Makefile                                           |  20 ++-

 arch/s390/include/asm/ipl.h                        |   1 +

 arch/s390/kernel/ipl.c                             |   5 +

 arch/s390/kernel/setup.c                           |   4 +

 arch/x86/kernel/setup.c                            |  22 ++-

 drivers/acpi/apei/hest.c                           |   8 +

 drivers/acpi/irq.c                                 |  17 +-

 drivers/acpi/scan.c                                |   9 ++

 drivers/ata/libahci.c                              |  18 +++

 drivers/char/ipmi/ipmi_dmi.c                       |  15 ++

 drivers/char/ipmi/ipmi_msghandler.c                |  16 +-

 drivers/firmware/efi/Makefile                      |   1 +

 drivers/firmware/efi/efi.c                         | 124 +++++++++++----

 drivers/firmware/efi/secureboot.c                  |  38 +++++

 drivers/firmware/sysfb.c                           |  18 ++-

 drivers/hid/hid-rmi.c                              |  66 --------

 drivers/hwtracing/coresight/coresight-etm4x-core.c |  19 +++

 drivers/input/rmi4/rmi_driver.c                    | 124 +++++++++------

 drivers/iommu/iommu.c                              |  22 +++

 drivers/pci/quirks.c                               |  24 +++

 drivers/scsi/sd.c                                  |  10 ++

 drivers/usb/core/hub.c                             |   7 +

 fs/xfs/xfs_iomap.c                                 |   4 +-

 include/linux/efi.h                                |  22 ++-

 include/linux/lsm_hook_defs.h                      |   2 +

 include/linux/module.h                             |   1 +

 include/linux/rh_kabi.h                            | 172 +++++++++++++++++++++

 include/linux/rmi.h                                |   1 +

 include/linux/security.h                           |   5 +

 kernel/module/main.c                               |   2 +

 kernel/module/signing.c                            |   9 +-

 scripts/mod/modpost.c                              |   8 +

 scripts/tags.sh                                    |   2 +

 security/integrity/platform_certs/load_uefi.c      |   6 +-

 security/lockdown/Kconfig                          |  13 ++

 security/lockdown/lockdown.c                       |   1 +

 security/security.c                                |  12 ++

 tools/power/cpupower/Makefile                      |   2 +-

 38 files changed, 672 insertions(+), 178 deletions(-)

diff --git a/Makefile b/Makefile

index ffa43a6d0424..0d5ae4952215 100644

--- a/Makefile

+++ b/Makefile

@@ -22,6 +22,18 @@ $(if $(filter __%, $(MAKECMDGOALS)), \

 PHONY := __all

 __all:

+# Set RHEL variables

+# Note that this ifdef'ery is required to handle when building with

+# the O= mechanism (relocate the object file results) due to upstream

+# commit 67d7c302 which broke our RHEL include file

+ifneq ($(realpath source),)

+include $(realpath source)/Makefile.rhelver

+else

+ifneq ($(realpath Makefile.rhelver),)

+include Makefile.rhelver

+endif

+endif

+

 # We are using a recursive build, so we need to do a little thinking

 # to get the ordering right.

 #

@@ -1247,7 +1259,13 @@ define filechk_version.h

 	((c) > 255 ? 255 : (c)))';                                       \

 	echo \#define LINUX_VERSION_MAJOR $(VERSION);                    \

 	echo \#define LINUX_VERSION_PATCHLEVEL $(PATCHLEVEL);            \

-	echo \#define LINUX_VERSION_SUBLEVEL $(SUBLEVEL)

+	echo \#define LINUX_VERSION_SUBLEVEL $(SUBLEVEL);                \

+	echo '#define RHEL_MAJOR $(RHEL_MAJOR)'; \

+	echo '#define RHEL_MINOR $(RHEL_MINOR)'; \

+	echo '#define RHEL_RELEASE_VERSION(a,b) (((a) << 8) + (b))'; \

+	echo '#define RHEL_RELEASE_CODE \

+		$(shell expr $(RHEL_MAJOR) \* 256 + $(RHEL_MINOR))'; \

+	echo '#define RHEL_RELEASE "$(RHEL_RELEASE)"'

 endef

 $(version_h): PATCHLEVEL := $(or $(PATCHLEVEL), 0)

diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h

index b0d00032479d..afb9544fb007 100644

--- a/arch/s390/include/asm/ipl.h

+++ b/arch/s390/include/asm/ipl.h

@@ -139,6 +139,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,

 			     unsigned char flags, unsigned short cert);

 int ipl_report_add_certificate(struct ipl_report *report, void *key,

 			       unsigned long addr, unsigned long len);

