Kconfig                                            |   2 +

 Kconfig.redhat                                     |  17 +++

 Makefile                                           |  12 +-

 arch/arm/Kconfig                                   |   4 +-

 arch/arm64/Kconfig                                 |   3 +-

 arch/s390/include/asm/ipl.h                        |   1 +

 arch/s390/kernel/ipl.c                             |   5 +

 arch/s390/kernel/setup.c                           |   4 +

 arch/x86/kernel/setup.c                            |  22 ++--

 crypto/rng.c                                       |  73 +++++++++++-

 drivers/acpi/apei/hest.c                           |   8 ++

 drivers/acpi/irq.c                                 |  17 ++-

 drivers/acpi/scan.c                                |   9 ++

 drivers/ata/libahci.c                              |  18 +++

 drivers/char/ipmi/ipmi_dmi.c                       |  15 +++

 drivers/char/ipmi/ipmi_msghandler.c                |  16 ++-

 drivers/char/random.c                              | 115 +++++++++++++++++++

 drivers/firmware/efi/Makefile                      |   1 +

 drivers/firmware/efi/efi.c                         | 124 +++++++++++++++------

 drivers/firmware/efi/secureboot.c                  |  38 +++++++

 drivers/hid/hid-rmi.c                              |  64 -----------

 drivers/hwtracing/coresight/coresight-etm4x-core.c |  19 ++++

 drivers/input/rmi4/rmi_driver.c                    | 124 ++++++++++++---------

 drivers/iommu/iommu.c                              |  22 ++++

 drivers/nvme/host/core.c                           |  22 +++-

 drivers/nvme/host/multipath.c                      |  19 ++--

 drivers/nvme/host/nvme.h                           |   4 +

 drivers/pci/msi/msi.c                              |  12 +-

 drivers/pci/quirks.c                               |  24 ++++

 drivers/usb/core/hub.c                             |   7 ++

 include/linux/efi.h                                |  22 ++--

 include/linux/lsm_hook_defs.h                      |   2 +

 include/linux/lsm_hooks.h                          |   6 +

 include/linux/mmzone.h                             |   4 +-

 include/linux/module.h                             |   1 +

 include/linux/random.h                             |   7 ++

 include/linux/rmi.h                                |   1 +

 include/linux/security.h                           |   5 +

 init/Kconfig                                       |   2 +-

 kernel/module.c                                    |   2 +

 kernel/module_signing.c                            |   9 +-

 scripts/mod/modpost.c                              |   8 ++

 scripts/tags.sh                                    |   2 +

 security/integrity/platform_certs/load_uefi.c      |   6 +-

 security/lockdown/Kconfig                          |  13 +++

 security/lockdown/lockdown.c                       |   1 +

 security/security.c                                |   6 +

 47 files changed, 719 insertions(+), 199 deletions(-)

diff --git a/Kconfig b/Kconfig

index 745bc773f567..f57ff40109d7 100644

--- a/Kconfig

+++ b/Kconfig

@@ -30,3 +30,5 @@ source "lib/Kconfig"

 source "lib/Kconfig.debug"

 source "Documentation/Kconfig"

+

+source "Kconfig.redhat"

diff --git a/Kconfig.redhat b/Kconfig.redhat

new file mode 100644

index 000000000000..733a26bd887a

--- /dev/null

+++ b/Kconfig.redhat

@@ -0,0 +1,17 @@

+# SPDX-License-Identifier: GPL-2.0-only

+#

+# Red Hat specific options

+#

+

+menu "Red Hat options"

+

+config RH_DISABLE_DEPRECATED

+	bool "Remove support for deprecated features"

+	help

+	  Red Hat may choose to deprecate certain features in its kernels.

+	  Enable this option to remove support for hardware that is no

+	  longer supported.

+

+	  Unless you want a restricted kernel, say N here.

