Linux v4.11-8539-gaf82455

54 files changed, 613 insertions, 355 deletions

diff --git a/Add-EFI-signature-data-types.patch b/Add-EFI-signature-data-types.patch
index 40d14f949..f7f7c36d3 100644
--- a/Add-EFI-signature-data-types.patch
+++ b/Add-EFI-signature-data-types.patch
@@ -1,37 +1,36 @@
-From ba3f737b8521314b62edaa7d4cc4bdc9aeefe394 Mon Sep 17 00:00:00 2001
+From 0451d4e795929a69a0fda6d960aa4b077c5bd179 Mon Sep 17 00:00:00 2001
 From: Dave Howells <dhowells@redhat.com>
-Date: Tue, 23 Oct 2012 09:30:54 -0400
-Subject: [PATCH 15/20] Add EFI signature data types
+Date: Fri, 5 May 2017 08:21:58 +0100
+Subject: [PATCH 1/4] efi: Add EFI signature data types
 
-Add the data types that are used for containing hashes, keys and certificates
-for cryptographic verification.
-
-Bugzilla: N/A
-Upstream-status: Fedora mustard for now
+Add the data types that are used for containing hashes, keys and
+certificates for cryptographic verification along with their corresponding
+type GUIDs.
 
 Signed-off-by: David Howells <dhowells@redhat.com>
 ---
- include/linux/efi.h | 17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
+ include/linux/efi.h | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
 
 diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 5af91b58afae..190858d62fe3 100644
+index ec36f42..3259ad6 100644
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
-@@ -603,6 +603,9 @@ void efi_native_runtime_setup(void);
- #define LINUX_EFI_LOADER_ENTRY_GUID		EFI_GUID(0x4a67b082, 0x0a4c, 0x41cf,  0xb6, 0xc7, 0x44, 0x0b, 0x29, 0xbb, 0x8c, 0x4f)
- #define LINUX_EFI_RANDOM_SEED_TABLE_GUID	EFI_GUID(0x1ce1e5bc, 0x7ceb, 0x42f2,  0x81, 0xe5, 0x8a, 0xad, 0xf1, 0x80, 0xf5, 0x7b)
- 
-+#define EFI_CERT_SHA256_GUID			EFI_GUID(0xc1c41626, 0x504c, 0x4092,  0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28)
-+#define EFI_CERT_X509_GUID			EFI_GUID(0xa5c059a1, 0x94e4, 0x4aa7,  0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72)
+@@ -614,6 +614,10 @@ void efi_native_runtime_setup(void);
+ #define EFI_IMAGE_SECURITY_DATABASE_GUID	EFI_GUID(0xd719b2cb, 0x3d3a, 0x4596,  0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f)
+ #define EFI_SHIM_LOCK_GUID			EFI_GUID(0x605dab50, 0xe046, 0x4300,  0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)
+
++#define EFI_CERT_SHA256_GUID			EFI_GUID(0xc1c41626, 0x504c, 0x4092, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28)
++#define EFI_CERT_X509_GUID			EFI_GUID(0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72)
++#define EFI_CERT_X509_SHA256_GUID		EFI_GUID(0x3bd2a492, 0x96c0, 0x4079, 0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed)
 +
- typedef struct {
- 	efi_guid_t guid;
- 	u64 table;
-@@ -853,6 +856,20 @@ typedef struct {
+ /*
+  * This GUID is used to pass to the kernel proper the struct screen_info
+  * structure that was populated by the stub based on the GOP protocol instance
+@@ -873,6 +877,27 @@ typedef struct {
  	efi_memory_desc_t entry[0];
  } efi_memory_attributes_table_t;
- 
+
 +typedef struct  {
 +	efi_guid_t signature_owner;
 +	u8 signature_data[];
@@ -46,6 +45,13 @@ index 5af91b58afae..190858d62fe3 100644
 +	/* efi_signature_data_t signatures[][] */
 +} efi_signature_list_t;
 +
++typedef u8 efi_sha256_hash_t[32];
++
++typedef struct {
++	efi_sha256_hash_t to_be_signed_hash;
++	efi_time_t time_of_revocation;
++} efi_cert_x509_sha256_t;
++
  /*
   * All runtime access to EFI goes through this structure:
   */
diff --git a/Add-an-EFI-signature-blob-parser-and-key-loader.patch b/Add-an-EFI-signature-blob-parser-and-key-loader.patch
index f57abc9f2..e3941eeaa 100644
--- a/Add-an-EFI-signature-blob-parser-and-key-loader.patch
+++ b/Add-an-EFI-signature-blob-parser-and-key-loader.patch
@@ -1,29 +1,38 @@
-From 822b4b3eb76ca451a416a51f0a7bfedfa5c5ea39 Mon Sep 17 00:00:00 2001
+From e4c62c12635a371e43bd17e8d33a936668264491 Mon Sep 17 00:00:00 2001
 From: Dave Howells <dhowells@redhat.com>
-Date: Tue, 23 Oct 2012 09:36:28 -0400
-Subject: [PATCH 16/20] Add an EFI signature blob parser and key loader.
+Date: Fri, 5 May 2017 08:21:58 +0100
+Subject: [PATCH 2/4] efi: Add an EFI signature blob parser
 
-X.509 certificates are loaded into the specified keyring as asymmetric type
-keys.
+Add a function to parse an EFI signature blob looking for elements of
+interest.  A list is made up of a series of sublists, where all the
+elements in a sublist are of the same type, but sublists can be of
+different types.
+
+For each sublist encountered, the function pointed to by the
+get_handler_for_guid argument is called with the type specifier GUID and
+returns either a pointer to a function to handle elements of that type or
+NULL if the type is not of interest.
+
+If the sublist is of interest, each element is passed to the handler
+function in turn.
 
-[labbott@fedoraproject.org: Drop KEY_ALLOC_TRUSTED]
 Signed-off-by: David Howells <dhowells@redhat.com>
 ---
- crypto/asymmetric_keys/Kconfig      |   8 +++
- crypto/asymmetric_keys/Makefile     |   1 +
- crypto/asymmetric_keys/efi_parser.c | 108 ++++++++++++++++++++++++++++++++++++
- include/linux/efi.h                 |   4 ++
- 4 files changed, 121 insertions(+)
- create mode 100644 crypto/asymmetric_keys/efi_parser.c
+ certs/Kconfig       |   8 ++++
+ certs/Makefile      |   1 +
+ certs/efi_parser.c  | 112 ++++++++++++++++++++++++++++++++++++++++++++++++++++
+ include/linux/efi.h |   9 +++++
+ 4 files changed, 130 insertions(+)
+ create mode 100644 certs/efi_parser.c
+
+diff --git a/certs/Kconfig b/certs/Kconfig
+index 6ce51ed..630ae09 100644
+--- a/certs/Kconfig
++++ b/certs/Kconfig
+@@ -82,4 +82,12 @@ config SYSTEM_BLACKLIST_HASH_LIST
+ 	  wrapper to incorporate the list into the kernel.  Each <hash> should
+ 	  be a string of hex digits.
 
-diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
-index 331f6baf2df8..5f9002d3192e 100644
---- a/crypto/asymmetric_keys/Kconfig
-+++ b/crypto/asymmetric_keys/Kconfig
-@@ -61,4 +61,12 @@ config SIGNED_PE_FILE_VERIFICATION
- 	  This option provides support for verifying the signature(s) on a
- 	  signed PE binary.
- 
 +config EFI_SIGNATURE_LIST_PARSER
 +	bool "EFI signature list parser"
 +	depends on EFI
@@ -32,28 +41,28 @@ index 331f6baf2df8..5f9002d3192e 100644
 +	  This option provides support for parsing EFI signature lists for
 +	  X.509 certificates and turning them into keys.
 +
- endif # ASYMMETRIC_KEY_TYPE
-diff --git a/crypto/asymmetric_keys/Makefile b/crypto/asymmetric_keys/Makefile
-index 6516855bec18..c099fe15ed6d 100644
---- a/crypto/asymmetric_keys/Makefile
-+++ b/crypto/asymmetric_keys/Makefile
-@@ -10,6 +10,7 @@ asymmetric_keys-y := \
- 	signature.o
- 
- obj-$(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) += public_key.o
+ endmenu
+diff --git a/certs/Makefile b/certs/Makefile
+index 4119bb3..738151a 100644
+--- a/certs/Makefile
++++ b/certs/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
+ else
+ obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
+ endif
 +obj-$(CONFIG_EFI_SIGNATURE_LIST_PARSER) += efi_parser.o
- 
- #
- # X.509 Certificate handling
-diff --git a/crypto/asymmetric_keys/efi_parser.c b/crypto/asymmetric_keys/efi_parser.c
+
+ ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
+
+diff --git a/certs/efi_parser.c b/certs/efi_parser.c
 new file mode 100644
-index 000000000000..636feb18b733
+index 0000000..4e396f9
 --- /dev/null
-+++ b/crypto/asymmetric_keys/efi_parser.c
-@@ -0,0 +1,108 @@
++++ b/certs/efi_parser.c
+@@ -0,0 +1,112 @@
 +/* EFI signature/key/certificate list parser
 + *
-+ * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
++ * Copyright (C) 2012, 2016 Red Hat, Inc. All Rights Reserved.
 + * Written by David Howells (dhowells@redhat.com)
 + *
 + * This program is free software; you can redistribute it and/or
@@ -67,27 +76,44 @@ index 000000000000..636feb18b733
 +#include <linux/printk.h>
 +#include <linux/err.h>
 +#include <linux/efi.h>
-+#include <keys/asymmetric-type.h>
-+
-+static __initdata efi_guid_t efi_cert_x509_guid = EFI_CERT_X509_GUID;
 +
 +/**
 + * parse_efi_signature_list - Parse an EFI signature list for certificates
++ * @source: The source of the key
 + * @data: The data blob to parse
 + * @size: The size of the data blob
-+ * @keyring: The keyring to add extracted keys to
++ * @get_handler_for_guid: Get the handler func for the sig type (or NULL)
++ *
++ * Parse an EFI signature list looking for elements of interest.  A list is
++ * made up of a series of sublists, where all the elements in a sublist are of
++ * the same type, but sublists can be of different types.
++ *
++ * For each sublist encountered, the @get_handler_for_guid function is called
++ * with the type specifier GUID and returns either a pointer to a function to
++ * handle elements of that type or NULL if the type is not of interest.
++ *
++ * If the sublist is of interest, each element is passed to the handler
++ * function in turn.
++ *
++ * Error EBADMSG is returned if the list doesn't parse correctly and 0 is
++ * returned if the list was parsed correctly.  No error can be returned from
++ * the @get_handler_for_guid function or the element handler function it
++ * returns.
 + */
-+int __init parse_efi_signature_list(const void *data, size_t size, struct key *keyring)
++int __init parse_efi_signature_list(
++	const char *source,
++	const void *data, size_t size,
++	efi_element_handler_t (*get_handler_for_guid)(const efi_guid_t *))
 +{
++	efi_element_handler_t handler;
 +	unsigned offs = 0;
-+	size_t lsize, esize, hsize, elsize;
 +
 +	pr_devel("-->%s(,%zu)\n", __func__, size);
 +
 +	while (size > 0) {
-+		efi_signature_list_t list;
 +		const efi_signature_data_t *elem;
-+		key_ref_t key;
++		efi_signature_list_t list;
++		size_t lsize, esize, hsize, elsize;
 +
 +		if (size < sizeof(list))
 +			return -EBADMSG;
@@ -108,6 +134,7 @@ index 000000000000..636feb18b733
 +				 __func__, offs);
 +			return -EBADMSG;
 +		}
++
 +		if (lsize < sizeof(list) ||
 +		    lsize - sizeof(list) < hsize ||
 +		    esize < sizeof(*elem) ||
@@ -117,7 +144,8 @@ index 000000000000..636feb18b733
 +			return -EBADMSG;
 +		}
 +
-+		if (efi_guidcmp(list.signature_type, efi_cert_x509_guid) != 0) {
++		handler = get_handler_for_guid(&list.signature_type);
++		if (!handler) {
 +			data += lsize;
 +			size -= lsize;
 +			offs += lsize;
@@ -132,24 +160,9 @@ index 000000000000..636feb18b733
 +			elem = data;
 +
 +			pr_devel("ELEM[%04x]\n", offs);
-+
-+			key = key_create_or_update(
-+				make_key_ref(keyring, 1),
-+				"asymmetric",
-+				NULL,
++			handler(source,
 +				&elem->signature_data,
-+				esize - sizeof(*elem),
-+				(KEY_POS_ALL & ~KEY_POS_SETATTR) |
-+				KEY_USR_VIEW,
-+				KEY_ALLOC_NOT_IN_QUOTA);
-+
-+			if (IS_ERR(key))
-+				pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
-+				       PTR_ERR(key));
-+			else
-+				pr_notice("Loaded cert '%s' linked to '%s'\n",
-+					  key_ref_to_ptr(key)->description,
-+					  keyring->description);
++				esize - sizeof(*elem));
 +
 +			data += esize;
 +			size -= esize;
@@ -160,16 +173,21 @@ index 000000000000..636feb18b733
 +	return 0;
 +}
 diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 190858d62fe3..668aa1244885 100644
+index 3259ad6..08024c6 100644
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
-@@ -1025,6 +1025,10 @@ extern int efi_memattr_apply_permissions(struct mm_struct *mm,
+@@ -1055,6 +1055,15 @@ extern int efi_memattr_apply_permissions(struct mm_struct *mm,
  char * __init efi_md_typeattr_format(char *buf, size_t size,
  				     const efi_memory_desc_t *md);
- 
-+struct key;
-+extern int __init parse_efi_signature_list(const void *data, size_t size,
-+					   struct key *keyring);
+
++
++typedef void (*efi_element_handler_t)(const char *source,
++				      const void *element_data,
++				      size_t element_size);
++extern int __init parse_efi_signature_list(
++	const char *source,
++	const void *data, size_t size,
++	efi_element_handler_t (*get_handler_for_guid)(const efi_guid_t *));
 +
  /**
   * efi_range_is_wc - check the WC bit on an address range
diff --git a/MODSIGN-Don-t-try-secure-boot-if-EFI-runtime-is-disa.patch b/MODSIGN-Don-t-try-secure-boot-if-EFI-runtime-is-disa.patch
deleted file mode 100644
index 6f5d8b6ab..000000000
--- a/MODSIGN-Don-t-try-secure-boot-if-EFI-runtime-is-disa.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 71db1b222ecdf6cb4356f6f1e2bd45cd2f0e85e1 Mon Sep 17 00:00:00 2001
-From: Laura Abbott <labbott@redhat.com>
-Date: Tue, 18 Oct 2016 13:58:44 -0700
-Subject: [PATCH] MODSIGN: Don't try secure boot if EFI runtime is disabled
-
-Secure boot depends on having EFI runtime variable access. The code
-does not handle a lack of runtime variables gracefully. Add a check
-to just bail out of EFI runtime is disabled.
-
-Signed-off-by: Laura Abbott <labbott@redhat.com>
----
- kernel/modsign_uefi.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c
-index a41da14..2bdaf76 100644
---- a/kernel/modsign_uefi.c
-+++ b/kernel/modsign_uefi.c
-@@ -71,6 +71,10 @@ static int __init load_uefi_certs(void)
- 	if (!efi_enabled(EFI_SECURE_BOOT))
- 		return 0;
- 
-+	/* Things blow up if efi runtime is disabled */
-+	if (efi_runtime_disabled())
-+		return 0;
-+
- 	keyring = get_system_keyring();
- 	if (!keyring) {
- 		pr_err("MODSIGN: Couldn't get system keyring\n");
--- 
-2.7.4
-
diff --git a/MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch b/MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch
index 5ff792c3c..08195ff4e 100644
--- a/MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch
+++ b/MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch
@@ -1,7 +1,7 @@
-From 8a4535bcfe24d317be675e53cdc8c61d22fdc7f3 Mon Sep 17 00:00:00 2001
+From 90dc66270b02981b19a085c6a9184e3452b7b3e8 Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Fri, 26 Oct 2012 12:42:16 -0400
-Subject: [PATCH 18/20] MODSIGN: Import certificates from UEFI Secure Boot
+Date: Fri, 5 May 2017 08:21:59 +0100
+Subject: [PATCH 3/4] MODSIGN: Import certificates from UEFI Secure Boot
 