+bool ipl_get_secureboot(void);

 /*

  * DIAG 308 support

diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c

index ba75f6bee774..7d37ce1772f1 100644

--- a/arch/s390/kernel/ipl.c

+++ b/arch/s390/kernel/ipl.c

@@ -2520,3 +2520,8 @@ int ipl_report_free(struct ipl_report *report)

 }

 #endif

+

+bool ipl_get_secureboot(void)

+{

+	return !!ipl_secure_flag;

+}

diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c

index d1f3b56e7afc..eaefd0d7cfff 100644

--- a/arch/s390/kernel/setup.c

+++ b/arch/s390/kernel/setup.c

@@ -49,6 +49,7 @@

 #include <linux/memory.h>

 #include <linux/compat.h>

 #include <linux/start_kernel.h>

+#include <linux/security.h>

 #include <linux/hugetlb.h>

 #include <linux/kmemleak.h>

@@ -891,6 +892,9 @@ void __init setup_arch(char **cmdline_p)

 	log_component_list();

+	if (ipl_get_secureboot())

+		security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);

+

 	/* Have one command line that is parsed and saved in /proc/cmdline */

 	/* boot_command_line has been already set up in early.c */

 	*cmdline_p = boot_command_line;

diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c

index 3998109195da..cedcd208de44 100644

--- a/arch/x86/kernel/setup.c

+++ b/arch/x86/kernel/setup.c

@@ -20,6 +20,7 @@

 #include <linux/root_dev.h>

 #include <linux/hugetlb.h>

 #include <linux/tboot.h>

+#include <linux/security.h>

 #include <linux/usb/xhci-dbgp.h>

 #include <linux/static_call.h>

 #include <linux/swiotlb.h>

@@ -901,6 +902,13 @@ void __init setup_arch(char **cmdline_p)

 	if (efi_enabled(EFI_BOOT))

 		efi_init();

+	efi_set_secure_boot(boot_params.secure_boot);

+

+#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT

+	if (efi_enabled(EFI_SECURE_BOOT))

+		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);

+#endif

+

 	reserve_ibft_region();

 	x86_init.resources.dmi_setup();

@@ -1065,19 +1073,7 @@ void __init setup_arch(char **cmdline_p)

 	/* Allocate bigger log buffer */

 	setup_log_buf(1);

-	if (efi_enabled(EFI_BOOT)) {

-		switch (boot_params.secure_boot) {

-		case efi_secureboot_mode_disabled:

-			pr_info("Secure boot disabled\n");

-			break;

-		case efi_secureboot_mode_enabled:

-			pr_info("Secure boot enabled\n");

-			break;

-		default:

-			pr_info("Secure boot could not be determined\n");

-			break;

-		}

-	}

+	efi_set_secure_boot(boot_params.secure_boot);

 	reserve_initrd();

diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c

index 6aef1ee5e1bd..8f146b1b4972 100644

--- a/drivers/acpi/apei/hest.c

+++ b/drivers/acpi/apei/hest.c

@@ -96,6 +96,14 @@ static int apei_hest_parse(apei_hest_func_t func, void *data)

 	if (hest_disable || !hest_tab)

 		return -EINVAL;

+#ifdef CONFIG_ARM64

+	/* Ignore broken firmware */

+	if (!strncmp(hest_tab->header.oem_id, "HPE   ", 6) &&

+	    !strncmp(hest_tab->header.oem_table_id, "ProLiant", 8) &&

+	    MIDR_IMPLEMENTOR(read_cpuid_id()) == ARM_CPU_IMP_APM)

+		return -EINVAL;

+#endif

+

 	hest_hdr = (struct acpi_hest_header *)(hest_tab + 1);

 	for (i = 0; i < hest_tab->error_source_count; i++) {

 		len = hest_esrc_len(hest_hdr);

diff --git a/drivers/acpi/irq.c b/drivers/acpi/irq.c

index 1687483ff319..390b67f19181 100644

--- a/drivers/acpi/irq.c

+++ b/drivers/acpi/irq.c

@@ -143,6 +143,7 @@ struct acpi_irq_parse_one_ctx {

 	unsigned int index;

 	unsigned long *res_flags;

 	struct irq_fwspec *fwspec;

