add 3rd party/custom patches

3rd patchs (in alphabetical order):
- bbr3
- ntsync5
- openwrt
- pf-kernel
- xanmod
- zen

no configuration changes for now

debian/patches/krd/0001-Revert-objtool-dont-fail-the-kernel-build-on-fatal-errors.patch

@@ -0,0 +1,52 @@
+this reverts following commit:
+
+    From: Josh Poimboeuf <jpoimboe@redhat.com>
+    Date: Thu, 14 Jan 2021 16:32:42 -0600
+    Subject: objtool: Don't fail the kernel build on fatal errors
+
+    [ Upstream commit 655cf86548a3938538642a6df27dd359e13c86bd ]
+
+    This is basically a revert of commit 644592d32837 ("objtool: Fail the
+    kernel build on fatal errors").
+
+    That change turned out to be more trouble than it's worth.  Failing the
+    build is an extreme measure which sometimes gets too much attention and
+    blocks CI build testing.
+
+    These fatal-type warnings aren't yet as rare as we'd hope, due to the
+    ever-increasing matrix of supported toolchains/plugins and their
+    fast-changing nature as of late.
+
+    Also, there are more people (and bots) looking for objtool warnings than
+    ever before, so even non-fatal warnings aren't likely to be ignored for
+    long.
+
+    Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
+    Reviewed-by: Miroslav Benes <mbenes@suse.cz>
+    Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+    Reviewed-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
+    Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+    Signed-off-by: Sasha Levin <sashal@kernel.org>
+
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -4872,10 +4872,14 @@ int check(struct objtool_file *file)
+ 	}
+ 
+ out:
+-	/*
+-	 *  For now, don't fail the kernel build on fatal warnings.  These
+-	 *  errors are still fairly common due to the growing matrix of
+-	 *  supported toolchains and their recent pace of change.
+-	 */
++	if (ret < 0) {
++		/*
++		 *  Fatal error.  The binary is corrupt or otherwise broken in
++		 *  some way, or objtool itself is broken.  Fail the kernel
++		 *  build.
++		 */
++		return ret;
++	}
++
+ 	return 0;
+ }

debian/patches/krd/0002-established-timeout.patch

@@ -0,0 +1,11 @@
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -61,7 +61,7 @@ enum nf_ct_tcp_action {
+ static const unsigned int tcp_timeouts[TCP_CONNTRACK_TIMEOUT_MAX] = {
+ 	[TCP_CONNTRACK_SYN_SENT]	= 2 MINS,
+ 	[TCP_CONNTRACK_SYN_RECV]	= 60 SECS,
+-	[TCP_CONNTRACK_ESTABLISHED]	= 5 DAYS,
++	[TCP_CONNTRACK_ESTABLISHED]	= 128 MINS,
+ 	[TCP_CONNTRACK_FIN_WAIT]	= 2 MINS,
+ 	[TCP_CONNTRACK_CLOSE_WAIT]	= 60 SECS,
+ 	[TCP_CONNTRACK_LAST_ACK]	= 30 SECS,

debian/patches/krd/0003-local-ports.patch

@@ -0,0 +1,11 @@
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1802,7 +1802,7 @@ static __net_init int inet_init_net(stru
+ 	/*
+ 	 * Set defaults for local port range
+ 	 */
+-	net->ipv4.ip_local_ports.range = 60999u << 16 | 32768u;
++	net->ipv4.ip_local_ports.range = 65533u << 16 | 49152u;
+ 
+ 	seqlock_init(&net->ipv4.ping_group_range.lock);
+ 	/*

debian/patches/krd/0004-bridge-group_fwd_mask.patch

@@ -0,0 +1,37 @@
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -374,7 +374,11 @@ static rx_handler_result_t br_handle_fra
+ 			return RX_HANDLER_PASS;
+ 
+ 		case 0x01:	/* IEEE MAC (Pause) */
+-			goto drop;
++			fwd_mask |= p->br->group_fwd_mask;
++			if (fwd_mask & (1u << dest[5]))
++				goto forward;
++			else
++				goto drop;
+ 
+ 		case 0x0E:	/* 802.1AB LLDP */
+ 			fwd_mask |= p->br->group_fwd_mask;
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -1365,8 +1365,6 @@ static int br_changelink(struct net_devi
+ 	if (data[IFLA_BR_GROUP_FWD_MASK]) {
+ 		u16 fwd_mask = nla_get_u16(data[IFLA_BR_GROUP_FWD_MASK]);
+ 
+-		if (fwd_mask & BR_GROUPFWD_RESTRICTED)
+-			return -EINVAL;
+ 		br->group_fwd_mask = fwd_mask;
+ 	}
+ 
+--- a/net/bridge/br_sysfs_br.c
++++ b/net/bridge/br_sysfs_br.c
+@@ -179,8 +179,6 @@ static ssize_t group_fwd_mask_show(struc
+ static int set_group_fwd_mask(struct net_bridge *br, unsigned long val,
+ 			      struct netlink_ext_ack *extack)
+ {
+-	if (val & BR_GROUPFWD_RESTRICTED)
+-		return -EINVAL;
+ 
+ 	br->group_fwd_mask = val;
+