipl_get_secureboot(void)
+{
+	return !!ipl_secure_flag;
+}

arch/s390/kernel/setup.c

@@ -49,6 +49,7 @@
 #include <linux/memory.h>
 #include <linux/compat.h>
 #include <linux/start_kernel.h>
+#include <linux/security.h>
 #include <linux/hugetlb.h>
 #include <linux/kmemleak.h>
 
@@ -981,6 +982,9 @@ void __init setup_arch(char **cmdline_p)
 
 	log_component_list();
 
+	if (ipl_get_secureboot())
+		security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);
+
 	/* Have one command line that is parsed and saved in /proc/cmdline */
 	/* boot_command_line has been already set up in early.c */
 	*cmdline_p = boot_command_line;

arch/x86/kernel/setup.c

@@ -20,6 +20,7 @@
 #include <linux/root_dev.h>
 #include <linux/hugetlb.h>
 #include <linux/tboot.h>
+#include <linux/security.h>
 #include <linux/usb/xhci-dbgp.h>
 #include <linux/static_call.h>
 #include <linux/swiotlb.h>
@@ -929,6 +930,13 @@ void __init setup_arch(char **cmdline_p)
 	if (efi_enabled(EFI_BOOT))
 		efi_init();
 
+	efi_set_secure_boot(boot_params.secure_boot);
+
+#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
+	if (efi_enabled(EFI_SECURE_BOOT))
+		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);
+#endif
+
 	dmi_setup();
 
 	/*
@@ -1094,19 +1102,7 @@ void __init setup_arch(char **cmdline_p)
 	/* Allocate bigger log buffer */
 	setup_log_buf(1);
 
-	if (efi_enabled(EFI_BOOT)) {
-		switch (boot_params.secure_boot) {
-		case efi_secureboot_mode_disabled:
-			pr_info("Secure boot disabled\n");
-			break;
-		case efi_secureboot_mode_enabled:
-			pr_info("Secure boot enabled\n");
-			break;
-		default:
-			pr_info("Secure boot could not be determined\n");
-			break;
-		}
-	}
+	efi_set_secure_boot(boot_params.secure_boot);
 
 	reserve_initrd();
 

crypto/rng.c

@@ -11,14 +11,17 @@
 #include <linux/atomic.h>
 #include <crypto/internal/rng.h>
 #include <linux/err.h>
+#include <linux/fips.h>
+#include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/random.h>
 #include <linux/seq_file.h>
+#include <linux/sched.h>
+#include <linux/sched/signal.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/cryptouser.h>
-#include <linux/compiler.h>
 #include <net/netlink.h>
 
 #include "internal.h"
@@ -224,5 +227,73 @@ void crypto_unregister_rngs(struct rng_alg *algs, int count)
 }
 EXPORT_SYMBOL_GPL(crypto_unregister_rngs);
 
+static ssize_t crypto_devrandom_read(void __user *buf, size_t buflen)
+{
+	u8 tmp[256];
+	ssize_t ret;
+
+	if (!buflen)
+		return 0;
+
+	ret = crypto_get_default_rng();
+	if (ret)
+		return ret;
+
+	for (;;) {
+		int err;
+		int i;
+
+		i = min_t(int, buflen, sizeof(tmp));
+		err = crypto_rng_get_bytes(crypto_default_rng, tmp, i);
+		if (err) {
+			ret = err;
+			break;
+		}
+
+		if (copy_to_user(buf, tmp, i)) {
+			ret = -EFAULT;
+			break;
+		}
+
+		buflen -= i;
+		buf += i;
+		ret += i;
+
+		if (!buflen)
+			break;
+
+		if (need_resched()) {
+			if (signal_pending(current))
+				break;
+			schedule();
+		}
+	}
+
+	crypto_put_default_rng();
+	memzero_explicit(tmp, sizeof(tmp));
+
+	return ret;
+}
+
+static const struct random_extrng crypto_devrandom_rng = {
+	.extrng_read = crypto_devrandom_read,
+	.owner = THIS_MODULE,
+};
+
+static int __init crypto_rng_init(void)
+{
+	if (fips_enabled)
+		random_register_extrng(&crypto_devrandom_rng);
+	return 0;
+}
+
+static void __exit crypto_rng_exit(void)
+{
+	random_unregister_extrng();
+}
+
+late_initcall(crypto_rng_init);
+module_exit(crypto_rng_exit);
+
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Random Number Generator");

drivers/acpi/apei/hest.c

@@ -94,6 +94,14 @@ int apei_hest_parse(apei_hest_func_t func, void *data)
 	if (hest_disable || !hest_tab)
 		return -EINVAL;
 
+#ifdef CONFIG_ARM64
+	/* Ignore broken firmware */
+	if (!strncmp(hest_tab->header.oem_id, "HPE   ", 6) &&
+	    !strncmp(hest_tab->header.oem_table_id, "ProLiant", 8) &&
+	    MIDR_IMPLEMENTOR(read_cpuid_id()) == ARM_CPU_IMP_APM)
+		return -EINVAL;
+#endif
+
 	hest_hdr = (struct acpi_hest_header *)(hest_tab + 1);
 	for (i = 0; i < hest_tab->error_source_count; i++) {
 		len = hest_esrc_len(hest_hdr);

drivers/acpi/irq.c

@@ -130,6 +130,7 @@ struct acpi_irq_parse_one_ctx {
 	unsigned int index;
 	unsigned long *res_flags;
 	struct irq_fwspec *fwspec;
+	bool skip_producer_check;
 };
 
 /**
@@ -201,7 +202,8 @@ static acpi_status acpi_irq_parse_one_cb(struct acpi_resource *ares,
 		return AE_CTRL_TERMINATE;
 	case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
 		eirq = &ares->data.extended_irq;
-		if (eirq->producer_consumer == ACPI_PRODUCER)
+		if (!ctx->skip_producer_check &&
+		    eirq->producer_consumer == ACPI_PRODUCER)
 			return AE_OK;
 		if (ctx->index >= eirq->interrupt_count) {
 			ctx->index -= eirq->interrupt_count;
@@ -236,8 +238,19 @@ static acpi_status acpi_irq_parse_one_cb(struct acpi_resource *ares,
 static int acpi_irq_parse_one(acpi_handle handle, unsigned int index,
 			      struct irq_fwspec *fwspec, unsigned long *flags)
 {
-	struct acpi_irq_parse_one_ctx ctx = { -EINVAL, index, flags, fwspec };
+	struct acpi_irq_parse_one_ctx ctx = { -EINVAL, index, flags, fwspec, false };
 
+	/*
+	 * Firmware on arm64-based HPE m400 platform incorrectly marks
+	 * its UART interrupt as ACPI_PRODUCER rather than ACPI_CONSUMER.
+	 * Don't do the producer/consumer check for that device.
+	 */
+	if (IS_ENABLED(CONFIG_ARM64)) {
+		struct acpi_device *adev = acpi_bus_get_acpi_device(handle);
+
+		if (adev && !strcmp(acpi_device_hid(adev), "APMC0D08"))
+			ctx.skip_producer_check = true;
+	}
 	acpi_walk_resources(handle, METHOD_NAME__CRS, acpi_irq_parse_one_cb, &ctx);
 	return ctx.rc;
 }

drivers/acpi/scan.c

@@ -1720,6 +1720,15 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device)
 	if (!acpi_match_device_ids(device, i2c_multi_instantiate_ids))
 		return false;
 
+	/*
+	 * Firmware on some arm64 X-Gene platforms will make the UART
+	 * device appear as both a UART and a slave of that UART. Just
+	 * bail out here for X-Gene UARTs.
+	 */
+	if (IS_ENABLED(CONFIG_ARM64) &&
+	    !strcmp(acpi_device_hid(device), "APMC0D08"))
+		return false;
+
 	INIT_LIST_HEAD(&resource_list);
 	acpi_dev_get_resources(device, &resource_list,
 			       acpi_check_serial_bus_slave,

drivers/amba/bus.c

@@ -377,9 +377,6 @@ static int amba_device_try_add(struct amba_device *dev, struct resource *parent)
 	void __iomem *tmp;
 	int i, ret;
 
-	WARN_ON(dev->irq[0] == (unsigned int)-1);
-	WARN_ON(dev->irq[1] == (unsigned int)-1);
-
 	ret = request_resource(parent, &dev->res);
 	if (ret)
 		goto err_out;

drivers/ata/libahci.c

@@ -672,6 +672,24 @@ int ahci_stop_engine(struct ata_port *ap)
 	tmp &= ~PORT_CMD_START;
 	writel(tmp, port_mmio + PORT_CMD);
 
+#ifdef CONFIG_ARM64
+	/* Rev Ax of Cavium CN99XX needs a hack for port stop */
+	if (dev_is_pci(ap->host->dev) &&
+	    to_pci_dev(ap->host->dev)->vendor == 0x14e4 &&
+	    to_pci_dev(ap->host->dev)->device == 0x9027 &&
+	    midr_is_cpu_model_range(read_cpuid_id(),
+			MIDR_CPU_MODEL(ARM_CPU_IMP_BRCM, BRCM_CPU_PART_VULCAN),
+			MIDR_CPU_VAR_REV(0, 0),
+			MIDR_CPU_VAR_REV(0, MIDR_REVISION_MASK))) {
+		tmp = readl(hpriv->mmio + 0x8000);
+		udelay(100);
+		writel(tmp | (1 << 26), hpriv->mmio + 0x8000);
+		udelay(100);
+		writel(tmp & ~(1 << 26), hpriv->mmio + 0x8000);
+		dev_warn(ap->host->dev, "CN99XX SATA reset workaround applied\n");
+	}
+#endif
+
 	/* wait for engine to stop. This could be as long as 500 msec */
 	tmp = ata_wait_register(ap, port_mmio + PORT_CMD,
 				PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500);

drivers/char/ipmi/ipmi_dmi.c

@@ -215,6 +215,21 @@ static int __init scan_for_dmi_ipmi(void)
 {
 	const struct dmi_device *dev = NULL;
 
+#ifdef CONFIG_ARM64
+	/* RHEL-only
+	 * If this is ARM-based HPE m400, return now, because that platform
+	 * reports the host-side ipmi address as intel port-io space, which
+	 * does not exist in the ARM architecture.
+	 */
+	const char *dmistr = dmi_get_system_info(DMI_PRODUCT_NAME);
+
+	if (dmistr && (strcmp("ProLiant m400 Server", dmistr) == 0)) {
+		pr_debug("%s does not support host ipmi\n", dmistr);
+		return 0;
+	}
+	/* END RHEL-only */
+#endif
+
 	while ((dev = dmi_find_device(DMI_DEV_TYPE_IPMI, NULL, dev)))
 		dmi_decode_ipmi((const struct dmi_header *) dev->device_data);
 

drivers/char/ipmi/ipmi_msghandler.c

@@ -35,6 +35,7 @@
 #include <linux/uuid.h>
 #include <linux/nospec.h>
 #include <linux/vmalloc.h>
+#include <linux/dmi.h>
 #include <linux/delay.h>
 
 #define IPMI_DRIVER_VERSION "39.2"
@@ -5160,8 +5161,21 @@ static int __init ipmi_init_msghandler_mod(void)
 {
 	int rv;
 
-	pr_info("version " IPMI_DRIVER_VERSION "\n");
+#ifdef CONFIG_ARM64
+	/* RHEL-only
+	 * If this is ARM-based HPE m400, return now, because that platform
+	 * reports the host-side ipmi address as intel port-io space, which
+	 * does not exist in the ARM architecture.
+	 */
+	const char *dmistr = dmi_get_system_info(DMI_PRODUCT_NAME);
 
+	if (dmistr && (strcmp("ProLiant m400 Server", dmistr) == 0)) {
+		pr_debug("%s does not support host ipmi\n", dmistr);
+		return -ENOSYS;
+	}
+	/* END RHEL-only */
+#endif
+	pr_info("version " IPMI_DRIVER_VERSION "\n");
 	mutex_lock(&ipmi_interfaces_mutex);
 	rv = ipmi_register_driver();
 	mutex_unlock(&ipmi_interfaces_mutex);

drivers/char/random.c

@@ -335,6 +335,7 @@
 #include <linux/syscalls.h>
 #include <linux/completion.h>
 #include <linux/uuid.h>
+#include <linux/rcupdate.h>
 #include <crypto/chacha.h>
 #include <crypto/sha1.h>
 
@@ -349,6 +350,11 @@
 
 /* #define ADD_INTERRUPT_BENCH */
 
+/*
+ * Hook for external RNG.
+ */
+static const struct random_extrng __rcu *extrng;
+
 /*
  * Configuration information
  */
@@ -481,6 +487,9 @@ static int ratelimit_disable __read_mostly;
 module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
 MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
 
+static const struct file_operations extrng_random_fops;
+static const struct file_operations extrng_urandom_fops;
+
 /**********************************************************************
  *
  * OS independent entropy store.   Here are the functions which handle
@@ -1858,6 +1867,13 @@ random_poll(struct file *file, poll_table * wait)
 	return mask;
 }
 
+static __poll_t
+extrng_poll(struct file *file, poll_table * wait)
+{
+	/* extrng pool is always full, always read, no writes */
+	return EPOLLIN | EPOLLRDNORM;
+}
+
 static int
 write_pool(struct entropy_store *r, const char __user *buffer, size_t count)
 {
@@ -1961,7 +1977,58 @@ static int random_fasync(int fd, struct file *filp, int on)
 	return fasync_helper(fd, filp, on, &fasync);
 }
 
+static int random_open(struct inode *inode, struct file *filp)
+{
+	const struct random_extrng *rng;
+
+	rcu_read_lock();
+	rng = rcu_dereference(extrng);
+	if (rng && !try_module_get(rng->owner))
+		rng = NULL;
+	rcu_read_unlock();
+
+	if (!rng)
+		return 0;
+
+	filp->f_op = &extrng_random_fops;
+	filp->private_data = rng->owner;
+
+	return 0;
+}
+
+static int urandom_open(struct inode *inode, struct file *filp)
+{
+	const struct random_extrng *rng;
+
+	rcu_read_lock();
+	rng = rcu_dereference(extrng);
+	if (rng && !try_module_get(rng->owner))
+		rng = NULL;
+	rcu_read_unlock();
+
+	if (!rng)
+		return 0;
+
+	filp->f_op = &extrng_urandom_fops;
+	filp->private_data = rng->owner;
+
+	return 0;
+}
+
+static int extrng_release(struct inode *inode, struct file *filp)
+{
+	module_put(filp->private_data);
+	return 0;
+}
+
+static ssize_t
+extrng_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
+{
+	return rcu_dereference_raw(extrng)->extrng_read(buf, nbytes);
+}
+
 const struct file_operations random_fops = {
+	.open  = random_open,
 	.read  = random_read,
 	.write = random_write,
 	.poll  = random_poll,
@@ -1972,6 +2039,7 @@ const struct file_operations random_fops = {
 };
 
 const struct file_operations urandom_fops = {
+	.open  = urandom_open,
 	.read  = urandom_read,
 	.write = random_write,
 	.unlocked_ioctl = random_ioctl,
@@ -1980,9 +2048,31 @@ const struct file_operations urandom_fops = {
 	.llseek = noop_llseek,
 };
 