+	bool skip_producer_check;

 };

 /**

@@ -216,7 +217,8 @@ static acpi_status acpi_irq_parse_one_cb(struct acpi_resource *ares,

 		return AE_CTRL_TERMINATE;

 	case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:

 		eirq = &ares->data.extended_irq;

-		if (eirq->producer_consumer == ACPI_PRODUCER)

+		if (!ctx->skip_producer_check &&

+		    eirq->producer_consumer == ACPI_PRODUCER)

 			return AE_OK;

 		if (ctx->index >= eirq->interrupt_count) {

 			ctx->index -= eirq->interrupt_count;

@@ -252,8 +254,19 @@ static acpi_status acpi_irq_parse_one_cb(struct acpi_resource *ares,

 static int acpi_irq_parse_one(acpi_handle handle, unsigned int index,

 			      struct irq_fwspec *fwspec, unsigned long *flags)

 {

-	struct acpi_irq_parse_one_ctx ctx = { -EINVAL, index, flags, fwspec };

+	struct acpi_irq_parse_one_ctx ctx = { -EINVAL, index, flags, fwspec, false };

+	/*

+	 * Firmware on arm64-based HPE m400 platform incorrectly marks

+	 * its UART interrupt as ACPI_PRODUCER rather than ACPI_CONSUMER.

+	 * Don't do the producer/consumer check for that device.

+	 */

+	if (IS_ENABLED(CONFIG_ARM64)) {

+		struct acpi_device *adev = acpi_get_acpi_dev(handle);

+

+		if (adev && !strcmp(acpi_device_hid(adev), "APMC0D08"))

+			ctx.skip_producer_check = true;

+	}

 	acpi_walk_resources(handle, METHOD_NAME__CRS, acpi_irq_parse_one_cb, &ctx;;

 	return ctx.rc;

 }

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c

index eb4ca85d16ff..be8278b39b22 100644

--- a/drivers/acpi/scan.c

+++ b/drivers/acpi/scan.c

@@ -1757,6 +1757,15 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device)

 	if (!acpi_match_device_ids(device, ignore_serial_bus_ids))

 		return false;

+	/*

+	 * Firmware on some arm64 X-Gene platforms will make the UART

+	 * device appear as both a UART and a slave of that UART. Just

+	 * bail out here for X-Gene UARTs.

+	 */

+	if (IS_ENABLED(CONFIG_ARM64) &&

+	    !strcmp(acpi_device_hid(device), "APMC0D08"))

+		return false;

+

 	INIT_LIST_HEAD(&resource_list);

 	acpi_dev_get_resources(device, &resource_list,

 			       acpi_check_serial_bus_slave,

diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c

index 1a63200ea437..a911e976a596 100644

--- a/drivers/ata/libahci.c

+++ b/drivers/ata/libahci.c

@@ -729,6 +729,24 @@ int ahci_stop_engine(struct ata_port *ap)

 	tmp &= ~PORT_CMD_START;

 	writel(tmp, port_mmio + PORT_CMD);

+#ifdef CONFIG_ARM64

+	/* Rev Ax of Cavium CN99XX needs a hack for port stop */

+	if (dev_is_pci(ap->host->dev) &&

+	    to_pci_dev(ap->host->dev)->vendor == 0x14e4 &&

+	    to_pci_dev(ap->host->dev)->device == 0x9027 &&

+	    midr_is_cpu_model_range(read_cpuid_id(),

+			MIDR_CPU_MODEL(ARM_CPU_IMP_BRCM, BRCM_CPU_PART_VULCAN),

+			MIDR_CPU_VAR_REV(0, 0),

+			MIDR_CPU_VAR_REV(0, MIDR_REVISION_MASK))) {

+		tmp = readl(hpriv->mmio + 0x8000);

+		udelay(100);

+		writel(tmp | (1 << 26), hpriv->mmio + 0x8000);

+		udelay(100);

+		writel(tmp & ~(1 << 26), hpriv->mmio + 0x8000);

+		dev_warn(ap->host->dev, "CN99XX SATA reset workaround applied\n");

+	}

+#endif

+

 	/* wait for engine to stop. This could be as long as 500 msec */

 	tmp = ata_wait_register(ap, port_mmio + PORT_CMD,

 				PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500);

diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c

index bbf7029e224b..cf7faa970dd6 100644

--- a/drivers/char/ipmi/ipmi_dmi.c

+++ b/drivers/char/ipmi/ipmi_dmi.c

@@ -215,6 +215,21 @@ static int __init scan_for_dmi_ipmi(void)

 {

 	const struct dmi_device *dev = NULL;

+#ifdef CONFIG_ARM64

+	/* RHEL-only

+	 * If this is ARM-based HPE m400, return now, because that platform

+	 * reports the host-side ipmi address as intel port-io space, which

+	 * does not exist in the ARM architecture.

