patch-7.3-redhat.patch

 Documentation/admin-guide/kernel-parameters.txt    |  23 +
 Documentation/admin-guide/rh-waived-items.rst      |  29 ++
 Kconfig                                            |   2 +
 Kconfig.redhat                                     |  31 ++
 Makefile                                           |  38 +-
 arch/arm/Kconfig                                   |   4 +-
 arch/arm64/Kconfig                                 |   2 +-
 arch/arm64/kernel/setup.c                          |  27 +
 arch/s390/include/asm/ipl.h                        |   1 +
 arch/s390/kernel/ipl.c                             |   5 +
 arch/s390/kernel/setup.c                           |   4 +
 arch/x86/kernel/cpu/common.c                       |   1 +
 arch/x86/kernel/setup.c                            | 101 +++-
 crypto/akcipher.c                                  |   3 +-
 crypto/dh.c                                        |  25 +
 crypto/seqiv.c                                     |  15 +-
 crypto/sig.c                                       |   3 +-
 crypto/testmgr.c                                   |   6 +-
 drivers/acpi/apei/hest.c                           |   8 +
 drivers/acpi/irq.c                                 |  17 +-
 drivers/acpi/scan.c                                |   9 +
 drivers/ata/libahci.c                              |  18 +
 drivers/char/ipmi/ipmi_dmi.c                       |  15 +
 drivers/char/ipmi/ipmi_msghandler.c                |  16 +-
 drivers/char/random.c                              | 128 ++++-
 drivers/firmware/efi/Makefile                      |   1 +
 drivers/firmware/efi/efi.c                         | 124 +++--
 drivers/firmware/efi/libstub/fdt.c                 |   5 +
 drivers/firmware/efi/libstub/secureboot.c          |  14 +-
 drivers/firmware/efi/secureboot.c                  |  38 ++
 drivers/hwtracing/coresight/coresight-etm4x-core.c |  19 +
 drivers/iommu/iommu.c                              |  22 +
 drivers/message/fusion/mptsas.c                    |   5 +
 drivers/message/fusion/mptspi.c                    |   5 +
 drivers/net/wireguard/main.c                       |   6 +
 drivers/pci/pci-driver.c                           |   9 +
 drivers/pci/quirks.c                               |  24 +
 drivers/scsi/hpsa.c                                |   4 +
 drivers/scsi/qla2xxx/qla_os.c                      |   6 +
 drivers/scsi/sd.c                                  |  12 +
 drivers/usb/core/hub.c                             |   7 +
 fs/afs/main.c                                      |   3 +
 fs/erofs/super.c                                   |   9 +
 fs/ext4/super.c                                    |  11 +
 include/linux/crypto.h                             |   2 +
 include/linux/efi.h                                |  22 +-
 include/linux/kernel.h                             |  28 ++
 include/linux/lsm_hook_defs.h                      |   1 +
 include/linux/module.h                             |   5 +
 include/linux/panic.h                              |  17 +-
 include/linux/pci.h                                |   5 +
 include/linux/random.h                             |  10 +
 include/linux/rh_flags.h                           |  34 ++
 include/linux/rh_kabi.h                            | 541 +++++++++++++++++++++
 include/linux/rh_waived.h                          |  19 +
 include/linux/security.h                           |   9 +
 init/main.c                                        |   5 +
 kernel/Makefile                                    |   2 +
 kernel/bpf/core.c                                  |   5 +
 kernel/bpf/syscall.c                               |  23 +
 kernel/module/main.c                               |  13 +
 kernel/module/signing.c                            |   9 +-
 kernel/panic.c                                     |  12 +
 kernel/rh_flags.c                                  | 115 +++++
 kernel/rh_messages.c                               | 414 ++++++++++++++++
 kernel/rh_messages.h                               | 335 +++++++++++++
 kernel/rh_waived.c                                 | 147 ++++++
 scripts/Makefile.lib                               |   3 +
 scripts/mod/modpost.c                              |   8 +
 scripts/tags.sh                                    |   2 +
 security/integrity/platform_certs/load_uefi.c      |   6 +-
 security/lockdown/Kconfig                          |  13 +
 security/lockdown/lockdown.c                       |  11 +
 tools/testing/selftests/bpf/DENYLIST.rhel          |  76 +++
 tools/testing/selftests/bpf/Makefile               |   2 +-
 tools/testing/selftests/bpf/prog_tests/ksyms_btf.c |  31 --
 76 files changed, 2672 insertions(+), 108 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 68647ff4bdd2..a786aad83a2b 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -6726,6 +6726,20 @@ Kernel parameters
 		2	The "airplane mode" button toggles between everything
 			blocked and everything unblocked.
 
+	rh_waived=
+			Enable waived items in RHEL.
+
+			Some specific features, or security mitigations, can be
+			waived (toggled on/off) on demand in RHEL.  However,
+			waiving any of these items should be used judiciously,
+			as it generally means the system might end up being
+			considered insecure or even out-of-scope for support.
+
+			Format: <item-1>,<item-2>...<item-n>
+
+			Use 'rh_waived' to enable all waived features listed at
+			Documentation/admin-guide/rh-waived-features.rst
+
 	ring3mwait=disable
 			[KNL] Disable ring 3 MONITOR/MWAIT feature on supported
 			CPUs.
@@ -8131,6 +8145,15 @@ Kernel parameters
 	unknown_nmi_panic
 			[X86] Cause panic on unknown NMI.
 
+	unprivileged_bpf_disabled=
+			Format: { "0" | "1" | "2" }
+			Sets the initial value of
+			kernel.unprivileged_bpf_disabled sysctl knob.
+			0 - unprivileged bpf() syscall access is enabled.
+			1 - unprivileged bpf() syscall access is disabled permanently.
+			2 - unprivileged bpf() syscall access is disabled.
+			Default value is 2.
+
 	unwind_debug	[X86-64,EARLY]
 			Enable unwinder debug output.  This can be
 			useful for debugging certain unwinder error
diff --git a/Documentation/admin-guide/rh-waived-items.rst b/Documentation/admin-guide/rh-waived-items.rst
new file mode 100644
index 000000000000..7471c891419c
--- /dev/null
+++ b/Documentation/admin-guide/rh-waived-items.rst
@@ -0,0 +1,29 @@
+.. _rh_waived_items:
+
+====================
+Red Hat Waived Items
+====================
+
+Waived Items is a mechanism offered by Red Hat which allows customers to "waive"
+and utilize features that are not enabled by default as these are considered as
+unmaintained, insecure, rudimentary, or deprecated, but are shipped with the
+RHEL kernel for customer's convinience only.
+Waived Items can range from features that can be enabled on demand to specific
+security mitigations that can be disabled on demand.
+
+To explicitly "waive" any of these items, RHEL offers the ``rh_waived``
+kernel boot parameter. To allow set of waived items, append
+``rh_waived=<item name>,...,<item name>`` to the kernel
+cmdline.
+Appending ``rh_waived=features`` will waive all features listed below,
+and appending ``rh_waived=cves`` will waive all security mitigations
+listed below.
+
+The waived items listed in the next session follow the pattern below:
+
+- item name
+        item description
+
+List of Red Hat Waived Items
+============================
+
diff --git a/Kconfig b/Kconfig
index 307e581144de..11e93e479ce4 100644
--- a/Kconfig
+++ b/Kconfig
@@ -32,3 +32,5 @@ source "lib/Kconfig.debug"
 source "Documentation/Kconfig"
 
 source "io_uring/Kconfig"
+
+source "Kconfig.redhat"
diff --git a/Kconfig.redhat b/Kconfig.redhat
new file mode 100644
index 000000000000..85771d74c34f
--- /dev/null
+++ b/Kconfig.redhat
@@ -0,0 +1,31 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Red Hat specific options
+#
+
+menu "Red Hat options"
+
+config RHEL_DIFFERENCES
+	bool "Enable RHEL-only code"
+	help
+	  This option controls whether rhel-only changes are enabled during
+	  the build. Unless you want to enable rhel-only changes, say N here.
+
+config RH_KABI_SIZE_ALIGN_CHECKS
+	bool "Enables more stringent kabi checks in the macros"
+	depends on RHEL_DIFFERENCES
+	default y
+	help
+	  This option enables more stringent kabi checks. Those must
+	  be disabled in case of a debug build, because debug builds
+	  allow to change struct sizes.
+
+config RH_AUTOMOTIVE
+	bool "Enable automotive only code"
+	depends on RHEL_DIFFERENCES
+	default n
+	help
+	  This option controls whether code is included in the automotive
+	  kernel build. If you are building an automotive kernel, say Y.
+
+endmenu
diff --git a/Makefile b/Makefile
index 66654fa71655..c695c48745a0 100644
--- a/Makefile
+++ b/Makefile
@@ -358,6 +358,17 @@ ifneq ($(filter install,$(MAKECMDGOALS)),)
     endif
 endif
 
+# CKI/cross compilation hack
+# Do we need to rebuild scripts after cross compilation?
+# If kernel was cross-compiled, these scripts have arch of build host.
+REBUILD_SCRIPTS_FOR_CROSS:=0
+
+# Regenerating config with incomplete source tree will produce different
+# config options. Disable it.
+ifeq ($(REBUILD_SCRIPTS_FOR_CROSS),1)
+may-sync-config:=
+endif
+
 ifdef mixed-build
 # ===========================================================================
 # We're called with mixed targets (*config and build targets).
@@ -1449,6 +1460,8 @@ uapi-asm-generic:
 # Generate some files
 # ---------------------------------------------------------------------------
 
+include $(srctree)/Makefile.rhelver
+
 # KERNELRELEASE can change from a few different places, meaning version.h
 # needs to be updated, so this check is forced on all builds
 
@@ -1473,7 +1486,13 @@ define filechk_version.h
 	((c) > 255 ? 255 : (c)))';                                       \
 	echo \#define LINUX_VERSION_MAJOR $(VERSION);                    \
 	echo \#define LINUX_VERSION_PATCHLEVEL $(PATCHLEVEL);            \
-	echo \#define LINUX_VERSION_SUBLEVEL $(SUBLEVEL)
+	echo \#define LINUX_VERSION_SUBLEVEL $(SUBLEVEL);                \
+	echo '#define RHEL_MAJOR $(RHEL_MAJOR)'; \
+	echo '#define RHEL_MINOR $(RHEL_MINOR)'; \
+	echo '#define RHEL_RELEASE_VERSION(a,b) (((a) << 8) + (b))'; \
+	echo '#define RHEL_RELEASE_CODE \
+		$(shell expr $(RHEL_MAJOR) \* 256 + $(RHEL_MINOR))'; \
+	echo '#define RHEL_RELEASE "$(RHEL_RELEASE)"'
 endef
 
 $(version_h): private PATCHLEVEL := $(or $(PATCHLEVEL), 0)
@@ -2150,6 +2169,23 @@ endif
 
 ifdef CONFIG_MODULES
 
+scripts_build:
+	$(MAKE) $(build)=scripts/basic
+	$(MAKE) $(build)=scripts/mod
+	$(MAKE) $(build)=scripts scripts/module.lds
+	$(MAKE) $(build)=scripts scripts/unifdef
+	$(MAKE) $(build)=scripts
+
+prepare_after_cross:
+	# disable STACK_VALIDATION to avoid building objtool
+	sed -i '/^CONFIG_STACK_VALIDATION/d' ./include/config/auto.conf || true
+	# build minimum set of scripts and resolve_btfids to allow building
+	# external modules
+	$(MAKE) KBUILD_EXTMOD="" M="" scripts_build V=1
+	$(MAKE) -C tools/bpf/resolve_btfids
+
+PHONY += prepare_after_cross scripts_build
+
 modules.order: $(build-dir)
 	@:
 
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index ffbc7f386131..abff04320b4e 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1227,9 +1227,9 @@ config HIGHMEM
 	  If unsure, say n.
 
 config HIGHPTE
-	bool "Allocate 2nd-level pagetables from highmem" if EXPERT
+	bool "Allocate 2nd-level pagetables from highmem"
 	depends on HIGHMEM && !PREEMPT_RT
-	default y
+	default n
 	help
 	  The VM uses one page of physical memory for each page table.
 	  For systems with a lot of processes, this can use a lot of
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index b5a51b0ef944..68c30096c205 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1543,7 +1543,7 @@ endchoice
 
 config ARM64_FORCE_52BIT
 	bool "Force 52-bit virtual addresses for userspace"
-	depends on ARM64_VA_BITS_52 && EXPERT
+	depends on ARM64_VA_BITS_52
 	help
 	  For systems with 52-bit userspace VAs enabled, the kernel will attempt
 	  to maintain compatibility with older software by providing 48-bit VAs
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index 29c6100f0c50..fecb897b1457 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -32,6 +32,8 @@
 #include <linux/sched/task.h>
 #include <linux/scs.h>
 #include <linux/mm.h>
+#include <linux/security.h>
+#include <linux/libfdt.h>
 
 #include <asm/acpi.h>
 #include <asm/fixmap.h>
@@ -207,6 +209,24 @@ static void __init setup_machine_fdt(phys_addr_t dt_phys)
 	dump_stack_set_arch_desc("%s (DT)", name);
 }
 
+static void __init init_secureboot_mode(void)
+{
+	void *fdt = initial_boot_params;
+	u64 chosen;
+	const __be32 *prop;
+	int len;
+
+	chosen = fdt_path_offset(fdt, "/chosen");
+	if (chosen < 0)
+		return;
+
+	prop = fdt_getprop(fdt, chosen, "secure-boot-mode", &len);
+	if (!prop || len != sizeof(u32))
+		return;
+
+	efi_set_secure_boot((enum efi_secureboot_mode)fdt32_to_cpu(*prop));
+}
+
 static void __init request_standard_resources(void)
 {
 	struct memblock_region *region;
@@ -327,6 +347,13 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p)
 			pr_warn(FW_BUG "Kernel image misaligned at boot, please fix your bootloader!");
 		WARN_TAINT(mmu_enabled_at_boot, TAINT_FIRMWARE_WORKAROUND,
 			   FW_BUG "Booted with MMU enabled!");
+	} else {
+		init_secureboot_mode();
+
+#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
+		if (efi_enabled(EFI_SECURE_BOOT))
+			security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);
+#endif
 	}
 
 	arm64_memblock_init();
diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h
index b0d00032479d..afb9544fb007 100644
--- a/arch/s390/include/asm/ipl.h
+++ b/arch/s390/include/asm/ipl.h
@@ -139,6 +139,7 @@ int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
 			     unsigned char flags, unsigned short cert);
 int ipl_report_add_certificate(struct ipl_report *report, void *key,
 			       unsigned long addr, unsigned long len);
+bool ipl_get_secureboot(void);
 
 /*
  * DIAG 308 support
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index b1e798f8e1dd..c11298f71f62 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -2551,3 +2551,8 @@ int ipl_report_free(struct ipl_report *report)
 }
 
 #endif
+
+bool ipl_get_secureboot(void)
+{
+	return !!ipl_secure_flag;
+}
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index b60284328fe3..e4d37b08ca29 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -47,6 +47,7 @@
 #include <linux/crash_dump.h>
 #include <linux/memory.h>
 #include <linux/start_kernel.h>
+#include <linux/security.h>
 #include <linux/hugetlb.h>
 #include <linux/kmemleak.h>
 
@@ -917,6 +918,9 @@ void __init setup_arch(char **cmdline_p)
 
 	log_component_list();
 
+	if (ipl_get_secureboot())
+		security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);
+
 	/* Have one command line that is parsed and saved in /proc/cmdline */
 	/* boot_command_line has been already set up in early.c */
 	*cmdline_p = boot_command_line;
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index c7352827f491..09b2c1c67f3a 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1807,6 +1807,7 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
 		get_cpu_vendor(c);
 		intel_unlock_cpuid_leafs(c);
 		get_cpu_cap(c);
+		get_model_name(c); /* RHEL: get model name for unsupported check */
 		setup_force_cpu_cap(X86_FEATURE_CPUID);
 		get_cpu_address_sizes(c);
 		cpu_parse_early_param();
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index cda6adb9f69c..ec8d0bb4351a 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -23,6 +23,7 @@
 #include <linux/pci.h>
 #include <linux/random.h>
 #include <linux/root_dev.h>
+#include <linux/security.h>
 #include <linux/static_call.h>
 #include <linux/sysfb.h>
 #include <linux/swiotlb.h>
@@ -59,6 +60,10 @@
 #include <asm/thermal.h>
 #include <asm/unwind.h>
 #include <asm/vsyscall.h>
+#include <asm/intel-family.h>
+#if defined(CONFIG_X86_LOCAL_APIC)
+#include <asm/nmi.h>
+#endif
 
 /*
  * max_low_pfn_mapped: highest directly mapped pfn < 4 GB
@@ -826,6 +831,79 @@ static void __init early_reserve_memory(void)
 	trim_snb_memory();
 }
 
+#ifdef CONFIG_RHEL_DIFFERENCES
+
+static void rh_check_supported(void)
+{
+	bool guest;
+
+	guest = (x86_hyper_type != X86_HYPER_NATIVE || boot_cpu_has(X86_FEATURE_HYPERVISOR));
+
+	/* RHEL supports single cpu on guests only */
+	if (((topology_num_threads_per_package() * __max_threads_per_core) == 1) &&
+	    !guest && !is_kdump_kernel()) {
+		pr_crit("Detected single cpu native boot.\n");
+		pr_crit("Important:  In this kernel, single threaded, single CPU 64-bit physical systems are unsupported.");
+	}
+
+	/*
+	 * If the RHEL kernel does not support this hardware, the kernel will
+	 * attempt to boot, but no support is provided for this hardware
+	 */
+	switch (boot_cpu_data.x86_vendor) {
+	case X86_VENDOR_AMD:
+	case X86_VENDOR_INTEL:
+		break;
+	default:
+		pr_crit("Detected processor %s %s\n",
+			boot_cpu_data.x86_vendor_id,
+			boot_cpu_data.x86_model_id);
+		break;
+	}
+
+	/*
+	 * Due to the complexity of x86 lapic & ioapic enumeration, and PCI IRQ
+	 * routing, ACPI is required for x86.  acpi=off is a valid debug kernel
+	 * parameter, so just print out a loud warning in case something
+	 * goes wrong (which is most of the time).
+	 */
+	if (acpi_disabled && !guest)
+		pr_crit("ACPI has been disabled or is not available on this hardware.  This may result in a single cpu boot, incorrect PCI IRQ routing, or boot failure.\n");
+
+	/*
+	 * x86_64 microarchitecture levels:
+	 * 	https://en.wikipedia.org/wiki/X86-64#Microarchitecture_levels
+	 *
+	 * RHEL9 has a minimum of the x86_64-v2 microarchitecture
+	 * RHEL10 has a minimum of the x86_64-v3 microarchitecture
+	 */
+
+	if (!boot_cpu_has(X86_FEATURE_CX16) || /* CMPXCHG16B */
+	    !boot_cpu_has(X86_FEATURE_LAHF_LM) || /* LAHF-SAHF */
+	    !boot_cpu_has(X86_FEATURE_POPCNT) ||
+	    !boot_cpu_has(X86_FEATURE_XMM3) || /* SSE-3 */
+	    !boot_cpu_has(X86_FEATURE_XMM4_1) || /* SSE4_1 */
+	    !boot_cpu_has(X86_FEATURE_XMM4_2) || /* SSE4_2 */
+	    !boot_cpu_has(X86_FEATURE_SSSE3)) {
+		mark_hardware_deprecated("x86_64-v1", "%s:%s",
+					 boot_cpu_data.x86_vendor_id, boot_cpu_data.x86_model_id);
+	} else if (!boot_cpu_has(X86_FEATURE_AVX) ||
+		   !boot_cpu_has(X86_FEATURE_AVX2) ||
+		   !boot_cpu_has(X86_FEATURE_BMI1) ||
+		   !boot_cpu_has(X86_FEATURE_BMI2) ||
+		   !boot_cpu_has(X86_FEATURE_F16C) ||
+		   !boot_cpu_has(X86_FEATURE_FMA) ||
+		   /* LZCNT is not explicitly listed, but appears to be paired with BMI2 */
+		   !boot_cpu_has(X86_FEATURE_MOVBE) ||
+		   !boot_cpu_has(X86_FEATURE_XSAVE)) {
+		mark_hardware_deprecated("x86_64-v2", "%s:%s",
+					 boot_cpu_data.x86_vendor_id, boot_cpu_data.x86_model_id);
+	}
+}
+#else
+#define rh_check_supported()
+#endif
+
 /*
  * Dump out kernel offset information on panic.
  */
@@ -1007,6 +1085,13 @@ void __init setup_arch(char **cmdline_p)
 	if (efi_enabled(EFI_BOOT))
 		efi_init();
 