+

+endmenu

diff --git a/Makefile b/Makefile

index 7214f075e1f0..6ecb3acb605c 100644

--- a/Makefile

+++ b/Makefile

@@ -18,6 +18,10 @@ $(if $(filter __%, $(MAKECMDGOALS)), \

 PHONY := __all

 __all:

+# Set RHEL variables

+# Use this spot to avoid future merge conflicts

+include Makefile.rhelver

+

 # We are using a recursive build, so we need to do a little thinking

 # to get the ordering right.

 #

@@ -1235,7 +1239,13 @@ define filechk_version.h

 	((c) > 255 ? 255 : (c)))';                                       \

 	echo \#define LINUX_VERSION_MAJOR $(VERSION);                    \

 	echo \#define LINUX_VERSION_PATCHLEVEL $(PATCHLEVEL);            \

-	echo \#define LINUX_VERSION_SUBLEVEL $(SUBLEVEL)

+	echo \#define LINUX_VERSION_SUBLEVEL $(SUBLEVEL);                \

+	echo '#define RHEL_MAJOR $(RHEL_MAJOR)'; \

+	echo '#define RHEL_MINOR $(RHEL_MINOR)'; \

+	echo '#define RHEL_RELEASE_VERSION(a,b) (((a) << 8) + (b))'; \

+	echo '#define RHEL_RELEASE_CODE \

+		$(shell expr $(RHEL_MAJOR) \* 256 + $(RHEL_MINOR))'; \

+	echo '#define RHEL_RELEASE "$(RHEL_RELEASE)"'

 endef

 $(version_h): PATCHLEVEL := $(if $(PATCHLEVEL), $(PATCHLEVEL), 0)

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig

index 4c97cb40eebb..caf06cef3d2e 100644

--- a/arch/arm/Kconfig

+++ b/arch/arm/Kconfig

@@ -1479,9 +1479,9 @@ config HIGHMEM

 	  If unsure, say n.

 config HIGHPTE

-	bool "Allocate 2nd-level pagetables from highmem" if EXPERT

+	bool "Allocate 2nd-level pagetables from highmem"

 	depends on HIGHMEM

-	default y

+	default n

 	help

 	  The VM uses one page of physical memory for each page table.

 	  For systems with a lot of processes, this can use a lot of

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig

index c842878f8133..72949bfbe1af 100644

--- a/arch/arm64/Kconfig

+++ b/arch/arm64/Kconfig

@@ -1109,7 +1109,7 @@ endchoice

 config ARM64_FORCE_52BIT

 	bool "Force 52-bit virtual addresses for userspace"

-	depends on ARM64_VA_BITS_52 && EXPERT

+	depends on ARM64_VA_BITS_52

 	help

 	  For systems with 52-bit userspace VAs enabled, the kernel will attempt

 	  to maintain compatibility with older software by providing 48-bit VAs

@@ -1348,6 +1348,7 @@ config XEN

 config FORCE_MAX_ZONEORDER

 	int

 	default "14" if ARM64_64K_PAGES

+	default "13" if (ARCH_THUNDER && !ARM64_64K_PAGES)

 	default "12" if ARM64_16K_PAGES

 	default "11"

 	help

diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h

index 3f8ee257f9aa..3ab92feb6241 100644

--- a/arch/s390/include/asm/ipl.h

+++ b/arch/s390/include/asm/ipl.h

@@ -128,6 +128,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,

 			     unsigned char flags, unsigned short cert);

 int ipl_report_add_certificate(struct ipl_report *report, void *key,

 			       unsigned long addr, unsigned long len);

+bool ipl_get_secureboot(void);

 /*

  * DIAG 308 support

diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c

index 5ad1dde23dc5..b6192d58eed3 100644

--- a/arch/s390/kernel/ipl.c

+++ b/arch/s390/kernel/ipl.c

@@ -2216,3 +2216,8 @@ int ipl_report_free(struct ipl_report *report)

 }

 #endif

+

+bool ipl_get_secureboot(void)

+{

+	return !!ipl_secure_flag;