+	 */

+	const char *dmistr = dmi_get_system_info(DMI_PRODUCT_NAME);

+

+	if (dmistr && (strcmp("ProLiant m400 Server", dmistr) == 0)) {

+		pr_debug("%s does not support host ipmi\n", dmistr);

+		return 0;

+	}

+	/* END RHEL-only */

+#endif

+

 	while ((dev = dmi_find_device(DMI_DEV_TYPE_IPMI, NULL, dev)))

 		dmi_decode_ipmi((const struct dmi_header *) dev->device_data);

diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c

index b0eedc4595b3..a9024c1dd68a 100644

--- a/drivers/char/ipmi/ipmi_msghandler.c

+++ b/drivers/char/ipmi/ipmi_msghandler.c

@@ -35,6 +35,7 @@

 #include <linux/uuid.h>

 #include <linux/nospec.h>

 #include <linux/vmalloc.h>

+#include <linux/dmi.h>

 #include <linux/delay.h>

 #define IPMI_DRIVER_VERSION "39.2"

@@ -5511,8 +5512,21 @@ static int __init ipmi_init_msghandler_mod(void)

 {

 	int rv;

-	pr_info("version " IPMI_DRIVER_VERSION "\n");

+#ifdef CONFIG_ARM64

+	/* RHEL-only

+	 * If this is ARM-based HPE m400, return now, because that platform

+	 * reports the host-side ipmi address as intel port-io space, which

+	 * does not exist in the ARM architecture.

+	 */

+	const char *dmistr = dmi_get_system_info(DMI_PRODUCT_NAME);

+	if (dmistr && (strcmp("ProLiant m400 Server", dmistr) == 0)) {

+		pr_debug("%s does not support host ipmi\n", dmistr);

+		return -ENOSYS;

+	}

+	/* END RHEL-only */

+#endif

+	pr_info("version " IPMI_DRIVER_VERSION "\n");

 	mutex_lock(&ipmi_interfaces_mutex);

 	rv = ipmi_register_driver();

 	mutex_unlock(&ipmi_interfaces_mutex);

diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile

index a2d0009560d0..4f3486e6a84b 100644

--- a/drivers/firmware/efi/Makefile

+++ b/drivers/firmware/efi/Makefile

@@ -25,6 +25,7 @@ subdir-$(CONFIG_EFI_STUB)		+= libstub

 obj-$(CONFIG_EFI_BOOTLOADER_CONTROL)	+= efibc.o

 obj-$(CONFIG_EFI_TEST)			+= test/

 obj-$(CONFIG_EFI_DEV_PATH_PARSER)	+= dev-path-parser.o

+obj-$(CONFIG_EFI)			+= secureboot.o

 obj-$(CONFIG_APPLE_PROPERTIES)		+= apple-properties.o

 obj-$(CONFIG_EFI_RCI2_TABLE)		+= rci2-table.o

 obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE)	+= embedded-firmware.o

diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c

index 1ea14e86a741..ae3518be391e 100644

--- a/drivers/firmware/efi/efi.c

+++ b/drivers/firmware/efi/efi.c

@@ -33,6 +33,7 @@

 #include <linux/memblock.h>

 #include <linux/security.h>

 #include <linux/notifier.h>

+#include <linux/bsearch.h>

 #include <asm/early_ioremap.h>

@@ -992,40 +993,101 @@ int efi_mem_type(unsigned long phys_addr)

 	return -EINVAL;

 }

+struct efi_error_code {

+	efi_status_t status;

+	int errno;

+	const char *description;

+};

