release 6.16.6-1

debian/.gitignore

@@ -27,6 +27,7 @@
 /rules.gen
 !/linux-bpf-dev.*
 !/linux-cpupower.*
+!/linux-misc-tools.*
 !/linux-perf.*
 
 # Ignore compiled Python files

debian/bin/gencontrol.py

@@ -62,7 +62,7 @@ class Gencontrol(Base):
         super().do_main_setup(config, vars, makeflags)
         makeflags.update({
             'VERSION': self.version.linux_version,
-            'UPSTREAMVERSION': self.version.linux_upstream,
+            'UPSTREAMVERSION': self.version.linux_upstream_full,
             'ABINAME': self.abiname,
             'SOURCEVERSION': self.version.complete,
         })
@@ -221,27 +221,17 @@ class Gencontrol(Base):
         do_meta = config.packages.meta
 
         relation_compiler = PackageRelationEntry(cast(str, config.build.compiler))
+        relation_compiler_host = PackageRelationEntry(
+            relation_compiler,
+            name=f'{relation_compiler.name}-for-host',
+        )
 
-        relation_compiler_header = PackageRelationGroup([relation_compiler])
+        # Generate compiler build-depends:
-
-        # Generate compiler build-depends for native:
-        # gcc-N [arm64] <!cross !pkg.linux.nokernel>
         self.bundle.source.build_depends_arch.merge([
             PackageRelationEntry(
-                relation_compiler,
+                relation_compiler_host,
                 arches={arch},
-                restrictions='<!cross !pkg.linux.nokernel>',
+                restrictions='<!pkg.linux.nokernel>',
-            )
-        ])
-
-        # Generate compiler build-depends for cross:
-        # gcc-N-aarch64-linux-gnu [arm64] <cross !pkg.linux.nokernel>
-        self.bundle.source.build_depends_arch.merge([
-            PackageRelationEntry(
-                relation_compiler,
-                name=f'{relation_compiler.name}-{config.defs_debianarch.gnutype_package}',
-                arches={arch},
-                restrictions='<cross !pkg.linux.nokernel>',
             )
         ])
 
@@ -307,7 +297,7 @@ class Gencontrol(Base):
                     desc.append(config.description.long[part])
                     desc.append_short(config.description.short[part])
 
-        packages_headers[0].depends.merge(relation_compiler_header)
+        packages_headers[0].depends.merge([relation_compiler_host])
         packages_own.extend(packages_image)
         packages_own.extend(packages_headers)
 
@@ -349,7 +339,7 @@ class Gencontrol(Base):
         makeflags['KCONFIG_OPTIONS'] = ''
         # Add "salt" to fix #872263
         makeflags['KCONFIG_OPTIONS'] += \
-            ' -o "BUILD_SALT=\\"%(source_basename)s%(abiname)s%(localversion)s\\""' % vars
+            ' -o "BUILD_SALT=\\"krd-%(source_basename)s-%(abiname)s%(localversion)s\\""' % vars
 
         merged_config = ('debian/build/config.%s_%s_%s' %
                          (config.name_debianarch, config.name_featureset, config.name_flavour))
@@ -360,17 +350,10 @@ class Gencontrol(Base):
     def process_changelog(self) -> None:
         version = self.version = self.changelog[0].version
 
-        if self.changelog[0].distribution == 'UNRELEASED':
+        self.abiname = f'{version.linux_upstream_full}'
-            self.abiname = f'{version.linux_upstream}+unreleased'
-        elif self.changelog[0].distribution == 'experimental':
-            self.abiname = f'{version.linux_upstream}'
-        elif version.linux_revision_backports:
-            self.abiname = f'{version.linux_upstream_full}+bpo'
-        else:
-            self.abiname = f'{version.linux_upstream_full}'
 
         self.vars = {
-            'upstreamversion': self.version.linux_upstream,
+            'upstreamversion': self.version.linux_upstream_full,
             'version': self.version.linux_version,
             'version_complete': self.version.complete,
             'source_basename': re.sub(r'-[\d.]+$', '',

debian/bin/genpatch-pf

@@ -5,11 +5,12 @@ export GIT_OPTIONAL_LOCKS=0
 
 w=$(git rev-parse --path-format=absolute --show-toplevel) ; : "${w:?}" ; cd "$w"
 
-dst='debian/patches/pf'
+dst='debian/patches/tmp-pf'
 src='../linux-extras'
-branches='amd-pstate amd-rapl cpu cpuidle crypto fixes ksm zstd'
+branches='archlinux bbr3 cpuidle kbuild steady'
 