+}

diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c

index 05327be3a982..c473e5ca67f1 100644

--- a/arch/s390/kernel/setup.c

+++ b/arch/s390/kernel/setup.c

@@ -49,6 +49,7 @@

 #include <linux/memory.h>

 #include <linux/compat.h>

 #include <linux/start_kernel.h>

+#include <linux/security.h>

 #include <linux/hugetlb.h>

 #include <linux/kmemleak.h>

@@ -965,6 +966,9 @@ void __init setup_arch(char **cmdline_p)

 	log_component_list();

+	if (ipl_get_secureboot())

+		security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);

+

 	/* Have one command line that is parsed and saved in /proc/cmdline */

 	/* boot_command_line has been already set up in early.c */

 	*cmdline_p = boot_command_line;

diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c

index 90d7e1788c91..262198c48162 100644

--- a/arch/x86/kernel/setup.c

+++ b/arch/x86/kernel/setup.c

@@ -20,6 +20,7 @@

 #include <linux/root_dev.h>

 #include <linux/hugetlb.h>

 #include <linux/tboot.h>

+#include <linux/security.h>

 #include <linux/usb/xhci-dbgp.h>

 #include <linux/static_call.h>

 #include <linux/swiotlb.h>

@@ -950,6 +951,13 @@ void __init setup_arch(char **cmdline_p)

 	if (efi_enabled(EFI_BOOT))

 		efi_init();

+	efi_set_secure_boot(boot_params.secure_boot);

+

+#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT

+	if (efi_enabled(EFI_SECURE_BOOT))

+		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);

+#endif

+

 	dmi_setup();

 	/*

@@ -1119,19 +1127,7 @@ void __init setup_arch(char **cmdline_p)

 	/* Allocate bigger log buffer */

 	setup_log_buf(1);

-	if (efi_enabled(EFI_BOOT)) {

-		switch (boot_params.secure_boot) {

-		case efi_secureboot_mode_disabled:

-			pr_info("Secure boot disabled\n");

-			break;

-		case efi_secureboot_mode_enabled:

-			pr_info("Secure boot enabled\n");

-			break;

-		default:

-			pr_info("Secure boot could not be determined\n");

-			break;

-		}

-	}

+	efi_set_secure_boot(boot_params.secure_boot);

 	reserve_initrd();

diff --git a/crypto/rng.c b/crypto/rng.c

index fea082b25fe4..50a9d040bed1 100644

--- a/crypto/rng.c

+++ b/crypto/rng.c

@@ -11,14 +11,17 @@

 #include <linux/atomic.h>

 #include <crypto/internal/rng.h>

 #include <linux/err.h>

+#include <linux/fips.h>

+#include <linux/kernel.h>

 #include <linux/module.h>

 #include <linux/mutex.h>

 #include <linux/random.h>

 #include <linux/seq_file.h>

+#include <linux/sched.h>

+#include <linux/sched/signal.h>

 #include <linux/slab.h>

 #include <linux/string.h>

 #include <linux/cryptouser.h>

-#include <linux/compiler.h>

 #include <net/netlink.h>

 #include "internal.h"

@@ -224,5 +227,73 @@ void crypto_unregister_rngs(struct rng_alg *algs, int count)

 }

 EXPORT_SYMBOL_GPL(crypto_unregister_rngs);

+static ssize_t crypto_devrandom_read(void __user *buf, size_t buflen)

+{

+	u8 tmp[256];

+	ssize_t ret;

+

+	if (!buflen)

+		return 0;

+

+	ret = crypto_get_default_rng();

+	if (ret)

+		return ret;

+

+	for (;;) {

+		int err;

+		int i;

+

+		i = min_t(int, buflen, sizeof(tmp));

+		err = crypto_rng_get_bytes(crypto_default_rng, tmp, i);

+		if (err) {

+			ret = err;

+			break;

+		}

+

+		if (copy_to_user(buf, tmp, i)) {

+			ret = -EFAULT;

+			break;

+		}

+

+		buflen -= i;

+		buf += i;

+		ret += i;

+

+		if (!buflen)

+			break;