+

+static const struct efi_error_code efi_error_codes[] = {

+	{ EFI_SUCCESS, 0, "Success"},

+#if 0

+	{ EFI_LOAD_ERROR, -EPICK_AN_ERRNO, "Load Error"},

+#endif

+	{ EFI_INVALID_PARAMETER, -EINVAL, "Invalid Parameter"},

+	{ EFI_UNSUPPORTED, -ENOSYS, "Unsupported"},

+	{ EFI_BAD_BUFFER_SIZE, -ENOSPC, "Bad Buffer Size"},

+	{ EFI_BUFFER_TOO_SMALL, -ENOSPC, "Buffer Too Small"},

+	{ EFI_NOT_READY, -EAGAIN, "Not Ready"},

+	{ EFI_DEVICE_ERROR, -EIO, "Device Error"},

+	{ EFI_WRITE_PROTECTED, -EROFS, "Write Protected"},

+	{ EFI_OUT_OF_RESOURCES, -ENOMEM, "Out of Resources"},

+#if 0

+	{ EFI_VOLUME_CORRUPTED, -EPICK_AN_ERRNO, "Volume Corrupt"},

+	{ EFI_VOLUME_FULL, -EPICK_AN_ERRNO, "Volume Full"},

+	{ EFI_NO_MEDIA, -EPICK_AN_ERRNO, "No Media"},

+	{ EFI_MEDIA_CHANGED, -EPICK_AN_ERRNO, "Media changed"},

+#endif

+	{ EFI_NOT_FOUND, -ENOENT, "Not Found"},

+#if 0

+	{ EFI_ACCESS_DENIED, -EPICK_AN_ERRNO, "Access Denied"},

+	{ EFI_NO_RESPONSE, -EPICK_AN_ERRNO, "No Response"},

+	{ EFI_NO_MAPPING, -EPICK_AN_ERRNO, "No mapping"},

+	{ EFI_TIMEOUT, -EPICK_AN_ERRNO, "Time out"},

+	{ EFI_NOT_STARTED, -EPICK_AN_ERRNO, "Not started"},

+	{ EFI_ALREADY_STARTED, -EPICK_AN_ERRNO, "Already started"},

+#endif

+	{ EFI_ABORTED, -EINTR, "Aborted"},

+#if 0

+	{ EFI_ICMP_ERROR, -EPICK_AN_ERRNO, "ICMP Error"},

+	{ EFI_TFTP_ERROR, -EPICK_AN_ERRNO, "TFTP Error"},

+	{ EFI_PROTOCOL_ERROR, -EPICK_AN_ERRNO, "Protocol Error"},

+	{ EFI_INCOMPATIBLE_VERSION, -EPICK_AN_ERRNO, "Incompatible Version"},

+#endif

+	{ EFI_SECURITY_VIOLATION, -EACCES, "Security Policy Violation"},

+#if 0

+	{ EFI_CRC_ERROR, -EPICK_AN_ERRNO, "CRC Error"},

+	{ EFI_END_OF_MEDIA, -EPICK_AN_ERRNO, "End of Media"},

+	{ EFI_END_OF_FILE, -EPICK_AN_ERRNO, "End of File"},

+	{ EFI_INVALID_LANGUAGE, -EPICK_AN_ERRNO, "Invalid Languages"},

+	{ EFI_COMPROMISED_DATA, -EPICK_AN_ERRNO, "Compromised Data"},

+

+	// warnings

+	{ EFI_WARN_UNKOWN_GLYPH, -EPICK_AN_ERRNO, "Warning Unknown Glyph"},

+	{ EFI_WARN_DELETE_FAILURE, -EPICK_AN_ERRNO, "Warning Delete Failure"},

+	{ EFI_WARN_WRITE_FAILURE, -EPICK_AN_ERRNO, "Warning Write Failure"},

+	{ EFI_WARN_BUFFER_TOO_SMALL, -EPICK_AN_ERRNO, "Warning Buffer Too Small"},

+#endif

+};

+

+static int

+efi_status_cmp_bsearch(const void *key, const void *item)

+{

+	u64 status = (u64)(uintptr_t)key;

+	struct efi_error_code *code = (struct efi_error_code *)item;

+

+	if (status < code->status)

+		return -1;

+	if (status > code->status)

+		return 1;

+	return 0;

+}

+

 int efi_status_to_err(efi_status_t status)

 {

-	int err;

-

-	switch (status) {

-	case EFI_SUCCESS:

-		err = 0;

-		break;

-	case EFI_INVALID_PARAMETER:

-		err = -EINVAL;