+static const struct file_operations extrng_random_fops = {
+	.open  = random_open,
+	.read  = extrng_read,
+	.write = random_write,
+	.poll  = extrng_poll,
+	.unlocked_ioctl = random_ioctl,
+	.fasync = random_fasync,
+	.llseek = noop_llseek,
+	.release = extrng_release,
+};
+
+static const struct file_operations extrng_urandom_fops = {
+	.open  = urandom_open,
+	.read  = extrng_read,
+	.write = random_write,
+	.unlocked_ioctl = random_ioctl,
+	.fasync = random_fasync,
+	.llseek = noop_llseek,
+	.release = extrng_release,
+};
+
 SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count,
 		unsigned int, flags)
 {
+	const struct random_extrng *rng;
 	int ret;
 
 	if (flags & ~(GRND_NONBLOCK|GRND_RANDOM|GRND_INSECURE))
@@ -1998,6 +2088,18 @@ SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count,
 	if (count > INT_MAX)
 		count = INT_MAX;
 
+	rcu_read_lock();
+	rng = rcu_dereference(extrng);
+	if (rng && !try_module_get(rng->owner))
+		rng = NULL;
+	rcu_read_unlock();
+
+	if (rng) {
+		ret = rng->extrng_read(buf, count);
+		module_put(rng->owner);
+		return ret;
+	}
+
 	if (!(flags & GRND_INSECURE) && !crng_ready()) {
 		if (flags & GRND_NONBLOCK)
 			return -EAGAIN;
@@ -2303,3 +2405,16 @@ void add_bootloader_randomness(const void *buf, unsigned int size)
 		add_device_randomness(buf, size);
 }
 EXPORT_SYMBOL_GPL(add_bootloader_randomness);
+
+void random_register_extrng(const struct random_extrng *rng)
+{
+	rcu_assign_pointer(extrng, rng);
+}
+EXPORT_SYMBOL_GPL(random_register_extrng);
+
+void random_unregister_extrng(void)
+{
+	RCU_INIT_POINTER(extrng, NULL);
+	synchronize_rcu();
+}
+EXPORT_SYMBOL_GPL(random_unregister_extrng);

drivers/firmware/efi/Makefile

@@ -28,6 +28,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP)		+= fake_map.o
 obj-$(CONFIG_EFI_BOOTLOADER_CONTROL)	+= efibc.o
 obj-$(CONFIG_EFI_TEST)			+= test/
 obj-$(CONFIG_EFI_DEV_PATH_PARSER)	+= dev-path-parser.o
+obj-$(CONFIG_EFI)			+= secureboot.o
 obj-$(CONFIG_APPLE_PROPERTIES)		+= apple-properties.o
 obj-$(CONFIG_EFI_RCI2_TABLE)		+= rci2-table.o
 obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE)	+= embedded-firmware.o

drivers/firmware/efi/efi.c

@@ -31,6 +31,7 @@
 #include <linux/ucs2_string.h>
 #include <linux/memblock.h>
 #include <linux/security.h>
+#include <linux/bsearch.h>
 
 #include <asm/early_ioremap.h>
 
@@ -841,40 +842,101 @@ int efi_mem_type(unsigned long phys_addr)
 }
 #endif
 
+struct efi_error_code {
+	efi_status_t status;
+	int errno;
+	const char *description;
+};
+
+static const struct efi_error_code efi_error_codes[] = {
+	{ EFI_SUCCESS, 0, "Success"},
+#if 0
+	{ EFI_LOAD_ERROR, -EPICK_AN_ERRNO, "Load Error"},
+#endif
+	{ EFI_INVALID_PARAMETER, -EINVAL, "Invalid Parameter"},
+	{ EFI_UNSUPPORTED, -ENOSYS, "Unsupported"},
+	{ EFI_BAD_BUFFER_SIZE, -ENOSPC, "Bad Buffer Size"},
+	{ EFI_BUFFER_TOO_SMALL, -ENOSPC, "Buffer Too Small"},
+	{ EFI_NOT_READY, -EAGAIN, "Not Ready"},
+	{ EFI_DEVICE_ERROR, -EIO, "Device Error"},
+	{ EFI_WRITE_PROTECTED, -EROFS, "Write Protected"},
+	{ EFI_OUT_OF_RESOURCES, -ENOMEM, "Out of Resources"},
+#if 0
+	{ EFI_VOLUME_CORRUPTED, -EPICK_AN_ERRNO, "Volume Corrupt"},
+	{ EFI_VOLUME_FULL, -EPICK_AN_ERRNO, "Volume Full"},
+	{ EFI_NO_MEDIA, -EPICK_AN_ERRNO, "No Media"},
+	{ EFI_MEDIA_CHANGED, -EPICK_AN_ERRNO, "Media changed"},
+#endif
+	{ EFI_NOT_FOUND, -ENOENT, "Not Found"},
+#if 0
+	{ EFI_ACCESS_DENIED, -EPICK_AN_ERRNO, "Access Denied"},
+	{ EFI_NO_RESPONSE, -EPICK_AN_ERRNO, "No Response"},
+	{ EFI_NO_MAPPING, -EPICK_AN_ERRNO, "No mapping"},
+	{ EFI_TIMEOUT, -EPICK_AN_ERRNO, "Time out"},
+	{ EFI_NOT_STARTED, -EPICK_AN_ERRNO, "Not started"},
+	{ EFI_ALREADY_STARTED, -EPICK_AN_ERRNO, "Already started"},
+#endif
+	{ EFI_ABORTED, -EINTR, "Aborted"},
+#if 0
+	{ EFI_ICMP_ERROR, -EPICK_AN_ERRNO, "ICMP Error"},
+	{ EFI_TFTP_ERROR, -EPICK_AN_ERRNO, "TFTP Error"},
+	{ EFI_PROTOCOL_ERROR, -EPICK_AN_ERRNO, "Protocol Error"},
+	{ EFI_INCOMPATIBLE_VERSION, -EPICK_AN_ERRNO, "Incompatible Version"},
+#endif
+	{ EFI_SECURITY_VIOLATION, -EACCES, "Security Policy Violation"},
+#if 0
+	{ EFI_CRC_ERROR, -EPICK_AN_ERRNO, "CRC Error"},
+	{ EFI_END_OF_MEDIA, -EPICK_AN_ERRNO, "End of Media"},
+	{ EFI_END_OF_FILE, -EPICK_AN_ERRNO, "End of File"},
+	{ EFI_INVALID_LANGUAGE, -EPICK_AN_ERRNO, "Invalid Languages"},
+	{ EFI_COMPROMISED_DATA, -EPICK_AN_ERRNO, "Compromised Data"},
+
+	// warnings
+	{ EFI_WARN_UNKOWN_GLYPH, -EPICK_AN_ERRNO, "Warning Unknown Glyph"},
+	{ EFI_WARN_DELETE_FAILURE, -EPICK_AN_ERRNO, "Warning Delete Failure"},
+	{ EFI_WARN_WRITE_FAILURE, -EPICK_AN_ERRNO, "Warning Write Failure"},
+	{ EFI_WARN_BUFFER_TOO_SMALL, -EPICK_AN_ERRNO, "Warning Buffer Too Small"},
+#endif
+};
+
+static int
+efi_status_cmp_bsearch(const void *key, const void *item)
+{
+	u64 status = (u64)(uintptr_t)key;
+	struct efi_error_code *code = (struct efi_error_code *)item;
+
+	if (status < code->status)
+		return -1;
+	if (status > code->status)
+		return 1;
+	return 0;
+}
+
 int efi_status_to_err(efi_status_t status)
 {
-	int err;
+	struct efi_error_code *found;
+	size_t num = sizeof(efi_error_codes) / sizeof(struct efi_error_code);
 
-	switch (status) {
-	case EFI_SUCCESS:
-		err = 0;
-		break;
-	case EFI_INVALID_PARAMETER:
-		err = -EINVAL;
-		break;
-	case EFI_OUT_OF_RESOURCES:
-		err = -ENOSPC;
-		break;
-	case EFI_DEVICE_ERROR:
-		err = -EIO;
-		break;
-	case EFI_WRITE_PROTECTED:
-		err = -EROFS;
-		break;
-	case EFI_SECURITY_VIOLATION:
-		err = -EACCES;
-		break;
-	case EFI_NOT_FOUND:
-		err = -ENOENT;
-		break;
-	case EFI_ABORTED:
-		err = -EINTR;
-		break;
-	default:
-		err = -EINVAL;
-	}
+	found = bsearch((void *)(uintptr_t)status, efi_error_codes,
+			sizeof(struct efi_error_code), num,
+			efi_status_cmp_bsearch);
+	if (!found)
+		return -EINVAL;
+	return found->errno;
+}
 
-	return err;
+const char *
+efi_status_to_str(efi_status_t status)
+{
+	struct efi_error_code *found;
+	size_t num = sizeof(efi_error_codes) / sizeof(struct efi_error_code);
+
+	found = bsearch((void *)(uintptr_t)status, efi_error_codes,
+			sizeof(struct efi_error_code), num,
+			efi_status_cmp_bsearch);
+	if (!found)
+		return "Unknown error code";
+	return found->description;
 }
 
 static DEFINE_SPINLOCK(efi_mem_reserve_persistent_lock);

drivers/firmware/efi/secureboot.c

@@ -0,0 +1,38 @@
+/* Core kernel secure boot support.
+ *
+ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/efi.h>
+#include <linux/kernel.h>
+#include <linux/printk.h>
+
+/*
+ * Decide what to do when UEFI secure boot mode is enabled.
+ */
+void __init efi_set_secure_boot(enum efi_secureboot_mode mode)
+{
+	if (efi_enabled(EFI_BOOT)) {
+		switch (mode) {
+		case efi_secureboot_mode_disabled:
+			pr_info("Secure boot disabled\n");
+			break;
+		case efi_secureboot_mode_enabled:
+			set_bit(EFI_SECURE_BOOT, &efi.flags);
+			pr_info("Secure boot enabled\n");
+			break;
+		default:
+			pr_warn("Secure boot could not be determined (mode %u)\n",
+				   mode);
+			break;
+		}
+	}
+}

drivers/gpu/drm/amd/amdgpu/amdgpu.h

@@ -1078,8 +1078,6 @@ struct amdgpu_device {
 	char				product_name[32];
 	char				serial[20];
 
-	struct amdgpu_autodump		autodump;
-
 	atomic_t			throttling_logging_enabled;
 	struct ratelimit_state		throttling_logging_rs;
 	uint32_t                        ras_hw_enabled;

drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c

@@ -27,7 +27,6 @@
 #include <linux/pci.h>
 #include <linux/uaccess.h>
 #include <linux/pm_runtime.h>
-#include <linux/poll.h>
 
 #include "amdgpu.h"
 #include "amdgpu_pm.h"
@@ -37,85 +36,7 @@
 #include "amdgpu_securedisplay.h"
 #include "amdgpu_fw_attestation.h"
 
-int amdgpu_debugfs_wait_dump(struct amdgpu_device *adev)
-{
 #if defined(CONFIG_DEBUG_FS)
-	unsigned long timeout = 600 * HZ;
-	int ret;
-
-	wake_up_interruptible(&adev->autodump.gpu_hang);
-
-	ret = wait_for_completion_interruptible_timeout(&adev->autodump.dumping, timeout);
-	if (ret == 0) {
-		pr_err("autodump: timeout, move on to gpu recovery\n");
-		return -ETIMEDOUT;
-	}
-#endif
-	return 0;
-}
-
-#if defined(CONFIG_DEBUG_FS)
-
-static int amdgpu_debugfs_autodump_open(struct inode *inode, struct file *file)
-{
-	struct amdgpu_device *adev = inode->i_private;
-	int ret;
-
-	file->private_data = adev;
-
-	ret = down_read_killable(&adev->reset_sem);
-	if (ret)
-		return ret;
-
-	if (adev->autodump.dumping.done) {
-		reinit_completion(&adev->autodump.dumping);
-		ret = 0;
-	} else {
-		ret = -EBUSY;
-	}
-
-	up_read(&adev->reset_sem);
-
-	return ret;
-}
-
-static int amdgpu_debugfs_autodump_release(struct inode *inode, struct file *file)
-{
-	struct amdgpu_device *adev = file->private_data;
-
-	complete_all(&adev->autodump.dumping);
-	return 0;
-}
-
-static unsigned int amdgpu_debugfs_autodump_poll(struct file *file, struct poll_table_struct *poll_table)
-{
-	struct amdgpu_device *adev = file->private_data;
-
-	poll_wait(file, &adev->autodump.gpu_hang, poll_table);
-
-	if (amdgpu_in_reset(adev))
-		return POLLIN | POLLRDNORM | POLLWRNORM;
-
-	return 0;
-}
-
-static const struct file_operations autodump_debug_fops = {
-	.owner = THIS_MODULE,
-	.open = amdgpu_debugfs_autodump_open,
-	.poll = amdgpu_debugfs_autodump_poll,
-	.release = amdgpu_debugfs_autodump_release,
-};
-
-static void amdgpu_debugfs_autodump_init(struct amdgpu_device *adev)
-{
-	init_completion(&adev->autodump.dumping);
-	complete_all(&adev->autodump.dumping);
-	init_waitqueue_head(&adev->autodump.gpu_hang);
-
-	debugfs_create_file("amdgpu_autodump", 0600,
-		adev_to_drm(adev)->primary->debugfs_root,
-		adev, &autodump_debug_fops);
-}
 
 /**
  * amdgpu_debugfs_process_reg_op - Handle MMIO register reads/writes
@@ -1588,7 +1509,6 @@ int amdgpu_debugfs_init(struct amdgpu_device *adev)
 	}
 
 	amdgpu_ras_debugfs_create_all(adev);
-	amdgpu_debugfs_autodump_init(adev);
 	amdgpu_rap_debugfs_init(adev);
 	amdgpu_securedisplay_debugfs_init(adev);
 	amdgpu_fw_attestation_debugfs_init(adev);

drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.h

@@ -26,10 +26,6 @@
 /*
  * Debugfs
  */
-struct amdgpu_autodump {
-	struct completion		dumping;
-	struct wait_queue_head		gpu_hang;
-};
 
 int amdgpu_debugfs_regs_init(struct amdgpu_device *adev);
 int amdgpu_debugfs_init(struct amdgpu_device *adev);
@@ -37,4 +33,3 @@ void amdgpu_debugfs_fini(struct amdgpu_device *adev);
 void amdgpu_debugfs_fence_init(struct amdgpu_device *adev);
 void amdgpu_debugfs_firmware_init(struct amdgpu_device *adev);
 void amdgpu_debugfs_gem_init(struct amdgpu_device *adev);
-int amdgpu_debugfs_wait_dump(struct amdgpu_device *adev);

drivers/gpu/drm/amd/amdgpu/amdgpu_device.c

@@ -2432,10 +2432,6 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
 	if (!adev->gmc.xgmi.pending_reset)
 		amdgpu_amdkfd_device_init(adev);
 