+

+		if (need_resched()) {

+			if (signal_pending(current))

+				break;

+			schedule();

+		}

+	}

+

+	crypto_put_default_rng();

+	memzero_explicit(tmp, sizeof(tmp));

+

+	return ret;

+}

+

+static const struct random_extrng crypto_devrandom_rng = {

+	.extrng_read = crypto_devrandom_read,

+	.owner = THIS_MODULE,

+};

+

+static int __init crypto_rng_init(void)

+{

+	if (fips_enabled)

+		random_register_extrng(&crypto_devrandom_rng);

+	return 0;

+}

+

+static void __exit crypto_rng_exit(void)

+{

+	random_unregister_extrng();

+}

+

+late_initcall(crypto_rng_init);

+module_exit(crypto_rng_exit);

+

 MODULE_LICENSE("GPL");

 MODULE_DESCRIPTION("Random Number Generator");

diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c

index 0edc1ed47673..782e2f399af2 100644

--- a/drivers/acpi/apei/hest.c

+++ b/drivers/acpi/apei/hest.c

@@ -96,6 +96,14 @@ static int apei_hest_parse(apei_hest_func_t func, void *data)

 	if (hest_disable || !hest_tab)

 		return -EINVAL;

+#ifdef CONFIG_ARM64

+	/* Ignore broken firmware */

+	if (!strncmp(hest_tab->header.oem_id, "HPE   ", 6) &&

+	    !strncmp(hest_tab->header.oem_table_id, "ProLiant", 8) &&

+	    MIDR_IMPLEMENTOR(read_cpuid_id()) == ARM_CPU_IMP_APM)

+		return -EINVAL;

+#endif

+

 	hest_hdr = (struct acpi_hest_header *)(hest_tab + 1);

 	for (i = 0; i < hest_tab->error_source_count; i++) {

 		len = hest_esrc_len(hest_hdr);

diff --git a/drivers/acpi/irq.c b/drivers/acpi/irq.c

index c68e694fca26..146cba5ae5bc 100644

--- a/drivers/acpi/irq.c

+++ b/drivers/acpi/irq.c

@@ -130,6 +130,7 @@ struct acpi_irq_parse_one_ctx {

 	unsigned int index;

 	unsigned long *res_flags;

 	struct irq_fwspec *fwspec;

+	bool skip_producer_check;

 };

 /**

@@ -201,7 +202,8 @@ static acpi_status acpi_irq_parse_one_cb(struct acpi_resource *ares,

 		return AE_CTRL_TERMINATE;

 	case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:

 		eirq = &ares->data.extended_irq;

-		if (eirq->producer_consumer == ACPI_PRODUCER)

+		if (!ctx->skip_producer_check &&

+		    eirq->producer_consumer == ACPI_PRODUCER)

 			return AE_OK;

 		if (ctx->index >= eirq->interrupt_count) {

 			ctx->index -= eirq->interrupt_count;

@@ -236,8 +238,19 @@ static acpi_status acpi_irq_parse_one_cb(struct acpi_resource *ares,

 static int acpi_irq_parse_one(acpi_handle handle, unsigned int index,

 			      struct irq_fwspec *fwspec, unsigned long *flags)

 {

-	struct acpi_irq_parse_one_ctx ctx = { -EINVAL, index, flags, fwspec };

+	struct acpi_irq_parse_one_ctx ctx = { -EINVAL, index, flags, fwspec, false };

+	/*

+	 * Firmware on arm64-based HPE m400 platform incorrectly marks

+	 * its UART interrupt as ACPI_PRODUCER rather than ACPI_CONSUMER.

+	 * Don't do the producer/consumer check for that device.