-		break;

-	case EFI_OUT_OF_RESOURCES:

-		err = -ENOSPC;

-		break;

-	case EFI_DEVICE_ERROR:

-		err = -EIO;

-		break;

-	case EFI_WRITE_PROTECTED:

-		err = -EROFS;

-		break;

-	case EFI_SECURITY_VIOLATION:

-		err = -EACCES;

-		break;

-	case EFI_NOT_FOUND:

-		err = -ENOENT;

-		break;

-	case EFI_ABORTED:

-		err = -EINTR;

-		break;

-	default:

-		err = -EINVAL;

-	}

+	struct efi_error_code *found;

+	size_t num = sizeof(efi_error_codes) / sizeof(struct efi_error_code);

-	return err;

+	found = bsearch((void *)(uintptr_t)status, efi_error_codes,

+			sizeof(struct efi_error_code), num,

+			efi_status_cmp_bsearch);

+	if (!found)

+		return -EINVAL;

+	return found->errno;

+}

+

+const char *

+efi_status_to_str(efi_status_t status)

+{

+	struct efi_error_code *found;

+	size_t num = sizeof(efi_error_codes) / sizeof(struct efi_error_code);

+

+	found = bsearch((void *)(uintptr_t)status, efi_error_codes,

+			sizeof(struct efi_error_code), num,

+			efi_status_cmp_bsearch);

+	if (!found)

+		return "Unknown error code";

+	return found->description;

 }

 EXPORT_SYMBOL_GPL(efi_status_to_err);

diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c

new file mode 100644

index 000000000000..de0a3714a5d4

--- /dev/null

+++ b/drivers/firmware/efi/secureboot.c

@@ -0,0 +1,38 @@

+/* Core kernel secure boot support.

+ *

+ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.

+ * Written by David Howells (dhowells@redhat.com)

+ *

+ * This program is free software; you can redistribute it and/or

+ * modify it under the terms of the GNU General Public Licence

+ * as published by the Free Software Foundation; either version

+ * 2 of the Licence, or (at your option) any later version.

+ */

+

+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

+

+#include <linux/efi.h>

+#include <linux/kernel.h>

+#include <linux/printk.h>

+

+/*

+ * Decide what to do when UEFI secure boot mode is enabled.

+ */

+void __init efi_set_secure_boot(enum efi_secureboot_mode mode)

+{

+	if (efi_enabled(EFI_BOOT)) {

+		switch (mode) {

+		case efi_secureboot_mode_disabled:

+			pr_info("Secure boot disabled\n");

+			break;

+		case efi_secureboot_mode_enabled:

+			set_bit(EFI_SECURE_BOOT, &efi.flags);

+			pr_info("Secure boot enabled\n");

+			break;

+		default:

+			pr_warn("Secure boot could not be determined (mode %u)\n",

+				   mode);

+			break;

+		}

+	}

+}

diff --git a/drivers/firmware/sysfb.c b/drivers/firmware/sysfb.c

index 3c197db42c9d..16e4a2e90fae 100644

--- a/drivers/firmware/sysfb.c

+++ b/drivers/firmware/sysfb.c

@@ -34,6 +34,22 @@

 #include <linux/screen_info.h>

 #include <linux/sysfb.h>

+static int skip_simpledrm;

+

+static int __init simpledrm_disable(char *opt)

+{

+	if (!opt)

+                return -EINVAL;

+

+	get_option(&opt, &skip_simpledrm);

+

+	if (skip_simpledrm)

+		pr_info("The simpledrm driver will not be probed\n");

+

+	return 0;

+}

+early_param("nvidia-drm.modeset", simpledrm_disable);

+

 static struct platform_device *pd;

 static DEFINE_MUTEX(disable_lock);

 static bool disabled;

@@ -85,7 +101,7 @@ static __init int sysfb_init(void)

 	/* try to create a simple-framebuffer device */

 	compatible = sysfb_parse_mode(si, &mode);

-	if (compatible) {

+	if (compatible && !skip_simpledrm) {

 		pd = sysfb_create_simplefb(si, &mode);

 		if (!IS_ERR(pd))

 			goto unlock_mutex;

diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c

index d4af17fdba46..154f0403cbf4 100644

--- a/drivers/hid/hid-rmi.c

+++ b/drivers/hid/hid-rmi.c

@@ -321,21 +321,12 @@ static int rmi_input_event(struct hid_device *hdev, u8 *data, int size)