-	r = amdgpu_amdkfd_resume_iommu(adev);
-	if (r)
-		goto init_failed;
-
 	amdgpu_fru_get_product_info(adev);
 
 init_failed:
@@ -4466,10 +4462,6 @@ int amdgpu_device_pre_asic_reset(struct amdgpu_device *adev,
 	if (reset_context->reset_req_dev == adev)
 		job = reset_context->job;
 
-	/* no need to dump if device is not in good state during probe period */
-	if (!adev->gmc.xgmi.pending_reset)
-		amdgpu_debugfs_wait_dump(adev);
-
 	if (amdgpu_sriov_vf(adev)) {
 		/* stop the data exchange thread */
 		amdgpu_virt_fini_data_exchange(adev);

drivers/gpu/drm/amd/amdkfd/kfd_device.c

@@ -924,6 +924,9 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd,
 
 	svm_migrate_init((struct amdgpu_device *)kfd->kgd);
 
+	if(kgd2kfd_resume_iommu(kfd))
+		goto device_iommu_error;
+
 	if (kfd_resume(kfd))
 		goto kfd_resume_error;
 

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c

@@ -247,6 +247,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf,
 {
 	struct amdgpu_dm_connector *connector = file_inode(f)->i_private;
 	struct dc_link *link = connector->dc_link;
+	struct dc *dc = (struct dc *)link->dc;
 	struct dc_link_settings prefer_link_settings;
 	char *wr_buf = NULL;
 	const uint32_t wr_buf_size = 40;
@@ -313,7 +314,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf,
 	prefer_link_settings.lane_count = param[0];
 	prefer_link_settings.link_rate = param[1];
 
-	dp_retrain_link_dp_test(link, &prefer_link_settings, false);
+	dc_link_set_preferred_training_settings(dc, &prefer_link_settings, NULL, link, true);
 
 	kfree(wr_buf);
 	return size;

drivers/gpu/drm/i915/gt/intel_execlists_submission.c

@@ -2140,10 +2140,6 @@ static void __execlists_unhold(struct i915_request *rq)
 			if (p->flags & I915_DEPENDENCY_WEAK)
 				continue;
 
-			/* Propagate any change in error status */
-			if (rq->fence.error)
-				i915_request_set_error_once(w, rq->fence.error);
-
 			if (w->engine != rq->engine)
 				continue;
 

drivers/hid/hid-rmi.c

@@ -322,19 +322,12 @@ static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)
 {
 	struct rmi_data *hdata = hid_get_drvdata(hdev);
 	struct rmi_device *rmi_dev = hdata->xport.rmi_dev;
-	unsigned long flags;
 
 	if (!(test_bit(RMI_STARTED, &hdata->flags)))
 		return 0;
 
-	local_irq_save(flags);
-
 	rmi_set_attn_data(rmi_dev, data[1], &data[2], size - 2);
 
-	generic_handle_irq(hdata->rmi_irq);
-
-	local_irq_restore(flags);
-
 	return 1;
 }
 
@@ -591,56 +584,6 @@ static const struct rmi_transport_ops hid_rmi_ops = {
 	.reset		= rmi_hid_reset,
 };
 
-static void rmi_irq_teardown(void *data)
-{
-	struct rmi_data *hdata = data;
-	struct irq_domain *domain = hdata->domain;
-
-	if (!domain)
-		return;
-
-	irq_dispose_mapping(irq_find_mapping(domain, 0));
-
-	irq_domain_remove(domain);
-	hdata->domain = NULL;
-	hdata->rmi_irq = 0;
-}
-
-static int rmi_irq_map(struct irq_domain *h, unsigned int virq,
-		       irq_hw_number_t hw_irq_num)
-{
-	irq_set_chip_and_handler(virq, &dummy_irq_chip, handle_simple_irq);
-
-	return 0;
-}
-
-static const struct irq_domain_ops rmi_irq_ops = {
-	.map = rmi_irq_map,
-};
-
-static int rmi_setup_irq_domain(struct hid_device *hdev)
-{
-	struct rmi_data *hdata = hid_get_drvdata(hdev);
-	int ret;
-
-	hdata->domain = irq_domain_create_linear(hdev->dev.fwnode, 1,
-						 &rmi_irq_ops, hdata);
-	if (!hdata->domain)
-		return -ENOMEM;
-
-	ret = devm_add_action_or_reset(&hdev->dev, &rmi_irq_teardown, hdata);
-	if (ret)
-		return ret;
-
-	hdata->rmi_irq = irq_create_mapping(hdata->domain, 0);
-	if (hdata->rmi_irq <= 0) {
-		hid_err(hdev, "Can't allocate an IRQ\n");
-		return hdata->rmi_irq < 0 ? hdata->rmi_irq : -ENXIO;
-	}
-
-	return 0;
-}
-
 static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)
 {
 	struct rmi_data *data = NULL;
@@ -713,18 +656,11 @@ static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)
 
 	mutex_init(&data->page_mutex);
 
-	ret = rmi_setup_irq_domain(hdev);
-	if (ret) {
-		hid_err(hdev, "failed to allocate IRQ domain\n");
-		return ret;
-	}
-
 	if (data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS)
 		rmi_hid_pdata.gpio_data.disable = true;
 
 	data->xport.dev = hdev->dev.parent;
 	data->xport.pdata = rmi_hid_pdata;
-	data->xport.pdata.irq = data->rmi_irq;
 	data->xport.proto_name = "hid";
 	data->xport.ops = &hid_rmi_ops;
 

drivers/hwtracing/coresight/coresight-etm4x-core.c

@@ -9,6 +9,7 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/device.h>
+#include <linux/dmi.h>
 #include <linux/io.h>
 #include <linux/err.h>
 #include <linux/fs.h>
@@ -2105,6 +2106,16 @@ static const struct amba_id etm4_ids[] = {
 	{},
 };
 
+static const struct dmi_system_id broken_coresight[] = {
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "HPE"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Apollo 70"),
+		},
+	},
+	{ }	/* terminating entry */
+};
+
 MODULE_DEVICE_TABLE(amba, etm4_ids);
 
 static struct amba_driver etm4x_amba_driver = {
@@ -2138,6 +2149,11 @@ static int __init etm4x_init(void)
 {
 	int ret;
 
+	if (dmi_check_system(broken_coresight)) {
+		pr_info("ETM4 disabled due to firmware bug\n");
+		return 0;
+	}
+
 	ret = etm4_pm_setup();
 
 	/* etm4_pm_setup() does its own cleanup - exit on error */
@@ -2164,6 +2180,9 @@ clear_pm:
 
 static void __exit etm4x_exit(void)
 {
+	if (dmi_check_system(broken_coresight))
+		return;
+
 	amba_driver_unregister(&etm4x_amba_driver);
 	platform_driver_unregister(&etm4_platform_driver);
 	etm4_pm_clear();

drivers/input/rmi4/rmi_driver.c

@@ -182,42 +182,54 @@ void rmi_set_attn_data(struct rmi_device *rmi_dev, unsigned long irq_status,
 	attn_data.data = fifo_data;
 
 	kfifo_put(&drvdata->attn_fifo, attn_data);
+
+	schedule_work(&drvdata->attn_work);
 }
 EXPORT_SYMBOL_GPL(rmi_set_attn_data);
 
-static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
+static void attn_callback(struct work_struct *work)
 {
-	struct rmi_device *rmi_dev = dev_id;
-	struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev);
+	struct rmi_driver_data *drvdata = container_of(work,
+							struct rmi_driver_data,
+							attn_work);
 	struct rmi4_attn_data attn_data = {0};
 	int ret, count;
 
 	count = kfifo_get(&drvdata->attn_fifo, &attn_data);
-	if (count) {
-		*(drvdata->irq_status) = attn_data.irq_status;
-		drvdata->attn_data = attn_data;
-	}
+	if (!count)
+		return;
+
+	*(drvdata->irq_status) = attn_data.irq_status;
+	drvdata->attn_data = attn_data;
+
+	ret = rmi_process_interrupt_requests(drvdata->rmi_dev);
+	if (ret)
+		rmi_dbg(RMI_DEBUG_CORE, &drvdata->rmi_dev->dev,
+			"Failed to process interrupt request: %d\n", ret);
+
+	kfree(attn_data.data);
+	drvdata->attn_data.data = NULL;
+
+	if (!kfifo_is_empty(&drvdata->attn_fifo))
+		schedule_work(&drvdata->attn_work);
+}
+
+static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
+{
+	struct rmi_device *rmi_dev = dev_id;
+	int ret;
 
 	ret = rmi_process_interrupt_requests(rmi_dev);
 	if (ret)
 		rmi_dbg(RMI_DEBUG_CORE, &rmi_dev->dev,
 			"Failed to process interrupt request: %d\n", ret);
 
-	if (count) {
-		kfree(attn_data.data);
-		drvdata->attn_data.data = NULL;
-	}
-
-	if (!kfifo_is_empty(&drvdata->attn_fifo))
-		return rmi_irq_fn(irq, dev_id);
-
 	return IRQ_HANDLED;
 }
 
 static int rmi_irq_init(struct rmi_device *rmi_dev)
 {
 	struct rmi_device_platform_data *pdata = rmi_get_platform_data(rmi_dev);
-	struct rmi_driver_data *data = dev_get_drvdata(&rmi_dev->dev);
 	int irq_flags = irq_get_trigger_type(pdata->irq);
 	int ret;
 
@@ -235,8 +247,6 @@ static int rmi_irq_init(struct rmi_device *rmi_dev)
 		return ret;
 	}
 
-	data->enabled = true;
-
 	return 0;
 }
 
@@ -886,23 +896,27 @@ void rmi_enable_irq(struct rmi_device *rmi_dev, bool clear_wake)
 	if (data->enabled)
 		goto out;
 
-	enable_irq(irq);
-	data->enabled = true;
-	if (clear_wake && device_may_wakeup(rmi_dev->xport->dev)) {
-		retval = disable_irq_wake(irq);
-		if (retval)
-			dev_warn(&rmi_dev->dev,
-				 "Failed to disable irq for wake: %d\n",
-				 retval);
-	}
+	if (irq) {
+		enable_irq(irq);
+		data->enabled = true;
+		if (clear_wake && device_may_wakeup(rmi_dev->xport->dev)) {
+			retval = disable_irq_wake(irq);
+			if (retval)
+				dev_warn(&rmi_dev->dev,
+					 "Failed to disable irq for wake: %d\n",
+					 retval);
+		}
 
-	/*
-	 * Call rmi_process_interrupt_requests() after enabling irq,
-	 * otherwise we may lose interrupt on edge-triggered systems.
-	 */
-	irq_flags = irq_get_trigger_type(pdata->irq);
-	if (irq_flags & IRQ_TYPE_EDGE_BOTH)
-		rmi_process_interrupt_requests(rmi_dev);
+		/*
+		 * Call rmi_process_interrupt_requests() after enabling irq,
+		 * otherwise we may lose interrupt on edge-triggered systems.
+		 */
+		irq_flags = irq_get_trigger_type(pdata->irq);
+		if (irq_flags & IRQ_TYPE_EDGE_BOTH)
+			rmi_process_interrupt_requests(rmi_dev);
+	} else {
+		data->enabled = true;
+	}
 
 out:
 	mutex_unlock(&data->enabled_mutex);
@@ -922,20 +936,22 @@ void rmi_disable_irq(struct rmi_device *rmi_dev, bool enable_wake)
 		goto out;
 
 	data->enabled = false;
-	disable_irq(irq);
-	if (enable_wake && device_may_wakeup(rmi_dev->xport->dev)) {
-		retval = enable_irq_wake(irq);
-		if (retval)
-			dev_warn(&rmi_dev->dev,
-				 "Failed to enable irq for wake: %d\n",
-				 retval);
-	}
-
-	/* make sure the fifo is clean */
-	while (!kfifo_is_empty(&data->attn_fifo)) {
-		count = kfifo_get(&data->attn_fifo, &attn_data);
-		if (count)
-			kfree(attn_data.data);
+	if (irq) {
+		disable_irq(irq);
+		if (enable_wake && device_may_wakeup(rmi_dev->xport->dev)) {
+			retval = enable_irq_wake(irq);
+			if (retval)
+				dev_warn(&rmi_dev->dev,
+					 "Failed to enable irq for wake: %d\n",
+					 retval);
+		}
+	} else {
+		/* make sure the fifo is clean */
+		while (!kfifo_is_empty(&data->attn_fifo)) {
+			count = kfifo_get(&data->attn_fifo, &attn_data);
+			if (count)
+				kfree(attn_data.data);
+		}
 	}
 
 out:
@@ -981,6 +997,8 @@ static int rmi_driver_remove(struct device *dev)
 	irq_domain_remove(data->irqdomain);
 	data->irqdomain = NULL;
 
+	cancel_work_sync(&data->attn_work);
+
 	rmi_f34_remove_sysfs(rmi_dev);
 	rmi_free_function_list(rmi_dev);
 
@@ -1219,9 +1237,15 @@ static int rmi_driver_probe(struct device *dev)
 		}
 	}
 
-	retval = rmi_irq_init(rmi_dev);
-	if (retval < 0)
-		goto err_destroy_functions;
+	if (pdata->irq) {
+		retval = rmi_irq_init(rmi_dev);
+		if (retval < 0)
+			goto err_destroy_functions;
+	}
+
+	data->enabled = true;
+
+	INIT_WORK(&data->attn_work, attn_callback);
 
 	if (data->f01_container->dev.driver) {
 		/* Driver already bound, so enable ATTN now. */

drivers/iommu/iommu.c

@@ -7,6 +7,7 @@
 #define pr_fmt(fmt)    "iommu: " fmt
 
 #include <linux/device.h>
+#include <linux/dmi.h>
 #include <linux/dma-iommu.h>
 #include <linux/kernel.h>
 #include <linux/bits.h>
@@ -3118,6 +3119,27 @@ u32 iommu_sva_get_pasid(struct iommu_sva *handle)
 }
 EXPORT_SYMBOL_GPL(iommu_sva_get_pasid);
 
+#ifdef CONFIG_ARM64
+static int __init iommu_quirks(void)
+{
+	const char *vendor, *name;
+
+	vendor = dmi_get_system_info(DMI_SYS_VENDOR);
+	name = dmi_get_system_info(DMI_PRODUCT_NAME);
+
+	if (vendor &&
+	    (strncmp(vendor, "GIGABYTE", 8) == 0 && name &&
+	     (strncmp(name, "R120", 4) == 0 ||
+	      strncmp(name, "R270", 4) == 0))) {
+		pr_warn("Gigabyte %s detected, force iommu passthrough mode", name);
+		iommu_def_domain_type = IOMMU_DOMAIN_IDENTITY;
+	}
+
+	return 0;
+}
+arch_initcall(iommu_quirks);
+#endif
+
 /*
  * Changes the default domain of an iommu group that has *only* one device
  *

drivers/media/firewire/firedtv-avc.c

@@ -1165,7 +1165,11 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
 		read_pos += program_info_length;
 		write_pos += program_info_length;
 	}
-	while (read_pos < length) {
+	while (read_pos + 4 < length) {
+		if (write_pos + 4 >= sizeof(c->operand) - 4) {
+			ret = -EINVAL;
+			goto out;
+		}
 		c->operand[write_pos++] = msg[read_pos++];
 		c->operand[write_pos++] = msg[read_pos++];
 		c->operand[write_pos++] = msg[read_pos++];
@@ -1177,13 +1181,17 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
 		c->operand[write_pos++] = es_info_length >> 8;
 		c->operand[write_pos++] = es_info_length & 0xff;
 		if (es_info_length > 0) {
+			if (read_pos >= length) {
+				ret = -EINVAL;
+				goto out;
+			}
 			pmt_cmd_id = msg[read_pos++];
 			if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
 				dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n",
 					pmt_cmd_id);
 