+	efi_set_secure_boot(boot_params.secure_boot);
+
+#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
+	if (efi_enabled(EFI_SECURE_BOOT))
+		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);
+#endif
+
 	reserve_ibft_region();
 	x86_init.resources.dmi_setup();
 
@@ -1168,19 +1253,7 @@ void __init setup_arch(char **cmdline_p)
 	/* Allocate bigger log buffer */
 	setup_log_buf(1);
 
-	if (efi_enabled(EFI_BOOT)) {
-		switch (boot_params.secure_boot) {
-		case efi_secureboot_mode_disabled:
-			pr_info("Secure boot disabled\n");
-			break;
-		case efi_secureboot_mode_enabled:
-			pr_info("Secure boot enabled\n");
-			break;
-		default:
-			pr_info("Secure boot could not be determined\n");
-			break;
-		}
-	}
+	efi_set_secure_boot(boot_params.secure_boot);
 
 	reserve_initrd();
 
@@ -1287,6 +1360,8 @@ void __init setup_arch(char **cmdline_p)
 		efi_apply_memmap_quirks();
 #endif
 
+	rh_check_supported();
+
 	unwind_init();
 }
 
diff --git a/crypto/akcipher.c b/crypto/akcipher.c
index 630bb19738be..8da7eedce31e 100644
--- a/crypto/akcipher.c
+++ b/crypto/akcipher.c
@@ -138,8 +138,7 @@ int crypto_register_akcipher(struct akcipher_alg *alg)
 
 	if (!alg->encrypt)
 		alg->encrypt = akcipher_default_op;
-	if (!alg->decrypt)
-		alg->decrypt = akcipher_default_op;
+	alg->decrypt = akcipher_default_op;
 	if (!alg->set_priv_key)
 		alg->set_priv_key = akcipher_default_set_key;
 
diff --git a/crypto/dh.c b/crypto/dh.c
index 7ad4768716c8..01ccc24db074 100644
--- a/crypto/dh.c
+++ b/crypto/dh.c
@@ -227,10 +227,35 @@ static int dh_compute_value(struct kpp_request *req)
 
 		/* SP800-56A rev 3 5.6.2.1.3 key check */
 		} else {
+			MPI val_pct;
+
 			if (dh_is_pubkey_valid(ctx, val)) {
 				ret = -EAGAIN;
 				goto err_free_val;
 			}
+
+			/*
+			 * SP800-56Arev3, 5.6.2.1.4: ("Owner Assurance
+			 * of Pair-wise Consistency"): recompute the
+			 * public key and check if the results match.
+			 */
+			val_pct = mpi_alloc(0);
+			if (!val_pct) {
+				ret = -ENOMEM;
+				goto err_free_val;
+			}
+
+			ret = _compute_val(ctx, base, val_pct);
+			if (ret) {
+				mpi_free(val_pct);
+				goto err_free_val;
+			}
+
+			if (mpi_cmp(val, val_pct) != 0) {
+				fips_fail_notify();
+				panic("dh: pair-wise consistency test failed\n");
+			}
+			mpi_free(val_pct);
 		}
 	}
 
diff --git a/crypto/seqiv.c b/crypto/seqiv.c
index 678bb4145d78..fcc059e7d3db 100644
--- a/crypto/seqiv.c
+++ b/crypto/seqiv.c
@@ -123,6 +123,19 @@ static int seqiv_aead_decrypt(struct aead_request *req)
 	return crypto_aead_decrypt(subreq);
 }
 
+static int aead_init_seqiv(struct crypto_aead *aead)
+{
+	int err;
+
+	err = aead_init_geniv(aead);
+	if (err)
+		return err;
+
+	crypto_aead_set_flags(aead, CRYPTO_TFM_FIPS_COMPLIANCE);
+
+	return 0;
+}
+
 static int seqiv_aead_create(struct crypto_template *tmpl, struct rtattr **tb)
 {
 	struct aead_instance *inst;
@@ -140,7 +153,7 @@ static int seqiv_aead_create(struct crypto_template *tmpl, struct rtattr **tb)
 	inst->alg.encrypt = seqiv_aead_encrypt;
 	inst->alg.decrypt = seqiv_aead_decrypt;
 
-	inst->alg.init = aead_init_geniv;
+	inst->alg.init = aead_init_seqiv;
 	inst->alg.exit = aead_exit_geniv;
 
 	inst->alg.base.cra_ctxsize = sizeof(struct aead_geniv_ctx);
diff --git a/crypto/sig.c b/crypto/sig.c
index 7d2048da5c3a..6b4e2163fcc5 100644
--- a/crypto/sig.c
+++ b/crypto/sig.c
@@ -112,8 +112,7 @@ static int sig_prepare_alg(struct sig_alg *alg)
 {
 	struct crypto_alg *base = &alg->base;
 
-	if (!alg->sign)
-		alg->sign = sig_default_sign;
+	alg->sign = sig_default_sign;
 	if (!alg->verify)
 		alg->verify = sig_default_verify;
 	if (!alg->set_priv_key)
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 4958211fbfa9..ee6d34885696 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -3831,7 +3831,7 @@ static int test_akcipher_one(struct crypto_akcipher *tfm,
 	 * Don't invoke decrypt test which requires a private key
 	 * for vectors with only a public key.
 	 */
-	if (vecs->public_key_vec) {
+	if (1 || vecs->public_key_vec) {
 		err = 0;
 		goto free_all;
 	}
@@ -3967,7 +3967,7 @@ static int test_sig_one(struct crypto_sig *tfm, const struct sig_testvec *vecs)
 	 * Don't invoke sign test (which requires a private key)
 	 * for vectors with only a public key.
 	 */
-	if (vecs->public_key_vec)
+	if (1 || vecs->public_key_vec)
 		return 0;
 
 	sig_size = crypto_sig_maxsize(tfm);
@@ -4790,14 +4790,12 @@ static const struct alg_test_desc alg_test_descs[] = {
 	}, {
 		.alg = "ecdh-nist-p256",
 		.test = alg_test_kpp,
-		.fips_allowed = 1,
 		.suite = {
 			.kpp = __VECS(ecdh_p256_tv_template)
 		}
 	}, {
 		.alg = "ecdh-nist-p384",
 		.test = alg_test_kpp,
-		.fips_allowed = 1,
 		.suite = {
 			.kpp = __VECS(ecdh_p384_tv_template)
 		}
diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
index 20d757687e3d..90a13f20f052 100644
--- a/drivers/acpi/apei/hest.c
+++ b/drivers/acpi/apei/hest.c
@@ -142,6 +142,14 @@ static int apei_hest_parse(apei_hest_func_t func, void *data)
 	if (hest_disable || !hest_tab)
 		return -EINVAL;
 
+#ifdef CONFIG_ARM64
+	/* Ignore broken firmware */
+	if (!strncmp(hest_tab->header.oem_id, "HPE   ", 6) &&
+	    !strncmp(hest_tab->header.oem_table_id, "ProLiant", 8) &&
+	    MIDR_IMPLEMENTOR(read_cpuid_id()) == ARM_CPU_IMP_APM)
+		return -EINVAL;
+#endif
+
 	hest_hdr = (struct acpi_hest_header *)(hest_tab + 1);
 	for (i = 0; i < hest_tab->error_source_count; i++) {
 		len = hest_esrc_len(hest_hdr);
diff --git a/drivers/acpi/irq.c b/drivers/acpi/irq.c
index a670722ddd5a..748d1250a852 100644
--- a/drivers/acpi/irq.c
+++ b/drivers/acpi/irq.c
@@ -144,6 +144,7 @@ struct acpi_irq_parse_one_ctx {
 	unsigned int index;
 	unsigned long *res_flags;
 	struct irq_fwspec *fwspec;
+	bool skip_producer_check;
 };
 
 /**
@@ -217,7 +218,8 @@ static acpi_status acpi_irq_parse_one_cb(struct acpi_resource *ares,
 		return AE_CTRL_TERMINATE;
 	case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
 		eirq = &ares->data.extended_irq;
-		if (eirq->producer_consumer == ACPI_PRODUCER)
+		if (!ctx->skip_producer_check &&
+		    eirq->producer_consumer == ACPI_PRODUCER)
 			return AE_OK;
 		if (ctx->index >= eirq->interrupt_count) {
 			ctx->index -= eirq->interrupt_count;
@@ -253,8 +255,19 @@ static acpi_status acpi_irq_parse_one_cb(struct acpi_resource *ares,
 static int acpi_irq_parse_one(acpi_handle handle, unsigned int index,
 			      struct irq_fwspec *fwspec, unsigned long *flags)
 {
-	struct acpi_irq_parse_one_ctx ctx = { -EINVAL, index, flags, fwspec };
+	struct acpi_irq_parse_one_ctx ctx = { -EINVAL, index, flags, fwspec, false };
 
+	/*
+	 * Firmware on arm64-based HPE m400 platform incorrectly marks
+	 * its UART interrupt as ACPI_PRODUCER rather than ACPI_CONSUMER.
+	 * Don't do the producer/consumer check for that device.
+	 */
+	if (IS_ENABLED(CONFIG_ARM64)) {
+		struct acpi_device *adev = acpi_get_acpi_dev(handle);
+
+		if (adev && !strcmp(acpi_device_hid(adev), "APMC0D08"))
+			ctx.skip_producer_check = true;
+	}
 	acpi_walk_resources(handle, METHOD_NAME__CRS, acpi_irq_parse_one_cb, &ctx);
 	return ctx.rc;
 }
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 163a3cccf197..cce23a1b5d71 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1796,6 +1796,15 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device)
 	if (!acpi_match_device_ids(device, ignore_serial_bus_ids))
 		return false;
 
+	/*
+	 * Firmware on some arm64 X-Gene platforms will make the UART
+	 * device appear as both a UART and a slave of that UART. Just
+	 * bail out here for X-Gene UARTs.
+	 */
+	if (IS_ENABLED(CONFIG_ARM64) &&
+	    !strcmp(acpi_device_hid(device), "APMC0D08"))
+		return false;
+
 	INIT_LIST_HEAD(&resource_list);
 	acpi_dev_get_resources(device, &resource_list,
 			       acpi_check_serial_bus_slave,
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 6d72eb017b49..0a6701eb8d37 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -727,6 +727,24 @@ int ahci_stop_engine(struct ata_port *ap)
 	tmp &= ~PORT_CMD_START;
 	writel(tmp, port_mmio + PORT_CMD);
 
+#ifdef CONFIG_ARM64
+	/* Rev Ax of Cavium CN99XX needs a hack for port stop */
+	if (dev_is_pci(ap->host->dev) &&
+	    to_pci_dev(ap->host->dev)->vendor == 0x14e4 &&
+	    to_pci_dev(ap->host->dev)->device == 0x9027 &&
+	    midr_is_cpu_model_range(read_cpuid_id(),
+			MIDR_CPU_MODEL(ARM_CPU_IMP_BRCM, BRCM_CPU_PART_VULCAN),
+			MIDR_CPU_VAR_REV(0, 0),
+			MIDR_CPU_VAR_REV(0, MIDR_REVISION_MASK))) {
+		tmp = readl(hpriv->mmio + 0x8000);
+		udelay(100);
+		writel(tmp | (1 << 26), hpriv->mmio + 0x8000);
+		udelay(100);
+		writel(tmp & ~(1 << 26), hpriv->mmio + 0x8000);
+		dev_warn(ap->host->dev, "CN99XX SATA reset workaround applied\n");
+	}
+#endif
+
 	/* wait for engine to stop. This could be as long as 500 msec */
 	tmp = ata_wait_register(ap, port_mmio + PORT_CMD,
 				PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500);
diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c
index 505e32911c34..26f7ee0ccf40 100644
--- a/drivers/char/ipmi/ipmi_dmi.c
+++ b/drivers/char/ipmi/ipmi_dmi.c
@@ -215,6 +215,21 @@ static int __init scan_for_dmi_ipmi(void)
 {
 	const struct dmi_device *dev = NULL;
 
+#ifdef CONFIG_ARM64
+	/* RHEL-only
+	 * If this is ARM-based HPE m400, return now, because that platform
+	 * reports the host-side ipmi address as intel port-io space, which
+	 * does not exist in the ARM architecture.
+	 */
+	const char *dmistr = dmi_get_system_info(DMI_PRODUCT_NAME);
+
+	if (dmistr && (strcmp("ProLiant m400 Server", dmistr) == 0)) {
+		pr_debug("%s does not support host ipmi\n", dmistr);
+		return 0;
+	}
+	/* END RHEL-only */
+#endif
+
 	while ((dev = dmi_find_device(DMI_DEV_TYPE_IPMI, NULL, dev)))
 		dmi_decode_ipmi((const struct dmi_header *) dev->device_data);
 
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 152dd6b5bb27..e1ceb726eb51 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -34,6 +34,7 @@
 #include <linux/uuid.h>
 #include <linux/nospec.h>
 #include <linux/vmalloc.h>
+#include <linux/dmi.h>
 #include <linux/delay.h>
 
 #define IPMI_DRIVER_VERSION "39.2"
@@ -5648,8 +5649,21 @@ static int __init ipmi_init_msghandler_mod(void)
 {
 	int rv;
 
-	pr_info("version " IPMI_DRIVER_VERSION "\n");
+#ifdef CONFIG_ARM64
+	/* RHEL-only
+	 * If this is ARM-based HPE m400, return now, because that platform
+	 * reports the host-side ipmi address as intel port-io space, which
+	 * does not exist in the ARM architecture.
+	 */
+	const char *dmistr = dmi_get_system_info(DMI_PRODUCT_NAME);
 
+	if (dmistr && (strcmp("ProLiant m400 Server", dmistr) == 0)) {
+		pr_debug("%s does not support host ipmi\n", dmistr);
+		return -ENOSYS;
+	}
+	/* END RHEL-only */
+#endif
+	pr_info("version " IPMI_DRIVER_VERSION "\n");
 	mutex_lock(&ipmi_interfaces_mutex);
 	rv = ipmi_register_driver();
 	mutex_unlock(&ipmi_interfaces_mutex);
diff --git a/drivers/char/random.c b/drivers/char/random.c
index b4da1fb976c1..7ff4dd4d9836 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -51,9 +51,11 @@
 #include <linux/completion.h>
 #include <linux/uuid.h>
 #include <linux/uaccess.h>
+#include <linux/rcupdate.h>
 #include <linux/suspend.h>
 #include <linux/siphash.h>
 #include <linux/sched/isolation.h>
+#include <linux/fips.h>
 #include <crypto/chacha.h>
 #include <crypto/blake2s.h>
 #include <vdso/datapage.h>
@@ -320,6 +322,11 @@ static void crng_fast_key_erasure(u8 key[CHACHA_KEY_SIZE],
 	memzero_explicit(first_block, sizeof(first_block));
 }
 
+/*
+ * Hook for external RNG.
+ */
+static const struct random_extrng __rcu *extrng;
+
 /*
  * This function returns a ChaCha state that you may use for generating
  * random data. It also returns up to 32 bytes on its own of random data
@@ -732,7 +739,8 @@ static void __cold _credit_init_bits(size_t bits)
 			queue_work(system_dfl_wq, &set_ready);
 		atomic_notifier_call_chain(&random_ready_notifier, 0, NULL);
 		if (IS_ENABLED(CONFIG_VDSO_GETRANDOM))
-			WRITE_ONCE(vdso_k_rng_data->is_ready, true);
+			if (!fips_enabled)
+				WRITE_ONCE(vdso_k_rng_data->is_ready, true);
 		wake_up_interruptible(&crng_init_wait);
 		kill_fasync(&fasync, SIGIO, POLL_IN);
 		pr_notice("crng init done\n");
@@ -751,6 +759,9 @@ static void __cold _credit_init_bits(size_t bits)
 }
 
 
+static const struct file_operations extrng_random_fops;
+static const struct file_operations extrng_urandom_fops;
+
 /**********************************************************************
  *
  * Entropy collection routines.
@@ -967,6 +978,19 @@ void __init add_bootloader_randomness(const void *buf, size_t len)
 		credit_init_bits(len * 8);
 }
 
+void random_register_extrng(const struct random_extrng *rng)
+{
+	rcu_assign_pointer(extrng, rng);
+}
+EXPORT_SYMBOL_GPL(random_register_extrng);
+
+void random_unregister_extrng(void)
+{
+	RCU_INIT_POINTER(extrng, NULL);
+	synchronize_rcu();
+}
+EXPORT_SYMBOL_GPL(random_unregister_extrng);
+
 #if IS_ENABLED(CONFIG_VMGENID)
 static BLOCKING_NOTIFIER_HEAD(vmfork_chain);
 
@@ -1381,6 +1405,7 @@ SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags
 {
 	struct iov_iter iter;
 	int ret;
+	const struct random_extrng *rng;
 
 	if (flags & ~(GRND_NONBLOCK | GRND_RANDOM | GRND_INSECURE))
 		return -EINVAL;
@@ -1392,6 +1417,23 @@ SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags
 	if ((flags & (GRND_INSECURE | GRND_RANDOM)) == (GRND_INSECURE | GRND_RANDOM))
 		return -EINVAL;
 
+	rcu_read_lock();
+	rng = rcu_dereference(extrng);
+	if (rng && !try_module_get(rng->owner))
+		rng = NULL;
+	rcu_read_unlock();
+
+	if (rng) {
+		ret = import_ubuf(ITER_DEST, ubuf, len, &iter);
+		if (unlikely(ret)) {
+			module_put(rng->owner);
+			return ret;
+		}
+		ret = rng->extrng_read_iter(&iter, !!(flags & GRND_RANDOM));
+		module_put(rng->owner);
+		return ret;
+	}
+
 	if (!crng_ready() && !(flags & GRND_INSECURE)) {
 		if (flags & GRND_NONBLOCK)
 			return -EAGAIN;
@@ -1412,6 +1454,12 @@ static __poll_t random_poll(struct file *file, poll_table *wait)
 	return crng_ready() ? EPOLLIN | EPOLLRDNORM : EPOLLOUT | EPOLLWRNORM;
 }
 
+static __poll_t extrng_poll(struct file *file, poll_table * wait)
+{
+	/* extrng pool is always full, always read, no writes */
+	return EPOLLIN | EPOLLRDNORM;
+}
+
 static ssize_t write_pool_user(struct iov_iter *iter)
 {
 	u8 block[BLAKE2S_BLOCK_SIZE];
@@ -1552,7 +1600,58 @@ static int random_fasync(int fd, struct file *filp, int on)
 	return fasync_helper(fd, filp, on, &fasync);
 }
 
+static int random_open(struct inode *inode, struct file *filp)
+{
+	const struct random_extrng *rng;
+
+	rcu_read_lock();
+	rng = rcu_dereference(extrng);
+	if (rng && !try_module_get(rng->owner))
+		rng = NULL;
+	rcu_read_unlock();
+
+	if (!rng)
+		return 0;
+
+	filp->f_op = &extrng_random_fops;
+	filp->private_data = rng->owner;
+
+	return 0;
+}
+
+static int urandom_open(struct inode *inode, struct file *filp)
+{
+	const struct random_extrng *rng;
+
+	rcu_read_lock();
+	rng = rcu_dereference(extrng);
+	if (rng && !try_module_get(rng->owner))
+		rng = NULL;
+	rcu_read_unlock();
+
+	if (!rng)
+		return 0;
+
+	filp->f_op = &extrng_urandom_fops;
+	filp->private_data = rng->owner;
+
+	return 0;
+}
+
+static int extrng_release(struct inode *inode, struct file *filp)
+{
+	module_put(filp->private_data);
+	return 0;
+}
+
+static ssize_t
+extrng_read_iter(struct kiocb *kiocb, struct iov_iter *iter)
+{
+	return rcu_dereference_raw(extrng)->extrng_read_iter(iter, false);
+}
+
 const struct file_operations random_fops = {
+	.open  = random_open,
 	.read_iter = random_read_iter,
 	.write_iter = random_write_iter,
 	.poll = random_poll,
@@ -1565,6 +1664,7 @@ const struct file_operations random_fops = {
 };
 
 const struct file_operations urandom_fops = {
+	.open  = urandom_open,
 	.read_iter = urandom_read_iter,
 	.write_iter = random_write_iter,
 	.unlocked_ioctl = random_ioctl,
@@ -1575,6 +1675,32 @@ const struct file_operations urandom_fops = {
 	.splice_write = iter_file_splice_write,
 };
 