 Secure Boot stores a list of allowed certificates in the 'db' variable.
 This imports those certificates into the system trusted keyring.  This
@@ -11,123 +11,68 @@ variable, a user can allow a module signed with that certificate to
 load.  The shim UEFI bootloader has a similar certificate list stored
 in the 'MokListRT' variable.  We import those as well.
 
-In the opposite case, Secure Boot maintains a list of disallowed
-certificates in the 'dbx' variable.  We load those certificates into
-the newly introduced system blacklist keyring and forbid any module
-signed with those from loading.
+Secure Boot also maintains a list of disallowed certificates in the 'dbx'
+variable.  We load those certificates into the newly introduced system
+blacklist keyring and forbid any module signed with those from loading and
+forbid the use within the kernel of any key with a matching hash.
+
+This facility is enabled by setting CONFIG_LOAD_UEFI_KEYS.
 
 Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
 ---
- certs/system_keyring.c        | 13 ++++++
- include/keys/system_keyring.h |  1 +
- init/Kconfig                  |  9 ++++
- kernel/Makefile               |  3 ++
- kernel/modsign_uefi.c         | 99 +++++++++++++++++++++++++++++++++++++++++++
- 5 files changed, 125 insertions(+)
- create mode 100644 kernel/modsign_uefi.c
+ certs/Kconfig     |  16 ++++++
+ certs/Makefile    |   4 ++
+ certs/load_uefi.c | 168 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 188 insertions(+)
+ create mode 100644 certs/load_uefi.c
 
-diff --git a/certs/system_keyring.c b/certs/system_keyring.c
-index 787eeead2f57..4d9123ed5c07 100644
---- a/certs/system_keyring.c
-+++ b/certs/system_keyring.c
-@@ -30,6 +30,19 @@ extern __initconst const u8 system_certificate_list[];
- extern __initconst const unsigned long system_certificate_list_size;
- 
- /**
-+ * get_system_keyring - Return a pointer to the system keyring
-+ *
-+ */
-+struct key *get_system_keyring(void)
-+{
-+	struct key *system_keyring = NULL;
-+
-+	system_keyring = builtin_trusted_keys;
-+	return system_keyring;
-+}
-+EXPORT_SYMBOL_GPL(get_system_keyring);
-+
-+/**
-  * restrict_link_to_builtin_trusted - Restrict keyring addition by built in CA
-  *
-  * Restrict the addition of keys into a keyring based on the key-to-be-added
-diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
-index 359c2f9..e7160a6 100644
---- a/include/keys/system_keyring.h
-+++ b/include/keys/system_keyring.h
-@@ -39,14 +39,26 @@ extern int restrict_link_by_builtin_and_secondary_trusted(
- extern int mark_hash_blacklisted(const char *hash);
- extern int is_hash_blacklisted(const u8 *hash, size_t hash_len,
- 			       const char *type);
-+extern struct key *blacklist_keyring;
-+
-+static inline struct key *get_blacklist_keyring(void)
-+{
-+	return blacklist_keyring;
-+}
- #else
- static inline int is_hash_blacklisted(const u8 *hash, size_t hash_len,
- 				      const char *type)
- {
- 	return 0;
- }
-+static inline struct key *get_blacklist_keyring(void)
-+{
-+	return NULL;
-+}
- #endif
+diff --git a/certs/Kconfig b/certs/Kconfig
+index 630ae09..edf9f75 100644
+--- a/certs/Kconfig
++++ b/certs/Kconfig
+@@ -90,4 +90,20 @@ config EFI_SIGNATURE_LIST_PARSER
+ 	  This option provides support for parsing EFI signature lists for
+ 	  X.509 certificates and turning them into keys.
+
++config LOAD_UEFI_KEYS
++	bool "Load certs and blacklist from UEFI db for module checking"
++	depends on SYSTEM_BLACKLIST_KEYRING
++	depends on SECONDARY_TRUSTED_KEYRING
++	depends on EFI
++	depends on EFI_SIGNATURE_LIST_PARSER
++	help
++	  If the kernel is booted in secure boot mode, this option will cause
++	  the kernel to load the certificates from the UEFI db and MokListRT
++	  into the secondary trusted keyring.  It will also load any X.509
++	  SHA256 hashes in the dbx list into the blacklist.
++
++	  The effect of this is that, if the kernel is booted in secure boot
++	  mode, modules signed with UEFI-stored keys will be permitted to be
++	  loaded and keys that match the blacklist will be rejected.
++
+ endmenu
+diff --git a/certs/Makefile b/certs/Makefile
+index 738151a..a5e057a 100644
+--- a/certs/Makefile
++++ b/certs/Makefile
+@@ -11,6 +11,10 @@ obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_nohashes.o
+ endif
+ obj-$(CONFIG_EFI_SIGNATURE_LIST_PARSER) += efi_parser.o
 
-+extern struct key *get_system_keyring(void);
++obj-$(CONFIG_LOAD_UEFI_KEYS) += load_uefi.o
++$(obj)/load_uefi.o: KBUILD_CFLAGS += -fshort-wchar
 +
- #ifdef CONFIG_IMA_BLACKLIST_KEYRING
- extern struct key *ima_blacklist_keyring;
++
+ ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
 