-			if (es_info_length > sizeof(c->operand) - 4 -
-					     write_pos) {
+			if (es_info_length > sizeof(c->operand) - 4 - write_pos ||
+			    es_info_length > length - read_pos) {
 				ret = -EINVAL;
 				goto out;
 			}

drivers/media/firewire/firedtv-ci.c

@@ -134,6 +134,8 @@ static int fdtv_ca_pmt(struct firedtv *fdtv, void *arg)
 	} else {
 		data_length = msg->msg[3];
 	}
+	if (data_length > sizeof(msg->msg) - data_pos)
+		return -EINVAL;
 
 	return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length);
 }

drivers/net/ethernet/sfc/ethtool_common.c

@@ -563,20 +563,14 @@ int efx_ethtool_get_link_ksettings(struct net_device *net_dev,
 {
 	struct efx_nic *efx = netdev_priv(net_dev);
 	struct efx_link_state *link_state = &efx->link_state;
-	u32 supported;
 
 	mutex_lock(&efx->mac_lock);
 	efx_mcdi_phy_get_link_ksettings(efx, cmd);
 	mutex_unlock(&efx->mac_lock);
 
 	/* Both MACs support pause frames (bidirectional and respond-only) */
-	ethtool_convert_link_mode_to_legacy_u32(&supported,
-						cmd->link_modes.supported);
-
-	supported |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
-
-	ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.supported,
-						supported);
+	ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
+	ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause);
 
 	if (LOOPBACK_INTERNAL(efx)) {
 		cmd->base.speed = link_state->speed;

drivers/net/wireguard/main.c

@@ -12,6 +12,7 @@
 
 #include <uapi/linux/wireguard.h>
 
+#include <linux/fips.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/genetlink.h>
@@ -21,6 +22,11 @@ static int __init mod_init(void)
 {
 	int ret;
 
+#ifdef CONFIG_RHEL_DIFFERENCES
+	if (fips_enabled)
+		return -EOPNOTSUPP;
+#endif
+
 	ret = wg_allowedips_slab_init();
 	if (ret < 0)
 		goto err_allowedips;
@@ -48,6 +54,7 @@ static int __init mod_init(void)
 	pr_info("WireGuard " WIREGUARD_VERSION " loaded. See www.wireguard.com for information.\n");
 	pr_info("Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.\n");
 
+	mark_tech_preview("WireGuard", THIS_MODULE);
 	return 0;
 
 err_netlink:

drivers/net/wireless/ath/wcn36xx/main.c

@@ -604,15 +604,6 @@ static int wcn36xx_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 				}
 			}
 		}
-		/* FIXME: Only enable bmps support when encryption is enabled.
-		 * For any reasons, when connected to open/no-security BSS,
-		 * the wcn36xx controller in bmps mode does not forward
-		 * 'wake-up' beacons despite AP sends DTIM with station AID.
-		 * It could be due to a firmware issue or to the way driver
-		 * configure the station.
-		 */
-		if (vif->type == NL80211_IFTYPE_STATION)
-			vif_priv->allow_bmps = true;
 		break;
 	case DISABLE_KEY:
 		if (!(IEEE80211_KEY_FLAG_PAIRWISE & key_conf->flags)) {
@@ -913,7 +904,6 @@ static void wcn36xx_bss_info_changed(struct ieee80211_hw *hw,
 				    vif->addr,
 				    bss_conf->aid);
 			vif_priv->sta_assoc = false;
-			vif_priv->allow_bmps = false;
 			wcn36xx_smd_set_link_st(wcn,
 						bss_conf->bssid,
 						vif->addr,

drivers/net/wireless/ath/wcn36xx/pmc.c

@@ -23,10 +23,7 @@ int wcn36xx_pmc_enter_bmps_state(struct wcn36xx *wcn,
 {
 	int ret = 0;
 	struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
-
-	if (!vif_priv->allow_bmps)
-		return -ENOTSUPP;
-
+	/* TODO: Make sure the TX chain clean */
 	ret = wcn36xx_smd_enter_bmps(wcn, vif);
 	if (!ret) {
 		wcn36xx_dbg(WCN36XX_DBG_PMC, "Entered BMPS\n");

drivers/net/wireless/ath/wcn36xx/wcn36xx.h

@@ -128,7 +128,6 @@ struct wcn36xx_vif {
 	enum wcn36xx_hal_bss_type bss_type;
 
 	/* Power management */
-	bool allow_bmps;
 	enum wcn36xx_power_state pw_state;
 
 	u8 bss_index;

drivers/nvme/host/core.c

@@ -262,6 +262,9 @@ static void nvme_delete_ctrl_sync(struct nvme_ctrl *ctrl)
 
 static blk_status_t nvme_error_status(u16 status)
 {
+	if (unlikely(status & NVME_SC_DNR))
+		return BLK_STS_TARGET;
+
 	switch (status & 0x7ff) {
 	case NVME_SC_SUCCESS:
 		return BLK_STS_OK;
@@ -321,6 +324,7 @@ enum nvme_disposition {
 	COMPLETE,
 	RETRY,
 	FAILOVER,
+	FAILUP,
 };
 
 static inline enum nvme_disposition nvme_decide_disposition(struct request *req)
@@ -328,15 +332,16 @@ static inline enum nvme_disposition nvme_decide_disposition(struct request *req)
 	if (likely(nvme_req(req)->status == 0))
 		return COMPLETE;
 
-	if (blk_noretry_request(req) ||
+	if ((req->cmd_flags & (REQ_FAILFAST_DEV | REQ_FAILFAST_DRIVER)) ||
 	    (nvme_req(req)->status & NVME_SC_DNR) ||
 	    nvme_req(req)->retries >= nvme_max_retries)
 		return COMPLETE;
 
-	if (req->cmd_flags & REQ_NVME_MPATH) {
+	if (req->cmd_flags & (REQ_NVME_MPATH | REQ_FAILFAST_TRANSPORT)) {
 		if (nvme_is_path_error(nvme_req(req)->status) ||
 		    blk_queue_dying(req->q))
-			return FAILOVER;
+			return (req->cmd_flags & REQ_NVME_MPATH) ?
+				FAILOVER : FAILUP;
 	} else {
 		if (blk_queue_dying(req->q))
 			return COMPLETE;
@@ -358,6 +363,14 @@ static inline void nvme_end_req(struct request *req)
 	blk_mq_end_request(req, status);
 }
 
+static inline void nvme_failup_req(struct request *req)
+{
+	nvme_update_ana(req);
+
+	nvme_req(req)->status = NVME_SC_HOST_PATH_ERROR;
+	nvme_end_req(req);
+}
+
 void nvme_complete_rq(struct request *req)
 {
 	trace_nvme_complete_rq(req);
@@ -376,6 +389,9 @@ void nvme_complete_rq(struct request *req)
 	case FAILOVER:
 		nvme_failover_req(req);
 		return;
+	case FAILUP:
+		nvme_failup_req(req);
+		return;
 	}
 }
 EXPORT_SYMBOL_GPL(nvme_complete_rq);

drivers/nvme/host/multipath.c

@@ -65,14 +65,10 @@ bool nvme_mpath_set_disk_name(struct nvme_ns *ns, char *disk_name, int *flags)
 	return true;
 }
 
-void nvme_failover_req(struct request *req)
+void nvme_update_ana(struct request *req)
 {
 	struct nvme_ns *ns = req->q->queuedata;
 	u16 status = nvme_req(req)->status & 0x7ff;
-	unsigned long flags;
-	struct bio *bio;
-
-	nvme_mpath_clear_current_path(ns);
 
 	/*
 	 * If we got back an ANA error, we know the controller is alive but not
@@ -83,6 +79,16 @@ void nvme_failover_req(struct request *req)
 		set_bit(NVME_NS_ANA_PENDING, &ns->flags);
 		queue_work(nvme_wq, &ns->ctrl->ana_work);
 	}
+}
+
+void nvme_failover_req(struct request *req)
+{
+	struct nvme_ns *ns = req->q->queuedata;
+	unsigned long flags;
+	struct bio *bio;
+
+	nvme_mpath_clear_current_path(ns);
+	nvme_update_ana(req);
 
 	spin_lock_irqsave(&ns->head->requeue_lock, flags);
 	for (bio = req->bio; bio; bio = bio->bi_next)
@@ -814,8 +820,7 @@ int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
 	int error = 0;
 
 	/* check if multipath is enabled and we have the capability */
-	if (!multipath || !ctrl->subsys ||
-	    !(ctrl->subsys->cmic & NVME_CTRL_CMIC_ANA))
+	if (!ctrl->subsys || !(ctrl->subsys->cmic & NVME_CTRL_CMIC_ANA))
 		return 0;
 
 	if (!ctrl->max_namespaces ||

drivers/nvme/host/nvme.h

@@ -746,6 +746,7 @@ void nvme_mpath_wait_freeze(struct nvme_subsystem *subsys);
 void nvme_mpath_start_freeze(struct nvme_subsystem *subsys);
 bool nvme_mpath_set_disk_name(struct nvme_ns *ns, char *disk_name, int *flags);
 void nvme_failover_req(struct request *req);
+void nvme_update_ana(struct request *req);
 void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl);
 int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head);
 void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id);
@@ -784,6 +785,9 @@ static inline bool nvme_mpath_set_disk_name(struct nvme_ns *ns, char *disk_name,
 static inline void nvme_failover_req(struct request *req)
 {
 }
+static inline void nvme_update_ana(struct request *req)
+{
+}
 static inline void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl)
 {
 }

drivers/pci/pci-driver.c

@@ -19,6 +19,7 @@
 #include <linux/kexec.h>
 #include <linux/of_device.h>
 #include <linux/acpi.h>
+#include <linux/kernel.h>
 #include <linux/dma-map-ops.h>
 #include "pci.h"
 #include "pcie/portdrv.h"
@@ -295,6 +296,34 @@ static struct attribute *pci_drv_attrs[] = {
 };
 ATTRIBUTE_GROUPS(pci_drv);
 
+/**
+ * pci_hw_vendor_status - Tell if a PCI device is supported by the HW vendor
+ * @ids: array of PCI device id structures to search in
+ * @dev: the PCI device structure to match against
+ *
+ * Used by a driver to check whether this device is in its list of unsupported
+ * devices.  Returns the matching pci_device_id structure or %NULL if there is
+ * no match.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+const struct pci_device_id *pci_hw_vendor_status(
+						const struct pci_device_id *ids,
+						struct pci_dev *dev)
+{
+	char devinfo[64];
+	const struct pci_device_id *ret = pci_match_id(ids, dev);
+
+	if (ret) {
+		snprintf(devinfo, sizeof(devinfo), "%s %s",
+			 dev_driver_string(&dev->dev), dev_name(&dev->dev));
+		mark_hardware_deprecated(devinfo);
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL(pci_hw_vendor_status);
+
 struct drv_dev_and_id {
 	struct pci_driver *drv;
 	struct pci_dev *dev;

drivers/pci/quirks.c

@@ -4268,6 +4268,30 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_BROADCOM, 0x9000,
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_BROADCOM, 0x9084,
 				quirk_bridge_cavm_thrx2_pcie_root);
 
+/*
+ * PCI BAR 5 is not setup correctly for the on-board AHCI controller
+ * on Broadcom's Vulcan processor. Added a quirk to fix BAR 5 by
+ * using BAR 4's resources which are populated correctly and NOT
+ * actually used by the AHCI controller.
+ */
+static void quirk_fix_vulcan_ahci_bars(struct pci_dev *dev)
+{
+	struct resource *r =  &dev->resource[4];
+
+	if (!(r->flags & IORESOURCE_MEM) || (r->start == 0))
+		return;
+
+	/* Set BAR5 resource to BAR4 */
+	dev->resource[5] = *r;
+
+	/* Update BAR5 in pci config space */
+	pci_write_config_dword(dev, PCI_BASE_ADDRESS_5, r->start);
+
+	/* Clear BAR4's resource */
+	memset(r, 0, sizeof(*r));
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_BROADCOM, 0x9027, quirk_fix_vulcan_ahci_bars);
+
 /*
  * Intersil/Techwell TW686[4589]-based video capture cards have an empty (zero)
  * class code.  Fix it.

drivers/scsi/megaraid/megaraid_sas_base.c

@@ -157,12 +157,14 @@ static struct pci_device_id megasas_pci_table[] = {
 	/* ppc IOP */
 	{PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS1078GEN2)},
 	/* gen2*/
+#endif
 	{PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS0079GEN2)},
 	/* gen2*/
 	{PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS0073SKINNY)},
 	/* skinny*/
 	{PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS0071SKINNY)},
 	/* skinny*/
+#ifndef CONFIG_RHEL_DIFFERENCES
 	{PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_VERDE_ZCR)},
 	/* xscale IOP, vega */
 	{PCI_DEVICE(PCI_VENDOR_ID_DELL, PCI_DEVICE_ID_DELL_PERC5)},

drivers/soc/imx/gpcv2.c

@@ -244,6 +244,8 @@ static int imx_pgc_power_up(struct generic_pm_domain *genpd)
 		goto out_regulator_disable;
 	}
 
+	reset_control_assert(domain->reset);
+
 	if (domain->bits.pxx) {
 		/* request the domain to power up */
 		regmap_update_bits(domain->regmap, GPC_PU_PGC_SW_PUP_REQ,
@@ -266,8 +268,6 @@ static int imx_pgc_power_up(struct generic_pm_domain *genpd)
 				  GPC_PGC_CTRL_PCR);
 	}
 
-	reset_control_assert(domain->reset);
-
 	/* delay for reset to propagate */
 	udelay(5);
 

drivers/usb/core/hcd.c

@@ -2795,7 +2795,6 @@ int usb_add_hcd(struct usb_hcd *hcd,
 {
 	int retval;
 	struct usb_device *rhdev;
-	struct usb_hcd *shared_hcd;
 
 	if (!hcd->skip_phy_initialization && usb_hcd_is_primary_hcd(hcd)) {
 		hcd->phy_roothub = usb_phy_roothub_alloc(hcd->self.sysdev);
@@ -2956,26 +2955,13 @@ int usb_add_hcd(struct usb_hcd *hcd,
 		goto err_hcd_driver_start;
 	}
 
-	/* starting here, usbcore will pay attention to the shared HCD roothub */
-	shared_hcd = hcd->shared_hcd;
-	if (!usb_hcd_is_primary_hcd(hcd) && shared_hcd && HCD_DEFER_RH_REGISTER(shared_hcd)) {
-		retval = register_root_hub(shared_hcd);
-		if (retval != 0)
-			goto err_register_root_hub;
-
-		if (shared_hcd->uses_new_polling && HCD_POLL_RH(shared_hcd))
-			usb_hcd_poll_rh_status(shared_hcd);
-	}
-
 	/* starting here, usbcore will pay attention to this root hub */
-	if (!HCD_DEFER_RH_REGISTER(hcd)) {
-		retval = register_root_hub(hcd);
-		if (retval != 0)
-			goto err_register_root_hub;
+	retval = register_root_hub(hcd);
+	if (retval != 0)
+		goto err_register_root_hub;
 