+static const struct file_operations extrng_random_fops = {
+	.open  = random_open,
+	.read_iter  = extrng_read_iter,
+	.write_iter = random_write_iter,
+	.poll  = extrng_poll,
+	.unlocked_ioctl = random_ioctl,
+	.compat_ioctl = compat_ptr_ioctl,
+	.fasync = random_fasync,
+	.llseek = noop_llseek,
+	.release = extrng_release,
+	.splice_read = copy_splice_read,
+	.splice_write = iter_file_splice_write,
+};
+
+static const struct file_operations extrng_urandom_fops = {
+	.open  = urandom_open,
+	.read_iter  = extrng_read_iter,
+	.write_iter = random_write_iter,
+	.unlocked_ioctl = random_ioctl,
+	.compat_ioctl = compat_ptr_ioctl,
+	.fasync = random_fasync,
+	.llseek = noop_llseek,
+	.release = extrng_release,
+	.splice_read = copy_splice_read,
+	.splice_write = iter_file_splice_write,
+};
 
 /********************************************************************
  *
diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile
index 8efbcf699e4f..96d5a1ca981d 100644
--- a/drivers/firmware/efi/Makefile
+++ b/drivers/firmware/efi/Makefile
@@ -25,6 +25,7 @@ subdir-$(CONFIG_EFI_STUB)		+= libstub
 obj-$(CONFIG_EFI_BOOTLOADER_CONTROL)	+= efibc.o
 obj-$(CONFIG_EFI_TEST)			+= test/
 obj-$(CONFIG_EFI_DEV_PATH_PARSER)	+= dev-path-parser.o
+obj-$(CONFIG_EFI)			+= secureboot.o
 obj-$(CONFIG_APPLE_PROPERTIES)		+= apple-properties.o
 obj-$(CONFIG_EFI_RCI2_TABLE)		+= rci2-table.o
 obj-$(CONFIG_EFI_EMBEDDED_FIRMWARE)	+= embedded-firmware.o
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 0327a39d31fa..5b5332b4de78 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -33,6 +33,7 @@
 #include <linux/memblock.h>
 #include <linux/security.h>
 #include <linux/notifier.h>
+#include <linux/bsearch.h>
 
 #include <asm/early_ioremap.h>
 
@@ -1017,40 +1018,101 @@ int efi_mem_type(unsigned long phys_addr)
 	return md.type;
 }
 
+struct efi_error_code {
+	efi_status_t status;
+	int errno;
+	const char *description;
+};
+
+static const struct efi_error_code efi_error_codes[] = {
+	{ EFI_SUCCESS, 0, "Success"},
+#if 0
+	{ EFI_LOAD_ERROR, -EPICK_AN_ERRNO, "Load Error"},
+#endif
+	{ EFI_INVALID_PARAMETER, -EINVAL, "Invalid Parameter"},
+	{ EFI_UNSUPPORTED, -ENOSYS, "Unsupported"},
+	{ EFI_BAD_BUFFER_SIZE, -ENOSPC, "Bad Buffer Size"},
+	{ EFI_BUFFER_TOO_SMALL, -ENOSPC, "Buffer Too Small"},
+	{ EFI_NOT_READY, -EAGAIN, "Not Ready"},
+	{ EFI_DEVICE_ERROR, -EIO, "Device Error"},
+	{ EFI_WRITE_PROTECTED, -EROFS, "Write Protected"},
+	{ EFI_OUT_OF_RESOURCES, -ENOMEM, "Out of Resources"},
+#if 0
+	{ EFI_VOLUME_CORRUPTED, -EPICK_AN_ERRNO, "Volume Corrupt"},
+	{ EFI_VOLUME_FULL, -EPICK_AN_ERRNO, "Volume Full"},
+	{ EFI_NO_MEDIA, -EPICK_AN_ERRNO, "No Media"},
+	{ EFI_MEDIA_CHANGED, -EPICK_AN_ERRNO, "Media changed"},
+#endif
+	{ EFI_NOT_FOUND, -ENOENT, "Not Found"},
+#if 0
+	{ EFI_ACCESS_DENIED, -EPICK_AN_ERRNO, "Access Denied"},
+	{ EFI_NO_RESPONSE, -EPICK_AN_ERRNO, "No Response"},
+	{ EFI_NO_MAPPING, -EPICK_AN_ERRNO, "No mapping"},
+	{ EFI_TIMEOUT, -EPICK_AN_ERRNO, "Time out"},
+	{ EFI_NOT_STARTED, -EPICK_AN_ERRNO, "Not started"},
+	{ EFI_ALREADY_STARTED, -EPICK_AN_ERRNO, "Already started"},
+#endif
+	{ EFI_ABORTED, -EINTR, "Aborted"},
+#if 0
+	{ EFI_ICMP_ERROR, -EPICK_AN_ERRNO, "ICMP Error"},
+	{ EFI_TFTP_ERROR, -EPICK_AN_ERRNO, "TFTP Error"},
+	{ EFI_PROTOCOL_ERROR, -EPICK_AN_ERRNO, "Protocol Error"},
+	{ EFI_INCOMPATIBLE_VERSION, -EPICK_AN_ERRNO, "Incompatible Version"},
+#endif
+	{ EFI_SECURITY_VIOLATION, -EACCES, "Security Policy Violation"},
+#if 0
+	{ EFI_CRC_ERROR, -EPICK_AN_ERRNO, "CRC Error"},
+	{ EFI_END_OF_MEDIA, -EPICK_AN_ERRNO, "End of Media"},
+	{ EFI_END_OF_FILE, -EPICK_AN_ERRNO, "End of File"},
+	{ EFI_INVALID_LANGUAGE, -EPICK_AN_ERRNO, "Invalid Languages"},
+	{ EFI_COMPROMISED_DATA, -EPICK_AN_ERRNO, "Compromised Data"},
+
+	// warnings
+	{ EFI_WARN_UNKOWN_GLYPH, -EPICK_AN_ERRNO, "Warning Unknown Glyph"},
+	{ EFI_WARN_DELETE_FAILURE, -EPICK_AN_ERRNO, "Warning Delete Failure"},
+	{ EFI_WARN_WRITE_FAILURE, -EPICK_AN_ERRNO, "Warning Write Failure"},
+	{ EFI_WARN_BUFFER_TOO_SMALL, -EPICK_AN_ERRNO, "Warning Buffer Too Small"},
+#endif
+};
+
+static int
+efi_status_cmp_bsearch(const void *key, const void *item)
+{
+	u64 status = (u64)(uintptr_t)key;
+	struct efi_error_code *code = (struct efi_error_code *)item;
+
+	if (status < code->status)
+		return -1;
+	if (status > code->status)
+		return 1;
+	return 0;
+}
+
 int efi_status_to_err(efi_status_t status)
 {
-	int err;
-
-	switch (status) {
-	case EFI_SUCCESS:
-		err = 0;
-		break;
-	case EFI_INVALID_PARAMETER:
-		err = -EINVAL;
-		break;
-	case EFI_OUT_OF_RESOURCES:
-		err = -ENOSPC;
-		break;
-	case EFI_DEVICE_ERROR:
-		err = -EIO;
-		break;
-	case EFI_WRITE_PROTECTED:
-		err = -EROFS;
-		break;
-	case EFI_SECURITY_VIOLATION:
-		err = -EACCES;
-		break;
-	case EFI_NOT_FOUND:
-		err = -ENOENT;
-		break;
-	case EFI_ABORTED:
-		err = -EINTR;
-		break;
-	default:
-		err = -EINVAL;
-	}
+	struct efi_error_code *found;
+	size_t num = sizeof(efi_error_codes) / sizeof(struct efi_error_code);
 
-	return err;
+	found = bsearch((void *)(uintptr_t)status, efi_error_codes,
+			num, sizeof(struct efi_error_code),
+			efi_status_cmp_bsearch);
+	if (!found)
+		return -EINVAL;
+	return found->errno;
+}
+
+const char *
+efi_status_to_str(efi_status_t status)
+{
+	struct efi_error_code *found;
+	size_t num = sizeof(efi_error_codes) / sizeof(struct efi_error_code);
+
+	found = bsearch((void *)(uintptr_t)status, efi_error_codes,
+			num, sizeof(struct efi_error_code),
+			efi_status_cmp_bsearch);
+	if (!found)
+		return "Unknown error code";
+	return found->description;
 }
 EXPORT_SYMBOL_GPL(efi_status_to_err);
 
diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
index 23b3543d3041..0d08a549a10b 100644
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -132,6 +132,11 @@ static efi_status_t update_fdt(void *orig_fdt, unsigned long orig_fdt_size,
 		}
 	}
 
+	fdt_val32 = cpu_to_fdt32((u32)efi_get_secureboot());
+	status = fdt_setprop_var(fdt, node, "secure-boot-mode", fdt_val32);
+	if (status)
+		goto fdt_set_fail;
+
 	/* Shrink the FDT back to its minimum size: */
 	fdt_pack(fdt);
 
diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
index 516f4f0069bd..380354755108 100644
--- a/drivers/firmware/efi/libstub/secureboot.c
+++ b/drivers/firmware/efi/libstub/secureboot.c
@@ -29,10 +29,13 @@ enum efi_secureboot_mode efi_get_secureboot(void)
 {
 	u32 attr;
 	unsigned long size;
-	enum efi_secureboot_mode mode;
+	static enum efi_secureboot_mode mode;
 	efi_status_t status;
 	u8 moksbstate;
 
+	if (mode != efi_secureboot_mode_unset)
+		return mode;
+
 	mode = efi_get_secureboot_mode(get_var);
 	if (mode == efi_secureboot_mode_unknown) {
 		efi_err("Could not determine UEFI Secure Boot status.\n");
@@ -53,10 +56,13 @@ enum efi_secureboot_mode efi_get_secureboot(void)
 	/* If it fails, we don't care why. Default to secure */
 	if (status != EFI_SUCCESS)
 		goto secure_boot_enabled;
-	if (!(attr & EFI_VARIABLE_NON_VOLATILE) && moksbstate == 1)
-		return efi_secureboot_mode_disabled;
+	if (!(attr & EFI_VARIABLE_NON_VOLATILE) && moksbstate == 1) {
+		mode = efi_secureboot_mode_disabled;
+		return mode;
+	}
 
 secure_boot_enabled:
 	efi_info("UEFI Secure Boot is enabled.\n");
-	return efi_secureboot_mode_enabled;
+	mode = efi_secureboot_mode_enabled;
+	return mode;
 }
diff --git a/drivers/firmware/efi/secureboot.c b/drivers/firmware/efi/secureboot.c
new file mode 100644
index 000000000000..de0a3714a5d4
--- /dev/null
+++ b/drivers/firmware/efi/secureboot.c
@@ -0,0 +1,38 @@
+/* Core kernel secure boot support.
+ *
+ * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/efi.h>
+#include <linux/kernel.h>
+#include <linux/printk.h>
+
+/*
+ * Decide what to do when UEFI secure boot mode is enabled.
+ */
+void __init efi_set_secure_boot(enum efi_secureboot_mode mode)
+{
+	if (efi_enabled(EFI_BOOT)) {
+		switch (mode) {
+		case efi_secureboot_mode_disabled:
+			pr_info("Secure boot disabled\n");
+			break;
+		case efi_secureboot_mode_enabled:
+			set_bit(EFI_SECURE_BOOT, &efi.flags);
+			pr_info("Secure boot enabled\n");
+			break;
+		default:
+			pr_warn("Secure boot could not be determined (mode %u)\n",
+				   mode);
+			break;
+		}
+	}
+}
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 2247ad55d444..5f9da88479e8 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -12,6 +12,7 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/device.h>
+#include <linux/dmi.h>
 #include <linux/io.h>
 #include <linux/err.h>
 #include <linux/fs.h>
@@ -2458,6 +2459,16 @@ static const struct amba_id etm4_ids[] = {
 	{},
 };
 
+static const struct dmi_system_id broken_coresight[] = {
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "HPE"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Apollo 70"),
+		},
+	},
+	{ }	/* terminating entry */
+};
+
 MODULE_DEVICE_TABLE(amba, etm4_ids);
 
 static struct amba_driver etm4x_amba_driver = {
@@ -2532,6 +2543,11 @@ static int __init etm4x_init(void)
 {
 	int ret;
 
+	if (dmi_check_system(broken_coresight)) {
+		pr_info("ETM4 disabled due to firmware bug\n");
+		return 0;
+	}
+
 	ret = etm4_pm_setup();
 
 	/* etm4_pm_setup() does its own cleanup - exit on error */
@@ -2558,6 +2574,9 @@ static int __init etm4x_init(void)
 
 static void __exit etm4x_exit(void)
 {
+	if (dmi_check_system(broken_coresight))
+		return;
+
 	amba_driver_unregister(&etm4x_amba_driver);
 	platform_driver_unregister(&etm4_platform_driver);
 	etm4_pm_clear();
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index cd1bca7ede9a..821027f45794 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -8,6 +8,7 @@
 
 #include <linux/amba/bus.h>
 #include <linux/device.h>
+#include <linux/dmi.h>
 #include <linux/kernel.h>
 #include <linux/bits.h>
 #include <linux/bug.h>
@@ -3135,6 +3136,27 @@ int iommu_fwspec_add_ids(struct device *dev, const u32 *ids, int num_ids)
 }
 EXPORT_SYMBOL_GPL(iommu_fwspec_add_ids);
 
+#ifdef CONFIG_ARM64
+static int __init iommu_quirks(void)
+{
+	const char *vendor, *name;
+
+	vendor = dmi_get_system_info(DMI_SYS_VENDOR);
+	name = dmi_get_system_info(DMI_PRODUCT_NAME);
+
+	if (vendor &&
+	    (strncmp(vendor, "GIGABYTE", 8) == 0 && name &&
+	     (strncmp(name, "R120", 4) == 0 ||
+	      strncmp(name, "R270", 4) == 0))) {
+		pr_warn("Gigabyte %s detected, force iommu passthrough mode", name);
+		iommu_def_domain_type = IOMMU_DOMAIN_IDENTITY;
+	}
+
+	return 0;
+}
+arch_initcall(iommu_quirks);
+#endif
+
 /**
  * iommu_setup_default_domain - Set the default_domain for the group
  * @group: Group to change
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index c362f09a8c55..bcda62d89ecd 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -5377,6 +5377,10 @@ static void mptsas_remove(struct pci_dev *pdev)
 }
 
 static const struct pci_device_id mptsas_pci_table[] = {
+#ifdef CONFIG_RHEL_DIFFERENCES
+	{ PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_SAS1068,
+		PCI_VENDOR_ID_VMWARE, PCI_ANY_ID },
+#else
 	{ PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_SAS1064,
 		PCI_ANY_ID, PCI_ANY_ID },
 	{ PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_SAS1068,
@@ -5389,6 +5393,7 @@ static const struct pci_device_id mptsas_pci_table[] = {
 		PCI_ANY_ID, PCI_ANY_ID },
 	{ PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_SAS1068_820XELP,
 		PCI_ANY_ID, PCI_ANY_ID },
+#endif
 	{0}	/* Terminating entry */
 };
 MODULE_DEVICE_TABLE(pci, mptsas_pci_table);
diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c
index 56892b1f3de2..b0e55913bb2e 100644
--- a/drivers/message/fusion/mptspi.c
+++ b/drivers/message/fusion/mptspi.c
@@ -1240,12 +1240,17 @@ static struct spi_function_template mptspi_transport_functions = {
  */
 
 static const struct pci_device_id mptspi_pci_table[] = {
+#ifdef CONFIG_RHEL_DIFFERENCES
+	{ PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_53C1030,
+	PCI_VENDOR_ID_VMWARE, PCI_ANY_ID },
+#else
 	{ PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_53C1030,
 		PCI_ANY_ID, PCI_ANY_ID },
 	{ PCI_VENDOR_ID_ATTO, MPI_MANUFACTPAGE_DEVID_53C1030,
 		PCI_ANY_ID, PCI_ANY_ID },
 	{ PCI_VENDOR_ID_LSI_LOGIC, MPI_MANUFACTPAGE_DEVID_53C1035,
 		PCI_ANY_ID, PCI_ANY_ID },
+#endif
 	{0}	/* Terminating entry */
 };
 MODULE_DEVICE_TABLE(pci, mptspi_pci_table);
diff --git a/drivers/net/wireguard/main.c b/drivers/net/wireguard/main.c
index a00671b58701..eeef2766b8b3 100644
--- a/drivers/net/wireguard/main.c
+++ b/drivers/net/wireguard/main.c
@@ -12,6 +12,7 @@
 
 #include <uapi/linux/wireguard.h>
 
+#include <linux/fips.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <net/genetlink.h>
@@ -21,6 +22,11 @@ static int __init wg_mod_init(void)
 {
 	int ret;
 
+#ifdef CONFIG_RHEL_DIFFERENCES
+	if (fips_enabled)
+		return -EOPNOTSUPP;
+#endif
+
 	ret = wg_allowedips_slab_init();
 	if (ret < 0)
 		goto err_allowedips;
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index e16aa59dd7ac..5edbf7eb64fc 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -19,6 +19,7 @@
 #include <linux/kexec.h>
 #include <linux/of_device.h>
 #include <linux/acpi.h>
+#include <linux/kernel.h>
 #include <linux/dma-map-ops.h>
 #include <linux/iommu.h>
 #include "pci.h"
@@ -351,7 +352,15 @@ static int local_pci_probe(struct drv_dev_and_id *ddi)
 	 */
 	pm_runtime_get_sync(dev);
 	pci_dev->driver = pci_drv;
+
+#ifdef CONFIG_RHEL_DIFFERENCES
+	rc = -EACCES;
+	if (!pci_rh_check_status(pci_dev))
+		rc = pci_drv->probe(pci_dev, ddi->id);
+#else
 	rc = pci_drv->probe(pci_dev, ddi->id);
+#endif
+
 	if (!rc)
 		return rc;
 	if (rc < 0) {
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index de9bbccda21f..31c0bebf897a 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4499,6 +4499,30 @@ static void quirk_aspeed_pci_bridge_no_alias(struct pci_dev *pdev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASPEED, 0x1150, quirk_aspeed_pci_bridge_no_alias);
 
+/*
+ * PCI BAR 5 is not setup correctly for the on-board AHCI controller
+ * on Broadcom's Vulcan processor. Added a quirk to fix BAR 5 by
+ * using BAR 4's resources which are populated correctly and NOT
+ * actually used by the AHCI controller.
+ */
+static void quirk_fix_vulcan_ahci_bars(struct pci_dev *dev)
+{
+	struct resource *r =  &dev->resource[4];
+
+	if (!(r->flags & IORESOURCE_MEM) || (r->start == 0))
+		return;
+
+	/* Set BAR5 resource to BAR4 */
+	dev->resource[5] = *r;
+
+	/* Update BAR5 in pci config space */
+	pci_write_config_dword(dev, PCI_BASE_ADDRESS_5, r->start);
+
+	/* Clear BAR4's resource */
+	memset(r, 0, sizeof(*r));
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_BROADCOM, 0x9027, quirk_fix_vulcan_ahci_bars);
+
 /*
  * Intersil/Techwell TW686[4589]-based video capture cards have an empty (zero)
  * class code.  Fix it.
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 8edad1830abe..e558acedfa44 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -82,7 +82,9 @@ MODULE_DESCRIPTION("Driver for HP Smart Array Controller version " \
 	HPSA_DRIVER_VERSION);
 MODULE_VERSION(HPSA_DRIVER_VERSION);
 MODULE_LICENSE("GPL");
+#ifndef CONFIG_RHEL_DIFFERENCES
 MODULE_ALIAS("cciss");
+#endif
 
 static int hpsa_simple_mode;
 module_param(hpsa_simple_mode, int, S_IRUGO|S_IWUSR);
@@ -144,10 +146,12 @@ static const struct pci_device_id hpsa_pci_device_id[] = {
 	{PCI_VENDOR_ID_HP_3PAR, 0x0075, 0x1590, 0x007D},
 	{PCI_VENDOR_ID_HP_3PAR, 0x0075, 0x1590, 0x0088},
 	{PCI_VENDOR_ID_HP, 0x333f, 0x103c, 0x333f},
+#ifndef CONFIG_RHEL_DIFFERENCES
 	{PCI_VENDOR_ID_HP,     PCI_ANY_ID,	PCI_ANY_ID, PCI_ANY_ID,
 		PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
 	{PCI_VENDOR_ID_COMPAQ,     PCI_ANY_ID,	PCI_ANY_ID, PCI_ANY_ID,
 		PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
+#endif
 	{0,}
 };
 