-diff --git a/init/Kconfig b/init/Kconfig
-index 461ad575a608..93646fd7b1c8 100644
---- a/init/Kconfig
-+++ b/init/Kconfig
-@@ -2009,6 +2009,15 @@ config MODULE_SIG_ALL
- comment "Do not forget to sign required modules with scripts/sign-file"
- 	depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL
- 
-+config MODULE_SIG_UEFI
-+	bool "Allow modules signed with certs stored in UEFI"
-+	depends on MODULE_SIG && SYSTEM_BLACKLIST_KEYRING && EFI
-+	select EFI_SIGNATURE_LIST_PARSER
-+	help
-+	  This will import certificates stored in UEFI and allow modules
-+	  signed with those to be loaded.  It will also disallow loading
-+	  of modules stored in the UEFI dbx variable.
-+
- choice
- 	prompt "Which hash algorithm should modules be signed with?"
- 	depends on MODULE_SIG
-diff --git a/kernel/Makefile b/kernel/Makefile
-index eb26e12c6c2a..e0c2268cb97e 100644
---- a/kernel/Makefile
-+++ b/kernel/Makefile
-@@ -57,6 +57,7 @@ endif
- obj-$(CONFIG_UID16) += uid16.o
- obj-$(CONFIG_MODULES) += module.o
- obj-$(CONFIG_MODULE_SIG) += module_signing.o
-+obj-$(CONFIG_MODULE_SIG_UEFI) += modsign_uefi.o
- obj-$(CONFIG_KALLSYMS) += kallsyms.o
- obj-$(CONFIG_BSD_PROCESS_ACCT) += acct.o
- obj-$(CONFIG_KEXEC_CORE) += kexec_core.o
-@@ -113,6 +114,8 @@ obj-$(CONFIG_MEMBARRIER) += membarrier.o
- 
- obj-$(CONFIG_HAS_IOMEM) += memremap.o
- 
-+$(obj)/modsign_uefi.o: KBUILD_CFLAGS += -fshort-wchar
-+
- $(obj)/configs.o: $(obj)/config_data.h
- 
- targets += config_data.gz
-diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c
+ $(eval $(call config_filename,SYSTEM_TRUSTED_KEYS))
+diff --git a/certs/load_uefi.c b/certs/load_uefi.c
 new file mode 100644
-index 000000000000..fe4a6f2bf10a
+index 0000000..b44e464
 --- /dev/null
-+++ b/kernel/modsign_uefi.c
-@@ -0,0 +1,101 @@
++++ b/certs/load_uefi.c
+@@ -0,0 +1,168 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/cred.h>
@@ -136,14 +81,22 @@ index 000000000000..fe4a6f2bf10a
 +#include <linux/slab.h>
 +#include <keys/asymmetric-type.h>
 +#include <keys/system_keyring.h>
-+#include "module-internal.h"
++#include "internal.h"
++
++static __initdata efi_guid_t efi_cert_x509_guid = EFI_CERT_X509_GUID;
++static __initdata efi_guid_t efi_cert_x509_sha256_guid = EFI_CERT_X509_SHA256_GUID;
++static __initdata efi_guid_t efi_cert_sha256_guid = EFI_CERT_SHA256_GUID;
 +
-+static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, unsigned long *size)
++/*
++ * Get a certificate list blob from the named EFI variable.
++ */
++static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
++				  unsigned long *size)
 +{
 +	efi_status_t status;
 +	unsigned long lsize = 4;
 +	unsigned long tmpdb[4];
-+	void *db = NULL;
++	void *db;
 +
 +	status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb);
 +	if (status != EFI_BUFFER_TOO_SMALL) {
@@ -154,23 +107,89 @@ index 000000000000..fe4a6f2bf10a
 +	db = kmalloc(lsize, GFP_KERNEL);
 +	if (!db) {
 +		pr_err("Couldn't allocate memory for uefi cert list\n");
-+		goto out;
++		return NULL;
 +	}
 +
 +	status = efi.get_variable(name, guid, NULL, &lsize, db);
 +	if (status != EFI_SUCCESS) {
 +		kfree(db);
-+		db = NULL;
 +		pr_err("Error reading db var: 0x%lx\n", status);
++		return NULL;
 +	}
-+out:
++
 +	*size = lsize;
 +	return db;
 +}
 +
 +/*
-+ *  * Load the certs contained in the UEFI databases
-+ *   */
++ * Blacklist an X509 TBS hash.
++ */
++static __init void uefi_blacklist_x509_tbs(const char *source,
++					   const void *data, size_t len)
++{
++	char *hash, *p;
++
++	hash = kmalloc(4 + len * 2 + 1, GFP_KERNEL);
++	if (!hash)
++		return;
++	p = memcpy(hash, "tbs:", 4);
++	p += 4;
++	bin2hex(p, data, len);
++	p += len * 2;
++	*p = 0;
++
++	mark_hash_blacklisted(hash);
++	kfree(hash);
++}
++
++/*
++ * Blacklist the hash of an executable.
++ */
++static __init void uefi_blacklist_binary(const char *source,
++					 const void *data, size_t len)
++{
++	char *hash, *p;
++
++	hash = kmalloc(4 + len * 2 + 1, GFP_KERNEL);
++	if (!hash)
++		return;
++	p = memcpy(hash, "bin:", 4);
++	p += 4;
++	bin2hex(p, data, len);
++	p += len * 2;
++	*p = 0;
++
++	mark_hash_blacklisted(hash);
++	kfree(hash);
++}
++
++/*
++ * Return the appropriate handler for particular signature list types found in
++ * the UEFI db and MokListRT tables.
++ */
++static __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type)
++{
++	if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0)
++		return add_trusted_secondary_key;
++	return 0;
++}
++
++/*
++ * Return the appropriate handler for particular signature list types found in
++ * the UEFI dbx and MokListXRT tables.
++ */
++static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type)
++{
++	if (efi_guidcmp(*sig_type, efi_cert_x509_sha256_guid) == 0)
++		return uefi_blacklist_x509_tbs;
++	if (efi_guidcmp(*sig_type, efi_cert_sha256_guid) == 0)
++		return uefi_blacklist_binary;
++	return 0;
++}
++
++/*
++ * Load the certs contained in the UEFI databases
++ */
 +static int __init load_uefi_certs(void)
 +{
 +	efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;
@@ -178,18 +197,9 @@ index 000000000000..fe4a6f2bf10a
 +	void *db = NULL, *dbx = NULL, *mok = NULL;
 +	unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
 +	int rc = 0;
-+	struct key *keyring = NULL;
-+	struct key *blacklist = NULL;
 +
-+	/* Check if SB is enabled and just return if not */
-+	if (!efi_enabled(EFI_SECURE_BOOT))
-+		return 0;
-+
-+	keyring = get_system_keyring();
-+	if (!keyring) {
-+		pr_err("MODSIGN: Couldn't get system keyring\n");
-+		return -EINVAL;
-+	}
++	if (!efi.get_variable)
++		return false;
 +
 +	/* Get db, MokListRT, and dbx.  They might not exist, so it isn't
 +	 * an error if we can't get them.
@@ -198,7 +208,8 @@ index 000000000000..fe4a6f2bf10a
 +	if (!db) {
 +		pr_err("MODSIGN: Couldn't get UEFI db list\n");
 +	} else {
-+		rc = parse_efi_signature_list(db, dbsize, keyring);
++		rc = parse_efi_signature_list("UEFI:db",
++					      db, dbsize, get_handler_for_db);
 +		if (rc)
 +			pr_err("Couldn't parse db signatures: %d\n", rc);
 +		kfree(db);
@@ -208,19 +219,20 @@ index 000000000000..fe4a6f2bf10a
 +	if (!mok) {
 +		pr_info("MODSIGN: Couldn't get UEFI MokListRT\n");
 +	} else {
-+		rc = parse_efi_signature_list(mok, moksize, keyring);
++		rc = parse_efi_signature_list("UEFI:MokListRT",
++					      mok, moksize, get_handler_for_db);
 +		if (rc)
 +			pr_err("Couldn't parse MokListRT signatures: %d\n", rc);
 +		kfree(mok);
 +	}
 +
-+	blacklist = get_blacklist_keyring();
 +	dbx = get_cert_list(L"dbx", &secure_var, &dbxsize);
 +	if (!dbx) {
 +		pr_info("MODSIGN: Couldn't get UEFI dbx list\n");
 +	} else {
-+		rc = parse_efi_signature_list(dbx, dbxsize,
-+			blacklist);
++		rc = parse_efi_signature_list("UEFI:dbx",
++					      dbx, dbxsize,
++					      get_handler_for_dbx);
 +		if (rc)
 +			pr_err("Couldn't parse dbx signatures: %d\n", rc);
 +		kfree(dbx);
@@ -231,16 +243,4 @@ index 000000000000..fe4a6f2bf10a
 +late_initcall(load_uefi_certs);
 -- 
 2.9.3
-diff --git a/certs/blacklist.c b/certs/blacklist.c
-index 3eddce0..bd9324c 100644
---- a/certs/blacklist.c
-+++ b/certs/blacklist.c
-@@ -21,7 +21,7 @@
- #include <keys/system_keyring.h>
- #include "blacklist.h"
-
--static struct key *blacklist_keyring;
-+struct key *blacklist_keyring;
 
- /*
-  * The description must be a type prefix, a colon and then an even number of
diff --git a/MODSIGN-Support-not-importing-certs-from-db.patch b/MODSIGN-Support-not-importing-certs-from-db.patch
index 07626b2d3..13fecd2f2 100644
--- a/MODSIGN-Support-not-importing-certs-from-db.patch
+++ b/MODSIGN-Support-not-importing-certs-from-db.patch
@@ -1,62 +1,62 @@
-From 9d2e5c61d5adcf7911f67ed44a1b0ff881f175bb Mon Sep 17 00:00:00 2001
+From 9f1958a0cc911e1f79b2733ee5029dbd819ff328 Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
-Date: Thu, 3 Oct 2013 10:14:23 -0400
-Subject: [PATCH 19/20] MODSIGN: Support not importing certs from db
+Date: Fri, 5 May 2017 08:21:59 +0100
+Subject: [PATCH 4/4] MODSIGN: Allow the "db" UEFI variable to be suppressed
 
 If a user tells shim to not use the certs/hashes in the UEFI db variable
-for verification purposes, shim will set a UEFI variable called MokIgnoreDB.
-Have the uefi import code look for this and not import things from the db
-variable.
+for verification purposes, shim will set a UEFI variable called
+MokIgnoreDB.  Have the uefi import code look for this and ignore the db
+variable if it is found.
 
 Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
 ---
- kernel/modsign_uefi.c | 40 +++++++++++++++++++++++++++++++---------
- 1 file changed, 31 insertions(+), 9 deletions(-)
+ certs/load_uefi.c | 44 ++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 10 deletions(-)
 
-diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c
-index fe4a6f2bf10a..a41da14b1ffd 100644
---- a/kernel/modsign_uefi.c
-+++ b/kernel/modsign_uefi.c
-@@ -8,6 +8,23 @@
- #include <keys/system_keyring.h>
- #include "module-internal.h"
- 
-+static __init int check_ignore_db(void)
+diff --git a/certs/load_uefi.c b/certs/load_uefi.c
+index b44e464..3d88459 100644
+--- a/certs/load_uefi.c
++++ b/certs/load_uefi.c
+@@ -13,6 +13,26 @@ static __initdata efi_guid_t efi_cert_x509_sha256_guid = EFI_CERT_X509_SHA256_GU
+ static __initdata efi_guid_t efi_cert_sha256_guid = EFI_CERT_SHA256_GUID;
+
+ /*
++ * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
++ * it does.
++ *
++ * This UEFI variable is set by the shim if a user tells the shim to not use
++ * the certs/hashes in the UEFI db variable for verification purposes.  If it
++ * is set, we should ignore the db variable also and the true return indicates
++ * this.
++ */
++static __init bool uefi_check_ignore_db(void)
 +{
 +	efi_status_t status;
 +	unsigned int db = 0;
 +	unsigned long size = sizeof(db);
 +	efi_guid_t guid = EFI_SHIM_LOCK_GUID;
 +
-+	/* Check and see if the MokIgnoreDB variable exists.  If that fails
-+	 * then we don't ignore DB.  If it succeeds, we do.
-+	 */
 +	status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db);
-+	if (status != EFI_SUCCESS)
-+		return 0;
-+
-+	return 1;
++	return status == EFI_SUCCESS;
 +}
 +
- static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, unsigned long *size)
++/*
+  * Get a certificate list blob from the named EFI variable.
+  */
+ static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid,
+@@ -113,7 +133,9 @@ static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_ty
+ }
+
+ /*
+- * Load the certs contained in the UEFI databases
++ * Load the certs contained in the UEFI databases into the secondary trusted
++ * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist
++ * keyring.
+  */
+ static int __init load_uefi_certs(void)
  {
- 	efi_status_t status;
-@@ -47,7 +64,7 @@ static int __init load_uefi_certs(void)
- 	efi_guid_t mok_var = EFI_SHIM_LOCK_GUID;
- 	void *db = NULL, *dbx = NULL, *mok = NULL;
- 	unsigned long dbsize = 0, dbxsize = 0, moksize = 0;
--	int rc = 0;
-+	int ignore_db, rc = 0;
- 	struct key *keyring = NULL;
- 	struct key *blacklist = NULL;
- 
-@@ -60,17 +77,22 @@ static int __init load_uefi_certs(void)
- 		return -EINVAL;
- 	}
- 
-+	/* See if the user has setup Ignore DB mode */
-+	ignore_db = check_ignore_db();
-+
+@@ -129,15 +151,17 @@ static int __init load_uefi_certs(void)
  	/* Get db, MokListRT, and dbx.  They might not exist, so it isn't
  	 * an error if we can't get them.
  	 */
@@ -64,22 +64,24 @@ index fe4a6f2bf10a..a41da14b1ffd 100644
 -	if (!db) {
 -		pr_err("MODSIGN: Couldn't get UEFI db list\n");
 -	} else {
--		rc = parse_efi_signature_list(db, dbsize, keyring);
+-		rc = parse_efi_signature_list("UEFI:db",
+-					      db, dbsize, get_handler_for_db);
 -		if (rc)
 -			pr_err("Couldn't parse db signatures: %d\n", rc);
 -		kfree(db);
-+	if (!ignore_db) {
++	if (!uefi_check_ignore_db()) {
 +		db = get_cert_list(L"db", &secure_var, &dbsize);
 +		if (!db) {
 +			pr_err("MODSIGN: Couldn't get UEFI db list\n");
 +		} else {
-+			rc = parse_efi_signature_list(db, dbsize, keyring);
++			rc = parse_efi_signature_list("UEFI:db",
++						      db, dbsize, get_handler_for_db);
 +			if (rc)
 +				pr_err("Couldn't parse db signatures: %d\n", rc);
 +			kfree(db);
 +		}
  	}
- 
+
  	mok = get_cert_list(L"MokListRT", &mok_var, &moksize);
 -- 
 2.9.3
diff --git a/baseconfig/CONFIG_EXTCON_INTEL_CHT_WC b/baseconfig/CONFIG_EXTCON_INTEL_CHT_WC
new file mode 100644
index 000000000..9669fe2e5
--- /dev/null
+++ b/baseconfig/CONFIG_EXTCON_INTEL_CHT_WC
@@ -0,0 +1 @@
+CONFIG_EXTCON_INTEL_CHT_WC=y
diff --git a/baseconfig/CONFIG_GPIO_FTGPIO010 b/baseconfig/CONFIG_GPIO_FTGPIO010
new file mode 100644
index 000000000..3a1fb41ea
--- /dev/null
+++ b/baseconfig/CONFIG_GPIO_FTGPIO010
@@ -0,0 +1 @@
+# CONFIG_GPIO_FTGPIO010 is not set
diff --git a/baseconfig/CONFIG_HD44780 b/baseconfig/CONFIG_HD44780
new file mode 100644
index 000000000..4254ce45e
--- /dev/null
+++ b/baseconfig/CONFIG_HD44780
@@ -0,0 +1 @@
+# CONFIG_HD44780 is not set
diff --git a/baseconfig/CONFIG_LOAD_UEFI_KEYS b/baseconfig/CONFIG_LOAD_UEFI_KEYS
new file mode 100644
index 000000000..de1de5c25
--- /dev/null
+++ b/baseconfig/CONFIG_LOAD_UEFI_KEYS
@@ -0,0 +1 @@
+# CONFIG_LOAD_UEFI_KEYS is not set
diff --git a/baseconfig/CONFIG_MODULE_SIG_UEFI b/baseconfig/CONFIG_MODULE_SIG_UEFI
deleted file mode 100644
index e4fb898f7..000000000
--- a/baseconfig/CONFIG_MODULE_SIG_UEFI
+++ /dev/null
@@ -1 +0,0 @@
-# CONFIG_MODULE_SIG_UEFI is not set
diff --git a/baseconfig/CONFIG_NET_9P_XEN b/baseconfig/CONFIG_NET_9P_XEN
new file mode 100644
index 000000000..d2565ede3
--- /dev/null
+++ b/baseconfig/CONFIG_NET_9P_XEN
@@ -0,0 +1 @@
+CONFIG_NET_9P_XEN=m
diff --git a/baseconfig/CONFIG_TYPEC_FUSB302 b/baseconfig/CONFIG_TYPEC_FUSB302
new file mode 100644
index 000000000..9633e1956
--- /dev/null
+++ b/baseconfig/CONFIG_TYPEC_FUSB302
@@ -0,0 +1 @@
+CONFIG_TYPEC_FUSB302=m
diff --git a/baseconfig/CONFIG_TYPEC_TCPCI b/baseconfig/CONFIG_TYPEC_TCPCI
new file mode 100644
index 000000000..46687f546
--- /dev/null
+++ b/baseconfig/CONFIG_TYPEC_TCPCI
@@ -0,0 +1 @@
+CONFIG_TYPEC_TCPCI=m
diff --git a/baseconfig/CONFIG_TYPEC_TCPM b/baseconfig/CONFIG_TYPEC_TCPM
new file mode 100644
index 000000000..8294bcc60
--- /dev/null
+++ b/baseconfig/CONFIG_TYPEC_TCPM
@@ -0,0 +1 @@
+CONFIG_TYPEC_TCPM=m
diff --git a/baseconfig/CONFIG_TYPEC_WCOVE b/baseconfig/CONFIG_TYPEC_WCOVE
new file mode 100644
index 000000000..8801ecb28
--- /dev/null
+++ b/baseconfig/CONFIG_TYPEC_WCOVE
@@ -0,0 +1 @@
+CONFIG_TYPEC_WCOVE=m
diff --git a/baseconfig/CONFIG_USB_PCI b/baseconfig/CONFIG_USB_PCI
new file mode 100644
index 000000000..4ffaf0ae0
--- /dev/null
+++ b/baseconfig/CONFIG_USB_PCI
@@ -0,0 +1 @@
+# CONFIG_USB_PCI is not set
diff --git a/baseconfig/CONFIG_W1_SLAVE_DS2438 b/baseconfig/CONFIG_W1_SLAVE_DS2438
new file mode 100644
index 000000000..34301a62e
--- /dev/null
+++ b/baseconfig/CONFIG_W1_SLAVE_DS2438
@@ -0,0 +1 @@
+CONFIG_W1_SLAVE_DS2438=m
diff --git a/baseconfig/arm/CONFIG_DRM_MESON_DW_HDMI b/baseconfig/arm/CONFIG_DRM_MESON_DW_HDMI
index 2590929f1..db9d818a2 100644
--- a/baseconfig/arm/CONFIG_DRM_MESON_DW_HDMI
+++ b/baseconfig/arm/CONFIG_DRM_MESON_DW_HDMI
@@ -1 +1 @@
-CONFIG_DRM_MESON_DW_HDMI=m
+# CONFIG_DRM_MESON_DW_HDMI is not set
diff --git a/baseconfig/arm/CONFIG_PHY_QCOM_QMP b/baseconfig/arm/CONFIG_PHY_QCOM_QMP
new file mode 100644
index 000000000..cba57faf8
--- /dev/null
+++ b/baseconfig/arm/CONFIG_PHY_QCOM_QMP
@@ -0,0 +1 @@
+CONFIG_PHY_QCOM_QMP=m
diff --git a/baseconfig/arm/CONFIG_PHY_QCOM_QUSB2 b/baseconfig/arm/CONFIG_PHY_QCOM_QUSB2
new file mode 100644
index 000000000..6512e59d2
--- /dev/null
+++ b/baseconfig/arm/CONFIG_PHY_QCOM_QUSB2
@@ -0,0 +1 @@
+CONFIG_PHY_QCOM_QUSB2=m
diff --git a/baseconfig/arm/armv7/CONFIG_USB_EHCI_HCD_ORION b/baseconfig/arm/CONFIG_USB_EHCI_HCD_ORION
index eee05e763..eee05e763 100644
--- a/baseconfig/arm/armv7/CONFIG_USB_EHCI_HCD_ORION
+++ b/baseconfig/arm/CONFIG_USB_EHCI_HCD_ORION
diff --git a/baseconfig/arm/CONFIG_USB_PCI b/baseconfig/arm/CONFIG_USB_PCI
new file mode 100644
index 000000000..26c372a3a
--- /dev/null
+++ b/baseconfig/arm/CONFIG_USB_PCI
@@ -0,0 +1 @@
+CONFIG_USB_PCI=y
diff --git a/baseconfig/arm/arm64/CONFIG_GPIO_XLP b/baseconfig/arm/arm64/CONFIG_GPIO_XLP
new file mode 100644
index 000000000..f99cd41f3
--- /dev/null
+++ b/baseconfig/arm/arm64/CONFIG_GPIO_XLP
@@ -0,0 +1 @@
+CONFIG_GPIO_XLP=m
diff --git a/baseconfig/arm/armv7/CONFIG_DRM_DW_HDMI_AHB_AUDIO b/baseconfig/arm/armv7/CONFIG_DRM_DW_HDMI_AHB_AUDIO
index 679147e29..5c276f1dc 100644
--- a/baseconfig/arm/armv7/CONFIG_DRM_DW_HDMI_AHB_AUDIO
+++ b/baseconfig/arm/armv7/CONFIG_DRM_DW_HDMI_AHB_AUDIO
@@ -1 +1 @@
-CONFIG_DRM_DW_HDMI_AHB_AUDIO=m
+# CONFIG_DRM_DW_HDMI_AHB_AUDIO is not set
diff --git a/baseconfig/arm/armv7/CONFIG_NVMEM_IMX_IIM b/baseconfig/arm/armv7/CONFIG_NVMEM_IMX_IIM
new file mode 100644
index 000000000..9407e7a4b
--- /dev/null
+++ b/baseconfig/arm/armv7/CONFIG_NVMEM_IMX_IIM
@@ -0,0 +1 @@
+CONFIG_NVMEM_IMX_IIM=m
diff --git a/baseconfig/x86/CONFIG_INTEL_CHT_INT33FE b/baseconfig/x86/CONFIG_INTEL_CHT_INT33FE
new file mode 100644
index 000000000..7657a9a07
--- /dev/null
+++ b/baseconfig/x86/CONFIG_INTEL_CHT_INT33FE
@@ -0,0 +1 @@
+CONFIG_INTEL_CHT_INT33FE=m
diff --git a/baseconfig/x86/CONFIG_LOAD_UEFI_KEYS b/baseconfig/x86/CONFIG_LOAD_UEFI_KEYS
new file mode 100644
index 000000000..22502e981
--- /dev/null
+++ b/baseconfig/x86/CONFIG_LOAD_UEFI_KEYS
@@ -0,0 +1 @@
+CONFIG_LOAD_UEFI_KEYS=y
diff --git a/baseconfig/x86/CONFIG_MODULE_SIG_UEFI b/baseconfig/x86/CONFIG_MODULE_SIG_UEFI
deleted file mode 100644
index c2bb7cecf..000000000
--- a/baseconfig/x86/CONFIG_MODULE_SIG_UEFI
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_MODULE_SIG_UEFI=y
diff --git a/baseconfig/x86/CONFIG_XEN_DOM0 b/baseconfig/x86/CONFIG_XEN_DOM0
new file mode 100644
index 000000000..c5cb5d24a
--- /dev/null
+++ b/baseconfig/x86/CONFIG_XEN_DOM0
@@ -0,0 +1 @@
+CONFIG_XEN_DOM0=y
diff --git a/baseconfig/x86/CONFIG_XEN_PV b/baseconfig/x86/CONFIG_XEN_PV
new file mode 100644
index 000000000..89203e84e
--- /dev/null
+++ b/baseconfig/x86/CONFIG_XEN_PV
@@ -0,0 +1 @@
+CONFIG_XEN_PV=y
diff --git a/baseconfig/x86/CONFIG_XEN_PVHVM b/baseconfig/x86/CONFIG_XEN_PVHVM
new file mode 100644
index 000000000..be722d220
--- /dev/null
+++ b/baseconfig/x86/CONFIG_XEN_PVHVM
@@ -0,0 +1 @@
+CONFIG_XEN_PVHVM=y
diff --git a/gitrev b/gitrev
index 92ca8d8f6..0e583b768 100644
--- a/gitrev
+++ b/gitrev
@@ -1 +1 @@
-a1be8edda4fe1f0a75007f26000a51436800869d
+af82455f7dbd9dc20244d80d033721b30d22c065
diff --git a/kernel-aarch64-debug.config b/kernel-aarch64-debug.config
index 213d6cfd1..ef2c4c583 100644
--- a/kernel-aarch64-debug.config
+++ b/kernel-aarch64-debug.config
@@ -1250,7 +1250,7 @@ CONFIG_DRM_LOAD_EDID_FIRMWARE=y
 CONFIG_DRM=m
 CONFIG_DRM_MALI_DISPLAY=m
 # CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set
-CONFIG_DRM_MESON_DW_HDMI=m
+# CONFIG_DRM_MESON_DW_HDMI is not set
 CONFIG_DRM_MESON=m
 CONFIG_DRM_MGAG200=m
 # CONFIG_DRM_MGA is not set
@@ -1472,6 +1472,7 @@ CONFIG_EXT4_USE_FOR_EXT2=y
 CONFIG_EXTCON_ADC_JACK=m
 CONFIG_EXTCON_AXP288=m
 CONFIG_EXTCON_GPIO=m
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 CONFIG_EXTCON=m
 # CONFIG_EXTCON_MAX3355 is not set
@@ -1688,6 +1689,7 @@ CONFIG_GPIO_AXP209=m
 CONFIG_GPIO_DEVRES=y
 CONFIG_GPIO_DWAPB=m
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
@@ -1724,6 +1726,7 @@ CONFIG_GPIO_WATCHDOG=m
 CONFIG_GPIO_XGENE_SB=m
 CONFIG_GPIO_XGENE=y
 # CONFIG_GPIO_XILINX is not set
+CONFIG_GPIO_XLP=m
 CONFIG_GREENASIA_FF=y
 # CONFIG_GREYBUS is not set
 # CONFIG_GS_FPGABOOT is not set
@@ -1735,6 +1738,7 @@ CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2709,6 +2713,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -3074,7 +3079,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3236,6 +3240,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -3931,6 +3936,8 @@ CONFIG_PHY_MVEBU_SATA=y