-		if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
-			usb_hcd_poll_rh_status(hcd);
-	}
+	if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
+		usb_hcd_poll_rh_status(hcd);
 
 	return retval;
 
@@ -3013,7 +2999,6 @@ EXPORT_SYMBOL_GPL(usb_add_hcd);
 void usb_remove_hcd(struct usb_hcd *hcd)
 {
 	struct usb_device *rhdev = hcd->self.root_hub;
-	bool rh_registered;
 
 	dev_info(hcd->self.controller, "remove, state %x\n", hcd->state);
 
@@ -3024,7 +3009,6 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 
 	dev_dbg(hcd->self.controller, "roothub graceful disconnect\n");
 	spin_lock_irq (&hcd_root_hub_lock);
-	rh_registered = hcd->rh_registered;
 	hcd->rh_registered = 0;
 	spin_unlock_irq (&hcd_root_hub_lock);
 
@@ -3034,8 +3018,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 	cancel_work_sync(&hcd->died_work);
 
 	mutex_lock(&usb_bus_idr_lock);
-	if (rh_registered)
-		usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
+	usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
 	mutex_unlock(&usb_bus_idr_lock);
 
 	/*

drivers/usb/core/hub.c

@@ -5657,6 +5657,13 @@ static void hub_event(struct work_struct *work)
 			(u16) hub->change_bits[0],
 			(u16) hub->event_bits[0]);
 
+	/* Don't disconnect USB-SATA on TrimSlice */
+	if (strcmp(dev_name(hdev->bus->controller), "tegra-ehci.0") == 0) {
+		if ((hdev->state == 7) && (hub->change_bits[0] == 0) &&
+				(hub->event_bits[0] == 0x2))
+			hub->event_bits[0] = 0;
+	}
+
 	/* Lock the device, then check to see if we were
 	 * disconnected while waiting for the lock to succeed. */
 	usb_lock_device(hdev);

drivers/usb/host/xhci.c

@@ -692,7 +692,6 @@ int xhci_run(struct usb_hcd *hcd)
 		if (ret)
 			xhci_free_command(xhci, command);
 	}
-	set_bit(HCD_FLAG_DEFER_RH_REGISTER, &hcd->flags);
 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
 			"Finished xhci_run for USB2 roothub");
 

fs/ext4/super.c

@@ -4298,6 +4298,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
 		set_bit(EXT4_FLAGS_BDEV_IS_DAX, &sbi->s_ext4_flags);
 
 	if (sbi->s_mount_opt & EXT4_MOUNT_DAX_ALWAYS) {
+		static bool printed = false;
 		if (ext4_has_feature_inline_data(sb)) {
 			ext4_msg(sb, KERN_ERR, "Cannot use DAX on a filesystem"
 					" that may contain inline data");
@@ -4308,6 +4309,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
 				"DAX unsupported by block device.");
 			goto failed_mount;
 		}
+		if (!printed) {
+			mark_tech_preview("ext4 direct access (dax)", NULL);
+			printed = true;
+		}
 	}
 
 	if (ext4_has_feature_encrypt(sb) && es->s_encryption_level) {

fs/xfs/xfs_super.c

@@ -1593,6 +1593,7 @@ xfs_fs_fill_super(
 
 	if (xfs_has_dax_always(mp)) {
 		bool rtdev_is_dax = false, datadev_is_dax;
+		static bool printed = false;
 
 		xfs_warn(mp,
 		"DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
@@ -1612,6 +1613,10 @@ xfs_fs_fill_super(
 			error = -EINVAL;
 			goto out_filestream_unmount;
 		}
+		if (!printed) {
+			mark_tech_preview("xfs direct access (dax)", NULL);
+			printed = true;
+		}
 	}
 
 	if (xfs_has_discard(mp)) {

include/linux/efi.h

@@ -43,6 +43,8 @@
 #define EFI_ABORTED		(21 | (1UL << (BITS_PER_LONG-1)))
 #define EFI_SECURITY_VIOLATION	(26 | (1UL << (BITS_PER_LONG-1)))
 
+#define EFI_IS_ERROR(x)		((x) & (1UL << (BITS_PER_LONG-1)))
+
 typedef unsigned long efi_status_t;
 typedef u8 efi_bool_t;
 typedef u16 efi_char16_t;		/* UNICODE character */
@@ -782,6 +784,14 @@ extern int __init efi_setup_pcdp_console(char *);
 #define EFI_MEM_ATTR		10	/* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
 #define EFI_MEM_NO_SOFT_RESERVE	11	/* Is the kernel configured to ignore soft reservations? */
 #define EFI_PRESERVE_BS_REGIONS	12	/* Are EFI boot-services memory segments available? */
+#define EFI_SECURE_BOOT		13	/* Are we in Secure Boot mode? */
+
+enum efi_secureboot_mode {
+	efi_secureboot_mode_unset,
+	efi_secureboot_mode_unknown,
+	efi_secureboot_mode_disabled,
+	efi_secureboot_mode_enabled,
+};
 
 #ifdef CONFIG_EFI
 /*
@@ -793,6 +803,8 @@ static inline bool efi_enabled(int feature)
 }
 extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused);
 
+extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode);
+
 bool __pure __efi_soft_reserve_enabled(void);
 
 static inline bool __pure efi_soft_reserve_enabled(void)
@@ -813,6 +825,8 @@ static inline bool efi_enabled(int feature)
 static inline void
 efi_reboot(enum reboot_mode reboot_mode, const char *__unused) {}
 
+static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {}
+
 static inline bool efi_soft_reserve_enabled(void)
 {
 	return false;
@@ -825,6 +839,7 @@ static inline bool efi_rt_services_supported(unsigned int mask)
 #endif
 
 extern int efi_status_to_err(efi_status_t status);
+extern const char *efi_status_to_str(efi_status_t status);
 
 /*
  * Variable Attributes
@@ -1077,13 +1092,6 @@ static inline bool efi_runtime_disabled(void) { return true; }
 extern void efi_call_virt_check_flags(unsigned long flags, const char *call);
 extern unsigned long efi_call_virt_save_flags(void);
 
-enum efi_secureboot_mode {
-	efi_secureboot_mode_unset,
-	efi_secureboot_mode_unknown,
-	efi_secureboot_mode_disabled,
-	efi_secureboot_mode_enabled,
-};
-
 static inline
 enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var)
 {

include/linux/lsm_hook_defs.h

@@ -394,6 +394,8 @@ LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free_security, struct bpf_prog_aux *aux)
 #endif /* CONFIG_BPF_SYSCALL */
 
 LSM_HOOK(int, 0, locked_down, enum lockdown_reason what)
+LSM_HOOK(int, 0, lock_kernel_down, const char *where, enum lockdown_reason level)
+
 
 #ifdef CONFIG_PERF_EVENTS
 LSM_HOOK(int, 0, perf_event_open, struct perf_event_attr *attr, int type)

include/linux/lsm_hooks.h

@@ -1545,6 +1545,12 @@
  *
  *     @what: kernel feature being accessed
  *
+ * @lock_kernel_down
+ * 	Put the kernel into lock-down mode.
+ *
+ * 	@where: Where the lock-down is originating from (e.g. command line option)
+ * 	@level: The lock-down level (can only increase)
+ *
  * Security hooks for perf events
  *
  * @perf_event_open:

include/linux/pci.h

@@ -1470,6 +1470,10 @@ int pci_add_dynid(struct pci_driver *drv,
 		  unsigned long driver_data);
 const struct pci_device_id *pci_match_id(const struct pci_device_id *ids,
 					 struct pci_dev *dev);
+/* Reserved for Internal Red Hat use only */
+const struct pci_device_id *pci_hw_vendor_status(
+						const struct pci_device_id *ids,
+						struct pci_dev *dev);
 int pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max,
 		    int pass);
 

include/linux/random.h

@@ -14,6 +14,11 @@
 
 #include <uapi/linux/random.h>
 
+struct random_extrng {
+	ssize_t (*extrng_read)(void __user *buf, size_t buflen);
+	struct module *owner;
+};
+
 struct random_ready_callback {
 	struct list_head list;
 	void (*func)(struct random_ready_callback *rdy);
@@ -44,6 +49,8 @@ extern bool rng_is_initialized(void);
 extern int add_random_ready_callback(struct random_ready_callback *rdy);
 extern void del_random_ready_callback(struct random_ready_callback *rdy);
 extern int __must_check get_random_bytes_arch(void *buf, int nbytes);
+void random_register_extrng(const struct random_extrng *rng);
+void random_unregister_extrng(void);
 
 #ifndef MODULE
 extern const struct file_operations random_fops, urandom_fops;

include/linux/rmi.h

@@ -364,6 +364,7 @@ struct rmi_driver_data {
 
 	struct rmi4_attn_data attn_data;
 	DECLARE_KFIFO(attn_fifo, struct rmi4_attn_data, 16);
+	struct work_struct attn_work;
 };
 
 int rmi_register_transport_device(struct rmi_transport_dev *xport);

include/linux/security.h

@@ -472,6 +472,7 @@ int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
 int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
 int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
 int security_locked_down(enum lockdown_reason what);
+int security_lock_kernel_down(const char *where, enum lockdown_reason level);
 #else /* CONFIG_SECURITY */
 
 static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
@@ -1348,6 +1349,10 @@ static inline int security_locked_down(enum lockdown_reason what)
 {
 	return 0;
 }
+static inline int security_lock_kernel_down(const char *where, enum lockdown_reason level)
+{
+	return 0;
+}
 #endif	/* CONFIG_SECURITY */
 
 #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)

include/linux/usb/hcd.h

@@ -124,7 +124,6 @@ struct usb_hcd {
 #define HCD_FLAG_RH_RUNNING		5	/* root hub is running? */
 #define HCD_FLAG_DEAD			6	/* controller has died? */
 #define HCD_FLAG_INTF_AUTHORIZED	7	/* authorize interfaces? */
-#define HCD_FLAG_DEFER_RH_REGISTER	8	/* Defer roothub registration */
 
 	/* The flags can be tested using these macros; they are likely to
 	 * be slightly faster than test_bit().
@@ -135,7 +134,6 @@ struct usb_hcd {
 #define HCD_WAKEUP_PENDING(hcd)	((hcd)->flags & (1U << HCD_FLAG_WAKEUP_PENDING))
 #define HCD_RH_RUNNING(hcd)	((hcd)->flags & (1U << HCD_FLAG_RH_RUNNING))
 #define HCD_DEAD(hcd)		((hcd)->flags & (1U << HCD_FLAG_DEAD))
-#define HCD_DEFER_RH_REGISTER(hcd) ((hcd)->flags & (1U << HCD_FLAG_DEFER_RH_REGISTER))
 
 	/*
 	 * Specifies if interfaces are authorized by default

init/Kconfig

@@ -1648,7 +1648,7 @@ config AIO
 	  this option saves about 7k.
 
 config IO_URING
-	bool "Enable IO uring support" if EXPERT
+	bool "Enable IO uring support"
 	select IO_WQ
 	default y
 	help

kernel/module_signing.c

@@ -38,8 +38,15 @@ int mod_verify_sig(const void *mod, struct load_info *info)
 	modlen -= sig_len + sizeof(ms);
 	info->len = modlen;
 
-	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+	ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
 				      VERIFY_USE_SECONDARY_KEYRING,
 				      VERIFYING_MODULE_SIGNATURE,
 				      NULL, NULL);
+	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+		ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+				VERIFY_USE_PLATFORM_KEYRING,
+				VERIFYING_MODULE_SIGNATURE,
+				NULL, NULL);
+	}
+	return ret;
 }

redhat/.gitignore

@@ -4,5 +4,5 @@ configs/*-merged
 
 kabi/Module.kabi_*
 kabi/kabi-current
-kabi/kabi-rhel8*
-kabi/kabi-rhel8*/*
+kabi/kabi-rhel*
+kabi/kabi-rhel*/*

redhat/Makefile

@@ -1,3 +1,4 @@
+GIT ?= git
 include Makefile.common
 include Makefile.rhpkg
 
@@ -32,8 +33,8 @@ endif
 BUILD_TARGET ?= --scratch $(BUILD_SCRATCH_TARGET)
 FLAVOR =
 
-RHGITURL?=$(shell git config rhg.url || git config remote.origin.url)
-RHGITCOMMIT?=$(shell git log -1 --pretty=format:%H)
+RHGITURL?=$(shell $(GIT) config rhg.url || $(GIT) config remote.origin.url)
+RHGITCOMMIT?=$(shell $(GIT) log -1 --pretty=format:%H)
 
 # this section is needed in order to make O= to work
 _OUTPUT := ..
@@ -53,14 +54,8 @@ include Makefile.cross
 default: dist-help
 
 dist-python-check:
-	@if [ ! -f /usr/libexec/platform-python ]; then \
-		if ! which python3 > /dev/null 2>&1; then \
-			echo "ERROR: Python 3 is needed." ; \
-			exit 1; \
-		fi; \
-		echo "ERROR: your build environment is not compatible with this distribution."; \
-		echo "To fix this, run:"; \
-		echo "ln -s `which python3` /usr/libexec/platform-python"; \
+	@if [ ! -x /usr/bin/python3 ]; then \
+		echo "ERROR: Python 3 is needed." ; \
 		exit 1; \
 	fi
 
@@ -71,7 +66,7 @@ dist-kabi: dist-python-check
 		for i in {0..$(RHEL_MINOR)}; do \
 			mkdir -p $(REDHAT)/kabi/kabi-rhel$(RHEL_MAJOR)$$i/;\
 			$(REDHAT)/kabi/show-kabi -k $(REDHAT)/kabi/kabi-module/ -s -a $$KABIARCH \
-			-r $(RHEL_MAJOR).$$i > $(REDHAT)/kabi/kabi-rhel$(RHEL_MAJOR)$$i/kabi_whitelist_$$KABIARCH;\
+			-r $(RHEL_MAJOR).$$i > $(REDHAT)/kabi/kabi-rhel$(RHEL_MAJOR)$$i/kabi_stablelist_$$KABIARCH;\
 		done;\
 	done;
 	@(cd $(REDHAT)/kabi/ && ln -Tsf kabi-rhel$(RHEL_MAJOR)$(RHEL_MINOR) kabi-current)
@@ -106,7 +101,7 @@ dist-kabi-dw-base: dist-kabi
 	@echo "Generating baseline dataset for KABI DWARF-based comparison..."
 	@echo "**** GENERATING DWARF-based kABI baseline dataset ****"
 	@$(KABIDW)/run_kabi-dw.sh generate \
-		$(REDHAT)/kabi/kabi-current/kabi_whitelist_$(CURARCH) \
+		$(REDHAT)/kabi/kabi-current/kabi_stablelist_$(CURARCH) \
 		$(_OUTPUT) $(KABIDW)/base/$(CURARCH)/
 
 dist-kabi-dw-check: dist-kabi
@@ -118,7 +113,7 @@ dist-kabi-dw-check: dist-kabi
 	fi
 	@echo "**** GENERATING DWARF-based kABI dataset ****"
 	@$(KABIDW)/run_kabi-dw.sh generate \
-		$(REDHAT)/kabi/kabi-current/kabi_whitelist_$(CURARCH) \
+		$(REDHAT)/kabi/kabi-current/kabi_stablelist_$(CURARCH) \
 		$(_OUTPUT) $(KABIDW)/base/$(CURARCH).tmp/
 	@echo "**** KABI DWARF-based comparison report ****"
 	@$(KABIDW)/run_kabi-dw.sh compare \
@@ -134,16 +129,19 @@ dist-configs: dist-configs-prep
 	@cd $(REDHAT)/configs; VERSION=$(KVERSION) ./generate_all_configs.sh "$(FLAVOR)" 1; \
 	./process_configs.sh $(PROCESS_CONFIGS_OPTS) $(PACKAGE_NAME) $(KVERSION)
 