+	 */

+	if (IS_ENABLED(CONFIG_ARM64)) {

+		struct acpi_device *adev = acpi_bus_get_acpi_device(handle);

+

+		if (adev && !strcmp(acpi_device_hid(adev), "APMC0D08"))

+			ctx.skip_producer_check = true;

+	}

 	acpi_walk_resources(handle, METHOD_NAME__CRS, acpi_irq_parse_one_cb, &ctx;;

 	return ctx.rc;

 }

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c

index 8b2e5ef15559..ac0291ef0838 100644

--- a/drivers/acpi/scan.c

+++ b/drivers/acpi/scan.c

@@ -1769,6 +1769,15 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device)

 	if (!acpi_match_device_ids(device, ignore_serial_bus_ids))

 		return false;

+	/*

+	 * Firmware on some arm64 X-Gene platforms will make the UART

+	 * device appear as both a UART and a slave of that UART. Just

+	 * bail out here for X-Gene UARTs.

+	 */

+	if (IS_ENABLED(CONFIG_ARM64) &&

+	    !strcmp(acpi_device_hid(device), "APMC0D08"))

+		return false;

+

 	INIT_LIST_HEAD(&resource_list);

 	acpi_dev_get_resources(device, &resource_list,

 			       acpi_check_serial_bus_slave,

diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c

index 0ed484e04fd6..a2e486bd14ef 100644

--- a/drivers/ata/libahci.c

+++ b/drivers/ata/libahci.c

@@ -690,6 +690,24 @@ int ahci_stop_engine(struct ata_port *ap)

 	tmp &= ~PORT_CMD_START;

 	writel(tmp, port_mmio + PORT_CMD);

+#ifdef CONFIG_ARM64

+	/* Rev Ax of Cavium CN99XX needs a hack for port stop */

+	if (dev_is_pci(ap->host->dev) &&

+	    to_pci_dev(ap->host->dev)->vendor == 0x14e4 &&

+	    to_pci_dev(ap->host->dev)->device == 0x9027 &&

+	    midr_is_cpu_model_range(read_cpuid_id(),

+			MIDR_CPU_MODEL(ARM_CPU_IMP_BRCM, BRCM_CPU_PART_VULCAN),

+			MIDR_CPU_VAR_REV(0, 0),

+			MIDR_CPU_VAR_REV(0, MIDR_REVISION_MASK))) {

+		tmp = readl(hpriv->mmio + 0x8000);

+		udelay(100);

+		writel(tmp | (1 << 26), hpriv->mmio + 0x8000);

+		udelay(100);

+		writel(tmp & ~(1 << 26), hpriv->mmio + 0x8000);

+		dev_warn(ap->host->dev, "CN99XX SATA reset workaround applied\n");

+	}

+#endif

+

 	/* wait for engine to stop. This could be as long as 500 msec */

 	tmp = ata_wait_register(ap, port_mmio + PORT_CMD,

 				PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500);

diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c

index bbf7029e224b..cf7faa970dd6 100644

--- a/drivers/char/ipmi/ipmi_dmi.c

+++ b/drivers/char/ipmi/ipmi_dmi.c

@@ -215,6 +215,21 @@ static int __init scan_for_dmi_ipmi(void)

 {

 	const struct dmi_device *dev = NULL;

+#ifdef CONFIG_ARM64

+	/* RHEL-only

+	 * If this is ARM-based HPE m400, return now, because that platform

+	 * reports the host-side ipmi address as intel port-io space, which

+	 * does not exist in the ARM architecture.

+	 */

+	const char *dmistr = dmi_get_system_info(DMI_PRODUCT_NAME);

+

+	if (dmistr && (strcmp("ProLiant m400 Server", dmistr) == 0)) {

+		pr_debug("%s does not support host ipmi\n", dmistr);

+		return 0;

+	}

+	/* END RHEL-only */

+#endif

+

 	while ((dev = dmi_find_device(DMI_DEV_TYPE_IPMI, NULL, dev)))

 		dmi_decode_ipmi((const struct dmi_header *) dev->device_data);

diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c

index c59265146e9c..caa8458edde2 100644

--- a/drivers/char/ipmi/ipmi_msghandler.c

+++ b/drivers/char/ipmi/ipmi_msghandler.c

@@ -35,6 +35,7 @@

 #include <linux/uuid.h>

 #include <linux/nospec.h>

 #include <linux/vmalloc.h>

+#include <linux/dmi.h>

 #include <linux/delay.h>

 #define IPMI_DRIVER_VERSION "39.2"