 # CONFIG_PHY_PXA_28NM_USB2 is not set
 # CONFIG_PHY_QCOM_APQ8064_SATA is not set
 # CONFIG_PHY_QCOM_IPQ806X_SATA is not set
+CONFIG_PHY_QCOM_QMP=m
+CONFIG_PHY_QCOM_QUSB2=m
 # CONFIG_PHY_QCOM_UFS is not set
 CONFIG_PHY_QCOM_USB_HSIC=m
 CONFIG_PHY_QCOM_USB_HS=m
@@ -5611,6 +5618,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5707,6 +5718,7 @@ CONFIG_USB_DWC3_PCI=m
 CONFIG_USB_DWC3_ULPI=y
 # CONFIG_USB_DYNAMIC_MINORS is not set
 # CONFIG_USB_EG20T is not set
+CONFIG_USB_EHCI_HCD_ORION=m
 CONFIG_USB_EHCI_HCD_PLATFORM=m
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_MSM=m
@@ -5873,6 +5885,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG_WHITELIST is not set
 CONFIG_USB_OTG=y
 # CONFIG_USB_OXU210HP_HCD is not set
+CONFIG_USB_PCI=y
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -6206,6 +6219,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-aarch64.config b/kernel-aarch64.config
index 22c79c4e2..0be9d7663 100644
--- a/kernel-aarch64.config
+++ b/kernel-aarch64.config
@@ -1240,7 +1240,7 @@ CONFIG_DRM_LOAD_EDID_FIRMWARE=y
 CONFIG_DRM=m
 CONFIG_DRM_MALI_DISPLAY=m
 # CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set
-CONFIG_DRM_MESON_DW_HDMI=m
+# CONFIG_DRM_MESON_DW_HDMI is not set
 CONFIG_DRM_MESON=m
 CONFIG_DRM_MGAG200=m
 # CONFIG_DRM_MGA is not set
@@ -1462,6 +1462,7 @@ CONFIG_EXT4_USE_FOR_EXT2=y
 CONFIG_EXTCON_ADC_JACK=m
 CONFIG_EXTCON_AXP288=m
 CONFIG_EXTCON_GPIO=m
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 CONFIG_EXTCON=m
 # CONFIG_EXTCON_MAX3355 is not set
@@ -1671,6 +1672,7 @@ CONFIG_GPIO_AXP209=m
 CONFIG_GPIO_DEVRES=y
 CONFIG_GPIO_DWAPB=m
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
@@ -1707,6 +1709,7 @@ CONFIG_GPIO_WATCHDOG=m
 CONFIG_GPIO_XGENE_SB=m
 CONFIG_GPIO_XGENE=y
 # CONFIG_GPIO_XILINX is not set
+CONFIG_GPIO_XLP=m
 CONFIG_GREENASIA_FF=y
 # CONFIG_GREYBUS is not set
 # CONFIG_GS_FPGABOOT is not set
@@ -1718,6 +1721,7 @@ CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2690,6 +2694,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -3053,7 +3058,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3215,6 +3219,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -3910,6 +3915,8 @@ CONFIG_PHY_MVEBU_SATA=y
 # CONFIG_PHY_PXA_28NM_USB2 is not set
 # CONFIG_PHY_QCOM_APQ8064_SATA is not set
 # CONFIG_PHY_QCOM_IPQ806X_SATA is not set
+CONFIG_PHY_QCOM_QMP=m
+CONFIG_PHY_QCOM_QUSB2=m
 # CONFIG_PHY_QCOM_UFS is not set
 CONFIG_PHY_QCOM_USB_HSIC=m
 CONFIG_PHY_QCOM_USB_HS=m
@@ -5588,6 +5595,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5684,6 +5695,7 @@ CONFIG_USB_DWC3_PCI=m
 CONFIG_USB_DWC3_ULPI=y
 # CONFIG_USB_DYNAMIC_MINORS is not set
 # CONFIG_USB_EG20T is not set
+CONFIG_USB_EHCI_HCD_ORION=m
 CONFIG_USB_EHCI_HCD_PLATFORM=m
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_MSM=m
@@ -5850,6 +5862,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG_WHITELIST is not set
 CONFIG_USB_OTG=y
 # CONFIG_USB_OXU210HP_HCD is not set
+CONFIG_USB_PCI=y
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -6183,6 +6196,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-armv7hl-debug.config b/kernel-armv7hl-debug.config
index 02069e57e..ba485cfa9 100644
--- a/kernel-armv7hl-debug.config
+++ b/kernel-armv7hl-debug.config
@@ -1302,7 +1302,7 @@ CONFIG_DRM_CIRRUS_QEMU=m
 # CONFIG_DRM_DEBUG_MM_SELFTEST is not set
 CONFIG_DRM_DP_AUX_CHARDEV=y
 CONFIG_DRM_DUMB_VGA_DAC=m
-CONFIG_DRM_DW_HDMI_AHB_AUDIO=m
+# CONFIG_DRM_DW_HDMI_AHB_AUDIO is not set
 CONFIG_DRM_DW_HDMI_I2S_AUDIO=m
 CONFIG_DRM_DW_HDMI=m
 CONFIG_DRM_ETNAVIV=m
@@ -1348,7 +1348,7 @@ CONFIG_DRM_LOAD_EDID_FIRMWARE=y
 CONFIG_DRM=m
 CONFIG_DRM_MALI_DISPLAY=m
 # CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set
-CONFIG_DRM_MESON_DW_HDMI=m
+# CONFIG_DRM_MESON_DW_HDMI is not set
 CONFIG_DRM_MESON=m
 CONFIG_DRM_MGAG200=m
 # CONFIG_DRM_MGA is not set
@@ -1592,6 +1592,7 @@ CONFIG_EXT4_USE_FOR_EXT2=y
 CONFIG_EXTCON_ADC_JACK=m
 CONFIG_EXTCON_AXP288=m
 CONFIG_EXTCON_GPIO=m
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON_MAX3355 is not set
 CONFIG_EXTCON_MAX8997=m
@@ -1822,6 +1823,7 @@ CONFIG_GPIO_DA9055=m
 CONFIG_GPIO_DEVRES=y
 CONFIG_GPIO_DWAPB=m
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
@@ -1881,6 +1883,7 @@ CONFIG_HAVE_ARM_ARCH_TIMER=y
 CONFIG_HAVE_ARM_TWD=y
 CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HDQ_MASTER_OMAP=m
 CONFIG_HEADERS_CHECK=y
@@ -2899,6 +2902,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -3301,7 +3305,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3495,6 +3498,7 @@ CONFIG_NEON=y
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -3991,6 +3995,7 @@ CONFIG_NTP_PPS=y
 CONFIG_NVEC_PAZ00=y
 CONFIG_NVEC_POWER=y
 CONFIG_NVME_FC=m
+CONFIG_NVMEM_IMX_IIM=m
 CONFIG_NVMEM_IMX_OCOTP=m
 CONFIG_NVMEM=m
 CONFIG_NVMEM_SUNXI_SID=m
@@ -4239,6 +4244,8 @@ CONFIG_PHY_MVEBU_SATA=y
 # CONFIG_PHY_PXA_28NM_USB2 is not set
 CONFIG_PHY_QCOM_APQ8064_SATA=m
 # CONFIG_PHY_QCOM_IPQ806X_SATA is not set
+CONFIG_PHY_QCOM_QMP=m
+CONFIG_PHY_QCOM_QUSB2=m
 CONFIG_PHY_QCOM_UFS=m
 CONFIG_PHY_QCOM_USB_HSIC=m
 CONFIG_PHY_QCOM_USB_HS=m
@@ -6134,6 +6141,10 @@ CONFIG_TWL4030_WATCHDOG=m
 CONFIG_TWL6030_GPADC=m
 CONFIG_TWL6030_USB=m
 CONFIG_TWL6040_CORE=y
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 # CONFIG_UACCESS_WITH_MEMCPY is not set
 CONFIG_UBIFS_ATIME_SUPPORT=y
@@ -6417,6 +6428,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG_WHITELIST is not set
 CONFIG_USB_OTG=y
 # CONFIG_USB_OXU210HP_HCD is not set
+CONFIG_USB_PCI=y
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -6784,6 +6796,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-armv7hl-lpae-debug.config b/kernel-armv7hl-lpae-debug.config
index 5a42e9842..702043990 100644
--- a/kernel-armv7hl-lpae-debug.config
+++ b/kernel-armv7hl-lpae-debug.config
@@ -1252,7 +1252,7 @@ CONFIG_DRM_CIRRUS_QEMU=m
 # CONFIG_DRM_DEBUG_MM_SELFTEST is not set
 CONFIG_DRM_DP_AUX_CHARDEV=y
 CONFIG_DRM_DUMB_VGA_DAC=m
-CONFIG_DRM_DW_HDMI_AHB_AUDIO=m
+# CONFIG_DRM_DW_HDMI_AHB_AUDIO is not set
 CONFIG_DRM_DW_HDMI_I2S_AUDIO=m
 CONFIG_DRM_DW_HDMI=m
 CONFIG_DRM_EXYNOS5433_DECON=y
@@ -1291,7 +1291,7 @@ CONFIG_DRM_LOAD_EDID_FIRMWARE=y
 CONFIG_DRM=m
 CONFIG_DRM_MALI_DISPLAY=m
 # CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set
-CONFIG_DRM_MESON_DW_HDMI=m
+# CONFIG_DRM_MESON_DW_HDMI is not set
 CONFIG_DRM_MESON=m
 CONFIG_DRM_MGAG200=m
 # CONFIG_DRM_MGA is not set
@@ -1512,6 +1512,7 @@ CONFIG_EXT4_USE_FOR_EXT2=y
 CONFIG_EXTCON_ADC_JACK=m
 CONFIG_EXTCON_AXP288=m
 CONFIG_EXTCON_GPIO=m
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON_MAX3355 is not set
 CONFIG_EXTCON_MAX8997=m
@@ -1735,6 +1736,7 @@ CONFIG_GPIO_DAVINCI=y
 CONFIG_GPIO_DEVRES=y
 CONFIG_GPIO_DWAPB=m
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
@@ -1786,6 +1788,7 @@ CONFIG_HAVE_ARM_ARCH_TIMER=y
 CONFIG_HAVE_ARM_TWD=y
 CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2773,6 +2776,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -3156,7 +3160,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3333,6 +3336,7 @@ CONFIG_NEON=y
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -3824,6 +3828,7 @@ CONFIG_NSC_FIR=m
 # CONFIG_NTFS_FS is not set
 CONFIG_NTP_PPS=y
 CONFIG_NVME_FC=m
+CONFIG_NVMEM_IMX_IIM=m
 CONFIG_NVMEM=m
 CONFIG_NVMEM_SUNXI_SID=m
 CONFIG_NVME_RDMA=m
@@ -4028,6 +4033,8 @@ CONFIG_PHY_MVEBU_SATA=y
 # CONFIG_PHY_PXA_28NM_HSIC is not set
 # CONFIG_PHY_PXA_28NM_USB2 is not set
 # CONFIG_PHY_QCOM_IPQ806X_SATA is not set
+CONFIG_PHY_QCOM_QMP=m
+CONFIG_PHY_QCOM_QUSB2=m
 CONFIG_PHY_QCOM_USB_HSIC=m
 CONFIG_PHY_QCOM_USB_HS=m
 CONFIG_PHY_ROCKCHIP_DP=m
@@ -5743,6 +5750,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 # CONFIG_UACCESS_WITH_MEMCPY is not set
 CONFIG_UBIFS_ATIME_SUPPORT=y
@@ -6009,6 +6020,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG_WHITELIST is not set
 CONFIG_USB_OTG=y
 # CONFIG_USB_OXU210HP_HCD is not set
+CONFIG_USB_PCI=y
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -6356,6 +6368,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-armv7hl-lpae.config b/kernel-armv7hl-lpae.config
index d8d4c2576..c2b0cb81e 100644
--- a/kernel-armv7hl-lpae.config
+++ b/kernel-armv7hl-lpae.config
@@ -1242,7 +1242,7 @@ CONFIG_DRM_CIRRUS_QEMU=m
 # CONFIG_DRM_DEBUG_MM_SELFTEST is not set
 CONFIG_DRM_DP_AUX_CHARDEV=y
 CONFIG_DRM_DUMB_VGA_DAC=m
-CONFIG_DRM_DW_HDMI_AHB_AUDIO=m
+# CONFIG_DRM_DW_HDMI_AHB_AUDIO is not set
 CONFIG_DRM_DW_HDMI_I2S_AUDIO=m
 CONFIG_DRM_DW_HDMI=m
 CONFIG_DRM_EXYNOS5433_DECON=y
@@ -1281,7 +1281,7 @@ CONFIG_DRM_LOAD_EDID_FIRMWARE=y
 CONFIG_DRM=m
 CONFIG_DRM_MALI_DISPLAY=m
 # CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set
-CONFIG_DRM_MESON_DW_HDMI=m
+# CONFIG_DRM_MESON_DW_HDMI is not set
 CONFIG_DRM_MESON=m
 CONFIG_DRM_MGAG200=m
 # CONFIG_DRM_MGA is not set
@@ -1502,6 +1502,7 @@ CONFIG_EXT4_USE_FOR_EXT2=y
 CONFIG_EXTCON_ADC_JACK=m
 CONFIG_EXTCON_AXP288=m
 CONFIG_EXTCON_GPIO=m
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON_MAX3355 is not set
 CONFIG_EXTCON_MAX8997=m
@@ -1718,6 +1719,7 @@ CONFIG_GPIO_DAVINCI=y
 CONFIG_GPIO_DEVRES=y
 CONFIG_GPIO_DWAPB=m
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
@@ -1769,6 +1771,7 @@ CONFIG_HAVE_ARM_ARCH_TIMER=y
 CONFIG_HAVE_ARM_TWD=y
 CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2754,6 +2757,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -3135,7 +3139,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3312,6 +3315,7 @@ CONFIG_NEON=y
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -3803,6 +3807,7 @@ CONFIG_NSC_FIR=m
 # CONFIG_NTFS_FS is not set
 CONFIG_NTP_PPS=y
 CONFIG_NVME_FC=m
+CONFIG_NVMEM_IMX_IIM=m
 CONFIG_NVMEM=m
 CONFIG_NVMEM_SUNXI_SID=m
 CONFIG_NVME_RDMA=m
@@ -4007,6 +4012,8 @@ CONFIG_PHY_MVEBU_SATA=y
 # CONFIG_PHY_PXA_28NM_HSIC is not set
 # CONFIG_PHY_PXA_28NM_USB2 is not set
 # CONFIG_PHY_QCOM_IPQ806X_SATA is not set
+CONFIG_PHY_QCOM_QMP=m
+CONFIG_PHY_QCOM_QUSB2=m
 CONFIG_PHY_QCOM_USB_HSIC=m
 CONFIG_PHY_QCOM_USB_HS=m
 CONFIG_PHY_ROCKCHIP_DP=m
@@ -5720,6 +5727,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 # CONFIG_UACCESS_WITH_MEMCPY is not set
 CONFIG_UBIFS_ATIME_SUPPORT=y
@@ -5986,6 +5997,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG_WHITELIST is not set
 CONFIG_USB_OTG=y
 # CONFIG_USB_OXU210HP_HCD is not set
+CONFIG_USB_PCI=y
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -6333,6 +6345,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-armv7hl.config b/kernel-armv7hl.config
index 59aa14658..8093e0cdf 100644
--- a/kernel-armv7hl.config
+++ b/kernel-armv7hl.config
@@ -1292,7 +1292,7 @@ CONFIG_DRM_CIRRUS_QEMU=m
 # CONFIG_DRM_DEBUG_MM_SELFTEST is not set
 CONFIG_DRM_DP_AUX_CHARDEV=y
 CONFIG_DRM_DUMB_VGA_DAC=m
-CONFIG_DRM_DW_HDMI_AHB_AUDIO=m
+# CONFIG_DRM_DW_HDMI_AHB_AUDIO is not set
 CONFIG_DRM_DW_HDMI_I2S_AUDIO=m
 CONFIG_DRM_DW_HDMI=m
 CONFIG_DRM_ETNAVIV=m
@@ -1338,7 +1338,7 @@ CONFIG_DRM_LOAD_EDID_FIRMWARE=y
 CONFIG_DRM=m
 CONFIG_DRM_MALI_DISPLAY=m
 # CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set
-CONFIG_DRM_MESON_DW_HDMI=m
+# CONFIG_DRM_MESON_DW_HDMI is not set
 CONFIG_DRM_MESON=m
 CONFIG_DRM_MGAG200=m
 # CONFIG_DRM_MGA is not set
@@ -1582,6 +1582,7 @@ CONFIG_EXT4_USE_FOR_EXT2=y
 CONFIG_EXTCON_ADC_JACK=m
 CONFIG_EXTCON_AXP288=m