-fedora-configs: FLAVOR = fedora
-fedora-configs: dist-configs
+dist-fedora-configs: FLAVOR = fedora
+dist-fedora-configs: dist-configs
+fedora-configs: dist-fedora-configs
 
-rh-configs: FLAVOR = rhel
-rh-configs: dist-configs
+dist-rhel-configs: FLAVOR = rhel
+dist-rhel-configs: dist-configs
+rh-configs: dist-rhel-configs
 
 dist-configs-check: dist-configs-prep
 	cd $(REDHAT)/configs; ./process_configs.sh $(PROCESS_CONFIGS_CHECK_OPTS) $(PACKAGE_NAME)
 
-dist-configs-prep: dist-clean-configs
+dist-configs-prep: dist-clean-configs dist-buildreq-check
+	cd $(REDHAT)/configs; ./build_configs.sh "partial" "$(ARCH_MACH)" "snip"
 	cd $(REDHAT)/configs; ./build_configs.sh "$(PACKAGE_NAME)" "$(ARCH_MACH)" "$(FLAVOR)"
 
 dist-configs-arch: ARCH_MACH = $(MACH)
@@ -165,7 +163,10 @@ dist-clean-rpmdirs:
 		rm -rf $$i; \
 	done;
 
-dist-clean: dist-clean-sources dist-clean-configs dist-clean-rpmdirs
+dist-clean-scripts:
+	@rm -f dist-dump-variables.sh
+
+dist-clean: dist-clean-sources dist-clean-configs dist-clean-rpmdirs dist-clean-scripts
 
 dist-stub-key:
 	@echo "Copying pre-generated keys";
@@ -196,16 +197,39 @@ $(KABIDW_TARBALL):
 	@(cd kabi-dwarf && tar cjf $(SOURCES)/$(KABIDW_TARFILE) base run_kabi-dw.sh)
 
 
+dist-tarball: $(TARBALL)
+	@echo "redhat/$(TARFILE)"
+
+dist-kernelrelease:
+	@echo $(PACKAGE_NAME)-$(KVERSION)-$(DISTRO_BUILD)
+
+dist-kernelversion:
+	@echo $(KVERSION)-$(DISTRO_BUILD)
+
+dist-specfile: setup-source
+	@echo $(SOURCES)/$(SPECFILE)
+
 dist-git-version-check:
 	@# genspec.sh uses pathspec magic that wasn't introduced until version 2.13
 	@IFS=" ."; \
-	set -- $$(git --version); \
+	set -- $$($(GIT) --version); \
 	IFS=; \
 	if [ "$$3" -lt 2 -o \( "$$3" -eq 2 -a "$$4" -lt 13 \) ]; then \
 		echo "ERROR: You need git version 2.13 or newer to run some setup commands"; \
 		exit 1; \
 	fi
 
+dist-buildreq-check: setup-source
+	@PKGLIST="rpm-build $(rpmspec -q --buildrequires $(SOURCES)/$(SPECFILE) | cut -d ' ' -f 1)"; \
+	MISSING=""; \
+	for pkg in $$PKGLIST; do \
+		rpm -q --whatprovides $$pkg >/dev/null || MISSING="$$MISSING $$pkg"; \
+	done; \
+	if [ -n "$$MISSING" ]; then \
+		echo "Error: please install $$MISSING"; \
+		exit 1; \
+	fi
+
 setup-source: dist-git-version-check dist-clean-sources
 	@cp $(REDHAT)/$(SPECFILE).template $(SOURCES)/$(SPECFILE)
 	@if [ ! -e  $(REDHAT)/$(CHANGELOG) ]; then \
@@ -213,34 +237,35 @@ setup-source: dist-git-version-check dist-clean-sources
 		cp $(REDHAT)/$(CHANGELOG_PREV) $(REDHAT)/$(CHANGELOG); \
 	fi
 	@cp $(REDHAT)/$(CHANGELOG) $(SOURCES)/$(CHANGELOG)
-	@$(REDHAT)/genspec.sh $(SOURCES) $(SOURCES)/$(SPECFILE) $(SOURCES)/$(CHANGELOG) $(PKGRELEASE) $(RPMKVERSION) $(RPMKPATCHLEVEL) $(RPMKSUBLEVEL) $(DISTRO_BUILD) $(RELEASED_KERNEL) $(SPECRELEASE) $(__ZSTREAM) "$(BUILDOPTS)" $(MARKER) `cat $(REDHAT)/marker` $(SINGLE_TARBALL) $(TARFILE_RELEASE) $(SNAPSHOT) $(BUILDID)
+	@$(REDHAT)/genspec.sh $(SOURCES) $(SOURCES)/$(SPECFILE) $(SOURCES)/$(CHANGELOG) $(PKGRELEASE) $(RPMKVERSION) $(RPMKPATCHLEVEL) $(RPMKSUBLEVEL) $(DISTRO_BUILD) $(RELEASED_KERNEL) $(SPECRELEASE) $(__ZSTREAM) "$(BUILDOPTS)" $(MARKER) `cat $(REDHAT)/marker` $(SINGLE_TARBALL) $(TARFILE_RELEASE) $(SNAPSHOT) $(UPSTREAM_BRANCH) $(INCLUDE_FEDORA_FILES) $(INCLUDE_RHEL_FILES) $(BUILDID)
 	@cp $(SOURCES)/$(SPECFILE) $(SOURCES)/../SPECS/
 
-sources-rh: $(TARBALL)
+generate-testpatch-tmp:
+	@$(GIT) diff --no-renames HEAD ":(exclude,top).get_maintainer.conf" \
+		":(exclude,top).gitattributes" \
+		":(exclude,top).gitignore" \
+		":(exclude,top)makefile" \
+		":(exclude,top)Makefile.rhelver" \
+		":(exclude,top)redhat" > $(TESTPATCH).tmp
+
+sources-rh: $(TARBALL) generate-testpatch-tmp setup-source dist-configs-check
 	@cp -l $(TARBALL) $(SOURCES)/ || cp $(TARBALL) $(SOURCES)/
 	@touch $(TESTPATCH)
-	@git diff --no-renames HEAD > $(TESTPATCH).tmp
-	@# 1) filterdiff will return crap from the patches it just filtered,
-	@#    that's why egrep is needed so if there're changes under redhat/
-	@#    but not everywhere else, it will be empty just like
-	@#    linux-kernel-test.patch
-	@# 2) egrep -v will return "1" if it sucessfully removed index and diff
-	@#    lines, which will be considered an error
-	@($(FILTERDIFF) $(TESTPATCH).tmp | egrep -v "^index|^diff" >$(TESTPATCH).tmp2; true)
-	@mv $(TESTPATCH).tmp2 $(TESTPATCH).tmp
 	@diff $(TESTPATCH).tmp $(TESTPATCH) > /dev/null || \
 		echo "WARNING: There are uncommitted changes in your tree or the changes are not in sync with linux-kernel-test.patch.  Either commit the changes or run 'make dist-test-patch'"
 	@rm $(TESTPATCH).tmp
 	@cp $(TESTPATCH) $(SOURCES)/linux-kernel-test.patch
-	@cp fedora_files/* $(SOURCES);
-	@cp rhel_files/* $(SOURCES);
+	@cat configs/flavors | while read flavor; do echo "Copying sources for $${flavor}"; [ -e $${flavor}_files ] && cp $${flavor}_files/* $(SOURCES); done
 	@cp cpupower.* \
 		keys/rhel*.x509 \
 		kabi/check-kabi \
 		configs/$(PACKAGE_NAME)-*.config \
-		keys/*.cer \
+		configs/partial*.config \
+		gating.yaml \
+		rpminspect.yaml \
 		update_scripts.sh \
-		mod-blacklist.sh \
+		kvm_stat.logrotate \
+		mod-denylist.sh \
 		mod-internal.list \
 		mod-sign.sh \
 		configs/flavors \
@@ -248,10 +273,17 @@ sources-rh: $(TARBALL)
 		configs/merge.pl \
 		configs/process_configs.sh \
 		parallel_xz.sh \
-		generate_bls_conf.sh \
+		generate_crashkernel_default.sh \
 		../Makefile.rhelver \
 		README.rst \
+		kernel-local \
 		$(SOURCES)/
+	@if [ "$(RELEASED_KERNEL)" -ne 0 ]; then \
+		cp keys/redhatsecureboot{301,501,ca5,ca1}.cer $(SOURCES)/; \
+		cp keys/secureboot_{ppc,s390}.cer $(SOURCES)/; \
+	else \
+		cp keys/redhatsecureboot{003,401,ca2,ca4}.cer $(SOURCES)/; \
+	fi
 	@for KABIARCH in $(ARCH_LIST); do \
 		cp kabi/Module.kabi_$$KABIARCH $(SOURCES)/; \
 		cp kabi/Module.kabi_dup_$$KABIARCH $(SOURCES)/; \
@@ -262,72 +294,79 @@ sources-rh: $(TARBALL)
 	fi
 	@(cd kabi-dwarf && tar cjf $(SOURCES)/$(KABIDW_TARFILE) base run_kabi-dw.sh)
 
-dist-sources: setup-source dist-configs-check dist-kabi dist-kabi-dup sources-rh
+dist-sources: dist-kabi dist-kabi-dup sources-rh
 
-dist-test-patch:
-	@git diff --no-renames HEAD > $(TESTPATCH);
-	@($(FILTERDIFF) $(TESTPATCH) | egrep -v "^index|^diff" >$(TESTPATCH).tmp; true)
+dist-test-patch: generate-testpatch-tmp
 	@mv $(TESTPATCH).tmp $(TESTPATCH);
 
-dist-all-rpms: dist-sources
-	$(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" --target $(MACH) -ba $(RPM)/SOURCES/$(PACKAGE_NAME).spec
+do-rpmbuild: dist-sources
+	$(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" $(RPMBUILDOPTS) $(RPM)/SOURCES/$(PACKAGE_NAME).spec
 
-dist-srpm: dist-sources
-	$(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" --nodeps -bs $(RPM)/SOURCES/$(PACKAGE_NAME).spec
+dist-all-rpms: RPMBUILDOPTS=--target $(MACH) -ba
+dist-all-rpms: dist-sources do-rpmbuild
 
-dist-srpm-gcov:
-	make dist-sources BUILDID=".gcov" BUILDOPTS="+gcov"
-	$(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" --nodeps -bs $(RPM)/SOURCES/$(PACKAGE_NAME).spec
+dist-srpm: RPMBUILDOPTS=--nodeps -bs
+dist-srpm: dist-sources do-rpmbuild
 
-dist-rpms: dist-sources
-	$(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" --target $(MACH) -bb $(RPM)/SOURCES/$(PACKAGE_NAME).spec
+dist-srpm-gcov: BUILDID=".gcov"
+dist-srpm-gcov: BUILDOPTS+="+gcov"
+dist-srpm-gcov: dist-srpm
+
+dist-rpms: RPMBUILDOPTS=--target $(MACH) -bb
+dist-rpms: dist-sources do-rpmbuild
 
 dist-kernel-%: dist-sources
-	$(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" --target $(MACH) --with $* --without vdso_install --without perf --without tools -bb $(RPM)/SOURCES/$(PACKAGE_NAME).spec
+	RPMBUILDOPTS="--target $(MACH) --with $* -bb" make do-rpmbuild
 
-dist-prep: dist-sources
-	$(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" --nodeps --target noarch -bp $(RPM)/SOURCES/$(PACKAGE_NAME).spec
+dist-prep: RPMBUILDOPTS=--nodeps --target noarch -bp
+dist-prep: dist-sources do-rpmbuild
 
-dist-perf: dist-sources
-	$(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" --without up --without smp --without zfcpdump --without debug --without doc --without headers --without  --without doc --without debuginfo --target $(MACH) -bb $(RPM)/SOURCES/$(PACKAGE_NAME).spec
+dist-perf: RPMBUILDOPTS=--without up --without smp --without zfcpdump --without debug --without doc --without headers --without  --without doc --without debuginfo --target $(MACH) -bb
+dist-perf: dist-sources do-rpmbuild
 
-dist-rpm-baseonly: dist-sources
-	$(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" --target $(MACH) --without debug --without debuginfo --without vdso_install --without bpftool --without perf --without tools -bb $(RPM)/SOURCES/$(PACKAGE_NAME).spec
+dist-rpm-baseonly: RPMBUILDOPTS=--target $(MACH) --without debug --without debuginfo --without vdso_install --without bpftool --without perf --without tools -bb
+dist-rpm-baseonly: dist-sources do-rpmbuild
 