 {

 	struct rmi_data *hdata = hid_get_drvdata(hdev);

 	struct rmi_device *rmi_dev = hdata->xport.rmi_dev;

-	unsigned long flags;

 	if (!(test_bit(RMI_STARTED, &hdata->flags)))

 		return 0;

-	pm_wakeup_event(hdev->dev.parent, 0);

-

-	local_irq_save(flags);

-

 	rmi_set_attn_data(rmi_dev, data[1], &data[2], size - 2);

-	generic_handle_irq(hdata->rmi_irq);

-

-	local_irq_restore(flags);

-

 	return 1;

 }

@@ -589,56 +580,6 @@ static const struct rmi_transport_ops hid_rmi_ops = {

 	.reset		= rmi_hid_reset,

 };

-static void rmi_irq_teardown(void *data)

-{

-	struct rmi_data *hdata = data;

-	struct irq_domain *domain = hdata->domain;

-

-	if (!domain)

-		return;

-

-	irq_dispose_mapping(irq_find_mapping(domain, 0));

-

-	irq_domain_remove(domain);

-	hdata->domain = NULL;

-	hdata->rmi_irq = 0;

-}

-

-static int rmi_irq_map(struct irq_domain *h, unsigned int virq,

-		       irq_hw_number_t hw_irq_num)

-{

-	irq_set_chip_and_handler(virq, &dummy_irq_chip, handle_simple_irq);

-

-	return 0;

-}

-

-static const struct irq_domain_ops rmi_irq_ops = {

-	.map = rmi_irq_map,

-};

-

-static int rmi_setup_irq_domain(struct hid_device *hdev)

-{

-	struct rmi_data *hdata = hid_get_drvdata(hdev);

-	int ret;

-

-	hdata->domain = irq_domain_create_linear(hdev->dev.fwnode, 1,

-						 &rmi_irq_ops, hdata);

-	if (!hdata->domain)

-		return -ENOMEM;

-

-	ret = devm_add_action_or_reset(&hdev->dev, &rmi_irq_teardown, hdata);

-	if (ret)

-		return ret;

-

-	hdata->rmi_irq = irq_create_mapping(hdata->domain, 0);

-	if (hdata->rmi_irq <= 0) {

-		hid_err(hdev, "Can't allocate an IRQ\n");

-		return hdata->rmi_irq < 0 ? hdata->rmi_irq : -ENXIO;

-	}

-

-	return 0;

-}

-

 static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)

 {

 	struct rmi_data *data = NULL;

@@ -711,18 +652,11 @@ static int rmi_probe(struct hid_device *hdev, const struct hid_device_id *id)

 	mutex_init(&data->page_mutex);

-	ret = rmi_setup_irq_domain(hdev);

-	if (ret) {

-		hid_err(hdev, "failed to allocate IRQ domain\n");

-		return ret;

-	}

-

 	if (data->device_flags & RMI_DEVICE_HAS_PHYS_BUTTONS)

 		rmi_hid_pdata.gpio_data.disable = true;

 	data->xport.dev = hdev->dev.parent;

 	data->xport.pdata = rmi_hid_pdata;

-	data->xport.pdata.irq = data->rmi_irq;

 	data->xport.proto_name = "hid";

 	data->xport.ops = &hid_rmi_ops;

diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c

index 2e2cabc5f50a..8b44d990f978 100644

--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c

+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c

@@ -10,6 +10,7 @@

 #include <linux/init.h>

 #include <linux/types.h>

 #include <linux/device.h>

+#include <linux/dmi.h>

 #include <linux/io.h>

 #include <linux/err.h>

 #include <linux/fs.h>

@@ -2343,6 +2344,16 @@ static const struct amba_id etm4_ids[] = {

 	{},

 };

+static const struct dmi_system_id broken_coresight[] = {

+	{

+		.matches = {

+			DMI_MATCH(DMI_SYS_VENDOR, "HPE"),

+			DMI_MATCH(DMI_PRODUCT_NAME, "Apollo 70"),

+		},

+	},

+	{ }	/* terminating entry */

+};

+

 MODULE_DEVICE_TABLE(amba, etm4_ids);

 static struct amba_driver etm4x_amba_driver = {

@@ -2412,6 +2423,11 @@ static int __init etm4x_init(void)

 {

 	int ret;