-[ -d "${dst}" ]
+if [ -d "${dst}" ] ; then rm -rf "${dst}" ; fi
+mkdir -p "${dst}"
 
 kver=
 if [ -n "$1" ] ; then
@@ -33,19 +34,17 @@ for b in ${branches} ; do
 	git switch --detach "${ref}"
 	git switch -C "$r"
 
+	rm -rf "$w/${dst}/$b" ; mkdir -p "$w/${dst}/$b"
 	if git rebase "${from}" ; then
-		[ -d "$w/${dst}/$b/" ] || mkdir -p "$w/${dst}/$b"
-
-		set +e
-		env -C "$w" git ls-files -z | grep -zF "${dst}/$b/" | grep -zFv '/.' | env -C "$w" -u GIT_OPTIONAL_LOCKS xargs -r -0 git rm -f
-		find "$w/${dst}/$b/" -name '*.patch' -type f -exec rm -f {} +
-		set -e
-
 		git format-patch -N --subject-prefix='' --output-directory "$w/${dst}/$b" "${from}..$r"
 	else
 		echo >&2
 		git rebase --abort
-		echo >&2
+
+		touch "$w/${dst}/$b/0000-rebase-failed"
+
+		base=$(git merge-base "${from}" "${ref}")
+		git format-patch -N --subject-prefix='' --output-directory "$w/${dst}/$b" "${base}..${ref}"
 	fi
 
 	git switch -q --detach "${ref}"
@@ -56,6 +55,6 @@ done
 cd "$w" ; rm -rf "$t"
 
 echo >&2
-echo 'put in debian/patches/series' >&2
+echo 'output:' >&2
 echo >&2
 find "${dst}/" -type f -name '*.patch' | sed -E 's#^debian/patches/##' | sort -V

debian/bin/genpatch-zen

@@ -0,0 +1,60 @@
+#!/bin/sh
+set -ef
+
+export GIT_OPTIONAL_LOCKS=0
+
+w=$(git rev-parse --path-format=absolute --show-toplevel) ; : "${w:?}" ; cd "$w"
+
+dst='debian/patches/tmp-zen'
+src='../linux-extras'
+branches='bbr3 fixes zen-sauce'
+
+if [ -d "${dst}" ] ; then rm -rf "${dst}" ; fi
+mkdir -p "${dst}"
+
+kver=
+if [ -n "$1" ] ; then
+	kver="$1"
+else
+	kver=$(dpkg-parsechangelog --show-field=Version | sed -E 's/^[0-9]+://;s/-[^-]*$//' | cut -d. -f1-2)
+fi
+from="upstream/linux-${kver}.y"
+
+t=$(mktemp -d) ; : "${t:?}"
+
+cp -ar "${src}" "$t/"
+cd "$t/${src##*/}"
+
+git config advice.skippedCherryPicks false
+
+for b in ${branches} ; do
+	ref="zen/${kver}/$b"
+	r="tmp-rebase-$b"
+
+	git switch --detach "${ref}"
+	git switch -C "$r"
+
+	rm -rf "$w/${dst}/$b" ; mkdir -p "$w/${dst}/$b"
+	if git rebase "${from}" ; then
+		git format-patch -N --subject-prefix='' --output-directory "$w/${dst}/$b" "${from}..$r"
+	else
+		echo >&2
+		git rebase --abort
+
+		touch "$w/${dst}/$b/0000-rebase-failed"
+
+		base=$(git merge-base "${from}" "${ref}")
+		git format-patch -N --subject-prefix='' --output-directory "$w/${dst}/$b" "${base}..${ref}"
+	fi
+
+	git switch -q --detach "${ref}"
+	git branch -D "$r"
+	echo >&2
+done
+
+cd "$w" ; rm -rf "$t"
+
+echo >&2
+echo 'output:' >&2
+echo >&2
+find "${dst}/" -type f -name '*.patch' | sed -E 's#^debian/patches/##' | sort -V

debian/bin/refine-configs

@@ -1,6 +1,8 @@
 #!/bin/sh
 set -ef
 
+export PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
+
 prj_dir=$(readlink -f "$(dirname "$0")/../..")
 cd "${prj_dir}"
 
@@ -9,24 +11,25 @@ dpkg-parsechangelog --show-field Source | grep -Eq '^linux'
 
 ch_ver=$(dpkg-parsechangelog --show-field Version)
 
-v=$1
+ktarget=$1
+[ -n "${ktarget}" ] || ktarget=oldconfig
+
+v=$2
 [ -n "$v" ] || v=$(echo "${ch_ver}" | sed -E 's/^\d+://;s/-[^-]+$//')
 [ -n "$v" ]
 