@@ -5422,8 +5423,21 @@ static int __init ipmi_init_msghandler_mod(void)

 {

 	int rv;

-	pr_info("version " IPMI_DRIVER_VERSION "\n");

+#ifdef CONFIG_ARM64

+	/* RHEL-only

+	 * If this is ARM-based HPE m400, return now, because that platform

+	 * reports the host-side ipmi address as intel port-io space, which

+	 * does not exist in the ARM architecture.

+	 */

+	const char *dmistr = dmi_get_system_info(DMI_PRODUCT_NAME);

+	if (dmistr && (strcmp("ProLiant m400 Server", dmistr) == 0)) {

+		pr_debug("%s does not support host ipmi\n", dmistr);

+		return -ENOSYS;

+	}

+	/* END RHEL-only */

+#endif

+	pr_info("version " IPMI_DRIVER_VERSION "\n");

 	mutex_lock(&ipmi_interfaces_mutex);

 	rv = ipmi_register_driver();

 	mutex_unlock(&ipmi_interfaces_mutex);

diff --git a/drivers/char/random.c b/drivers/char/random.c

index 3404a91edf29..184dbb94710c 100644

--- a/drivers/char/random.c

+++ b/drivers/char/random.c

@@ -344,6 +344,7 @@

 #include <linux/syscalls.h>

 #include <linux/completion.h>

 #include <linux/uuid.h>

+#include <linux/rcupdate.h>

 #include <crypto/chacha.h>

 #include <crypto/blake2s.h>

@@ -358,6 +359,11 @@

 /* #define ADD_INTERRUPT_BENCH */

+/*

+ * Hook for external RNG.

+ */

+static const struct random_extrng __rcu *extrng;

+

 /*

  * If the entropy count falls under this number of bits, then we

  * should wake up processes which are selecting or polling on write

@@ -486,6 +492,9 @@ static int ratelimit_disable __read_mostly;

 module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);

 MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");

+static const struct file_operations extrng_random_fops;

+static const struct file_operations extrng_urandom_fops;

+

 /**********************************************************************

  *

  * OS independent entropy store.   Here are the functions which handle

@@ -1775,6 +1784,13 @@ static __poll_t random_poll(struct file *file, poll_table *wait)

 	return mask;

 }

+static __poll_t

+extrng_poll(struct file *file, poll_table * wait)

+{

+	/* extrng pool is always full, always read, no writes */

+	return EPOLLIN | EPOLLRDNORM;

+}

+

 static int write_pool(const char __user *buffer, size_t count)

 {

 	size_t bytes;

@@ -1879,7 +1895,58 @@ static int random_fasync(int fd, struct file *filp, int on)

 	return fasync_helper(fd, filp, on, &fasync);

 }

+static int random_open(struct inode *inode, struct file *filp)

+{

+	const struct random_extrng *rng;

+

+	rcu_read_lock();

+	rng = rcu_dereference(extrng);

+	if (rng && !try_module_get(rng->owner))

+		rng = NULL;

+	rcu_read_unlock();

+

+	if (!rng)

+		return 0;

+

+	filp->f_op = &extrng_random_fops;

+	filp->private_data = rng->owner;

+

+	return 0;

+}

+

+static int urandom_open(struct inode *inode, struct file *filp)

+{

+	const struct random_extrng *rng;

+

+	rcu_read_lock();

+	rng = rcu_dereference(extrng);

+	if (rng && !try_module_get(rng->owner))

+		rng = NULL;

+	rcu_read_unlock();

+

+	if (!rng)

+		return 0;

+

+	filp->f_op = &extrng_urandom_fops;

+	filp->private_data = rng->owner;

+

+	return 0;

+}

+

+static int extrng_release(struct inode *inode, struct file *filp)

+{

+	module_put(filp->private_data);

+	return 0;