-
-# unless you know what you're doing, you don't want to use the next three ones
+# unless you know what you're doing, you don't want to use the next four ones
 dist-release-finish: setup-source
+	@cp $(SOURCES)/$(CHANGELOG) $(REDHAT)/$(CHANGELOG)
+	@$(GIT) add $(REDHAT)/$(CHANGELOG)
+	@$(GIT) add $(REDHAT)/marker
+	@$(GIT) commit -s ../Makefile.rhelver $(REDHAT)/marker $(REDHAT)/$(CHANGELOG) $(PACKAGE_NAME).spec.template -m "[redhat] $(PACKAGE_NAME)-$(STAMP_VERSION)-$(PREBUILD)$(BUILD)$(BUILDID)"
+dist-release-changed: setup-source
 	@cp $(SOURCES)/$(CHANGELOG) $(REDHAT)/$(CHANGELOG)
 	@echo $(MARKER) > $(REDHAT)/marker
 	@# if neither changelog nor marker was updated, skip bumping a release
-	git diff-index --quiet HEAD && (echo "Nothing changed, skipping updates"; exit 0) || true
-	$(REDHAT)/scripts/new_release.sh $(REDHAT) $(__YSTREAM) $(__ZSTREAM); \
-	git add $(REDHAT)/$(CHANGELOG); \
-	git add $(REDHAT)/marker; \
-	git commit -s ../Makefile.rhelver $(REDHAT)/marker $(REDHAT)/$(CHANGELOG) $(PACKAGE_NAME).spec.template -m "[redhat] $(PACKAGE_NAME)-$(STAMP_VERSION)-$(PREBUILD)$(BUILD)$(BUILDID)"; \
-
+	@$(GIT) update-index -q --really-refresh
+	@if $(GIT) diff-index --quiet HEAD; then \
+		echo "Nothing changed, skipping updates"; \
+	else \
+		$(GIT) checkout -- $(REDHAT)/$(CHANGELOG); \
+		$(REDHAT)/scripts/new_release.sh $(REDHAT) $(__YSTREAM) $(__ZSTREAM) $(BUMP_RELEASE); \
+		$(MAKE) dist-release-finish; \
+	fi
 dist-release: dist-clean-sources
-	@$(MAKE) dist-release-finish
+	@$(MAKE) dist-release-changed
 dist-release-tag:
-	@git tag -a -m "$(PACKAGE_NAME)-$(STAMP_VERSION)-$(PKGRELEASE)" $(PACKAGE_NAME)-$(STAMP_VERSION)-$(PKGRELEASE)
+	@$(GIT) tag -a -m "$(PACKAGE_NAME)-$(STAMP_VERSION)-$(PKGRELEASE)" $(PACKAGE_NAME)-$(STAMP_VERSION)-$(PKGRELEASE)
 
 git-tree-check:
-	@if test -n "$(DIST_PUSH)" && test -z "$(shell git remote get-url gitlab 2>/dev/null)"; then \
+	@if test -n "$(DIST_PUSH)" && test -z "$(shell $(GIT) remote get-url gitlab 2>/dev/null)"; then \
 		echo -e "Please run 'git remote add gitlab <url>' to enable git-push.\n"; \
 		exit 1; \
 	fi
-	@git diff-index --quiet HEAD || \
+	@$(GIT) diff-index --quiet HEAD || \
 		{ echo -e "Dirty tree, please clean before merging.\n"; exit 1; }
 
 DIST_BRANCH ?= "os-build"
 dist-merge-upstream: git-tree-check
-	@if test "$(shell git branch --show-current)" != "$(DIST_BRANCH)"; then \
+	@if test "$(shell $(GIT) branch --show-current)" != "$(DIST_BRANCH)"; then \
 		echo -e "Please checkout $(DIST_BRANCH) branch before merging.\n"; \
 		exit 1; \
 		fi;
 
 	@# If TAG is empty, script defaults to master:HEAD
-	@git checkout $(DIST_BRANCH)
+	@$(GIT) checkout $(DIST_BRANCH)
 	@cd ..; $(REDHAT)/scripts/ci/ark-update-configs.sh $(TAG)
 
 dist-merge-upstream-push: export DIST_PUSH="1"
@@ -349,10 +388,10 @@ distg-brew: BUILD_FLAGS ?= $(BREW_FLAGS) $(TEST_FLAGS)
 distg-koji: BUILD_FLAGS ?= $(KOJI_FLAGS) $(TEST_FLAGS)
 
 dist-brew dist-koji: dist-%: dist-srpm
-	$* build $(BUILD_FLAGS) $(BUILD_TARGET) $(SRPMS)/$(PACKAGE_NAME)-$(KVERSION)-$(PKGRELEASE)$(DIST).src.rpm $(OUTPUT_FILE)
+	$* $(BUILD_PROFILE) build $(BUILD_FLAGS) $(BUILD_TARGET) $(SRPMS)/$(PACKAGE_NAME)-$(KVERSION)-$(PKGRELEASE)$(DIST).src.rpm $(OUTPUT_FILE)
 
 distg-brew distg-koji: distg-%:
-	$* build $(BUILD_FLAGS) $(BUILD_TARGET) "$(RHGITURL)?redhat/koji#$(RHGITCOMMIT)"
+	$* $(BUILD_PROFILE) build $(BUILD_FLAGS) $(BUILD_TARGET) "$(RHGITURL)?redhat/koji#$(RHGITCOMMIT)"
 
 .PHONY: $(REDHAT)/rpm/SOURCES/$(PACKAGE_NAME).spec
 $(REDHAT)/rpm/SOURCES/$(PACKAGE_NAME).spec:
@@ -366,6 +405,12 @@ dist-git: dist-srpm $(KABI_TARBALL) $(KABIDW_TARBALL)
 ifeq ("$(RHDISTGIT_BRANCH)", "")
  $(error RHDISTGIT_BRANCH unset)
 endif
+	@if [ "$(DISTRO)" == "centos" ]; then \
+	if [ -z "$(GL_DISTGIT_USER)" ]; then \
+		echo "Error: please provide your gitlab username with GL_DISTGIT_USER"; \
+		exit 1; \
+	fi; \
+	fi
 	$(REDHAT)/scripts/rh-dist-git.sh "$(RHDISTGIT_BRANCH)" "$(RHDISTGIT_CACHE)" "$(RHDISTGIT_TMP)" "$(RHDISTGIT)" "$(TARBALL)" "$(KABI_TARBALL)" "$(KABIDW_TARBALL)" "$(__ZSTREAM)" "$(PACKAGE_NAME)" "$(RHEL_MAJOR)" "$(RHPKG_BIN)" "$(SRPMS)/$(PACKAGE_NAME)-$(KVERSION)-$(PKGRELEASE)$(DIST).src.rpm"
 
 dist-rtg: dist-release
@@ -381,6 +426,20 @@ dist-get-latest:
 dist-os-version:
 	@echo "OSVERSION: $(RHEL_MAJOR).$(RHEL_MINOR)"
 
+.EXPORT_ALL_VARIABLES:
+.PHONY: dist-dump-variables
+dist-dump-variables:
+	grep -h "^[ 	]*[a-zA-Z_][a-zA-Z_0-9]*[ 	]*[:?]*=" $(REDHAT)/Makefile.common $(REDHAT)/Makefile $(TOPDIR)/Makefile.rhelver | sed -e 's/[ 	]*\([a-zA-Z_][a-zA-Z_0-9]*\).*/echo "\1=$$\1"/' | sort | uniq > dist-dump-variables.sh
+	chmod +x $(REDHAT)/dist-dump-variables.sh
+	@$(REDHAT)/dist-dump-variables.sh
+
+dist-self-test:
+	@if test -x /usr/bin/bats; then \
+		bats $(REDHAT)/self-test/*.bats ; \
+	else \
+		echo "dist-self-test: The bats package is not installed" ; \
+	fi
+
 dist-help:
 	@echo  'Cleaning targets:'
 	@echo  '  dist-clean          - Clean redhat/configs/ and redhat/rpm/ directories.'
@@ -464,20 +523,20 @@ dist-full-help:
 	@echo  '  dist-cross-<arch>-rpms  - [x86_64 only] execute rpm builds for specified'
 	@echo  '                            <arch> using RHEL cross compiler.'
 	@echo  '                            See dist-cross-<arch>-build for the supported archs.'
-	@echo  '  rh-configs       - build ELN configs'
-	@echo  '  fedora-configs   - build Fedora configs'
+	@echo  '  dist-rhel-configs       - build ELN configs'
+	@echo  '  dist-fedora-configs     - build Fedora configs'
 
 	@echo  ''
 	@echo  'kABI targets:'
-	@echo  '  dist-kabi           - Create kABI whitelist files in redhat/kabi/kabi-rhel*/'
+	@echo  '  dist-kabi           - Create kABI stablelist files in redhat/kabi/kabi-rhel*/'
 	@echo  '                        and merge kABI checksums into redhat/kabi/Module.kabi_*.'
 	@echo  '  dist-kabi-dup       - Merge kABI checksums for Driver Update Program (DUP)'
 	@echo  '                        into redhat/kabi/Module.kabi_dup_*.'
-	@echo  '  dist-check-kabi     - Check for changes in kABI whitelisted symbols.'
+	@echo  '  dist-check-kabi     - Check for changes in kABI stablelisted symbols.'
 	@echo  '                        Requires a pre-compiled tree: run `make dist-configs`,'
 	@echo  '                        copy the relevant config file from redhat/configs/ to'
 	@echo  '                       .config, and run `make`.'
-	@echo  '  dist-check-kabi-dup - Like dist-check-kabi but uses a DUP kABI whitelist.'
+	@echo  '  dist-check-kabi-dup - Like dist-check-kabi but uses a DUP kABI stablelist.'
 	@echo  '  dist-kabi-dw-base   - Generate the base dataset for kABI DWARF-based check.'
 	@echo  '  dist-kabi-dw-check  - Run DWARF-based kABI comparison of current binaries'
 	@echo  '                        with the base dataset.'
@@ -493,9 +552,11 @@ dist-full-help:
 
 	@echo  ''
 	@echo  'Misc targets:'
+	@echo  '  dist-buildreq-check - Checks for presence of packages required for build'
 	@echo  '  dist-get-latest - Returns the latest "known good" kernel from brew. This'
 	@echo  '                    should not be confused with the latest top-of-tree'
 	@echo  '                    development tag.'
 	@echo  '  dist-os-version - Displays the current Red Hat Enterprise Linux versioni'
 	@echo  '                    target used by the current branch/tree.'
+	@echo  '  dist-self-test  - Runs self-tests from the redhat/self-test directory'
 	@echo  ''

redhat/Makefile.common

@@ -1,49 +1,62 @@
-TOPDIR:=$(shell git rev-parse --show-toplevel)
+TOPDIR:=$(shell $(GIT) rev-parse --show-toplevel)
 REDHAT:=$(TOPDIR)/redhat
 include $(TOPDIR)/Makefile.rhelver
+include $(REDHAT)/Makefile.variables
 
 RPMBUILD := $(shell if [ -x "/usr/bin/rpmbuild" ]; then echo rpmbuild; \
                    else echo rpm; fi)
 
 MACH :=  $(shell uname -m)
-RPMKVERSION:=$(shell git show HEAD:Makefile | sed -ne '/^VERSION\ =\ /{s///;p;q}')
-RPMKPATCHLEVEL:=$(shell git show HEAD:Makefile | sed -ne '/^PATCHLEVEL\ =\ /{s///;p;q}')
-RPMKSUBLEVEL:=$(shell git show HEAD:Makefile | sed -ne '/^SUBLEVEL\ =\ /{s///;p;q}')
-RPMKEXTRAVERSION:=$(shell git show HEAD:Makefile | sed -ne '/^EXTRAVERSION\ =\ /{s///;p;q}')
-GITID:= $(shell git log --max-count=1 --pretty=format:%H)
+HEAD ?= HEAD
+RPMKVERSION:=$(shell $(GIT) show $(HEAD):Makefile | sed -ne '/^VERSION\ =\ /{s///;p;q}')
+RPMKPATCHLEVEL:=$(shell $(GIT) show $(HEAD):Makefile | sed -ne '/^PATCHLEVEL\ =\ /{s///;p;q}')
+RPMKSUBLEVEL:=$(shell $(GIT) show $(HEAD):Makefile | sed -ne '/^SUBLEVEL\ =\ /{s///;p;q}')
+RPMKEXTRAVERSION:=$(shell $(GIT) show $(HEAD):Makefile | sed -ne '/^EXTRAVERSION\ =\ /{s///;p;q}')
+GITID:= $(shell $(GIT) log --max-count=1 --pretty=format:%H $(HEAD))
 # marker is git tag which we base off of for exporting patches
 # Make sure marker uses RPMKPATCHLEVEL and RPMKEXTRAVERSION from the kernel
 # makefile as opposed to any adjusted version for snapshotting.
-MARKER:=v$(RPMKVERSION).$(RPMKPATCHLEVEL)$(RPMKEXTRAVERSION)
 ifneq ($(RPMKEXTRAVERSION),)
+  MARKER:=v$(RPMKVERSION).$(RPMKPATCHLEVEL)$(RPMKEXTRAVERSION)
   KEXTRAVERSION:=$(shell echo $(RPMKEXTRAVERSION) | sed -e s/-/./)
   PREBUILD:=0$(KEXTRAVERSION).
   UPSTREAM_TARBALL_NAME:=$(RPMKVERSION).$(RPMKPATCHLEVEL)$(RPMKEXTRAVERSION)
 else
   ifeq ($(RPMKSUBLEVEL),0)
+    MARKER:=v$(RPMKVERSION).$(RPMKPATCHLEVEL)
     UPSTREAM_TARBALL_NAME:=$(RPMKVERSION).$(RPMKPATCHLEVEL)
   else
+    MARKER:=v$(RPMKVERSION).$(RPMKPATCHLEVEL).$(RPMKSUBLEVEL)
     UPSTREAM_TARBALL_NAME:=$(RPMKVERSION).$(RPMKPATCHLEVEL).$(RPMKSUBLEVEL)
   endif
   PREBUILD:=
 endif
 
-DIST ?=.fc33
-IS_FEDORA:=$(shell ! echo $(DIST) | grep -q fc; echo $$?)
+ifneq ($(findstring .fc,$(DIST)),)
+  DISTRO ?= fedora
+else
+  DISTRO ?= rhel
+endif
+
 # If VERSION_ON_UPSTREAM is set, the versioning of the rpm package is based
 # on a branch tracking upstream. This allows for generating rpms
 # based on untagged releases.
-ifeq ("$(DIST)", ".elrdy")
-  VERSION_ON_UPSTREAM:=1
-else ifeq ("$(IS_FEDORA)", "1")
-  VERSION_ON_UPSTREAM:=1
-else
-  VERSION_ON_UPSTREAM:=0
+ifndef VERSION_ON_UPSTREAM
+  ifeq ("$(DISTRO)", "fedora")
+    VERSION_ON_UPSTREAM:=1
+  else
+    VERSION_ON_UPSTREAM:=0
+  endif
 endif
 ifeq ($(VERSION_ON_UPSTREAM),1)
-  # master is expected to track mainline.
-  MERGE_BASE:=$(shell git merge-base HEAD master)
-  _TAG:=$(shell git describe $(MERGE_BASE))
+  # UPSTREAM_BRANCH is expected to track mainline.
+  UPSTREAM:=$(shell $(GIT) rev-parse -q --verify origin/$(UPSTREAM_BRANCH) || \
+                  $(GIT) rev-parse -q --verify $(UPSTREAM_BRANCH))
+  ifeq ($(UPSTREAM),)
+      $(error "Missing an $(UPSTREAM_BRANCH) branch")
+  endif
+  MERGE_BASE:=$(shell $(GIT) merge-base $(HEAD) $(UPSTREAM))
+  _TAG:=$(shell $(GIT) describe $(MERGE_BASE))
   # a snapshot off of a tagged git is of the form [tag]-[cnt]-g[hash]
   SNAPSHOT:=$(shell echo $(_TAG) | grep -c '\-g')
 else
@@ -62,9 +75,10 @@ ifeq ($(SNAPSHOT),1)
     PREBUILD:=0$(KEXTRAVERSION).
     RPMKPATCHLEVEL:=$(shell expr $(RPMKPATCHLEVEL) + 1)
   endif
-  # Follow the packaging guidelines to include the date + git snapshot
-  PREBUILD:=$(PREBUILD)$(shell date +%Y%m%d)git$(MARKER).
-  UPSTREAM_TARBALL_NAME:=$(shell date +%Y%m%d)git$(MARKER)
+  # Obtain the date that HEAD was committed (not the snapshot commit).
+  HEAD_DATE:=$(shell $(GIT) show -s --format=%cd --date=format:%Y%m%d $(HEAD))
+  PREBUILD:=$(PREBUILD)$(HEAD_DATE)git$(MARKER).
+  UPSTREAM_TARBALL_NAME:=$(patsubst v%,%,$(_TAG))
 endif
 