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index c0efdbff5da7..8c6a9031899b 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -8319,6 +8319,7 @@ static const struct pci_error_handlers qla2xxx_err_handler = {
 };
 
 static const struct pci_device_id qla2xxx_pci_tbl[] = {
+#ifndef CONFIG_RHEL_DIFFERENCES
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP2100) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP2200) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP2300) },
@@ -8331,13 +8332,18 @@ static const struct pci_device_id qla2xxx_pci_tbl[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP8432) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP5422) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP5432) },
+#endif
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP2532) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP2031) },
+#ifndef CONFIG_RHEL_DIFFERENCES
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP8001) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP8021) },
+#endif
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP8031) },
+#ifndef CONFIG_RHEL_DIFFERENCES
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISPF001) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP8044) },
+#endif
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP2071) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP2271) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, PCI_DEVICE_ID_QLOGIC_ISP2261) },
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index a1b21ea14e54..3076237c435d 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -145,6 +145,13 @@ static void sd_large_pool_destroy(void)
 	}
 	mutex_unlock(&sd_mutex_lock);
 }
+#ifdef CONFIG_RHEL_DIFFERENCES
+static char sd_probe_type[6] = "async";
+module_param_string(probe, sd_probe_type, sizeof(sd_probe_type),
+		    S_IRUGO|S_IWUSR);
+MODULE_PARM_DESC(probe, "async or sync. Setting to 'sync' disables asynchronous "
+		 "device number assignments (sda, sdb, ...).");
+#endif
 
 static void sd_disable_discard(struct scsi_disk *sdkp)
 {
@@ -4475,6 +4482,11 @@ static int __init init_sd(void)
 		goto err_out_class;
 	}
 
+#ifdef CONFIG_RHEL_DIFFERENCES
+	if (!strcmp(sd_probe_type, "sync"))
+		sd_template.gendrv.probe_type = PROBE_FORCE_SYNCHRONOUS;
+#endif
+
 	err = scsi_register_driver(&sd_template);
 	if (err)
 		goto err_out_driver;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 3345b3298daf..473935984d36 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5907,6 +5907,13 @@ static void hub_event(struct work_struct *work)
 			(u16) hub->change_bits[0],
 			(u16) hub->event_bits[0]);
 
+	/* Don't disconnect USB-SATA on TrimSlice */
+	if (strcmp(dev_name(hdev->bus->controller), "tegra-ehci.0") == 0) {
+		if ((hdev->state == 7) && (hub->change_bits[0] == 0) &&
+				(hub->event_bits[0] == 0x2))
+			hub->event_bits[0] = 0;
+	}
+
 	/* Lock the device, then check to see if we were
 	 * disconnected while waiting for the lock to succeed. */
 	usb_lock_device(hdev);
diff --git a/fs/afs/main.c b/fs/afs/main.c
index 7a883c59976f..907ec60e500a 100644
--- a/fs/afs/main.c
+++ b/fs/afs/main.c
@@ -194,6 +194,9 @@ static int __init afs_init(void)
 		goto error_proc;
 	}
 
+#ifdef CONFIG_RHEL_DIFFERENCES
+	mark_partner_supported(KBUILD_MODNAME, THIS_MODULE);
+#endif
 	return ret;
 
 error_proc:
diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index 0967aace9f7f..a72ec3339e4e 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -652,6 +652,9 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
 {
 	struct inode *inode;
 	struct erofs_sb_info *sbi = EROFS_SB(sb);
+#ifdef CONFIG_RHEL_DIFFERENCES
+	static bool printed = false;
+#endif
 	int err;
 
 	sb->s_magic = EROFS_SUPER_MAGIC;
@@ -791,6 +794,12 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
 
 	sbi->dir_ra_bytes = EROFS_DIR_RA_BYTES;
 	erofs_info(sb, "mounted with root inode @ nid %llu.", sbi->root_nid);
+#ifdef CONFIG_RHEL_DIFFERENCES
+	if (!printed) {
+		mark_tech_preview("EROFS filesystem", NULL);
+		printed = true;
+       }
+#endif
 	return 0;
 }
 
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index bca0dc87d0b7..01940cbe1ad8 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5760,6 +5760,17 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
 	atomic_set(&sbi->s_warning_count, 0);
 	atomic_set(&sbi->s_msg_count, 0);
 
+#ifdef CONFIG_RHEL_DIFFERENCES
+	if (ext4_has_feature_verity(sb)) {
+		static bool printed = false;
+
+		if (!printed) {
+			mark_tech_preview("fs-verity on ext4", NULL);
+			printed = true;
+		}
+	}
+#endif
+
 	/* Register sysfs after all initializations are complete. */
 	err = ext4_register_sysfs(sb);
 	if (err)
diff --git a/include/linux/crypto.h b/include/linux/crypto.h
index b7c97f1c47c9..0a484f45b24a 100644
--- a/include/linux/crypto.h
+++ b/include/linux/crypto.h
@@ -152,6 +152,8 @@
 #define CRYPTO_TFM_REQ_MAY_BACKLOG	0x00000400
 #define CRYPTO_TFM_REQ_ON_STACK		0x00000800
 
+#define CRYPTO_TFM_FIPS_COMPLIANCE	0x80000000
+
 /*
  * Miscellaneous stuff.
  */
diff --git a/include/linux/efi.h b/include/linux/efi.h
index aa15ff88539b..08ae6d9c9af1 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -45,6 +45,8 @@ struct screen_info;
 #define EFI_ABORTED		(21 | (1UL << (BITS_PER_LONG-1)))
 #define EFI_SECURITY_VIOLATION	(26 | (1UL << (BITS_PER_LONG-1)))
 
+#define EFI_IS_ERROR(x)		((x) & (1UL << (BITS_PER_LONG-1)))
+
 typedef unsigned long efi_status_t;
 typedef u8 efi_bool_t;
 typedef u16 efi_char16_t;		/* UNICODE character */
@@ -847,6 +849,14 @@ extern int __init parse_efi_signature_list(
 #define EFI_MEM_ATTR		9	/* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
 #define EFI_MEM_NO_SOFT_RESERVE	10	/* Is the kernel configured to ignore soft reservations? */
 #define EFI_PRESERVE_BS_REGIONS	11	/* Are EFI boot-services memory segments available? */
+#define EFI_SECURE_BOOT		12	/* Are we in Secure Boot mode? */
+
+enum efi_secureboot_mode {
+	efi_secureboot_mode_unset,
+	efi_secureboot_mode_unknown,
+	efi_secureboot_mode_disabled,
+	efi_secureboot_mode_enabled,
+};
 
 #ifdef CONFIG_EFI
 /*
@@ -858,6 +868,8 @@ static inline bool efi_enabled(int feature)
 }
 extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused);
 
+extern void __init efi_set_secure_boot(enum efi_secureboot_mode mode);
+
 bool __pure __efi_soft_reserve_enabled(void);
 
 static inline bool __pure efi_soft_reserve_enabled(void)
@@ -879,6 +891,8 @@ static inline bool efi_enabled(int feature)
 static inline void
 efi_reboot(enum reboot_mode reboot_mode, const char *__unused) {}
 
+static inline void efi_set_secure_boot(enum efi_secureboot_mode mode) {}
+
 static inline bool efi_soft_reserve_enabled(void)
 {
 	return false;
@@ -893,6 +907,7 @@ static inline void efi_find_mirror(void) {}
 #endif
 
 extern int efi_status_to_err(efi_status_t status);
+extern const char *efi_status_to_str(efi_status_t status);
 
 /*
  * Variable Attributes
@@ -1110,13 +1125,6 @@ extern unsigned long efi_call_virt_save_flags(void);
 
 void efi_runtime_assert_lock_held(void);
 
-enum efi_secureboot_mode {
-	efi_secureboot_mode_unset,
-	efi_secureboot_mode_unknown,
-	efi_secureboot_mode_disabled,
-	efi_secureboot_mode_enabled,
-};
-
 static inline
 enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var)
 {
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 24414c79e59a..b086915ec6c0 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -194,4 +194,32 @@ extern enum system_states system_state;
 # define REBUILD_DUE_TO_DYNAMIC_FTRACE
 #endif
 
+/* Permissions on a sysfs file: you didn't miss the 0 prefix did you? */
+#define VERIFY_OCTAL_PERMISSIONS(perms)						\
+	(BUILD_BUG_ON_ZERO((perms) < 0) +					\
+	 BUILD_BUG_ON_ZERO((perms) > 0777) +					\
+	 /* USER_READABLE >= GROUP_READABLE >= OTHER_READABLE */		\
+	 BUILD_BUG_ON_ZERO((((perms) >> 6) & 4) < (((perms) >> 3) & 4)) +	\
+	 BUILD_BUG_ON_ZERO((((perms) >> 3) & 4) < ((perms) & 4)) +		\
+	 /* USER_WRITABLE >= GROUP_WRITABLE */					\
+	 BUILD_BUG_ON_ZERO((((perms) >> 6) & 2) < (((perms) >> 3) & 2)) +	\
+	 /* OTHER_WRITABLE?  Generally considered a bad idea. */		\
+	 BUILD_BUG_ON_ZERO((perms) & 2) +					\
+	 (perms))
+
+struct module;
+
+#ifdef CONFIG_RHEL_DIFFERENCES
+void mark_hardware_unmaintained(const char *driver_name, char *fmt, ...);
+void mark_hardware_deprecated(const char *driver_name, char *fmt, ...);
+void mark_tech_preview(const char *msg, struct module *mod);
+void mark_partner_supported(const char *msg, struct module *mod);
+void init_rh_check_status(char *fn_name);
+#else
+static inline void mark_hardware_unmaintained(const char *driver_name, char *fmt, ...) { }
+static inline void mark_hardware_deprecated(const char *driver_name, char *fmt, ...) { }
+static inline void mark_tech_preview(const char *msg, struct module *mod) { }
+static inline void mark_partner_supported(const char *msg, struct module *mod) { }
+#endif
+
 #endif
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 65c9609ec207..2cc243ec73f6 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -456,6 +456,7 @@ LSM_HOOK(int, 0, bpf_token_capable, const struct bpf_token *token, int cap)
 
 LSM_HOOK(int, 0, locked_down, enum lockdown_reason what)
 
+
 #ifdef CONFIG_PERF_EVENTS
 LSM_HOOK(int, 0, perf_event_open, int type)
 LSM_HOOK(int, 0, perf_event_alloc, struct perf_event *event)
diff --git a/include/linux/module.h b/include/linux/module.h
index 96cc98568eea..f00ea9bac538 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -413,6 +413,7 @@ struct module {
 	struct module_attribute *modinfo_attrs;
 	const char *version;
 	const char *srcversion;
+	const char *rhelversion;
 	const char *imported_namespaces;
 	struct kobject *holders_dir;
 
@@ -1016,6 +1017,10 @@ static inline unsigned long find_kallsyms_symbol_value(struct module *mod,
 
 #endif  /* CONFIG_MODULES && CONFIG_KALLSYMS */
 
+#ifdef CONFIG_RHEL_DIFFERENCES
+void module_rh_check_status(const char * module_name);
+#endif
+
 /* Define __free(module_put) macro for struct module *. */
 DEFINE_FREE(module_put, struct module *, if (_T) module_put(_T))
 
diff --git a/include/linux/panic.h b/include/linux/panic.h
index f1dd417e54b2..95344281ed2c 100644
--- a/include/linux/panic.h
+++ b/include/linux/panic.h
@@ -88,7 +88,22 @@ static inline void set_arch_panic_timeout(int timeout, int arch_default_timeout)
 #define TAINT_RANDSTRUCT		17
 #define TAINT_TEST			18
 #define TAINT_FWCTL			19
-#define TAINT_FLAGS_COUNT		20
+/* Start of Red Hat-specific taint flags */
+#define TAINT_20			20
+#define TAINT_21			21
+#define TAINT_22			22
+#define TAINT_23			23
+#define TAINT_24			24
+#define TAINT_25			25
+#define TAINT_PARTNER_SUPPORTED 	26
+#define TAINT_SUPPORT_REMOVED		27
+/* Bits 28 - 31 are reserved for Red Hat use only */
+#define TAINT_RESERVED28		28
+#define TAINT_RESERVED29		29
+#define TAINT_RESERVED30		30
+#define TAINT_UNPRIVILEGED_BPF		31
+/* End of Red Hat-specific taint flags */
+#define TAINT_FLAGS_COUNT		32
 #define TAINT_FLAGS_MAX			((1UL << TAINT_FLAGS_COUNT) - 1)
 
 struct taint_flag {
diff --git a/include/linux/pci.h b/include/linux/pci.h
index d31a8d107b1e..2944d6c5c484 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1723,6 +1723,7 @@ int pci_add_dynid(struct pci_driver *drv,
 		  unsigned long driver_data);
 const struct pci_device_id *pci_match_id(const struct pci_device_id *ids,
 					 struct pci_dev *dev);
+
 int pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max,
 		    int pass);
 
@@ -2917,6 +2918,10 @@ static inline bool pci_is_thunderbolt_attached(struct pci_dev *pdev)
 	return false;
 }
 
+#ifdef CONFIG_RHEL_DIFFERENCES
+bool pci_rh_check_status(struct pci_dev *pci_dev);
+#endif
+
 #if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH) || defined(CONFIG_S390)
 void pci_uevent_ers(struct pci_dev *pdev, enum  pci_ers_result err_type);
 #endif
diff --git a/include/linux/random.h b/include/linux/random.h
index 8a8064dc3970..3238fab8f749 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -9,6 +9,13 @@
 
 #include <uapi/linux/random.h>
 
+struct iov_iter;
+
+struct random_extrng {
+	ssize_t (*extrng_read_iter)(struct iov_iter *iter, bool reseed);
+	struct module *owner;
+};
+
 struct notifier_block;
 
 void add_device_randomness(const void *buf, size_t len);
@@ -135,6 +142,9 @@ int random_prepare_cpu(unsigned int cpu);
 int random_online_cpu(unsigned int cpu);
 #endif
 