+}

+

+static ssize_t

+extrng_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)

+{

+	return rcu_dereference_raw(extrng)->extrng_read(buf, nbytes);

+}

+

 const struct file_operations random_fops = {

+	.open  = random_open,

 	.read = random_read,

 	.write = random_write,

 	.poll = random_poll,

@@ -1890,6 +1957,7 @@ const struct file_operations random_fops = {

 };

 const struct file_operations urandom_fops = {

+	.open  = urandom_open,

 	.read = urandom_read,

 	.write = random_write,

 	.unlocked_ioctl = random_ioctl,

@@ -1898,9 +1966,31 @@ const struct file_operations urandom_fops = {

 	.llseek = noop_llseek,

 };

+static const struct file_operations extrng_random_fops = {

+	.open  = random_open,

+	.read  = extrng_read,

+	.write = random_write,

+	.poll  = extrng_poll,

+	.unlocked_ioctl = random_ioctl,

+	.fasync = random_fasync,

+	.llseek = noop_llseek,

+	.release = extrng_release,

+};

+

+static const struct file_operations extrng_urandom_fops = {

+	.open  = urandom_open,

+	.read  = extrng_read,

+	.write = random_write,

+	.unlocked_ioctl = random_ioctl,

+	.fasync = random_fasync,

+	.llseek = noop_llseek,

+	.release = extrng_release,

+};

+

 SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count, unsigned int,

 		flags)

 {

+	const struct random_extrng *rng;

 	int ret;

 	if (flags & ~(GRND_NONBLOCK | GRND_RANDOM | GRND_INSECURE))

@@ -1916,6 +2006,18 @@ SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count, unsigned int,

 	if (count > INT_MAX)

 		count = INT_MAX;

+	rcu_read_lock();

+	rng = rcu_dereference(extrng);

+	if (rng && !try_module_get(rng->owner))

+		rng = NULL;

+	rcu_read_unlock();

+

+	if (rng) {

+		ret = rng->extrng_read(buf, count);

+		module_put(rng->owner);

+		return ret;

+	}

+

 	if (!(flags & GRND_INSECURE) && !crng_ready()) {

 		if (flags & GRND_NONBLOCK)

 			return -EAGAIN;

@@ -2235,3 +2337,16 @@ void add_bootloader_randomness(const void *buf, unsigned int size)

 		add_device_randomness(buf, size);

 }

 EXPORT_SYMBOL_GPL(add_bootloader_randomness);

+

+void random_register_extrng(const struct random_extrng *rng)

+{

+	rcu_assign_pointer(extrng, rng);

+}

+EXPORT_SYMBOL_GPL(random_register_extrng);

+

+void random_unregister_extrng(void)

+{

+	RCU_INIT_POINTER(extrng, NULL);

+	synchronize_rcu();

+}

+EXPORT_SYMBOL_GPL(random_unregister_extrng);

diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile

index c02ff25dd477..d860f8eb9a81 100644

--- a/drivers/firmware/efi/Makefile

+++ b/drivers/firmware/efi/Makefile

@@ -28,6 +28,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP)		+= fake_map.o

 obj-$(CONFIG_EFI_BOOTLOADER_CONTROL)	+= efibc.o

 obj-$(CONFIG_EFI_TEST)			+= test/

 obj-$(CONFIG_EFI_DEV_PATH_PARSER)	+= dev-path-parser.o

+obj-$(CONFIG_EFI)			+= secureboot.o

 obj-$(CONFIG_APPLE_PROPERTIES)		+= apple-properties.o

 obj-$(CONFIG_EFI_RCI2_TABLE)		+= rci2-table.o

 obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE)	+= embedded-firmware.o

diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c

index 5502e176d51b..93b61ca552d6 100644

--- a/drivers/firmware/efi/efi.c

+++ b/drivers/firmware/efi/efi.c

@@ -31,6 +31,7 @@

 #include <linux/ucs2_string.h>

 #include <linux/memblock.h>

 #include <linux/security.h>