 CONFIG_EXTCON_GPIO=m
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON_MAX3355 is not set
 CONFIG_EXTCON_MAX8997=m
@@ -1805,6 +1806,7 @@ CONFIG_GPIO_DA9055=m
 CONFIG_GPIO_DEVRES=y
 CONFIG_GPIO_DWAPB=m
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 CONFIG_GPIO_GENERIC_PLATFORM=y
 CONFIG_GPIO_GENERIC=y
 # CONFIG_GPIO_GRGPIO is not set
@@ -1864,6 +1866,7 @@ CONFIG_HAVE_ARM_ARCH_TIMER=y
 CONFIG_HAVE_ARM_TWD=y
 CONFIG_HAVE_PERF_REGS=y
 CONFIG_HAVE_PERF_USER_STACK_DUMP=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HDQ_MASTER_OMAP=m
 CONFIG_HEADERS_CHECK=y
@@ -2880,6 +2883,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -3280,7 +3284,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3474,6 +3477,7 @@ CONFIG_NEON=y
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -3970,6 +3974,7 @@ CONFIG_NTP_PPS=y
 CONFIG_NVEC_PAZ00=y
 CONFIG_NVEC_POWER=y
 CONFIG_NVME_FC=m
+CONFIG_NVMEM_IMX_IIM=m
 CONFIG_NVMEM_IMX_OCOTP=m
 CONFIG_NVMEM=m
 CONFIG_NVMEM_SUNXI_SID=m
@@ -4218,6 +4223,8 @@ CONFIG_PHY_MVEBU_SATA=y
 # CONFIG_PHY_PXA_28NM_USB2 is not set
 CONFIG_PHY_QCOM_APQ8064_SATA=m
 # CONFIG_PHY_QCOM_IPQ806X_SATA is not set
+CONFIG_PHY_QCOM_QMP=m
+CONFIG_PHY_QCOM_QUSB2=m
 CONFIG_PHY_QCOM_UFS=m
 CONFIG_PHY_QCOM_USB_HSIC=m
 CONFIG_PHY_QCOM_USB_HS=m
@@ -6111,6 +6118,10 @@ CONFIG_TWL4030_WATCHDOG=m
 CONFIG_TWL6030_GPADC=m
 CONFIG_TWL6030_USB=m
 CONFIG_TWL6040_CORE=y
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 # CONFIG_UACCESS_WITH_MEMCPY is not set
 CONFIG_UBIFS_ATIME_SUPPORT=y
@@ -6394,6 +6405,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG_WHITELIST is not set
 CONFIG_USB_OTG=y
 # CONFIG_USB_OXU210HP_HCD is not set
+CONFIG_USB_PCI=y
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -6761,6 +6773,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-i686-PAE.config b/kernel-i686-PAE.config
index 4f4af47b3..eeb30088d 100644
--- a/kernel-i686-PAE.config
+++ b/kernel-i686-PAE.config
@@ -1354,6 +1354,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1578,6 +1579,7 @@ CONFIG_GPIO_CRYSTAL_COVE=y
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_F7188X is not set
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
@@ -1623,6 +1625,7 @@ CONFIG_HAMRADIO=y
 CONFIG_HANGCHECK_TIMER=m
 CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HDMI_LPE_AUDIO=m
 CONFIG_HEADERS_CHECK=y
@@ -2096,6 +2099,7 @@ CONFIG_INT3406_THERMAL=m
 CONFIG_INT340X_THERMAL=m
 # CONFIG_INTEGRITY is not set
 CONFIG_INTEL_BXT_PMIC_THERMAL=m
+CONFIG_INTEL_CHT_INT33FE=m
 CONFIG_INTEL_HID_EVENT=m
 CONFIG_INTEL_IDLE=y
 CONFIG_INTEL_IDMA64=m
@@ -2634,6 +2638,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+CONFIG_LOAD_UEFI_KEYS=y
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -2980,7 +2985,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-CONFIG_MODULE_SIG_UEFI=y
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3131,6 +3135,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5318,6 +5323,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5527,6 +5536,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5855,6 +5865,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
@@ -5987,6 +5998,7 @@ CONFIG_XEN_COMPAT_XENFS=y
 CONFIG_XEN_DEBUG_FS=y
 # CONFIG_XEN_DEBUG is not set
 CONFIG_XEN_DEV_EVTCHN=m
+CONFIG_XEN_DOM0=y
 CONFIG_XEN_FBDEV_FRONTEND=y
 CONFIG_XENFS=m
 CONFIG_XEN_GNTDEV=m
@@ -5995,7 +6007,9 @@ CONFIG_XEN_NETDEV_BACKEND=m
 CONFIG_XEN_NETDEV_FRONTEND=m
 CONFIG_XEN_PCIDEV_BACKEND=m
 CONFIG_XEN_PCIDEV_FRONTEND=m
+CONFIG_XEN_PVHVM=y
 CONFIG_XEN_PVH=y
+CONFIG_XEN_PV=y
 CONFIG_XEN_SAVE_RESTORE=y
 CONFIG_XEN_SCRUB_PAGES=y
 CONFIG_XEN_SCSI_BACKEND=m
diff --git a/kernel-i686-PAEdebug.config b/kernel-i686-PAEdebug.config
index ec46e3847..df92a6e24 100644
--- a/kernel-i686-PAEdebug.config
+++ b/kernel-i686-PAEdebug.config
@@ -1365,6 +1365,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1596,6 +1597,7 @@ CONFIG_GPIO_CRYSTAL_COVE=y
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_F7188X is not set
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
@@ -1641,6 +1643,7 @@ CONFIG_HAMRADIO=y
 CONFIG_HANGCHECK_TIMER=m
 CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HDMI_LPE_AUDIO=m
 CONFIG_HEADERS_CHECK=y
@@ -2114,6 +2117,7 @@ CONFIG_INT3406_THERMAL=m
 CONFIG_INT340X_THERMAL=m
 # CONFIG_INTEGRITY is not set
 CONFIG_INTEL_BXT_PMIC_THERMAL=m
+CONFIG_INTEL_CHT_INT33FE=m
 CONFIG_INTEL_HID_EVENT=m
 CONFIG_INTEL_IDLE=y
 CONFIG_INTEL_IDMA64=m
@@ -2654,6 +2658,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+CONFIG_LOAD_UEFI_KEYS=y
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -3000,7 +3005,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-CONFIG_MODULE_SIG_UEFI=y
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3151,6 +3155,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5340,6 +5345,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5549,6 +5558,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5877,6 +5887,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
@@ -6009,6 +6020,7 @@ CONFIG_XEN_COMPAT_XENFS=y
 CONFIG_XEN_DEBUG_FS=y
 # CONFIG_XEN_DEBUG is not set
 CONFIG_XEN_DEV_EVTCHN=m
+CONFIG_XEN_DOM0=y
 CONFIG_XEN_FBDEV_FRONTEND=y
 CONFIG_XENFS=m
 CONFIG_XEN_GNTDEV=m
@@ -6017,7 +6029,9 @@ CONFIG_XEN_NETDEV_BACKEND=m
 CONFIG_XEN_NETDEV_FRONTEND=m
 CONFIG_XEN_PCIDEV_BACKEND=m
 CONFIG_XEN_PCIDEV_FRONTEND=m
+CONFIG_XEN_PVHVM=y
 CONFIG_XEN_PVH=y
+CONFIG_XEN_PV=y
 CONFIG_XEN_SAVE_RESTORE=y
 CONFIG_XEN_SCRUB_PAGES=y
 CONFIG_XEN_SCSI_BACKEND=m
diff --git a/kernel-i686-debug.config b/kernel-i686-debug.config
index d147e7b4d..4a0c3dced 100644
--- a/kernel-i686-debug.config
+++ b/kernel-i686-debug.config
@@ -1365,6 +1365,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1596,6 +1597,7 @@ CONFIG_GPIO_CS5535=y
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_F7188X is not set
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
@@ -1641,6 +1643,7 @@ CONFIG_HAMRADIO=y
 CONFIG_HANGCHECK_TIMER=m
 CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HDMI_LPE_AUDIO=m
 CONFIG_HEADERS_CHECK=y
@@ -2114,6 +2117,7 @@ CONFIG_INT3406_THERMAL=m
 CONFIG_INT340X_THERMAL=m
 # CONFIG_INTEGRITY is not set
 CONFIG_INTEL_BXT_PMIC_THERMAL=m
+CONFIG_INTEL_CHT_INT33FE=m
 CONFIG_INTEL_HID_EVENT=m
 CONFIG_INTEL_IDLE=y
 CONFIG_INTEL_IDMA64=m
@@ -2654,6 +2658,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+CONFIG_LOAD_UEFI_KEYS=y
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -3000,7 +3005,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-CONFIG_MODULE_SIG_UEFI=y
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3151,6 +3155,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5340,6 +5345,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5549,6 +5558,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5877,6 +5887,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
@@ -6008,6 +6019,7 @@ CONFIG_XEN_BLKDEV_FRONTEND=m
 CONFIG_XEN_COMPAT_XENFS=y
 CONFIG_XEN_DEBUG_FS=y
 # CONFIG_XEN_DEBUG is not set
+CONFIG_XEN_DOM0=y
 CONFIG_XEN_FBDEV_FRONTEND=y
 CONFIG_XENFS=m
 CONFIG_XEN_GNTDEV=m
@@ -6016,7 +6028,9 @@ CONFIG_XEN_NETDEV_BACKEND=m
 CONFIG_XEN_NETDEV_FRONTEND=m
 CONFIG_XEN_PCIDEV_BACKEND=m
 CONFIG_XEN_PCIDEV_FRONTEND=m
+CONFIG_XEN_PVHVM=y
 CONFIG_XEN_PVH=y
+CONFIG_XEN_PV=y
 CONFIG_XEN_SAVE_RESTORE=y
 CONFIG_XEN_SCRUB_PAGES=y
 CONFIG_XEN_SCSI_BACKEND=m
diff --git a/kernel-i686.config b/kernel-i686.config
index 8ced03c95..9686bea7c 100644
--- a/kernel-i686.config
+++ b/kernel-i686.config
@@ -1354,6 +1354,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1578,6 +1579,7 @@ CONFIG_GPIO_CS5535=y
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_F7188X is not set
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
@@ -1623,6 +1625,7 @@ CONFIG_HAMRADIO=y
 CONFIG_HANGCHECK_TIMER=m
 CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HDMI_LPE_AUDIO=m
 CONFIG_HEADERS_CHECK=y
@@ -2096,6 +2099,7 @@ CONFIG_INT3406_THERMAL=m
 CONFIG_INT340X_THERMAL=m
 # CONFIG_INTEGRITY is not set
 CONFIG_INTEL_BXT_PMIC_THERMAL=m
+CONFIG_INTEL_CHT_INT33FE=m
 CONFIG_INTEL_HID_EVENT=m
 CONFIG_INTEL_IDLE=y
 CONFIG_INTEL_IDMA64=m
@@ -2634,6 +2638,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+CONFIG_LOAD_UEFI_KEYS=y
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -2980,7 +2985,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-CONFIG_MODULE_SIG_UEFI=y
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3131,6 +3135,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5318,6 +5323,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5527,6 +5536,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5855,6 +5865,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
@@ -5986,6 +5997,7 @@ CONFIG_XEN_BLKDEV_FRONTEND=m
 CONFIG_XEN_COMPAT_XENFS=y
 CONFIG_XEN_DEBUG_FS=y
 # CONFIG_XEN_DEBUG is not set
+CONFIG_XEN_DOM0=y
 CONFIG_XEN_FBDEV_FRONTEND=y
 CONFIG_XENFS=m
 CONFIG_XEN_GNTDEV=m
@@ -5994,7 +6006,9 @@ CONFIG_XEN_NETDEV_BACKEND=m
 CONFIG_XEN_NETDEV_FRONTEND=m
 CONFIG_XEN_PCIDEV_BACKEND=m
 CONFIG_XEN_PCIDEV_FRONTEND=m
+CONFIG_XEN_PVHVM=y
 CONFIG_XEN_PVH=y
+CONFIG_XEN_PV=y
 CONFIG_XEN_SAVE_RESTORE=y
 CONFIG_XEN_SCRUB_PAGES=y
 CONFIG_XEN_SCSI_BACKEND=m
diff --git a/kernel-ppc64-debug.config b/kernel-ppc64-debug.config
index 602dda3f1..7dabfd596 100644
--- a/kernel-ppc64-debug.config
+++ b/kernel-ppc64-debug.config
@@ -1284,6 +1284,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1508,6 +1509,7 @@ CONFIG_GIRBIL_DONGLE=m
 # CONFIG_GPIO_BT8XX is not set
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 # CONFIG_GPIO_IT87 is not set
@@ -1549,6 +1551,7 @@ CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HAVE_BOOTMEM_INFO_NODE=y
 # CONFIG_HCALL_STATS is not set
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2509,6 +2512,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -2847,7 +2851,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -2982,6 +2985,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5131,6 +5135,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5346,6 +5354,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5666,6 +5675,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-ppc64.config b/kernel-ppc64.config
index e1ddff27a..4190d58b7 100644
--- a/kernel-ppc64.config
+++ b/kernel-ppc64.config
@@ -1273,6 +1273,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1490,6 +1491,7 @@ CONFIG_GIRBIL_DONGLE=m
 # CONFIG_GPIO_BT8XX is not set
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 # CONFIG_GPIO_IT87 is not set
@@ -1531,6 +1533,7 @@ CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HAVE_BOOTMEM_INFO_NODE=y
 # CONFIG_HCALL_STATS is not set
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2489,6 +2492,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -2825,7 +2829,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -2960,6 +2963,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5107,6 +5111,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5322,6 +5330,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5642,6 +5651,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-ppc64le-debug.config b/kernel-ppc64le-debug.config
index a11b4f639..c03338df8 100644