+void random_register_extrng(const struct random_extrng *rng);
+void random_unregister_extrng(void);
+
 #ifndef MODULE
 extern const struct file_operations random_fops, urandom_fops;
 #endif
diff --git a/include/linux/rh_flags.h b/include/linux/rh_flags.h
new file mode 100644
index 000000000000..4bb0f5585df0
--- /dev/null
+++ b/include/linux/rh_flags.h
@@ -0,0 +1,34 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * rh_flags.h -- Red Hat flags tracking
+ *
+ * Copyright (c) 2018 Red Hat, Inc. -- Jiri Benc <jbenc@redhat.com>
+ *
+ * The intent of the flag tracking is to provide better and more focused
+ * support. Only those flags that are of a special interest for customer
+ * support should be tracked.
+ *
+ * THE FLAGS DO NOT EXPRESS ANY SUPPORT POLICIES.
+ */
+
+#ifndef _LINUX_RH_FLAGS_H
+#define _LINUX_RH_FLAGS_H
+
+#if defined CONFIG_RHEL_DIFFERENCES
+bool __rh_add_flag(const char *flag_name);
+void rh_print_flags(void);
+
+#define rh_add_flag(flag_name)						\
+({									\
+	static bool __mark_once __read_mostly;				\
+	bool __ret_mark_once = !__mark_once;				\
+									\
+	if (!__mark_once)						\
+		__mark_once = __rh_add_flag(flag_name);			\
+	unlikely(__ret_mark_once);					\
+})
+#else
+static inline void rh_print_flags(void) { }
+static inline void rh_add_flag(const char *flag_name) { }
+#endif
+#endif
diff --git a/include/linux/rh_kabi.h b/include/linux/rh_kabi.h
new file mode 100644
index 000000000000..5139cb2cabdc
--- /dev/null
+++ b/include/linux/rh_kabi.h
@@ -0,0 +1,541 @@
+/*
+ * rh_kabi.h - Red Hat kABI abstraction header
+ *
+ * Copyright (c) 2014 Don Zickus
+ * Copyright (c) 2015-2020 Jiri Benc
+ * Copyright (c) 2015 Sabrina Dubroca, Hannes Frederic Sowa
+ * Copyright (c) 2016-2018 Prarit Bhargava
+ * Copyright (c) 2017 Paolo Abeni, Larry Woodman
+ *
+ * This file is released under the GPLv2.
+ * See the file COPYING for more details.
+ *
+ * These kabi macros hide the changes from the kabi checker and from the
+ * process that computes the exported symbols' checksums.
+ * They have 2 variants: one (defined under __GENKSYMS__) used when
+ * generating the checksums, and the other used when building the kernel's
+ * binaries.
+ *
+ * The use of these macros does not guarantee that the usage and modification
+ * of code is correct.  As with all Red Hat only changes, an engineer must
+ * explain why the use of the macro is valid in the patch containing the
+ * changes.
+ *
+ */
+
+#ifndef _LINUX_RH_KABI_H
+#define _LINUX_RH_KABI_H
+
+#include <linux/kconfig.h>
+#include <linux/compiler.h>
+#include <linux/stringify.h>
+
+/*
+ * NOTE
+ *   Unless indicated otherwise, don't use ';' after these macros as it
+ *   messes up the kABI checker by changing what the resulting token string
+ *   looks like.  Instead let the macros add the ';' so it can be properly
+ *   hidden from the kABI checker (mainly for RH_KABI_EXTEND, but applied to
+ *   most macros for uniformity).
+ *
+ *
+ * RH_KABI_CONST
+ *   Adds a new const modifier to a function parameter preserving the old
+ *   checksum.
+ *
+ * RH_KABI_ADD_MODIFIER
+ *   Adds a new modifier to a function parameter or a typedef, preserving
+ *   the old checksum.  Useful e.g. for adding rcu annotations or changing
+ *   int to unsigned.  Beware that this may change the semantics; if you're
+ *   sure this is safe, always explain why binary compatibility with 3rd
+ *   party modules is retained.
+ *
+ * RH_KABI_DEPRECATE
+ *   Marks the element as deprecated and make it unusable by modules while
+ *   keeping a hole in its place to preserve binary compatibility.
+ *
+ * RH_KABI_DEPRECATE_FN
+ *   Marks the function pointer as deprecated and make it unusable by modules
+ *   while keeping a hole in its place to preserve binary compatibility.
+ *
+ * RH_KABI_EXTEND
+ *   Adds a new field to a struct.  This must always be added to the end of
+ *   the struct.  Before using this macro, make sure this is actually safe
+ *   to do - there is a number of conditions under which it is *not* safe.
+ *   In particular (but not limited to), this macro cannot be used:
+ *   - if the struct in question is embedded in another struct, or
+ *   - if the struct is allocated by drivers either statically or
+ *     dynamically, or
+ *   - if the struct is allocated together with driver data (an example of
+ *     such behavior is struct net_device or struct request).
+ *
+ * RH_KABI_EXTEND_WITH_SIZE
+ *   Adds a new element (usually a struct) to a struct and reserves extra
+ *   space for the new element.  The provided 'size' is the total space to
+ *   be added in longs (i.e. it's 8 * 'size' bytes), including the size of
+ *   the added element.  It is automatically checked that the new element
+ *   does not overflow the reserved space, now nor in the future. However,
+ *   no attempt is done to check the content of the added element (struct)
+ *   for kABI conformance - kABI checking inside the added element is
+ *   effectively switched off.
+ *   For any struct being added by RH_KABI_EXTEND_WITH_SIZE, it is
+ *   recommended its content to be documented as not covered by kABI
+ *   guarantee.
+ *
+ * RH_KABI_FILL_HOLE
+ *   Fills a hole in a struct.
+ *
+ *   Warning: only use if a hole exists for _all_ arches.  Use pahole to verify.
+ *
+ * RH_KABI_RENAME
+ *   Renames an element without changing its type.  This macro can be used in
+ *   bitfields, for example.
+ *
+ *   NOTE: this macro does not add the final ';'
+ *
+ * RH_KABI_REPLACE
+ *   Replaces the _orig field by the _new field.  The size of the occupied
+ *   space is preserved, it's fine if the _new field is smaller than the
+ *   _orig field.  If a _new field is larger or has a different alignment,
+ *   compilation will abort.
+ *
+ * RH_KABI_REPLACE_SPLIT
+ *   Works the same as RH_KABI_REPLACE but replaces a single _orig field by
+ *   multiple new fields.  The checks for size and alignment done by
+ *   RH_KABI_REPLACE are still applied.
+ *
+ * RH_KABI_HIDE_INCLUDE
+ *   Hides the given include file from kABI checksum computations.  This is
+ *   used when a newly added #include makes a previously opaque struct
+ *   visible.
+ *
+ *   Example usage:
+ *   #include RH_KABI_HIDE_INCLUDE(<linux/poll.h>)
+ *
+ * RH_KABI_FAKE_INCLUDE
+ *   Pretends inclusion of the given file for kABI checksum computations.
+ *   This is used when upstream removed a particular #include but that made
+ *   some structures opaque that were previously visible and is causing kABI
+ *   checker failures.
+ *
+ *   Example usage:
+ *   #include RH_KABI_FAKE_INCLUDE(<linux/rhashtable.h>)
+ *
+ * RH_KABI_RESERVE
+ *   Adds a reserved field to a struct.  This is done prior to kABI freeze
+ *   for structs that cannot be expanded later using RH_KABI_EXTEND (for
+ *   example because they are embedded in another struct or because they are
+ *   allocated by drivers or because they use unusual memory layout).  The
+ *   size of the reserved field is 'unsigned long' and is assumed to be
+ *   8 bytes.
+ *
+ *   The argument is a number unique for the given struct; usually, multiple
+ *   RH_KABI_RESERVE macros are added to a struct with numbers starting from
+ *   one.
+ *
+ *   Example usage:
+ *   struct foo {
+ *           int a;
+ *           RH_KABI_RESERVE(1)
+ *           RH_KABI_RESERVE(2)
+ *           RH_KABI_RESERVE(3)
+ *           RH_KABI_RESERVE(4)
+ *   };
+ *
+ * RH_KABI_USE
+ *   Uses a previously reserved field or multiple fields.  The arguments are
+ *   one or more numbers assigned to RH_KABI_RESERVE, followed by a field to
+ *   be put in their place.  The compiler ensures that the new field is not
+ *   larger than the reserved area.
+ *
+ *   Example usage:
+ *   struct foo {
+ *           int a;
+ *           RH_KABI_USE(1, int b)
+ *           RH_KABI_USE(2, 3, int c[3])
+ *           RH_KABI_RESERVE(4)
+ *   };
+ *
+ * RH_KABI_USE_SPLIT
+ *   Works the same as RH_KABI_USE but replaces a single reserved field by
+ *   multiple new fields.
+ *
+ * RH_KABI_AUX_EMBED
+ * RH_KABI_AUX_PTR
+ *   Adds an extenstion of a struct in the form of "auxiliary structure".
+ *   This is done prior to kABI freeze for structs that cannot be expanded
+ *   later using RH_KABI_EXTEND.  See also RH_KABI_RESERVED, these two
+ *   approaches can (and often are) combined.
+ *
+ *   To use this for 'struct foo' (the "base structure"), define a new
+ *   structure called 'struct foo_rh'; this new struct is called "auxiliary
+ *   structure".  Then add RH_KABI_AUX_EMBED or RH_KABI_AUX_PTR to the end
+ *   of the base structure.  The argument is the name of the base structure,
+ *   without the 'struct' keyword.
+ *
+ *   RH_KABI_AUX_PTR stores a pointer to the aux structure in the base
+ *   struct.  The lifecycle of the aux struct needs to be properly taken
+ *   care of.
+ *
+ *   RH_KABI_AUX_EMBED embeds the aux struct into the base struct.  This
+ *   cannot be used when the base struct is itself embedded into another
+ *   struct, allocated in an array, etc.
+ *
+ *   Both approaches (ptr and embed) work correctly even when the aux struct
+ *   is allocated by modules.  To ensure this, the code responsible for
+ *   allocation/assignment of the aux struct has to properly set the size of
+ *   the aux struct; see the RH_KABI_AUX_SET_SIZE and RH_KABI_AUX_INIT_SIZE
+ *   macros.
+ *
+ *   New fields can be later added to the auxiliary structure, always to its
+ *   end.  Note the auxiliary structure cannot be shrunk in size later (i.e.,
+ *   fields cannot be removed, only deprecated).  Any code accessing fields
+ *   from the aux struct must guard the access using the RH_KABI_AUX macro.
+ *   The access itself is then done via a '_rh' field in the base struct.
+ *
+ *   The auxiliary structure is not guaranteed for access by modules unless
+ *   explicitly commented as such in the declaration of the aux struct
+ *   itself or some of its elements.
+ *
+ *   Example:
+ *
+ *   struct foo_rh {
+ *           int newly_added;
+ *   };
+ *
+ *   struct foo {
+ *           bool big_hammer;
+ *           RH_KABI_AUX_PTR(foo)
+ *   };
+ *
+ *   void use(struct foo *f)
+ *   {
+ *           if (RH_KABI_AUX(f, foo, newly_added))
+ *                   f->_rh->newly_added = 123;
+ *	     else
+ *	             // the field 'newly_added' is not present in the passed
+ *	             // struct, fall back to old behavior
+ *	             f->big_hammer = true;
+ *   }
+ *
+ *   static struct foo_rh my_foo_rh {
+ *           .newly_added = 0;
+ *   }
+ *
+ *   static struct foo my_foo = {
+ *           .big_hammer = false,
+ *           ._rh = &my_foo_rh,
+ *           RH_KABI_AUX_INIT_SIZE(foo)
+ *   };
+ *
+ * RH_KABI_USE_AUX_PTR
+ *   Creates an auxiliary structure post kABI freeze.  This works by using
+ *   two reserved fields (thus there has to be two reserved fields still
+ *   available) and converting them to RH_KABI_AUX_PTR.
+ *
+ *   Example:
+ *
+ *   struct foo_rh {
+ *   };
+ *
+ *   struct foo {
+ *           int a;
+ *           RH_KABI_RESERVE(1)
+ *           RH_KABI_USE_AUX_PTR(2, 3, foo)
+ *   };
+ *
+ * RH_KABI_AUX_SET_SIZE
+ * RH_KABI_AUX_INIT_SIZE
+ *   Calculates and stores the size of the auxiliary structure.
+ *
+ *   RH_KABI_AUX_SET_SIZE is for dynamically allocated base structs,
+ *   RH_KABI_AUX_INIT_SIZE is for statically allocated case structs.
+ *
+ *   These macros must be called from the allocation (RH_KABI_AUX_SET_SIZE)
+ *   or declaration (RH_KABI_AUX_INIT_SIZE) site, regardless of whether
+ *   that happens in the kernel or in a module.  Without calling one of
+ *   these macros, the aux struct will appear to have no fields to the
+ *   kernel.
+ *
+ *   Note: since RH_KABI_AUX_SET_SIZE is intended to be invoked outside of
+ *   a struct definition, it does not add the semicolon and must be
+ *   terminated by semicolon by the caller.
+ *
+ * RH_KABI_AUX
+ *   Verifies that the given field exists in the given auxiliary structure.
+ *   This MUST be called prior to accessing that field; failing to do that
+ *   may lead to invalid memory access.
+ *
+ *   The first argument is a pointer to the base struct, the second argument
+ *   is the name of the base struct (without the 'struct' keyword), the
+ *   third argument is the field name.
+ *
+ *   This macro works for structs extended by either of RH_KABI_AUX_EMBED,
+ *   RH_KABI_AUX_PTR and RH_KABI_USE_AUX_PTR.
+ *
+ * RH_KABI_FORCE_CHANGE
+ *   Force change of the symbol checksum.  The argument of the macro is a
+ *   version for cases we need to do this more than once.
+ *
+ *   This macro does the opposite: it changes the symbol checksum without
+ *   actually changing anything about the exported symbol.  It is useful for
+ *   symbols that are not whitelisted, we're changing them in an
+ *   incompatible way and want to prevent 3rd party modules to silently
+ *   corrupt memory.  Instead, by changing the symbol checksum, such modules
+ *   won't be loaded by the kernel.  This macro should only be used as a
+ *   last resort when all other KABI workarounds have failed.
+ *
+ * RH_KABI_EXCLUDE
+ *   !!! WARNING: DANGEROUS, DO NOT USE unless you are aware of all the !!!
+ *   !!! implications. This should be used ONLY EXCEPTIONALLY and only  !!!
+ *   !!! under specific circumstances. Very likely, this macro does not !!!
+ *   !!! do what you expect it to do. Note that any usage of this macro !!!
+ *   !!! MUST be paired with a RH_KABI_FORCE_CHANGE annotation of       !!!
+ *   !!! a suitable symbol (or an equivalent safeguard) and the commit  !!!
+ *   !!! log MUST explain why the chosen solution is appropriate.       !!!
+ *
+ *   Exclude the element from checksum generation.  Any such element is
+ *   considered not to be part of the kABI whitelist and may be changed at
+ *   will.  Note however that it's the responsibility of the developer
+ *   changing the element to ensure 3rd party drivers using this element
+ *   won't panic, for example by not allowing them to be loaded.  That can
+ *   be achieved by changing another, non-whitelisted symbol they use,
+ *   either by nature of the change or by using RH_KABI_FORCE_CHANGE.
+ *
+ *   Also note that any change to the element must preserve its size. Change
+ *   of the size is not allowed and would constitute a silent kABI breakage.
+ *   Beware that the RH_KABI_EXCLUDE macro does not do any size checks.
+ *
+ * RH_KABI_EXCLUDE_WITH_SIZE
+ *   Like RH_KABI_EXCLUDE, this macro excludes the element from
+ *   checksum generation.  The same warnings as for RH_KABI_EXCLUDE
+ *   apply: use RH_KABI_FORCE_CHANGE.
+ *
+ *   This macro is intended to be used for elements embedded inside
+ *   kABI-protected structures (struct, array). In contrast with
+ *   RH_KABI_EXCLUDE, this macro reserves extra space, so that the
+ *   embedded element can grow without changing the offsets of the
+ *   fields that follow. The provided 'size' is the total space to be
+ *   added in longs (i.e. it's 8 * 'size' bytes), including the size
+ *   of the added element.  It is automatically checked that the new
+ *   element does not overflow the reserved space, now nor in the
+ *   future. The size is also included in the checksum via the
+ *   reserved space, to ensure that we don't accidentally change it,
+ *   which would change the offsets of the fields that follow.
+ *
+ * RH_KABI_BROKEN_INSERT
+ * RH_KABI_BROKEN_REMOVE
+ *   Insert a field to the middle of a struct / delete a field from a struct.
+ *   Note that this breaks kABI! It can be done only when it's certain that
+ *   no 3rd party driver can validly reach into the struct.  A typical
+ *   example is a struct that is:  both (a) referenced only through a long
+ *   chain of pointers from another struct that is part of a whitelisted
+ *   symbol and (b) kernel internal only, it should have never been visible
+ *   to genksyms in the first place.
+ *
+ *   Another example are structs that are explicitly exempt from kABI
+ *   guarantee but we did not have enough foresight to use RH_KABI_EXCLUDE.
+ *   In this case, the warning for RH_KABI_EXCLUDE applies.
+ *
+ *   A detailed explanation of correctness of every RH_KABI_BROKEN_* macro
+ *   use is especially important.
+ *
+ * RH_KABI_BROKEN_INSERT_BLOCK
+ * RH_KABI_BROKEN_REMOVE_BLOCK
+ *   A version of RH_KABI_BROKEN_INSERT / REMOVE that allows multiple fields
+ *   to be inserted or removed together.  All fields need to be terminated
+ *   by ';' inside(!) the macro parameter.  The macro itself must not be
+ *   terminated by ';'.
+ *
+ * RH_KABI_BROKEN_REPLACE
+ *   Replace a field by a different one without doing any checking.  This
+ *   allows replacing a field by another with a different size.  Similarly
+ *   to other RH_KABI_BROKEN macros, use of this indicates a kABI breakage.
+ *
+ * RH_KABI_BROKEN_INSERT_ENUM
+ * RH_KABI_BROKEN_REMOVE_ENUM
+ *   Insert a field to the middle of an enumaration type / delete a field from
+ *   an enumaration type. Note that this can break kABI especially if the
+ *   number of enum fields is used in an array within a structure. It can be
+ *   done only when it is certain that no 3rd party driver will use the
+ *   enumeration type or a structure that embeds an array with size determined
+ *   by an enumeration type.
+ *
+ * RH_KABI_EXTEND_ENUM
+ *   Adds a new field to an enumeration type.  This must always be added to
+ *   the end of the enum.  Before using this macro, make sure this is actually
+ *   safe to do.
+ */
+
+#undef linux
+#define linux linux
+
+#ifdef __GENKSYMS__
+
+# define RH_KABI_CONST
+# define RH_KABI_ADD_MODIFIER(_new)
+# define RH_KABI_EXTEND(_new)
+# define RH_KABI_FILL_HOLE(_new)
+# define RH_KABI_FORCE_CHANGE(ver)		__attribute__((rh_kabi_change ## ver))
+# define RH_KABI_RENAME(_orig, _new)		_orig
+# define RH_KABI_HIDE_INCLUDE(_file)		<linux/rh_kabi.h>
+# define RH_KABI_FAKE_INCLUDE(_file)		_file
+# define RH_KABI_BROKEN_INSERT(_new)
+# define RH_KABI_BROKEN_REMOVE(_orig)		_orig;
+# define RH_KABI_BROKEN_INSERT_BLOCK(_new)
+# define RH_KABI_BROKEN_REMOVE_BLOCK(_orig)	_orig
+# define RH_KABI_BROKEN_REPLACE(_orig, _new)	_orig;
+# define RH_KABI_BROKEN_INSERT_ENUM(_new)
+# define RH_KABI_BROKEN_REMOVE_ENUM(_orig)	_orig,
+# define RH_KABI_EXTEND_ENUM(_new)
+
+# define _RH_KABI_DEPRECATE(_type, _orig)	_type _orig
+# define _RH_KABI_DEPRECATE_FN(_type, _orig, _args...)	_type (*_orig)(_args)
+# define _RH_KABI_REPLACE(_orig, _new)		_orig
+# define _RH_KABI_EXCLUDE(_elem)
+
+# define __RH_KABI_CHECK_SIZE(_item, _size)
+
+#else
+
+# define RH_KABI_ALIGN_WARNING ".  Disable CONFIG_RH_KABI_SIZE_ALIGN_CHECKS if debugging."
+
+# define RH_KABI_CONST				const
+# define RH_KABI_ADD_MODIFIER(_new)		_new
+# define RH_KABI_EXTEND(_new)			_new;
+# define RH_KABI_FILL_HOLE(_new)		_new;
+# define RH_KABI_FORCE_CHANGE(ver)
+# define RH_KABI_RENAME(_orig, _new)		_new
+# define RH_KABI_HIDE_INCLUDE(_file)		_file
+# define RH_KABI_FAKE_INCLUDE(_file)		<linux/rh_kabi.h>
+# define RH_KABI_BROKEN_INSERT(_new)		_new;
+# define RH_KABI_BROKEN_REMOVE(_orig)
+# define RH_KABI_BROKEN_INSERT_BLOCK(_new)	_new
+# define RH_KABI_BROKEN_REMOVE_BLOCK(_orig)
+# define RH_KABI_BROKEN_REPLACE(_orig, _new)	_new;
+# define RH_KABI_BROKEN_INSERT_ENUM(_new)	_new,
+# define RH_KABI_BROKEN_REMOVE_ENUM(_orig)
+# define RH_KABI_EXTEND_ENUM(_new)		_new,
+
+#if IS_BUILTIN(CONFIG_RH_KABI_SIZE_ALIGN_CHECKS)
+# define __RH_KABI_CHECK_SIZE_ALIGN(_orig, _new)			\
+	union {								\
+		_Static_assert(sizeof(struct{_new;}) <= sizeof(struct{_orig;}), \
+			       __FILE__ ":" __stringify(__LINE__) ": "  __stringify(_new) " is larger than " __stringify(_orig) RH_KABI_ALIGN_WARNING); \
+		_Static_assert(__alignof__(struct{_new;}) <= __alignof__(struct{_orig;}), \
+			       __FILE__ ":" __stringify(__LINE__) ": "  __stringify(_orig) " is not aligned the same as " __stringify(_new) RH_KABI_ALIGN_WARNING); \
+	}
+# define __RH_KABI_CHECK_SIZE(_item, _size)				\
+	_Static_assert(sizeof(struct{_item;}) <= _size,			\
+		       __FILE__ ":" __stringify(__LINE__) ": " __stringify(_item) " is larger than the reserved size (" __stringify(_size) " bytes)" RH_KABI_ALIGN_WARNING);
+#else
+# define __RH_KABI_CHECK_SIZE_ALIGN(_orig, _new)
+# define __RH_KABI_CHECK_SIZE(_item, _size)
+#endif
+
+#define RH_KABI_UNIQUE_ID	__PASTE(rh_kabi_hidden_, __LINE__)
+
+# define _RH_KABI_DEPRECATE(_type, _orig)	_type rh_reserved_##_orig
+# define _RH_KABI_DEPRECATE_FN(_type, _orig, _args...)  \
+	_type (* rh_reserved_##_orig)(_args)
+# define _RH_KABI_REPLACE(_orig, _new)			  \
+	union {						  \
+		_new;					  \
+		struct {				  \
+			_orig;				  \
+		} RH_KABI_UNIQUE_ID;			  \
+		__RH_KABI_CHECK_SIZE_ALIGN(_orig, _new);  \
+	}
+
+# define _RH_KABI_EXCLUDE(_elem)		_elem
+
+#endif /* __GENKSYMS__ */
+
+# define RH_KABI_DEPRECATE(_type, _orig)	_RH_KABI_DEPRECATE(_type, _orig);
+# define RH_KABI_DEPRECATE_FN(_type, _orig, _args...)  \
+	_RH_KABI_DEPRECATE_FN(_type, _orig, _args);
+# define RH_KABI_REPLACE(_orig, _new)		_RH_KABI_REPLACE(_orig, _new);
+
+#define _RH_KABI_REPLACE1(_new)		_new;
+#define _RH_KABI_REPLACE2(_new, ...)	_new; _RH_KABI_REPLACE1(__VA_ARGS__)
+#define _RH_KABI_REPLACE3(_new, ...)	_new; _RH_KABI_REPLACE2(__VA_ARGS__)
+#define _RH_KABI_REPLACE4(_new, ...)	_new; _RH_KABI_REPLACE3(__VA_ARGS__)
+#define _RH_KABI_REPLACE5(_new, ...)	_new; _RH_KABI_REPLACE4(__VA_ARGS__)
+#define _RH_KABI_REPLACE6(_new, ...)	_new; _RH_KABI_REPLACE5(__VA_ARGS__)
+#define _RH_KABI_REPLACE7(_new, ...)	_new; _RH_KABI_REPLACE6(__VA_ARGS__)
+#define _RH_KABI_REPLACE8(_new, ...)	_new; _RH_KABI_REPLACE7(__VA_ARGS__)
+#define _RH_KABI_REPLACE9(_new, ...)	_new; _RH_KABI_REPLACE8(__VA_ARGS__)
+#define _RH_KABI_REPLACE10(_new, ...)	_new; _RH_KABI_REPLACE9(__VA_ARGS__)
+#define _RH_KABI_REPLACE11(_new, ...)	_new; _RH_KABI_REPLACE10(__VA_ARGS__)
+#define _RH_KABI_REPLACE12(_new, ...)	_new; _RH_KABI_REPLACE11(__VA_ARGS__)
+
+#define RH_KABI_REPLACE_SPLIT(_orig, ...)	_RH_KABI_REPLACE(_orig, \
+		struct { __PASTE(_RH_KABI_REPLACE, COUNT_ARGS(__VA_ARGS__))(__VA_ARGS__) });
+
+# define RH_KABI_RESERVE(n)		_RH_KABI_RESERVE(n);
+
+#define _RH_KABI_USE1(n, _new)	_RH_KABI_RESERVE(n), _new
+#define _RH_KABI_USE2(n, ...)	_RH_KABI_RESERVE(n); _RH_KABI_USE1(__VA_ARGS__)
+#define _RH_KABI_USE3(n, ...)	_RH_KABI_RESERVE(n); _RH_KABI_USE2(__VA_ARGS__)
+#define _RH_KABI_USE4(n, ...)	_RH_KABI_RESERVE(n); _RH_KABI_USE3(__VA_ARGS__)
+#define _RH_KABI_USE5(n, ...)	_RH_KABI_RESERVE(n); _RH_KABI_USE4(__VA_ARGS__)
+#define _RH_KABI_USE6(n, ...)	_RH_KABI_RESERVE(n); _RH_KABI_USE5(__VA_ARGS__)
+#define _RH_KABI_USE7(n, ...)	_RH_KABI_RESERVE(n); _RH_KABI_USE6(__VA_ARGS__)
+#define _RH_KABI_USE8(n, ...)	_RH_KABI_RESERVE(n); _RH_KABI_USE7(__VA_ARGS__)
+#define _RH_KABI_USE9(n, ...)	_RH_KABI_RESERVE(n); _RH_KABI_USE8(__VA_ARGS__)
+#define _RH_KABI_USE10(n, ...)	_RH_KABI_RESERVE(n); _RH_KABI_USE9(__VA_ARGS__)
+#define _RH_KABI_USE11(n, ...)	_RH_KABI_RESERVE(n); _RH_KABI_USE10(__VA_ARGS__)
+#define _RH_KABI_USE12(n, ...)	_RH_KABI_RESERVE(n); _RH_KABI_USE11(__VA_ARGS__)
+
+#define _RH_KABI_USE(...)	_RH_KABI_REPLACE(__VA_ARGS__)
+#define RH_KABI_USE(n, ...)	_RH_KABI_USE(__PASTE(_RH_KABI_USE, COUNT_ARGS(__VA_ARGS__))(n, __VA_ARGS__));
+
+# define RH_KABI_USE_SPLIT(n, ...)	RH_KABI_REPLACE_SPLIT(_RH_KABI_RESERVE(n), __VA_ARGS__)
+
+# define _RH_KABI_RESERVE(n)		unsigned long rh_reserved##n
+
+#define RH_KABI_EXCLUDE(_elem)		_RH_KABI_EXCLUDE(_elem);
+
+#define RH_KABI_EXCLUDE_WITH_SIZE(_new, _size)				\
+	union {								\
+		RH_KABI_EXCLUDE(_new)					\
+		unsigned long RH_KABI_UNIQUE_ID[_size];			\
+		__RH_KABI_CHECK_SIZE(_new, 8 * (_size))			\
+	};
+
+#define RH_KABI_EXTEND_WITH_SIZE(_new, _size)				\
+	RH_KABI_EXTEND(union {						\
+		_new;							\
+		unsigned long RH_KABI_UNIQUE_ID[_size];			\
+		__RH_KABI_CHECK_SIZE(_new, 8 * (_size))			\
+	})
+
+#define _RH_KABI_AUX_PTR(_struct)					\
+	size_t _struct##_size_rh;					\
+	_RH_KABI_EXCLUDE(struct _struct##_rh *_rh)
+#define RH_KABI_AUX_PTR(_struct)					\
+	_RH_KABI_AUX_PTR(_struct);
+
+#define _RH_KABI_AUX_EMBED(_struct)					\
+	size_t _struct##_size_rh;					\
+	_RH_KABI_EXCLUDE(struct _struct##_rh _rh)
+#define RH_KABI_AUX_EMBED(_struct)					\
+	_RH_KABI_AUX_EMBED(_struct);
+
+#define RH_KABI_USE_AUX_PTR(n1, n2, _struct)				\
+	RH_KABI_USE(n1, n2,						\
+		     struct { RH_KABI_AUX_PTR(_struct) })
+
+#define RH_KABI_AUX_SET_SIZE(_name, _struct) ({				\
+	(_name)->_struct##_size_rh = sizeof(struct _struct##_rh);	\
+})
+
+#define RH_KABI_AUX_INIT_SIZE(_struct)					\
+	._struct##_size_rh = sizeof(struct _struct##_rh),
+
+#define RH_KABI_AUX(_ptr, _struct, _field) ({				\
+	size_t __off = offsetof(struct _struct##_rh, _field);		\
+	(_ptr)->_struct##_size_rh > __off ? true : false;		\
+})
+
+#endif /* _LINUX_RH_KABI_H */
diff --git a/include/linux/rh_waived.h b/include/linux/rh_waived.h
new file mode 100644
index 000000000000..d62a9e896b5e
--- /dev/null
+++ b/include/linux/rh_waived.h
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * include/linux/rh_waived.h
+ *
+ * rh_waived cmdline parameter interface.
+ *
+ * Copyright (C) 2024, Red Hat, Inc.  Ricardo Robaina <rrobaina@redhat.com>
+ */
+#ifndef _RH_WAIVED_H
+#define _RH_WAIVED_H
+
+enum rh_waived_items {
+	/* RH_WAIVED_ITEMS must always be the last item in the enum */
+	RH_WAIVED_ITEMS,
+};
+
+bool is_rh_waived(enum rh_waived_items feat);
+
+#endif /* _RH_WAIVED_H */
diff --git a/include/linux/security.h b/include/linux/security.h
index 153e9043058f..2ee3a8990968 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -2439,4 +2439,13 @@ static inline void security_initramfs_populated(void)
 }
 #endif /* CONFIG_SECURITY */
 