 
@@ -81,29 +95,18 @@ RPM:=$(REDHAT)/rpm
 SRPMS:=$(RPM)/SRPMS
 SOURCES:=$(RPM)/SOURCES
 TESTPATCH:=$(REDHAT)/linux-kernel-test.patch
-FILTERDIFF:=/usr/bin/filterdiff -x '*redhat/*' -x '*/.gitignore' -x '*/makefile' -x '*/Makefile'
 ARCH_LIST=aarch64 ppc64le s390x x86_64
 # Make can't match on a regex to match fc31, fc32 so add another check here
 # A unified tarball means that the tarball in the srpm contains both the
 # upstream sources and redhat patches. A non-unified tarball means that
 # the tarball is only upstream sources and the patches get applied as
 # a diff in the spec file
-ifeq ("$(DIST)", ".elrdy")
-  SINGLE_TARBALL:=0
-else ifeq ("$(IS_FEDORA)", "1")
+ifeq ("$(DISTRO)", "fedora")
   SINGLE_TARBALL:=0
 else
   SINGLE_TARBALL:=1
 endif
 
-# RELEASED_KERNEL: swaps between the pre-release secureboot keys and
-# 		   the release one, for vmlinux signing.
-#
-#	0 : pre-release (devel) secureboot keys are used for signing
-#	1 : release (RC/GA) secureboot keys are used for signing
-#
-RELEASED_KERNEL:=0
-
 STAMP_VERSION:=$(KVERSION)
 
 LOCVERFILE:=../localversion
@@ -129,7 +132,7 @@ endif
 TARFILE:=linux-$(TARFILE_RELEASE).tar.xz
 TARBALL:=$(REDHAT)/$(TARFILE)
 DISTRO_BUILD:=$(PREBUILD)$(shell echo $(BUILD) | sed -e 's|\(^[0-9]\{1,4\}\)\..*|\1|')
-KABI_TARFILE:=kernel-abi-whitelists-$(KVERSION)-$(DISTRO_BUILD).tar.bz2
+KABI_TARFILE:=kernel-abi-stablelists-$(KVERSION)-$(DISTRO_BUILD).tar.bz2
 KABI_TARBALL:=$(REDHAT)/rpm/SOURCES/$(KABI_TARFILE)
 KABIDW_TARFILE:=kernel-kabi-dw-$(KVERSION)-$(DISTRO_BUILD).tar.bz2
 KABIDW_TARBALL:=$(REDHAT)/rpm/SOURCES/$(KABIDW_TARFILE)
@@ -137,18 +140,19 @@ KABIDW_TARBALL:=$(REDHAT)/rpm/SOURCES/$(KABIDW_TARFILE)
 CHANGELOG:=$(PACKAGE_NAME).changelog-$(RHEL_MAJOR).$(RHEL_MINOR)
 CHANGELOG_PREV:=$(PACKAGE_NAME).changelog-$(RHEL_MAJOR).$(shell expr $(RHEL_MINOR) - 1)
 
-ifeq ("$(DIST)", ".elrdy")
-  RHPRODUCT:=rhel-ready
-else ifeq ("$(IS_FEDORA)", "1")
-  RHPRODUCT:=master
+ifeq ("$(DISTRO)", "fedora")
+  RHPRODUCT:=rawhide
+else ifeq ("$(DISTRO)", "centos")
+  RHPRODUCT:=c$(RHEL_MAJOR)s
 else
   RHPRODUCT:=rhel-$(RHEL_MAJOR).$(RHEL_MINOR).0
 endif
 
-ifeq ("$(DIST)", ".elrdy")
-  BUILD_SCRATCH_TARGET ?= temp-ark-rhel-8-test
-else ifeq ("$(IS_FEDORA)", "1")
+ifeq ("$(DISTRO)", "fedora")
   BUILD_SCRATCH_TARGET ?= temp-ark-rhel-8-test
+else ifeq ("$(DISTRO)", "centos")
+  BUILD_PROFILE ?= -p stream
+  BUILD_SCRATCH_TARGET ?= c$(RHEL_MAJOR)s-candidate
 else
   BUILD_SCRATCH_TARGET ?= rhel-$(RHEL_MAJOR).$(RHEL_MINOR).0-test-pesign
 endif

redhat/Makefile.rhpkg

@@ -1,11 +1,13 @@
-# variables that can be overrided by ~/.rhel8git.mk or $(TOPDIR)/.rhel8git.mk
+# variables that can be overrided by ~/.rhpkg.mk or $(TOPDIR)/.rhpkg.mk
 #
 
 # Command to invoke rhpkg
-ifeq ("$(IS_FEDORA)", "1")
+ifeq ("$(DISTRO)", "fedora")
 	RHPKG_BIN:=fedpkg
+else ifeq ("$(DISTRO)", "centos")
+	RHPKG_BIN:=centpkg
 else
-	RHPKG_BIN:=rhpkg-sha512
+	RHPKG_BIN:=rhpkg
 endif
 # Kerberos username for pkgs.devel.redhat.com
 RHDISTGIT_USER:="$(shell whoami)"
@@ -19,12 +21,21 @@ RHDISTGIT_BRANCH:=${RHPRODUCT}
 
 # load configuration, starting with home directory then local
 ifeq ("$(RHDISTGIT_CACHE)", "")
- ifneq ("$(wildcard ${HOME}/.rhel8git.mk)", "")
-  include ${HOME}/.rhel8git.mk
+ ifneq ("$(wildcard ${HOME}/.rhpkg.mk)", "")
+  include ${HOME}/.rhpkg.mk
  endif
- ifneq ("$(wildcard $(TOPDIR)/.rhel8git.mk)", "")
-  include $(TOPDIR)/.rhel8git.mk
+ ifneq ("$(wildcard $(TOPDIR)/.rhpkg.mk)", "")
+  include $(TOPDIR)/.rhpkg.mk
  endif
 endif
 
-RHDISTGIT:="ssh://$(RHDISTGIT_USER)@pkgs.devel.redhat.com/rpms/$(PACKAGE_NAME)"
+ifneq ("$(DISTRO)", "centos")
+	RHDISTGIT:="ssh://$(RHDISTGIT_USER)@pkgs.devel.redhat.com/rpms/$(PACKAGE_NAME)"
+else
+	# CentOS uses a fork + merge request based workflow with dist-git to
+	# handle changes, so you need to provide the gitlab username and we by
+	# default set the default user's fork path. The dist-git target in
+	# redhat/Makefile has a check to see if the variable is not set.
+	GL_FORK_PATH?=$(PACKAGE_NAME).git
+	RHDISTGIT:=git@gitlab.com:$(GL_DISTGIT_USER)/$(GL_FORK_PATH)
+endif

redhat/Makefile.variables

@@ -0,0 +1,47 @@
+
+# Variables below should be changed as needed for building on a different
+# branch, or with a different upstream branch. This should be the only
+# file that needs to be changed now, and is included in redhat/Makefile
+# and redhat/Makefile.common
+
+# This is the source branch that you are building out of typically this is
+# the current branch.
+DIST_BRANCH ?= "fedora-5.15"
+
+# This is the dist release suffix used in the package release, eg. .fc34,
+# .el8 etc. In a different branch this may be set to a fixed value.
+DIST ?= $(shell $(RPMBUILD) --eval '%{?dist}')
+
+# The branch used as upstream. This is what the upstream tarball is it
+# should be tracked in a local branch. This would be "master" for the
+# Linus master branch or linux-5.x.y for a stable branch. It can also be
+# any other upstream you have added as a branch locally.
+UPSTREAM_BRANCH ?= linux-5.15.y
+
+# If VERSION_ON_UPSTREAM is set, the versioning of the rpm package is based
+# on a branch tracking upstream. This allows for generating rpms
+# based on untagged releases.
+VERSION_ON_UPSTREAM:=0
+
+# RELEASED_KERNEL swaps between the pre-release secureboot keys and
+# the release one, for vmlinux signing. It also controls whether Fedora
+# kernels are built as debug kernels or release kernels with a separate
+# kernel-debug build.
+# Set RELEASED_KERNEL to 1 when the upstream source tarball contains a
+#  kernel release. (This includes prepatch or "rc" releases.)
+# Set RELEASED_KERNEL to 0 when the upstream source tarball contains an
+#  unreleased kernel development snapshot.
+RELEASED_KERNEL:=1
+
+# BUMP_RELEASE determines whether the pkgrelease is bumped when you call
+# 'make dist-release'.  It should be set to "yes" if you expect to do
+# multiple updates and builds without bumping the base version, and no
+# when you expect every build to use a different base kernel version.
+BUMP_RELEASE:=no
+
+# INCLUDE_*_FILES determines whether or not the specific OS flavor files will
+# be included as part of the source RPM.  Downstream projects, such as
+# centos-stream or RHEL, can disable file inclusion by setting these values
+# to '0'.
+INCLUDE_FEDORA_FILES:=1
+INCLUDE_RHEL_FILES:=1

redhat/configs/.gitignore

@@ -1,5 +1,6 @@
 *merged
 config-*
 kernel*config
+partial*config
 *.old
 *.tmp

redhat/configs/README

@@ -41,6 +41,13 @@ to default in pending-common. These settings are moved to the fedora/
 configuration directory after community review. Options are populated with
 "make FLAVOR=fedora dist-commit-configs".
 
+custom-overrides - This directory contains an empty set of the generic and debug
+arch-specific directory tree. Any config option set here is applied last and
+therefore will override anything set in the ark, fedora, or pending directories.
+This allows users to easily override a config option without altering the
+standard directories. Users can even maintain their own branch with a full set
+of custom configuration options that can be easily be rebased on top of
+os-build without worrying about conflicts.
 
 All the configuration options for each arch and variant can be found
 in the "priority" file.

redhat/configs/ark/debug/CONFIG_PAGE_EXTENSION

@@ -1 +0,0 @@
-CONFIG_PAGE_EXTENSION=y

redhat/configs/ark/debug/arm/aarch64/CONFIG_LOCK_TORTURE_TEST

@@ -1 +0,0 @@
-CONFIG_LOCK_TORTURE_TEST=m

redhat/configs/ark/debug/powerpc/CONFIG_NVRAM

@@ -0,0 +1 @@
+CONFIG_NVRAM=m

redhat/configs/ark/generic/CONFIG_ARCH_AGILEX

@@ -1 +0,0 @@
-# CONFIG_ARCH_AGILEX is not set

redhat/configs/ark/generic/CONFIG_ARCH_ZX

@@ -1 +0,0 @@
-# CONFIG_ARCH_ZX is not set

redhat/configs/ark/generic/CONFIG_BCMGENET

@@ -1 +1 @@
-# CONFIG_BCMGENET is not set
+CONFIG_BCMGENET=m

redhat/configs/ark/generic/CONFIG_BLK_CGROUP_IOLATENCY

@@ -1 +0,0 @@
-# CONFIG_BLK_CGROUP_IOLATENCY is not set

redhat/configs/ark/generic/CONFIG_BLK_DEV_SKD

@@ -1 +0,0 @@
-# CONFIG_BLK_DEV_SKD is not set

redhat/configs/ark/generic/CONFIG_BLK_DEV_ZONED

@@ -1 +0,0 @@
-# CONFIG_BLK_DEV_ZONED is not set

redhat/configs/ark/generic/CONFIG_BRIDGE_NETFILTER

@@ -0,0 +1 @@
+# CONFIG_BRIDGE_NETFILTER is not set

redhat/configs/ark/generic/CONFIG_BRIDGE_NF_EBTABLES

@@ -0,0 +1,2 @@
+# This CONFIG has been disabled in RHEL by RHEL Engineering. Please contact Red Hat Support for further assistance.
+# CONFIG_BRIDGE_NF_EBTABLES is not set

redhat/configs/ark/generic/CONFIG_BUG_ON_DATA_CORRUPTION

@@ -1 +0,0 @@
-# CONFIG_BUG_ON_DATA_CORRUPTION is not set

redhat/configs/ark/generic/CONFIG_CAN_LEDS

@@ -1 +0,0 @@
-CONFIG_CAN_LEDS=y

redhat/configs/ark/generic/CONFIG_CAN_M_CAN

@@ -1 +0,0 @@
-# CONFIG_CAN_M_CAN is not set

redhat/configs/ark/generic/CONFIG_CAN_PEAK_PCIEFD

@@ -1 +0,0 @@
-# CONFIG_CAN_PEAK_PCIEFD is not set

redhat/configs/ark/generic/CONFIG_CAN_VXCAN

@@ -1 +0,0 @@
-# CONFIG_CAN_VXCAN is not set

redhat/configs/ark/generic/CONFIG_CAVIUM_PTP

@@ -1 +0,0 @@
-CONFIG_CAVIUM_PTP=y

redhat/configs/ark/generic/CONFIG_CRYPTO_CFB

@@ -1 +0,0 @@
-# CONFIG_CRYPTO_CFB is not set

redhat/configs/ark/generic/CONFIG_CRYPTO_CHACHA20_NEON

@@ -1 +0,0 @@
-CONFIG_CRYPTO_CHACHA20_NEON=m

redhat/configs/ark/generic/CONFIG_CRYPTO_CTS

@@ -1 +0,0 @@
-CONFIG_CRYPTO_CTS=m

redhat/configs/ark/generic/CONFIG_CRYPTO_SM3_ARM64_CE

@@ -1 +0,0 @@
-CONFIG_CRYPTO_SM3_ARM64_CE=m

redhat/configs/ark/generic/CONFIG_CRYPTO_SM4_ARM64_CE

@@ -1 +0,0 @@
-CONFIG_CRYPTO_SM4_ARM64_CE=m

redhat/configs/ark/generic/CONFIG_CRYPTO_XTS

@@ -1 +0,0 @@
-CONFIG_CRYPTO_XTS=m

redhat/configs/ark/generic/CONFIG_DMABUF_HEAPS_CMA

@@ -0,0 +1 @@
+# CONFIG_DMABUF_HEAPS_CMA is not set

redhat/configs/ark/generic/CONFIG_DM_VERITY_FEC

@@ -1 +0,0 @@
-# CONFIG_DM_VERITY_FEC is not set

redhat/configs/ark/generic/CONFIG_DRM_AMDGPU_USERPTR

@@ -1 +0,0 @@
-# CONFIG_DRM_AMDGPU_USERPTR is not set

redhat/configs/ark/generic/CONFIG_DRM_LEGACY

@@ -1 +0,0 @@
-CONFIG_DRM_LEGACY=y

redhat/configs/ark/generic/CONFIG_DVB_AV7110_IR

@@ -1 +0,0 @@
-CONFIG_DVB_AV7110_IR=y

redhat/configs/ark/generic/CONFIG_ENCRYPTED_KEYS

@@ -1 +0,0 @@
-CONFIG_ENCRYPTED_KEYS=m

redhat/configs/ark/generic/CONFIG_ENERGY_MODEL

@@ -1 +0,0 @@
-CONFIG_ENERGY_MODEL=y