--- a/kernel-ppc64le-debug.config
+++ b/kernel-ppc64le-debug.config
@@ -1238,6 +1238,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1462,6 +1463,7 @@ CONFIG_GIRBIL_DONGLE=m
 # CONFIG_GPIO_BT8XX is not set
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 # CONFIG_GPIO_IT87 is not set
@@ -1503,6 +1505,7 @@ CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HAVE_BOOTMEM_INFO_NODE=y
 # CONFIG_HCALL_STATS is not set
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2455,6 +2458,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -2792,7 +2796,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -2927,6 +2930,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5060,6 +5064,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5275,6 +5283,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5595,6 +5604,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-ppc64le.config b/kernel-ppc64le.config
index bbe941b93..48ecc2887 100644
--- a/kernel-ppc64le.config
+++ b/kernel-ppc64le.config
@@ -1227,6 +1227,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1444,6 +1445,7 @@ CONFIG_GIRBIL_DONGLE=m
 # CONFIG_GPIO_BT8XX is not set
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 # CONFIG_GPIO_IT87 is not set
@@ -1485,6 +1487,7 @@ CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HAVE_BOOTMEM_INFO_NODE=y
 # CONFIG_HCALL_STATS is not set
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2435,6 +2438,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -2770,7 +2774,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -2905,6 +2908,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5036,6 +5040,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5251,6 +5259,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5571,6 +5580,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-ppc64p7-debug.config b/kernel-ppc64p7-debug.config
index 53cb9c2a2..b84530924 100644
--- a/kernel-ppc64p7-debug.config
+++ b/kernel-ppc64p7-debug.config
@@ -1237,6 +1237,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1461,6 +1462,7 @@ CONFIG_GIRBIL_DONGLE=m
 # CONFIG_GPIO_BT8XX is not set
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 # CONFIG_GPIO_IT87 is not set
@@ -1502,6 +1504,7 @@ CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HAVE_BOOTMEM_INFO_NODE=y
 # CONFIG_HCALL_STATS is not set
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2454,6 +2457,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -2791,7 +2795,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -2926,6 +2929,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5059,6 +5063,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5274,6 +5282,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5594,6 +5603,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-ppc64p7.config b/kernel-ppc64p7.config
index f82453a1f..be032d86b 100644
--- a/kernel-ppc64p7.config
+++ b/kernel-ppc64p7.config
@@ -1226,6 +1226,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1443,6 +1444,7 @@ CONFIG_GIRBIL_DONGLE=m
 # CONFIG_GPIO_BT8XX is not set
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 # CONFIG_GPIO_IT87 is not set
@@ -1484,6 +1486,7 @@ CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HAVE_BOOTMEM_INFO_NODE=y
 # CONFIG_HCALL_STATS is not set
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2434,6 +2437,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -2769,7 +2773,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -2904,6 +2907,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5035,6 +5039,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5250,6 +5258,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5570,6 +5579,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-s390x-debug.config b/kernel-s390x-debug.config
index d177751c9..6884dcc44 100644
--- a/kernel-s390x-debug.config
+++ b/kernel-s390x-debug.config
@@ -1229,6 +1229,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1430,6 +1431,7 @@ CONFIG_GIRBIL_DONGLE=m
 # CONFIG_GPIO_BT8XX is not set
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 # CONFIG_GPIO_IT87 is not set
@@ -1467,6 +1469,7 @@ CONFIG_HAMRADIO=y
 CONFIG_HANGCHECK_TIMER=m
 CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2393,6 +2396,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -2726,7 +2730,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -2857,6 +2860,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -4956,6 +4960,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5164,6 +5172,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5486,6 +5495,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-s390x.config b/kernel-s390x.config
index b7e13b2a4..2ef011048 100644
--- a/kernel-s390x.config
+++ b/kernel-s390x.config
@@ -1218,6 +1218,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1412,6 +1413,7 @@ CONFIG_GIRBIL_DONGLE=m
 # CONFIG_GPIO_BT8XX is not set
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 # CONFIG_GPIO_IT87 is not set
@@ -1449,6 +1451,7 @@ CONFIG_HAMRADIO=y
 CONFIG_HANGCHECK_TIMER=m
 CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HEADERS_CHECK=y
 CONFIG_HERMES_CACHE_FW_ON_INIT=y
@@ -2373,6 +2376,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+# CONFIG_LOAD_UEFI_KEYS is not set
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -2704,7 +2708,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-# CONFIG_MODULE_SIG_UEFI is not set
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -2835,6 +2838,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -4932,6 +4936,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5140,6 +5148,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5462,6 +5471,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
diff --git a/kernel-x86_64-debug.config b/kernel-x86_64-debug.config
index 3b7b36861..4c684d242 100644
--- a/kernel-x86_64-debug.config
+++ b/kernel-x86_64-debug.config
@@ -1401,6 +1401,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1626,6 +1627,7 @@ CONFIG_GPIO_CRYSTAL_COVE=y
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_F7188X is not set
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
@@ -1671,6 +1673,7 @@ CONFIG_HANGCHECK_TIMER=m
 CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HAVE_MEMORY_PRESENT=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HDMI_LPE_AUDIO=m
 CONFIG_HEADERS_CHECK=y
@@ -2147,6 +2150,7 @@ CONFIG_INT3406_THERMAL=m
 CONFIG_INT340X_THERMAL=m
 # CONFIG_INTEGRITY is not set
 CONFIG_INTEL_BXT_PMIC_THERMAL=m
+CONFIG_INTEL_CHT_INT33FE=m
 CONFIG_INTEL_HID_EVENT=m
 CONFIG_INTEL_IDLE=y
 CONFIG_INTEL_IDMA64=m
@@ -2694,6 +2698,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+CONFIG_LOAD_UEFI_KEYS=y
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -3036,7 +3041,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-CONFIG_MODULE_SIG_UEFI=y
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3178,6 +3182,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5376,6 +5381,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5585,6 +5594,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5917,6 +5927,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
@@ -6039,6 +6050,7 @@ CONFIG_XEN_COMPAT_XENFS=y
 CONFIG_XEN_DEBUG_FS=y
 # CONFIG_XEN_DEBUG is not set
 CONFIG_XEN_DEV_EVTCHN=m
+CONFIG_XEN_DOM0=y
 CONFIG_XEN_FBDEV_FRONTEND=y
 CONFIG_XENFS=m
 CONFIG_XEN_GNTDEV=m
@@ -6048,7 +6060,9 @@ CONFIG_XEN_NETDEV_BACKEND=m
 CONFIG_XEN_NETDEV_FRONTEND=m
 CONFIG_XEN_PCIDEV_BACKEND=m
 CONFIG_XEN_PCIDEV_FRONTEND=m
+CONFIG_XEN_PVHVM=y
 CONFIG_XEN_PVH=y
+CONFIG_XEN_PV=y
 CONFIG_XEN_SAVE_RESTORE=y
 CONFIG_XEN_SCRUB_PAGES=y
 CONFIG_XEN_SCSI_BACKEND=m
diff --git a/kernel-x86_64.config b/kernel-x86_64.config
index 191145943..b5216328c 100644
--- a/kernel-x86_64.config
+++ b/kernel-x86_64.config
@@ -1390,6 +1390,7 @@ CONFIG_EXT4_FS_SECURITY=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_USE_FOR_EXT2=y
 # CONFIG_EXTCON_ADC_JACK is not set
+CONFIG_EXTCON_INTEL_CHT_WC=y
 CONFIG_EXTCON_INTEL_INT3496=m
 # CONFIG_EXTCON is not set
 # CONFIG_EXTCON_QCOM_SPMI_MISC is not set
@@ -1608,6 +1609,7 @@ CONFIG_GPIO_CRYSTAL_COVE=y
 # CONFIG_GPIO_DWAPB is not set
 CONFIG_GPIO_EXAR=m
 # CONFIG_GPIO_F7188X is not set
+# CONFIG_GPIO_FTGPIO010 is not set
 # CONFIG_GPIO_GENERIC_PLATFORM is not set
 # CONFIG_GPIO_GRGPIO is not set
 CONFIG_GPIO_ICH=m
@@ -1653,6 +1655,7 @@ CONFIG_HANGCHECK_TIMER=m
 CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 CONFIG_HAVE_MEMORY_PRESENT=y
+# CONFIG_HD44780 is not set
 # CONFIG_HDC100X is not set
 CONFIG_HDMI_LPE_AUDIO=m
 CONFIG_HEADERS_CHECK=y
@@ -2129,6 +2132,7 @@ CONFIG_INT3406_THERMAL=m
 CONFIG_INT340X_THERMAL=m
 # CONFIG_INTEGRITY is not set
 CONFIG_INTEL_BXT_PMIC_THERMAL=m
+CONFIG_INTEL_CHT_INT33FE=m
 CONFIG_INTEL_HID_EVENT=m
 CONFIG_INTEL_IDLE=y
 CONFIG_INTEL_IDMA64=m
@@ -2674,6 +2678,7 @@ CONFIG_LITELINK_DONGLE=m
 CONFIG_LLC=m
 CONFIG_LMP91000=m
 # CONFIG_LNET is not set
+CONFIG_LOAD_UEFI_KEYS=y
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_LOCKD=m
@@ -3016,7 +3021,6 @@ CONFIG_MODULE_SIG_ALL=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 # CONFIG_MODULE_SIG_SHA1 is not set
 CONFIG_MODULE_SIG_SHA256=y
-CONFIG_MODULE_SIG_UEFI=y
 CONFIG_MODULE_SIG=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_MODULES=y
@@ -3158,6 +3162,7 @@ CONFIG_NE2K_PCI=m
 CONFIG_NET_9P=m
 CONFIG_NET_9P_RDMA=m
 CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_XEN=m
 CONFIG_NET_ACT_BPF=m
 CONFIG_NET_ACT_CONNMARK=m
 CONFIG_NET_ACT_CSUM=m
@@ -5354,6 +5359,10 @@ CONFIG_TUN=m
 # CONFIG_TUN_VNET_CROSS_LE is not set
 # CONFIG_TWL4030_CORE is not set
 # CONFIG_TWL6040_CORE is not set
+CONFIG_TYPEC_FUSB302=m
+CONFIG_TYPEC_TCPCI=m
+CONFIG_TYPEC_TCPM=m
+CONFIG_TYPEC_WCOVE=m
 CONFIG_TYPHOON=m
 CONFIG_UBIFS_ATIME_SUPPORT=y
 # CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
@@ -5563,6 +5572,7 @@ CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_PCI is not set
 CONFIG_USBPCWATCHDOG=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_PHY=y
@@ -5895,6 +5905,7 @@ CONFIG_W1_SLAVE_DS2423=m
 CONFIG_W1_SLAVE_DS2431=m
 CONFIG_W1_SLAVE_DS2433_CRC=y
 CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
 CONFIG_W1_SLAVE_DS2760=m
 CONFIG_W1_SLAVE_DS2780=m
 CONFIG_W1_SLAVE_DS2781=m
@@ -6017,6 +6028,7 @@ CONFIG_XEN_COMPAT_XENFS=y
 CONFIG_XEN_DEBUG_FS=y
 # CONFIG_XEN_DEBUG is not set
 CONFIG_XEN_DEV_EVTCHN=m
+CONFIG_XEN_DOM0=y
 CONFIG_XEN_FBDEV_FRONTEND=y
 CONFIG_XENFS=m
 CONFIG_XEN_GNTDEV=m
@@ -6026,7 +6038,9 @@ CONFIG_XEN_NETDEV_BACKEND=m
 CONFIG_XEN_NETDEV_FRONTEND=m
 CONFIG_XEN_PCIDEV_BACKEND=m
 CONFIG_XEN_PCIDEV_FRONTEND=m
+CONFIG_XEN_PVHVM=y
 CONFIG_XEN_PVH=y
+CONFIG_XEN_PV=y
 CONFIG_XEN_SAVE_RESTORE=y
 CONFIG_XEN_SCRUB_PAGES=y
 CONFIG_XEN_SCSI_BACKEND=m
diff --git a/kernel.spec b/kernel.spec
index dc0034569..d3e2fb9f7 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -69,7 +69,7 @@ Summary: The Linux kernel
 # The rc snapshot level
 %global rcrev 0
 # The git snapshot level
-%define gitrev 3
+%define gitrev 4
 # Set rpm version accordingly
 %define rpmversion 4.%{upstream_sublevel}.0
 %endif
@@ -595,8 +595,6 @@ Patch502: firmware-Drop-WARN-from-usermodehelper_read_trylock-.patch
 