+#ifdef CONFIG_SECURITY_LOCKDOWN_LSM
+extern int security_lock_kernel_down(const char *where, enum lockdown_reason level);
+#else
+static inline int security_lock_kernel_down(const char *where, enum lockdown_reason level)
+{
+	return 0;
+}
+#endif /* CONFIG_SECURITY_LOCKDOWN_LSM */
+
 #endif /* ! __LINUX_SECURITY_H */
diff --git a/init/main.c b/init/main.c
index 2613d3f9b3ce..6b9f62f36903 100644
--- a/init/main.c
+++ b/init/main.c
@@ -1246,8 +1246,10 @@ static bool __init_or_module initcall_blacklisted(initcall_t fn)
 	char fn_name[KSYM_SYMBOL_LEN];
 	unsigned long addr;
 
+#ifndef CONFIG_RHEL_DIFFERENCES
 	if (list_empty(&blacklisted_initcalls))
 		return false;
+#endif
 
 	addr = (unsigned long) dereference_function_descriptor(fn);
 	sprint_symbol_no_offset(fn_name, addr);
@@ -1258,6 +1260,9 @@ static bool __init_or_module initcall_blacklisted(initcall_t fn)
 	 */
 	strreplace(fn_name, ' ', '\0');
 
+#ifdef CONFIG_RHEL_DIFFERENCES
+	init_rh_check_status(fn_name);
+#endif
 	list_for_each_entry(entry, &blacklisted_initcalls, next) {
 		if (!strcmp(fn_name, entry->buf)) {
 			pr_debug("initcall %s blacklisted\n", fn_name);
diff --git a/kernel/Makefile b/kernel/Makefile
index 1e1a31673577..60af4f6c2316 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -12,6 +12,8 @@ obj-y     = fork.o exec_domain.o exec_state.o panic.o \
 	    notifier.o ksysfs.o cred.o reboot.o \
 	    async.o range.o smpboot.o ucount.o regset.o ksyms_common.o
 
+obj-$(CONFIG_RHEL_DIFFERENCES) += rh_messages.o rh_flags.o rh_waived.o
+obj-$(CONFIG_USERMODE_DRIVER) += usermode_driver.o
 obj-$(CONFIG_MULTIUSER) += groups.o
 obj-$(CONFIG_VHOST_TASK) += vhost_task.o
 
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 8b294dfc1ad4..f76a5dd8c170 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -548,7 +548,12 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
 /* All BPF JIT sysctl knobs here. */
 int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
 int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
+#ifdef CONFIG_RHEL_DIFFERENCES
+/* RHEL-only: set it to 1 by default */
+int bpf_jit_harden   __read_mostly = 1;
+#else
 int bpf_jit_harden   __read_mostly;
+#endif /* CONFIG_RHEL_DIFFERENCES */
 long bpf_jit_limit   __read_mostly;
 long bpf_jit_limit_max __read_mostly;
 
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index c7bc9ba9b331..14331c681253 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -28,6 +28,7 @@
 #include <linux/ctype.h>
 #include <linux/nospec.h>
 #include <linux/audit.h>
+#include <linux/init.h>
 #include <uapi/linux/btf.h>
 #include <linux/pgtable.h>
 #include <linux/bpf_lsm.h>
@@ -65,6 +66,23 @@ static DEFINE_SPINLOCK(map_idr_lock);
 static DEFINE_IDR(link_idr);
 static DEFINE_SPINLOCK(link_idr_lock);
 
+static int __init unprivileged_bpf_setup(char *str)
+{
+	unsigned long disabled;
+	if (!kstrtoul(str, 0, &disabled))
+		sysctl_unprivileged_bpf_disabled = !!disabled;
+
+	if (!sysctl_unprivileged_bpf_disabled) {
+		pr_warn("Unprivileged BPF has been enabled "
+			"(unprivileged_bpf_disabled=0 has been supplied "
+			"in boot parameters), tainting the kernel");
+		add_taint(TAINT_UNPRIVILEGED_BPF, LOCKDEP_STILL_OK);
+	}
+
+	return 1;
+}
+__setup("unprivileged_bpf_disabled=", unprivileged_bpf_setup);
+
 int sysctl_unprivileged_bpf_disabled __read_mostly =
 	IS_BUILTIN(CONFIG_BPF_UNPRIV_DEFAULT_OFF) ? 2 : 0;
 
@@ -6704,6 +6722,11 @@ static int bpf_unpriv_handler(const struct ctl_table *table, int write,
 	if (write && !ret) {
 		if (locked_state && unpriv_enable != 1)
 			return -EPERM;
+		if (!unpriv_enable) {
+			pr_warn("Unprivileged BPF has been enabled, "
+				"tainting the kernel");
+			add_taint(TAINT_UNPRIVILEGED_BPF, LOCKDEP_STILL_OK);
+		}
 		*(int *)table->data = unpriv_enable;
 	}
 
diff --git a/kernel/module/main.c b/kernel/module/main.c
index d0e1e0bd2ad0..b940a2b8b32e 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -66,6 +66,8 @@
 #define CREATE_TRACE_POINTS
 #include <trace/events/module.h>
 
+#include <linux/rh_flags.h>
+
 /*
  * Mutex protects:
  * 1) List of modules (also safely readable within RCU read section),
@@ -604,6 +606,7 @@ static const struct module_attribute modinfo_##field = {              \
 
 MODINFO_ATTR(version);
 MODINFO_ATTR(srcversion);
+MODINFO_ATTR(rhelversion);
 
 static void setup_modinfo_import_ns(struct module *mod, const char *s)
 {
@@ -1086,6 +1089,7 @@ const struct module_attribute *const modinfo_attrs[] = {
 	&module_uevent,
 	&modinfo_version,
 	&modinfo_srcversion,
+	&modinfo_rhelversion,
 	&modinfo_import_ns,
 	&modinfo_initstate,
 	&modinfo_coresize,
@@ -3407,6 +3411,11 @@ static int early_mod_check(struct load_info *info, int flags)
 		return -EPERM;
 	}
 
+#ifdef CONFIG_RHEL_DIFFERENCES
+	if (get_modinfo(info, "intree"))
+		module_rh_check_status(info->name);
+#endif
+
 	err = rewrite_section_headers(info, flags);
 	if (err)
 		return err;
@@ -3987,6 +3996,10 @@ void print_modules(void)
 		pr_cont(" [last unloaded: %s%s]", last_unloaded_module.name,
 			last_unloaded_module.taints);
 	pr_cont("\n");
+
+#ifdef CONFIG_RHEL_DIFFERENCES
+	rh_print_flags();
+#endif
 }
 
 #ifdef CONFIG_MODULE_DEBUGFS
diff --git a/kernel/module/signing.c b/kernel/module/signing.c
index 590ba29c85ab..02153d857531 100644
--- a/kernel/module/signing.c
+++ b/kernel/module/signing.c
@@ -61,10 +61,17 @@ int mod_verify_sig(const void *mod, struct load_info *info)
 	modlen -= sig_len + sizeof(ms);
 	info->len = modlen;
 
-	return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+	ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
 				      VERIFY_USE_SECONDARY_KEYRING,
 				      VERIFYING_MODULE_SIGNATURE,
 				      NULL, NULL);
+	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+		ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
+				VERIFY_USE_PLATFORM_KEYRING,
+				VERIFYING_MODULE_SIGNATURE,
+				NULL, NULL);
+	}
+	return ret;
 }
 
 int module_sig_check(struct load_info *info, int flags)
diff --git a/kernel/panic.c b/kernel/panic.c
index 213725b612aa..a823d01f1f05 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -826,6 +826,18 @@ const struct taint_flag taint_flags[TAINT_FLAGS_COUNT] = {
 	TAINT_FLAG(RANDSTRUCT,			'T', ' '),
 	TAINT_FLAG(TEST,			'N', ' '),
 	TAINT_FLAG(FWCTL,			'J', ' '),
+	TAINT_FLAG(20,				'?', '-'),
+	TAINT_FLAG(21,				'?', '-'),
+	TAINT_FLAG(22,				'?', '-'),
+	TAINT_FLAG(23,				'?', '-'),
+	TAINT_FLAG(24,				'?', '-'),
+	TAINT_FLAG(25,				'?', '-'),
+	TAINT_FLAG(PARTNER_SUPPORTED,		'p', ' '),
+	TAINT_FLAG(SUPPORT_REMOVED,		'h', ' '),
+	TAINT_FLAG(RESERVED28,			'?', '-'),
+	TAINT_FLAG(RESERVED29,			'?', '-'),
+	TAINT_FLAG(RESERVED30,			'?', '-'),
+	TAINT_FLAG(UNPRIVILEGED_BPF,		'u', ' '),
 };
 