 ## should be source tree with patches applied
-src_dir=$2
+src_dir=$3
 [ -n "${src_dir}" ] || src_dir="/tmp/linux-$v"
 [ -n "${src_dir}" ]
 [ -d "${src_dir}" ]
 src_dir=$(readlink -f "${src_dir}")
 
-export PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
-
 nproc=$(nproc || printf 2)
 case "${nproc}" in
 [0-1] ) nproc=2 ;;
-[2-9] | 1[0-9] ) ;;
+[2-8] ) ;;
-* ) nproc=20 ;;
+* ) nproc=8 ;;
 esac
 
 rm -rf debian/build/
@@ -44,12 +47,23 @@ for c in ${configs} ; do
 
 	f="debian/build/$c"
 	cp -f "$f" "${src_dir}/.config"
-	env -C "${src_dir}" make "-j${nproc}" olddefconfig
+	env -C "${src_dir}" make "-j${nproc}" "${ktarget}"
 	cp -f "${src_dir}/.config" "$f"
 done
 
-## remove BUILD_SALT
+## remove build-generated options
-find debian/build/ -name 'config.*' -type f -exec sed -i -E '/CONFIG_BUILD_SALT/d' {} +
+find debian/build/ -name 'config.*' -type f -exec \
+  sed -i -E \
+    -e '/CONFIG_BUILD_SALT/d' \
+    -e '/CONFIG_MODULE_SIG_KEY( |=)/d' \
+    -e '/CONFIG_(AS|CC|PAHOLE)_((CAN|HAS)_)/d' \
+    -e '/CONFIG_(AS|BINDGEN|CC|CLANG|GCC|LD|LLD|PAHOLE|RUSTC)_VERSION/d' \
+    -e '/CONFIG_RUSTC_LLVM_VERSION/d' \
+    -e '/CONFIG_AS_(AVX512|GFNI|SHA(1|256)_NI|TPAUSE|VAES|VPCLMULQDQ|WRUSS)/d' \
+    -e '/CONFIG_CC_(IMPLICIT_FALLTHROUGH)/d' \
+    -e '/CONFIG_(CC|GCC10)_NO_ARRAY_BOUNDS/d' \
+    -e '/CONFIG_(CC|GCC)_((|NO_)STRINGOP_OVERFLOW)/d' \
+  {} +
 
 ## prepare configs for splitting
 find debian/build/ -name 'config.*' -type f -exec sed -i -En '/CONFIG_/p' {} +

debian/changelog

@@ -1,36 +1,30 @@
-linux (6.11.6-1) sid; urgency=medium
+linux (6.16.6-1) sid; urgency=medium
 
   * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.6
+    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.6
 
- -- Konstantin Demin <rockdrilla@gmail.com>  Fri, 01 Nov 2024 10:54:09 +0300
+ -- Konstantin Demin <rockdrilla@gmail.com>  Tue, 09 Sep 2025 20:27:56 +0300
 
-linux (6.11.5-1) sid; urgency=medium
+linux (6.16.5-1) sid; urgency=medium
 
   * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.5
+    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.5
 
-  [ Aurelien Jarno ]
+ -- Konstantin Demin <rockdrilla@gmail.com>  Thu, 04 Sep 2025 18:03:41 +0300
-  * Revert upstream commit causing data corrution (Closes: #1085425)
-    - Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
 
-  [ Salvatore Bonaccorso ]
+linux (6.16.4-1) sid; urgency=medium
-  * netfilter: xtables: fix typo causing some targets not to load on IPv6
-    (Closes: #1085953)
-
-  [ Konstantin Demin ]
-  * Initial package release.
-
- -- Konstantin Demin <rockdrilla@gmail.com>  Tue, 29 Oct 2024 05:14:58 +0300
-
-linux (6.11.4-1) unstable; urgency=medium
 
   * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.3
+    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.4
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11.4
 
-  [ Salvatore Bonaccorso ]
+ -- Konstantin Demin <rockdrilla@gmail.com>  Thu, 28 Aug 2025 22:38:27 +0300
-  * d/config: Update with the help of kconfigeditor2
-    - mm: Enable Z3FOLD_DEPRECATED instead of Z3FOLD
 