 # Patch503: drm-i915-turn-off-wc-mmaps.patch
 
-Patch509: MODSIGN-Don-t-try-secure-boot-if-EFI-runtime-is-disa.patch
-
 #rhbz 1435154
 Patch666: powerpc-prom-Increase-RMA-size-to-512MB.patch
 
@@ -2178,6 +2176,9 @@ fi
 #
 #
 %changelog
+* Fri May 05 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.12.0-0.rc0.git4.1
+- Linux v4.11-8539-gaf82455
+
 * Thu May 04 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.12.0-0.rc0.git3.1
 - Linux v4.11-7650-ga1be8ed
 
diff --git a/sources b/sources
index 17ce92cce..384fd20d8 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (perf-man-4.11.tar.gz) = f6dec8c3a296fc5bb1dd58011d7d1340550b9f4f228169bab079b0b36f2d5d96784b808765acda2d547719f6e9fd73b2855ab825dfe4fea8af43c55e5786f8d6
 SHA512 (linux-4.11.tar.xz) = 6610eed97ffb7207c71771198c36179b8244ace7222bebb109507720e26c5f17d918079a56d5febdd8605844d67fb2df0ebe910fa2f2f53690daf6e2a8ad09c3
-SHA512 (patch-4.11-git3.xz) = 4281a0d0ff677f816aeaf004c396311fc6e403f0ba3671b2ede1ae5ca88fc33745cc7bcbe050d29c9cae10e05e0b485948d21b3f5213b0037800484fe406dc93
+SHA512 (patch-4.11-git4.xz) = a5c8f127217507a0ec98b620ea24183f58aa70058d91a04dd2ae293bd93f77dac0302e63d1fe377054a8768ed7447786641cabf00f52ca2a9c99ab2b43fbc909