 #undef TAINT_FLAG
diff --git a/kernel/rh_flags.c b/kernel/rh_flags.c
new file mode 100644
index 000000000000..10d26958f840
--- /dev/null
+++ b/kernel/rh_flags.c
@@ -0,0 +1,115 @@
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/rh_flags.h>
+
+#define RH_FLAG_NAME_LEN	32
+#define MAX_RH_FLAGS		128
+#define MAX_RH_FLAG_NAME_LEN	(MAX_RH_FLAGS * RH_FLAG_NAME_LEN)
+
+struct rh_flag {
+	struct list_head list;
+	char name[RH_FLAG_NAME_LEN];
+};
+
+static LIST_HEAD(rh_flag_list);
+static DEFINE_SPINLOCK(rh_flag_lock);
+
+bool __rh_add_flag(const char *flag_name)
+{
+	struct rh_flag *feat, *iter;
+
+	BUG_ON(in_interrupt());
+	feat = kzalloc(sizeof(*feat), GFP_ATOMIC);
+	if (WARN(!feat, "Adding Red Hat flag %s.\n", flag_name))
+		return false;
+	strscpy(feat->name, flag_name, RH_FLAG_NAME_LEN);
+
+	spin_lock(&rh_flag_lock);
+	list_for_each_entry_rcu(iter, &rh_flag_list, list) {
+		if (!strcmp(iter->name, flag_name)) {
+			kfree(feat);
+			feat = NULL;
+			break;
+		}
+	}
+	if (feat)
+		list_add_rcu(&feat->list, &rh_flag_list);
+	spin_unlock(&rh_flag_lock);
+
+	if (feat)
+		pr_info("Adding Red Hat flag %s.\n", flag_name);
+	return true;
+}
+EXPORT_SYMBOL(__rh_add_flag);
+
+void rh_print_flags(void)
+{
+	struct rh_flag *feat;
+
+	/*
+	 * This function cannot do any locking, we're oopsing. Traversing
+	 * rh_flag_list is okay, though, even without the rcu_read_lock
+	 * taken: we never delete from that list and thus don't need the
+	 * delayed free. All we need are the smp barriers invoked by the rcu
+	 * list manipulation routines.
+	 */
+	if (list_empty(&rh_flag_list))
+		return;
+	printk(KERN_DEFAULT "Red Hat flags:");
+	list_for_each_entry_lockless(feat, &rh_flag_list, list) {
+		pr_cont(" %s", feat->name);
+	}
+	pr_cont("\n");
+}
+EXPORT_SYMBOL(rh_print_flags);
+
+#ifdef CONFIG_SYSCTL
+static int rh_flags_show(const struct ctl_table *ctl, int write,
+			    void __user *buffer, size_t *lenp,
+			    loff_t *ppos)
+{
+	struct ctl_table tbl = { .maxlen = MAX_RH_FLAG_NAME_LEN, };
+	struct rh_flag *feat;
+	size_t offs = 0;
+	int ret;
+
+	tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL);
+	if (!tbl.data)
+		return -ENOMEM;
+	((char *)tbl.data)[0] = '\0';
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(feat, &rh_flag_list, list) {
+		offs += scnprintf(tbl.data + offs, tbl.maxlen - offs, "%s%s",
+				  offs == 0 ? "" : " ", feat->name);
+	}
+	rcu_read_unlock();
+
+	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
+	kfree(tbl.data);
+	return ret;
+}
+
+static struct ctl_table rh_flags_table[] = {
+	{
+		.procname = "rh_flags",
+		.data = &rh_flag_list,
+		.maxlen = MAX_RH_FLAG_NAME_LEN,
+		.mode = 0444,
+		.proc_handler = rh_flags_show,
+	},
+};
+#endif
+
+static __init int rh_flags_init(void)
+{
+#ifdef CONFIG_SYSCTL
+	register_sysctl_init("kernel", rh_flags_table);
+#endif
+	return 0;
+}
+subsys_initcall(rh_flags_init);
diff --git a/kernel/rh_messages.c b/kernel/rh_messages.c
new file mode 100644
index 000000000000..bb69e8965748
--- /dev/null
+++ b/kernel/rh_messages.c
@@ -0,0 +1,414 @@
+/*
+ * The following functions are used by Red Hat to indicate to users that
+ * hardware and drivers are unsupported, or have limited support in RHEL major
+ * and minor releases.  These functions output loud warning messages to the end
+ * user and should be USED WITH CAUTION.
+ *
+ * Any use of these functions _MUST_ be documented in the RHEL Release Notes,
+ * and have approval of management.
+ *
+ * Generally, the process of disabling a driver or device in RHEL requires the
+ * driver or device to be marked as 'deprecated' in all existing releases, and
+ * then either 'unmaintained' or 'disabled' in a future release.
+ *
+ * In general, deprecated and unmaintained drivers continue to receive security
+ * related fixes until they are disabled.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include "rh_messages.h"
+
+/**
+ * mark_hardware_unmaintained() - Mark hardware as unmaintained.
+ * @driver_name: driver name
+ * @fmt: format for device description
+ * @...: args for device description
+ *
+ * Called to notify users that the device will no longer be tested on a routine
+ * basis and driver code associated with this device is no longer being updated.
+ * Red Hat may, at their own discretion, fix security-related and critical
+ * issues.  Support for this device will be disabled in a future major release
+ * and users deploying this device should plan to replace the device in
+ * production systems.
+ *
+ * This function should be used when the driver's usage can be tied to a
+ * specific hardware device.  For example, a network device driver loading on a
+ * specific device that is no longer maintained by the manufacturer.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+void __maybe_unused mark_hardware_unmaintained(const char *driver_name, char *fmt, ...)
+{
+	char device_description[DEV_DESC_LEN];
+	va_list args;
+
+	va_start(args, fmt);
+	vsnprintf(device_description, DEV_DESC_LEN, fmt, args);
+	pr_crit(RH_UNMAINT_HW,
+		driver_name, device_description);
+	va_end(args);
+}
+EXPORT_SYMBOL(mark_hardware_unmaintained);
+
+/**
+ * mark_hardware_deprecated() - Mark hardware as deprecated.
+ * @driver_name: driver name
+ * @fmt: format for device description
+ * @...: args for device description
+ *
+ * Called to notify users that support for the device is planned to be
+ * unmaintained in a future major release, and will eventually be disabled in a
+ * future major release.  This device should not be used in new production
+ * environments and users should replace the device in production systems.
+ *
+ * This function should be used when the driver's usage can be tied to a
+ * specific hardware device.  For example, a network device driver loading on a
+ * specific device that is no longer maintained by the manufacturer.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+void __maybe_unused mark_hardware_deprecated(const char *driver_name, char *fmt, ...)
+{
+	char device_description[DEV_DESC_LEN];
+	va_list args;
+
+	va_start(args, fmt);
+	vsnprintf(device_description, DEV_DESC_LEN, fmt, args);
+	pr_crit(RH_DEPRECATED_HW,
+		driver_name, device_description);
+	va_end(args);
+}
+
+/**
+ * mark_hardware_disabled() - Mark a driver as removed.
+ * @driver_name: driver name
+ * @fmt: format for device description
+ * @...: args for device description
+ *
+ * Called to notify users that a device's support has been completely disabled
+ * and no future support updates will occur.  This device cannot be used in new
+ * production environments, and users must replace the device in production
+ * systems.
+ *
+ * This function should be used when the driver's usage can be tied to a
+ * specific hardware device.  For example, a network device driver loading on a
+ * specific device that is no longer maintained by the manufacturer.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+static void __maybe_unused mark_hardware_disabled(const char *driver_name, char *fmt, ...)
+{
+	char device_description[DEV_DESC_LEN];
+	va_list args;
+
+	va_start(args, fmt);
+	vsnprintf(device_description, DEV_DESC_LEN, fmt, args);
+	pr_crit(RH_DISABLED_HW,
+		driver_name, device_description);
+	va_end(args);
+}
+
+#ifdef CONFIG_PCI
+/**
+ * pci_hw_deprecated() - Mark a PCI device deprecated.
+ * @dev: the PCI device structure to match against
+ *
+ * Called to check if this @dev is in the list of deprecated devices.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+static void __maybe_unused pci_hw_deprecated(struct pci_dev *dev)
+{
+	const struct pci_device_id *ret = pci_match_id(rh_deprecated_pci_devices, dev);
+
+	if (!ret)
+		return;
+
+	mark_hardware_deprecated(dev_driver_string(&dev->dev), "%04X:%04X @ %s",
+				 dev->device, dev->vendor, pci_name(dev));
+}
+
+/**
+ * pci_hw_unmaintained() - Mark a PCI device unmaintained.
+ * @dev: the PCI device structure to match against
+ *
+ * Called to check if this @dev is in the list of unmaintained devices.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+static void pci_hw_unmaintained(struct pci_dev *dev)
+{
+	const struct pci_device_id *ret = pci_match_id(rh_unmaintained_pci_devices, dev);
+
+	if (!ret)
+		return;
+
+	mark_hardware_unmaintained(dev_driver_string(&dev->dev), "%04X:%04X @ %s",
+				   dev->device, dev->vendor, pci_name(dev));
+}
+
+/**
+ * pci_hw_disabled() - Mark a PCI device disabled.
+ * @dev: the PCI device structure to match against
+ *
+ * Called to check if this @dev is in the list of disabled devices.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+static bool __maybe_unused pci_hw_disabled(struct pci_dev *dev)
+{
+	const struct pci_device_id *ret = pci_match_id(rh_disabled_pci_devices, dev);
+
+	if (!ret)
+		return false;
+
+	mark_hardware_disabled(dev_driver_string(&dev->dev), "%04X:%04X @ %s",
+				   dev->device, dev->vendor, pci_name(dev));
+	return true;
+}
+#endif
+
+/**
+ * driver_unmaintained() - check to see if a driver is unmaintained
+ * @module_name: module name
+ *
+ * Called to notify users that a driver will no longer be tested on a routine
+ * basis and the driver code is no longer being updated.  Red Hat may fix
+ * security-related and critical issues.  Support for this driver will be
+ * disabled in a future major release, and users should replace any affected
+ * devices in production systems.
+ *
+ * This function should be used when a driver's usage cannot be tied to a
+ * specific hardware device.  For example, a network bonding driver or a higher
+ * level storage layer driver that is no longer maintained upstream.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+static void __maybe_unused driver_unmaintained(const char* module_name)
+{
+	int i = 0;
+
+	while (rh_unmaintained_drivers[i]) {
+		if (strcmp(rh_unmaintained_drivers[i], module_name) == 0) {
+			pr_crit(RH_UNMAINT_DR, module_name);
+			return;
+		}
+		i++;
+	}
+}
+
+/**
+ * driver_deprecated() - check to see if a driver is deprecated
+ * @driver_name: module name
+ *
+ * Called to notify users that support for this driver is planned to be
+ * unmaintained in a future major release, and will eventually be disabled in a
+ * future major release.  This driver should not be used in new production
+ * environments and users should replace any affected devices in production
+ * systems.
+ *
+ * This function should be used when a driver's usage cannot be tied to a
+ * specific hardware device.  For example, a network bonding driver or a higher
+ * level storage layer driver that is no longer maintained upstream.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+static void __maybe_unused driver_deprecated(const char* module_name)
+{
+	int i = 0;
+
+	while (rh_deprecated_drivers[i]) {
+		if (strcmp(rh_deprecated_drivers[i], module_name) == 0) {
+			pr_crit(RH_DEPRECATED_DR, module_name);
+			return;
+		}
+		i++;
+	}
+}
+
+/* There is no driver_disabled() function.  Disabled drivers are configured off ;). */
+
+/**
+ * init_fn_unmaintained - check to see if a built-in driver is unmaintained.
+ * @fn_name: module's module_init function name
+ *
+ * Called to notify users that a built-in driver will no longer be tested on a routine
+ * basis and the built-in driver code is no longer being updated.  Red Hat may fix
+ * security-related and critical issues.  Support for this built-in driver will be
+ * disabled in a future major release, and users should replace any affected
+ * devices in production systems.
+ *
+ * This function should be used when a built-in driver's usage cannot be tied to a
+ * specific hardware device.  For example, a network bonding driver or a higher
+ * level storage layer driver that is no longer maintained upstream.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+
+static void __maybe_unused init_fn_unmaintained(char* fn_name)
+{
+	int i = 0;
+
+	while (rh_unmaintained_init_fns[i]) {
+		if (strcmp(rh_unmaintained_init_fns[i], fn_name) == 0) {
+			pr_crit(RH_UNMAINT_DR, fn_name);
+			return;
+		}
+		i++;
+	}
+}
+
+/**
+ * init_fn_deprecated() - check to see if a built-in driver is deprecated
+ * @fn_name: module's module_init function name
+ *
+ * Called to notify users that support for this built-in driver is planned to be
+ * unmaintained in a future major release, and will eventually be disabled in a
+ * future major release.  This driver should not be used in new production
+ * environments and users should replace any affected devices in production
+ * systems.
+ *
+ * This function should be used when a built-in driver's usage cannot be tied to a
+ * specific hardware device.  For example, a network bonding driver or a higher
+ * level storage layer driver that is no longer maintained upstream.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+static void __maybe_unused init_fn_deprecated(char* fn_name)
+{
+	int i = 0;
+
+	while (rh_deprecated_init_fns[i]) {
+		if (strcmp(rh_deprecated_init_fns[i], fn_name) == 0) {
+			pr_crit(RH_DEPRECATED_DR, fn_name);
+			return;
+		}
+		i++;
+	}
+}
+
+/**
+ * mark_tech_preview() - Mark driver or kernel subsystem as 'Tech Preview'
+ * @msg: Driver or kernel subsystem name
+ *
+ * Called to minimize the support status of a new driver.  This does TAINT the
+ * kernel.  Calling this function indicates that the driver or subsystem has
+ * had limited testing and is not marked for full support within this RHEL
+ * minor release.  The next RHEL minor release may contain full support for
+ * this driver.  Red Hat does not guarantee that bugs reported against this
+ * driver or subsystem will be resolved.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+void __maybe_unused mark_tech_preview(const char *msg, struct module *mod)
+{
+	const char *str = NULL;
+
+	if (msg)
+		str = msg;
+#ifdef CONFIG_MODULES
+	else if (mod)
+		str = mod->name;
+#endif
+
+	pr_warn(RH_TECH_PREVIEW, (str ? str : "kernel"));
+	add_taint(TAINT_AUX, LOCKDEP_STILL_OK);
+#ifdef CONFIG_MODULES
+	if (mod)
+		mod->taints |= (1U << TAINT_AUX);
+#endif
+}
+EXPORT_SYMBOL(mark_tech_preview);
+
+/**
+ * mark_partner_supported() - Mark driver or kernel subsystem as 'Partner Supported'
+ * @msg: Driver or kernel subsystem name
+ *
+ * Called to minimize the support status of a new driver.  This does TAINT the
+ * kernel.  Calling this function indicates that the driver or subsystem
+ * is not supported directly by Red Hat but by a partner engineer.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+void __maybe_unused mark_partner_supported(const char *msg, struct module *mod)
+{
+        const char *str = NULL;
+
+        if (msg)
+                str = msg;
+#ifdef CONFIG_MODULES
+	else if (mod)
+		str = mod->name;
+#endif
+
+        pr_warn(RH_PARTNER_SUPPORTED, (str ? str : "kernel"));
+        add_taint(TAINT_PARTNER_SUPPORTED, LOCKDEP_STILL_OK);
+#ifdef CONFIG_MODULES
+        if (mod)
+                mod->taints |= (1U << TAINT_PARTNER_SUPPORTED);
+#endif
+}
+EXPORT_SYMBOL(mark_partner_supported);
+
+/*
+ *
+ * Functions called by 'main' kernel code.
+ *
+ */
+
+#ifdef CONFIG_PCI
+/**
+ * pci_rh_check_status - checks the status of a PCI device.
+ * @pci_dev: PCI device to be examined
+ *
+ * This function is called by the PCI driver subsystem to check the status of a
+ * PCI device.
+ *
+ * This function returns true if the PCI device is disabled, and false otherwise.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+bool __maybe_unused pci_rh_check_status(struct pci_dev *pci_dev)
+{
+	if (pci_dev->driver->driver.owner != NULL) {
+		if (!test_bit(TAINT_OOT_MODULE, &pci_dev->driver->driver.owner->taints)) {
+			pci_hw_unmaintained(pci_dev);
+			pci_hw_deprecated(pci_dev);
+			return pci_hw_disabled(pci_dev);
+		}
+	}
+	return false;
+}
+#endif
+
+/** module_rh_check_status - checks the status of a module.
+ * @module_name: Name of module to be examined
+ *
+ * This function is called by the module loading code to check the status of a
+ * module.
+ *
+ * Reserved for Internal Red Hat use only.
+ */
+void __maybe_unused module_rh_check_status(const char * module_name)
+{
+	driver_unmaintained(module_name);
+	driver_deprecated(module_name);
+}
+
+/**
+  * init_rh_check_status - checks the status of a built-in module.
+  * @fn_name: init function of module to be examined
+  *
+  * This function is called by the init code to check the status of a built-in module.
+  * When a module is built-in, the module_init() function is converted into an initcall.
+  * The initcall is the called during boot with the other system initcalls.
+  *
+  * Reserved for Internal Red Hat use only.
+  */
+void __maybe_unused init_rh_check_status(char *fn_name)
+{
+	init_fn_deprecated(fn_name);
+	init_fn_unmaintained(fn_name);
+}
diff --git a/kernel/rh_messages.h b/kernel/rh_messages.h
new file mode 100644
index 000000000000..117354de4c59
--- /dev/null
+++ b/kernel/rh_messages.h
@@ -0,0 +1,335 @@
+/*
+ * WARNING: This file is auto-generated by an internal Red Hat script and,
+ * in general, should not be modified by hand.
+ * See: https://gitlab.com/redhat/rhel/src/kernel/hardware-removal-support
+ */
+
+/*
+ * The following tables are used by Red Hat to define what hardware and drivers
+ * are unsupported, or have limited support in RHEL major and minor releases.
+ *
+ * Generally, the process of disabling a driver or device in RHEL requires the
+ * driver or device to be marked as 'deprecated' in all existing releases, and
+ * then either 'unmaintained' or 'disabled' in a future release.
+ *
+ * In general, deprecated and unmaintained drivers continue to receive security
+ * related fixes until they are disabled.
+ */
+ 
+#ifndef __RH_MESSAGES_H
+#define __RH_MESSAGES_H
+
+#include <linux/version.h>
+#include <linux/pci.h>
+
+#define DEV_DESC_LEN 256
+
+#define RH_UNMAINT_HW "Warning: Unmaintained Hardware is detected: %s:%s\n"
+
+#define RH_UNMAINT_DR "Warning: Unmaintained driver is detected: %s\n"
+
+#define RH_DEPRECATED_HW "Warning: Deprecated Hardware is detected: %s:%s " \
+			 "will not be maintained in a future major release " \
+			 "and may be disabled\n"
+
+#define RH_DEPRECATED_DR "Warning: Deprecated Driver is detected: %s will " \
+			 "not be maintained in a future major release and " \
+			 "may be disabled\n"
+
+#define RH_DISABLED_HW "Warning: Disabled Hardware is detected: %s:%s is " \
+		       "no longer enabled in this release.\n"
+
+#define RH_TECH_PREVIEW "TECH PREVIEW: %s may not be fully supported.\n" \
+			"Please review provided documentation for " \
+			"limitations.\n"
+
+#define RH_PARTNER_SUPPORTED "Warning: %s is a Partner supported GPL " \
+			     "module and not supported directly by Red Hat.\n"
+
+static const char *rh_deprecated_drivers[] = {
+	0     /* Terminating entry */
+};
+
+static const char *rh_deprecated_init_fns[] = {
+	0     /* Terminating entry */
+};
+
+static const char *rh_unmaintained_drivers[] = {
+	"aacraid",
+	"af_key",
+	"ahci_seattle",
+	"ahci_xgene",
+	"arp_tables",
+	"bnx2",
+	"bnx2fc",
+	"bnx2i",
+	"bnx2x",
+	"cnic",
+	"dl2k",
+	"e1000",
+	"ebtables",
+	"hdlc_fr",
+	"hisi_sas_main",
+	"hpsa",
+	"ip6_tables",
+	"ip_set",
+	"ip_tables",
+	"mptbase",
+	"mptsas",
+	"mptscsih",
+	"mptspi",
+	"myri10ge",
+	"netxen_nic",
+	"nft_compat",
+	"nicpf",
+	"nicvf",
+	"nvmet_fc",
+	"nvmet_tcp",
+	"team",
+	0     /* Terminating entry */
+};
+
+static const char *rh_unmaintained_init_fns[] = {
+	"bnx2_pci_driver_init",
+	"e1000_init_module",
+	"rio_driver_init",
+	"hpsa_init",
+	"fusion_init",
+	"mptsas_init",
+	"fusion_init",
+	"mptspi_init",
+	"myri10ge_init_module",
+	"netxen_init_module",
+	"hdlc_fr_init",
+	"nvmet_fc_init_module",
+	"nvmet_tcp_init",
+	"team_module_init",
+	"ebtables_init",
+	"arp_tables_init",
+	"ip_tables_init",
+	"ip6_tables_init",
+	"ip_set_init",
+	"nft_compat_module_init",
+	"nicvf_init_module",
+	"nic_init_module",
+	"ipsec_pfkey_init",
+	"aac_init",
+	"cnic_init",
+	"bnx2x_init",
+	"bnx2fc_mod_init",
+	"bnx2i_mod_init",
+	"ahci_seattle_probe",
+	"xgene_ahci_probe",
+	"hisi_sas_init",
+	0     /* Terminating entry */
+};
+
+static const struct pci_device_id rh_deprecated_pci_devices[] = {
+	{0}     /* Terminating entry */
+};
+
+static const struct pci_device_id rh_disabled_pci_devices[] = {
+	{ 0x1011, 0x0046, 0x103c, 0x10c2 },
+	{ 0x1011, 0x0046, 0x9005, 0x0364 },
+	{ 0x1011, 0x0046, 0x9005, 0x0365 },
+	{ 0x1011, 0x0046, 0x9005, 0x1364 },
+	{ 0x1028, 0x0001, 0x1028, 0x0001 },
+	{ 0x1028, 0x0002, 0x1028, 0x0002 },
+	{ 0x1028, 0x0002, 0x1028, 0x00d1 },
+	{ 0x1028, 0x0002, 0x1028, 0x00d9 },
+	{ 0x1028, 0x0003, 0x1028, 0x0003 },
+	{ 0x1028, 0x0004, 0x1028, 0x00d0 },
+	{ 0x1028, 0x000a, 0x1028, 0x0106 },
+	{ 0x1028, 0x000a, 0x1028, 0x011b },
+	{ 0x1028, 0x000a, 0x1028, 0x0121 },
+	{ 0x9005, 0x0200, 0x9005, 0x0200 },
+	{ 0x9005, 0x0283, 0x9005, 0x0283 },
+	{ 0x9005, 0x0284, 0x9005, 0x0284 },
+	{ 0x9005, 0x0285, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x9005, 0x0285, 0x1014, 0x02F2 },
+	{ 0x9005, 0x0285, 0x1014, 0x0312 },
+	{ 0x9005, 0x0285, 0x1028, PCI_ANY_ID },
+	{ 0x9005, 0x0285, 0x1028, 0x0287 },
+	{ 0x9005, 0x0285, 0x1028, 0x0291 },
+	{ 0x9005, 0x0285, 0x103C, 0x3227 },
+	{ 0x9005, 0x0285, 0x17aa, PCI_ANY_ID },
+	{ 0x9005, 0x0285, 0x17aa, 0x0286 },
+	{ 0x9005, 0x0285, 0x17aa, 0x0287 },
+	{ 0x9005, 0x0285, 0x9005, 0x0285 },
+	{ 0x9005, 0x0285, 0x9005, 0x0286 },
+	{ 0x9005, 0x0285, 0x9005, 0x0287 },
+	{ 0x9005, 0x0285, 0x9005, 0x0288 },
+	{ 0x9005, 0x0285, 0x9005, 0x0289 },
+	{ 0x9005, 0x0285, 0x9005, 0x028a },
+	{ 0x9005, 0x0285, 0x9005, 0x028b },
+	{ 0x9005, 0x0285, 0x9005, 0x028e },
+	{ 0x9005, 0x0285, 0x9005, 0x028f },
+	{ 0x9005, 0x0285, 0x9005, 0x0290 },
+	{ 0x9005, 0x0285, 0x9005, 0x0291 },
+	{ 0x9005, 0x0285, 0x9005, 0x0292 },
+	{ 0x9005, 0x0285, 0x9005, 0x0293 },
+	{ 0x9005, 0x0285, 0x9005, 0x0294 },
+	{ 0x9005, 0x0285, 0x9005, 0x0296 },
+	{ 0x9005, 0x0285, 0x9005, 0x0297 },
+	{ 0x9005, 0x0285, 0x9005, 0x0298 },
+	{ 0x9005, 0x0285, 0x9005, 0x0299 },
+	{ 0x9005, 0x0285, 0x9005, 0x029a },
+	{ 0x9005, 0x0285, 0x9005, 0x02a4 },
+	{ 0x9005, 0x0285, 0x9005, 0x02a5 },
+	{ 0x9005, 0x0286, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x9005, 0x0286, 0x1014, 0x9540 },
+	{ 0x9005, 0x0286, 0x1014, 0x9580 },
+	{ 0x9005, 0x0286, 0x9005, 0x028c },
+	{ 0x9005, 0x0286, 0x9005, 0x028d },
+	{ 0x9005, 0x0286, 0x9005, 0x029b },
+	{ 0x9005, 0x0286, 0x9005, 0x029c },
+	{ 0x9005, 0x0286, 0x9005, 0x029d },
+	{ 0x9005, 0x0286, 0x9005, 0x029e },
+	{ 0x9005, 0x0286, 0x9005, 0x029f },
+	{ 0x9005, 0x0286, 0x9005, 0x02a0 },
+	{ 0x9005, 0x0286, 0x9005, 0x02a1 },
+	{ 0x9005, 0x0286, 0x9005, 0x02a2 },
+	{ 0x9005, 0x0286, 0x9005, 0x02a3 },
+	{ 0x9005, 0x0286, 0x9005, 0x02a6 },
+	{ 0x9005, 0x0286, 0x9005, 0x0800 },
+	{ 0x9005, 0x0287, 0x9005, 0x0800 },
+	{ 0x9005, 0x0288, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0x0222, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0x0712, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0x212, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0x702, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0x703, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0x0700, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0x0211, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0x0710, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0x0221, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0xe220, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0x1ae5, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xe100, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xe131, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xe180, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xe260, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf095, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf098, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf0a1, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf0a5, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf0d1, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf0d5, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf0e1, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf0e5, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf0f5, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf0f6, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf0f7, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf180, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf700, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf800, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf900, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf980, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfa00, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfb00, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfc00, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfc10, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfc20, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfc50, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfd00, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfd11, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfd12, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfe00, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfe05, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfe11, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfe12, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0x0704, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x19a2, 0x0714, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xe208, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xe268, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0060, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0078, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x007C, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0411, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0413, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1028, 0x0015, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x1002, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x6340, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x634A, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x6354, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x6368, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x6372, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x6732, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x673C, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x6746, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x6750, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x675A, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x6764, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x676E, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x1003, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x1004, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x1005, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x1006, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x1007, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x1008, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x1009, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x100a, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x100b, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x100c, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x100d, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x100e, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x100f, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x1010, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x1027, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x15B3, 0x2101, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0064, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0065, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0070, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0072, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0074, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0076, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0077, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x007E, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x2422, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x2432, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x5422, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x5432, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x8001, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x8021, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x8044, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x8432, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0xF000, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x8022, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x8032, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x8042, PCI_ANY_ID, PCI_ANY_ID },
+	{0}     /* Terminating entry */
+};
+
+static const struct pci_device_id rh_unmaintained_pci_devices[] = {
+	{ 0x10df, 0xe220, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0x0724, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xe200, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf011, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf015, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xf100, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x10df, 0xfc40, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x005b, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0071, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0073, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0079, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x006E, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0080, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0081, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0082, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0083, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0084, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0085, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0086, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1000, 0x0087, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x177d, 0xa01e, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x177d, 0xa034, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x177d, 0x0011, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x2031, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x2532, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1077, 0x8031, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1924, 0x0803, PCI_ANY_ID, PCI_ANY_ID },
+	{ 0x1924, 0x0813, PCI_ANY_ID, PCI_ANY_ID },
+	{0}     /* Terminating entry */
+};
+
+#endif /* __RH_MESSAGES_H */
diff --git a/kernel/rh_waived.c b/kernel/rh_waived.c
new file mode 100644
index 000000000000..20966f7c7277
--- /dev/null
+++ b/kernel/rh_waived.c
@@ -0,0 +1,147 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * kernel/rh_waived.c
+ *
+ * rh_waived cmdline parameter support.
+ *
+ * Copyright (C) 2024, Red Hat, Inc.  Ricardo Robaina <rrobaina@redhat.com>
+ */
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/printk.h>
+#include <linux/string.h>
+#include <linux/panic.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/rh_flags.h>
+#include <linux/rh_waived.h>
+
+/*
+ * * RH_INSERT_WAIVED_ITEM
+ *   This macro is intended to be used to insert items into the
+ *   rh_waived_list array. It expects to get an item from
+ *   enum rh_waived_items as its first argument, and a string
+ *   holding the feature name as its second argument.
+ *
+ *   The feature name is also utilized as the token for the
+ *   boot parameter parser.
+ *
+ *   Example usage:
+ *   struct rh_waived_item foo[RH_WAIVED_FEAT_ITEMS] = {
+ *     RH_INSERT_WAIVED_ITEM(FOO_FEAT, "foo_feat_short_str", "alias", RH_WAIVED_FEAT),
+ *   };
+ */
+#define RH_INSERT_WAIVED_ITEM(enum_item, item, item_alt, class)                \
+       [(enum_item)] = { .name = (item), .alias = (item_alt),          \
+                         .type = (class), .waived = 0, }
+
+/* Indicates if the rh_flag 'rh_waived' should be added. */
+bool __initdata add_rh_flag = false;
+
+typedef enum {
+       RH_WAIVED_FEAT,
+       RH_WAIVED_CVE,
+       RH_WAIVED_ANY
+} rh_waived_t;
+
+struct rh_waived_item {
+       char *name, *alias;
+       rh_waived_t type;
+       unsigned int waived;
+
+};
+
+/* Always use the marco RH_INSERT_WAIVED to insert items to this array. */
+struct rh_waived_item rh_waived_list[RH_WAIVED_ITEMS] = {
+};
+
+/*
+ * is_rh_waived() - Checks if a given item has been marked as waived.
+ *
+ * @item: waived item.
+ */
+__inline__ bool is_rh_waived(enum rh_waived_items item)
+{
+	return !!rh_waived_list[item].waived;
+}
+EXPORT_SYMBOL(is_rh_waived);
+
+static void __init rh_waived_parser(char *s, rh_waived_t type)
+{
+	int i;
+	char *token;
+
+	pr_info(KERN_CONT "rh_waived: ");
+
+	if (!s) {
+		for (i = 0; i < RH_WAIVED_ITEMS; i++) {
+			if (type != RH_WAIVED_ANY && rh_waived_list[i].type != type)
+				continue;
+
+			rh_waived_list[i].waived = 1;
+			pr_info(KERN_CONT "%s%s", rh_waived_list[i].name,
+				i < RH_WAIVED_ITEMS - 1 ? " " : "\n");
+		}
+
+		add_rh_flag = true;
+		return;
+	}
+
+	while ((token = strsep(&s, ",")) != NULL) {
+		for (i = 0; i < RH_WAIVED_ITEMS; i++) {
+			char *alias = rh_waived_list[i].alias;
+
+			if (type != RH_WAIVED_ANY && rh_waived_list[i].type != type)
+				continue;
+
+			if (!strcmp(token, rh_waived_list[i].name) ||
+			    (alias && !strcmp(token, alias))) {
+				rh_waived_list[i].waived = 1;
+				pr_info(KERN_CONT "%s ", rh_waived_list[i].name);
+			}
+		}
+	}
+
+	pr_info(KERN_CONT "\n");
+	add_rh_flag = true;
+}
+
+static int __init rh_waived_setup(char *s)
+{
+	/*
+	 * originally, if no string was passed to the cmdline option
+	 * all listed features would be waived, so we keep that same
+	 * compromise with the new contract.
+	 */
+	if (!s || !strcmp(s, "features")) {
+		rh_waived_parser(NULL, RH_WAIVED_FEAT);
+		return 0;
+	}
+
+	/* waive all possible mitigations in the list */
+	if (!strcmp(s, "cves")) {
+		rh_waived_parser(NULL, RH_WAIVED_CVE);
+		return 0;
+	}
+
+	/* otherwise, just deal with the enumerated waive list */
+	rh_waived_parser(s, RH_WAIVED_ANY);
+
+	return 0;
+}
+early_param("rh_waived", rh_waived_setup);
+
+/*
+ * rh_flags is initialized at subsys_initcall, calling rh_add_flag()
+ * from rh_waived_setup() would result in a can't boot situation.
+ * Deffering the inclusion 'rh_waived' rh_flag to late_initcall to
+ * avoid this issue.
+ */
+static int __init __add_rh_flag(void)
+{
+	if (add_rh_flag)
+		rh_add_flag("rh_waived");
+
+	return 0;
+}
+late_initcall(__add_rh_flag);
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 0a4fdd8bd975..dcb12dad419f 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -207,7 +207,10 @@ objtool-args-$(CONFIG_STACK_VALIDATION)			+= --stackval
 objtool-args-$(CONFIG_HAVE_STATIC_CALL_INLINE)		+= --static-call
 objtool-args-$(CONFIG_HAVE_UACCESS_VALIDATION)		+= --uaccess
 objtool-args-$(or $(CONFIG_GCOV_KERNEL),$(CONFIG_KCOV))	+= --no-unreachable
+# RHEL-only: don't enforce OBJTOOL_WERROR for out of tree modules
+ifeq ($(KBUILD_EXTMOD),)
 objtool-args-$(CONFIG_OBJTOOL_WERROR)			+= --werror
+endif
 