- -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 20 Oct 2024 20:51:13 +0200
+linux (6.16.3-1) sid; urgency=medium
+
+  * New upstream stable update:
+    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.1
+    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.2
+    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.3
+  * New upstream release: https://kernelnewbies.org/Linux_6.16
+
+ -- Konstantin Demin <rockdrilla@gmail.com>  Sun, 24 Aug 2025 20:54:35 +0300

debian/config/amd64/config.cloud

@@ -12,24 +12,11 @@
 # CONFIG_X86_INTEL_LPSS is not set
 # CONFIG_X86_AMD_PLATFORM_DEVICE is not set
 CONFIG_IOSF_MBI=m
-CONFIG_HYPERVISOR_GUEST=y
-CONFIG_PARAVIRT=y
-# CONFIG_PARAVIRT_DEBUG is not set
-CONFIG_PARAVIRT_SPINLOCKS=y
-CONFIG_KVM_GUEST=y
-CONFIG_ARCH_CPUIDLE_HALTPOLL=y
-CONFIG_PVH=y
-# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set
-CONFIG_JAILHOUSE_GUEST=y
-CONFIG_ACRN_GUEST=y
-CONFIG_INTEL_TDX_GUEST=y
 # CONFIG_GART_IOMMU is not set
-CONFIG_NR_CPUS=512
+CONFIG_NR_CPUS=64
 # CONFIG_X86_MCE_INJECT is not set
-CONFIG_X86_5LEVEL=y
 # CONFIG_AMD_NUMA is not set
-# CONFIG_NUMA_EMU is not set
+CONFIG_NODES_SHIFT=6
-CONFIG_NODES_SHIFT=10
 # CONFIG_X86_PMEM_LEGACY is not set
 # CONFIG_X86_CHECK_BIOS_CORRUPTION is not set
 ## choice: TSX enable mode
@@ -65,14 +52,7 @@ CONFIG_IO_DELAY_NONE=y
 ##
 ## file: arch/x86/xen/Kconfig
 ##
-CONFIG_XEN=y
-CONFIG_XEN_PV=y
-CONFIG_XEN_512GB=y
-CONFIG_XEN_PVHVM_GUEST=y
-# CONFIG_XEN_DEBUG_FS is not set
-CONFIG_XEN_PVH=y
 # CONFIG_XEN_DOM0 is not set
-CONFIG_XEN_PV_MSR_SAFE=y
 
 ##
 ## file: block/Kconfig
@@ -111,10 +91,8 @@ CONFIG_XEN_PV_MSR_SAFE=y
 ##
 ## file: crypto/Kconfig
 ##
+# CONFIG_CRYPTO_BENCHMARK is not set
 CONFIG_CRYPTO_ECDH=m
-CONFIG_CRYPTO_ECDSA=m
-CONFIG_CRYPTO_CTS=m
-CONFIG_CRYPTO_XTS=m
 CONFIG_CRYPTO_DEFLATE=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
@@ -154,7 +132,8 @@ CONFIG_CRYPTO_ZSTD=m
 CONFIG_ATA=m
 # CONFIG_ATA_ACPI is not set
 # CONFIG_SATA_PMP is not set
-# CONFIG_SATA_AHCI is not set
+CONFIG_SATA_AHCI=m
+CONFIG_SATA_MOBILE_LPM_POLICY=0
 # CONFIG_SATA_AHCI_PLATFORM is not set
 # CONFIG_AHCI_DWC is not set
 # CONFIG_SATA_ACARD_AHCI is not set
@@ -223,8 +202,7 @@ CONFIG_ATA=m
 ## file: drivers/block/Kconfig
 ##
 # CONFIG_ATA_OVER_ETH is not set
-CONFIG_XEN_BLKDEV_FRONTEND=m
+# CONFIG_BLK_DEV_ZONED_LOOP is not set
-CONFIG_XEN_BLKDEV_BACKEND=m
 
 ##
 ## file: drivers/block/mtip32xx/Kconfig
@@ -270,7 +248,6 @@ CONFIG_TCG_TIS=m
 # CONFIG_TCG_NSC is not set
 # CONFIG_TCG_ATMEL is not set
 # CONFIG_TCG_INFINEON is not set
-CONFIG_TCG_XEN=m
 CONFIG_TCG_CRB=m
 
 ##
@@ -296,12 +273,6 @@ CONFIG_TCG_CRB=m
 CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
 ## end choice
 
-##
-## file: drivers/cpuidle/Kconfig
-##
-CONFIG_CPU_IDLE_GOV_HALTPOLL=y
-CONFIG_HALTPOLL_CPUIDLE=y
-
 ##
 ## file: drivers/crypto/Kconfig
 ##
@@ -326,6 +297,7 @@ CONFIG_HALTPOLL_CPUIDLE=y
 # CONFIG_CRYPTO_DEV_QAT_C62X is not set
 # CONFIG_CRYPTO_DEV_QAT_4XXX is not set
 # CONFIG_CRYPTO_DEV_QAT_420XX is not set
+# CONFIG_CRYPTO_DEV_QAT_6XXX is not set
 # CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set
 # CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set
 # CONFIG_CRYPTO_DEV_QAT_C62XVF is not set
@@ -335,6 +307,7 @@ CONFIG_HALTPOLL_CPUIDLE=y
 ##
 CONFIG_CXL_BUS=y
 # CONFIG_CXL_MEM_RAW_COMMANDS is not set
+# CONFIG_CXL_FEATURES is not set
 