 objtool-args = $(objtool-args-y)					\
 	$(if $(delay-objtool), --link)					\
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 75374c64b8cc..62f1549582fd 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -27,6 +27,7 @@
 #include <xalloc.h>
 #include "modpost.h"
 #include "../../include/linux/license.h"
+#include "../../include/generated/uapi/linux/version.h"
 
 #define MODULE_NS_PREFIX "module:"
 
@@ -2067,6 +2068,12 @@ static void write_buf(struct buffer *b, const char *fname)
 	}
 }
 
+static void add_rhelversion(struct buffer *b, struct module *mod)
+{
+	buf_printf(b, "MODULE_INFO(rhelversion, \"%d.%d\");\n", RHEL_MAJOR,
+		   RHEL_MINOR);
+}
+
 static void write_if_changed(struct buffer *b, const char *fname)
 {
 	char *tmp;
@@ -2151,6 +2158,7 @@ static void write_mod_c_file(struct module *mod)
 	}
 
 	add_srcversion(&buf, mod);
+	add_rhelversion(&buf, mod);
 
 	ret = snprintf(fname, sizeof(fname), "%s.mod.c", mod->name);
 	if (ret >= sizeof(fname)) {
diff --git a/scripts/tags.sh b/scripts/tags.sh
index 41e38df96984..d35505058ebb 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -16,6 +16,8 @@ fi
 ignore="$(echo "$RCS_FIND_IGNORE" | sed 's|\\||g' )"
 # tags and cscope files should also ignore MODVERSION *.mod.c files
 ignore="$ignore ( -name *.mod.c ) -prune -o"
+# RHEL tags and cscope should also ignore redhat/rpm
+ignore="$ignore ( -path redhat/rpm ) -prune -o"
 
 # ignore arbitrary directories
 if [ -n "${IGNORE_DIRS}" ]; then
diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index c0d6948446c3..bed56532e206 100644
--- a/security/integrity/platform_certs/load_uefi.c
+++ b/security/integrity/platform_certs/load_uefi.c
@@ -74,7 +74,8 @@ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
 		return NULL;
 
 	if (*status != EFI_BUFFER_TOO_SMALL) {
-		pr_err("Couldn't get size: 0x%lx\n", *status);
+		pr_err("Couldn't get size: %s (0x%lx)\n",
+		       efi_status_to_str(*status), *status);
 		return NULL;
 	}
 
@@ -85,7 +86,8 @@ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
 	*status = efi.get_variable(name, guid, NULL, &lsize, db);
 	if (*status != EFI_SUCCESS) {
 		kfree(db);
-		pr_err("Error reading db var: 0x%lx\n", *status);
+		pr_err("Error reading db var: %s (0x%lx)\n",
+		       efi_status_to_str(*status), *status);
 		return NULL;
 	}
 
diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig
index e84ddf484010..d0501353a4b9 100644
--- a/security/lockdown/Kconfig
+++ b/security/lockdown/Kconfig
@@ -16,6 +16,19 @@ config SECURITY_LOCKDOWN_LSM_EARLY
 	  subsystem is fully initialised. If enabled, lockdown will
 	  unconditionally be called before any other LSMs.
 
+config LOCK_DOWN_IN_EFI_SECURE_BOOT
+	bool "Lock down the kernel in EFI Secure Boot mode"
+	default n
+	depends on EFI && SECURITY_LOCKDOWN_LSM_EARLY
+	help
+	  UEFI Secure Boot provides a mechanism for ensuring that the firmware
+	  will only load signed bootloaders and kernels.  Secure boot mode may
+	  be determined from EFI variables provided by the system firmware if
+	  not indicated by the boot parameters.
+
+	  Enabling this option results in kernel lockdown being triggered if
+	  EFI Secure Boot is set.
+
 choice
 	prompt "Kernel default lockdown mode"
 	default LOCK_DOWN_KERNEL_FORCE_NONE
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 8d46886d2cca..14a9cdff942b 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c
@@ -72,6 +72,17 @@ static int lockdown_is_locked_down(enum lockdown_reason what)
 	return 0;
 }
 
+/**
+ * security_lock_kernel_down() - Put the kernel into lock-down mode.
+ *
+ * @where: Where the lock-down is originating from (e.g. command line option)
+ * @level: The lock-down level (can only increase)
+ */
+int security_lock_kernel_down(const char *where, enum lockdown_reason level)
+{
+	return lock_kernel_down(where, level);
+}
+
 static struct security_hook_list lockdown_hooks[] __ro_after_init = {
 	LSM_HOOK_INIT(locked_down, lockdown_is_locked_down),
 };
diff --git a/tools/testing/selftests/bpf/DENYLIST.rhel b/tools/testing/selftests/bpf/DENYLIST.rhel
new file mode 100644
index 000000000000..9424a83c6f48
--- /dev/null
+++ b/tools/testing/selftests/bpf/DENYLIST.rhel
@@ -0,0 +1,76 @@
+# Tests that need CONFIG_FUNCTION_ERROR_INJECTION
+# Typical observed errors are:
+#     <...some function...> is not sleepable
+#     <...some function...> is not modifiable
+cgrp_local_storage/yes_rcu_lock
+cgrp_local_storage/no_rcu_lock
+cgrp_local_storage/cgrp1_yes_rcu_lock
+cgrp_local_storage/cgrp1_no_rcu_lock
+compute_live_registers/addr_space_cast
+dynptr/test_read_write
+dynptr/test_dynptr_data
+dynptr/test_dynptr_copy
+dynptr/test_dynptr_copy_xdp
+dynptr/test_dynptr_memset_zero
+dynptr/test_dynptr_memset_notzero
+dynptr/test_dynptr_memset_zero_offset
+dynptr/test_dynptr_memset_zero_adjusted
+dynptr/test_dynptr_memset_overflow
+dynptr/test_dynptr_memset_overflow_offset
+dynptr/test_dynptr_memset_readonly
+dynptr/test_dynptr_memset_xdp_chunks
+dynptr/test_dynptr_skb_meta_data
+dynptr/test_dynptr_skb_meta_flags
+dynptr/test_ringbuf
+dynptr/test_skb_readonly
+dynptr/test_dynptr_skb_data
+dynptr/test_adjust
+dynptr/test_adjust_err
+dynptr/test_zero_size_dynptr
+dynptr/test_dynptr_is_null
+dynptr/test_dynptr_is_rdonly
+dynptr/test_dynptr_clone
+dynptr/test_dynptr_skb_no_buff
+dynptr/test_dynptr_skb_strcmp
+dynptr/test_dynptr_skb_tp_btf
+dynptr/test_probe_read_user_dynptr
+dynptr/test_probe_read_kernel_dynptr
+dynptr/test_probe_read_user_str_dynptr
+dynptr/test_probe_read_kernel_str_dynptr
+dynptr/test_copy_from_user_dynptr
+dynptr/test_copy_from_user_str_dynptr
+dynptr/test_copy_from_user_task_dynptr
+dynptr/test_copy_from_user_task_str_dynptr
+irq/irq_sleepable_helper
+irq/irq_sleepable_kfunc
+iters/iter_css_task_for_each_sleep
+iters/iter_ret_rcu_test_protected
+iters/iter_ret_rcu_test_type
+iters/iter_ret_rcu_test_protected_nostruct
+iters/iter_ret_rcu_test_type_nostruct
+iters/task
+iters/css
+iters/iter_tasks_without_lock
+iters/iter_css_without_lock
+iters/iter_tasks_lock_and_unlock
+iters/iter_css_lock_and_unlock
+map_excl/map_excl_allowed
+map_in_map/sleepable_acc_map_in_array
+map_in_map/sleepable_acc_map_in_htab
+mem_rdonly_untrusted/helper_param_not_ok
+module_attach
+preempt_lock/preempt_sleepable_helper
+preempt_lock/preempt_sleepable_kfunc
+rcu_read_lock/success
+rcu_read_lock/rcuptr_acquire
+read_vsyscall
+refcounted_kptr/rbtree_sleepable_rcu
+refcounted_kptr/rbtree_sleepable_rcu_no_explicit_rcu_lock
+refcounted_kptr_fail/rbtree_fail_sleepable_lock_across_rcu
+test_lsm/lsm_basic
+verifier_global_subprogs/arg_tag_ctx_fmod_ret
+
+kprobe_multi_test/attach_override                # needs CONFIG_BPF_KPROBE_OVERRIDE
+libbpf_probe_prog_types/BPF_PROG_TYPE_LIRC_MODE2 # needs CONFIG_BPF_LIRC_MODE2
+test_bpffs                                       # needs CONFIG_BPF_PRELOAD
+tunnel                                           # needs CONFIG_NET_FOU
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 93c707116fad..cea544395fce 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -529,7 +529,7 @@ LSKELS := fexit_sleep.c trace_printk.c trace_vprintk.c map_ptr_kern.c 	\
 LSKELS_SIGNED := fentry_test.c fexit_test.c atomics.c
 
 # Generate both light skeleton and libbpf skeleton for these
-LSKELS_EXTRA := test_ksyms_module.c test_ksyms_weak.c kfunc_call_test.c \
+LSKELS_EXTRA := test_ksyms_module.c kfunc_call_test.c \
 	kfunc_call_test_subprog.c test_global_percpu_data.c
 SKEL_BLACKLIST += $$(LSKELS) $$(LSKELS_SIGNED)
 
diff --git a/tools/testing/selftests/bpf/prog_tests/ksyms_btf.c b/tools/testing/selftests/bpf/prog_tests/ksyms_btf.c
index 1d7a2f1e0731..b22f3a9cb8b8 100644
--- a/tools/testing/selftests/bpf/prog_tests/ksyms_btf.c
+++ b/tools/testing/selftests/bpf/prog_tests/ksyms_btf.c
@@ -7,7 +7,6 @@
 #include "test_ksyms_btf.skel.h"
 #include "test_ksyms_btf_null_check.skel.h"
 #include "test_ksyms_weak.skel.h"
-#include "test_ksyms_weak.lskel.h"
 #include "test_ksyms_btf_write_check.skel.h"
 
 static int duration;
@@ -111,33 +110,6 @@ static void test_weak_syms(void)
 	test_ksyms_weak__destroy(skel);
 }
 
-static void test_weak_syms_lskel(void)
-{
-	struct test_ksyms_weak_lskel *skel;
-	struct test_ksyms_weak_lskel__data *data;
-	int err;
-
-	skel = test_ksyms_weak_lskel__open_and_load();
-	if (!ASSERT_OK_PTR(skel, "test_ksyms_weak_lskel__open_and_load"))
-		return;
-
-	err = test_ksyms_weak_lskel__attach(skel);
-	if (!ASSERT_OK(err, "test_ksyms_weak_lskel__attach"))
-		goto cleanup;
-
-	/* trigger tracepoint */
-	usleep(1);
-
-	data = skel->data;
-	ASSERT_EQ(data->out__existing_typed, 0, "existing typed ksym");
-	ASSERT_NEQ(data->out__existing_typeless, -1, "existing typeless ksym");
-	ASSERT_EQ(data->out__non_existent_typeless, 0, "nonexistent typeless ksym");
-	ASSERT_EQ(data->out__non_existent_typed, 0, "nonexistent typed ksym");
-
-cleanup:
-	test_ksyms_weak_lskel__destroy(skel);
-}
-
 static void test_write_check(bool test_handler1)
 {
 	struct test_ksyms_btf_write_check *skel;
@@ -180,9 +152,6 @@ void test_ksyms_btf(void)
 	if (test__start_subtest("weak_ksyms"))
 		test_weak_syms();
 
-	if (test__start_subtest("weak_ksyms_lskel"))
-		test_weak_syms_lskel();
-
 	if (test__start_subtest("write_check1"))
 		test_write_check(true);