 ##
 ## file: drivers/devfreq/Kconfig
@@ -352,6 +325,12 @@ CONFIG_CXL_BUS=y
 # CONFIG_XILINX_DMA is not set
 # CONFIG_XILINX_XDMA is not set
 
+##
+## file: drivers/dma/amd/Kconfig
+##
+# CONFIG_AMD_PTDMA is not set
+# CONFIG_AMD_QDMA is not set
+
 ##
 ## file: drivers/dma/dw/Kconfig
 ##
@@ -368,11 +347,6 @@ CONFIG_CXL_BUS=y
 ##
 # CONFIG_INTEL_LDMA is not set
 
-##
-## file: drivers/dma/ptdma/Kconfig
-##
-# CONFIG_AMD_PTDMA is not set
-
 ##
 ## file: drivers/dma/qcom/Kconfig
 ##
@@ -426,6 +400,11 @@ CONFIG_GOOGLE_COREBOOT_TABLE=m
 CONFIG_GOOGLE_FRAMEBUFFER_COREBOOT=m
 CONFIG_GOOGLE_VPD=m
 
+##
+## file: drivers/fwctl/Kconfig
+##
+# CONFIG_FWCTL is not set
+
 ##
 ## file: drivers/gnss/Kconfig
 ##
@@ -469,10 +448,7 @@ CONFIG_GOOGLE_VPD=m
 ##
 ## file: drivers/hv/Kconfig
 ##
-CONFIG_HYPERV=m
+# CONFIG_MSHV_ROOT is not set
-# CONFIG_HYPERV_VTL_MODE is not set
-CONFIG_HYPERV_UTILS=m
-CONFIG_HYPERV_BALLOON=m
 
 ##
 ## file: drivers/hwmon/Kconfig
@@ -501,7 +477,6 @@ CONFIG_HWMON=m
 # CONFIG_SENSORS_NCT6683 is not set
 # CONFIG_SENSORS_NCT6775 is not set
 # CONFIG_SENSORS_NPCM7XX is not set
-# CONFIG_SENSORS_OXP is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
@@ -685,7 +660,6 @@ CONFIG_INFINIBAND_SRPT=m
 # CONFIG_SERIO_ALTERA_PS2 is not set
 # CONFIG_SERIO_PS2MULT is not set
 # CONFIG_SERIO_ARC_PS2 is not set
-CONFIG_HYPERV_KEYBOARD=m
 # CONFIG_USERIO is not set
 
 ##
@@ -703,22 +677,11 @@ CONFIG_HYPERV_KEYBOARD=m
 ##
 # CONFIG_INTERCONNECT is not set
 
-##
-## file: drivers/iommu/Kconfig
-##
-CONFIG_HYPERV_IOMMU=y
-CONFIG_VIRTIO_IOMMU=y
-
 ##
 ## file: drivers/iommu/iommufd/Kconfig
 ##
 # CONFIG_IOMMUFD is not set
 
-##
-## file: drivers/irqchip/Kconfig
-##
-# CONFIG_LAN966X_OIC is not set
-
 ##
 ## file: drivers/isdn/Kconfig
 ##
@@ -786,6 +749,7 @@ CONFIG_FUSION_FC=m
 ##
 ## file: drivers/mfd/Kconfig
 ##
+# CONFIG_MFD_CGBC is not set
 # CONFIG_MFD_MADERA is not set
 # CONFIG_MFD_INTEL_LPSS_ACPI is not set
 # CONFIG_MFD_INTEL_LPSS_PCI is not set
@@ -798,6 +762,8 @@ CONFIG_FUSION_FC=m
 # CONFIG_MFD_TQMX86 is not set
 # CONFIG_MFD_VX855 is not set
 # CONFIG_RAVE_SP_CORE is not set
+# CONFIG_MFD_QNAP_MCU is not set
+# CONFIG_MFD_UPBOARD_FPGA is not set
 # CONFIG_MFD_STEAMDECK is not set
 
 ##
@@ -808,7 +774,6 @@ CONFIG_FUSION_FC=m
 # CONFIG_TIFM_CORE is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_HP_ILO is not set
-CONFIG_VMWARE_BALLOON=m
 # CONFIG_SRAM is not set
 # CONFIG_DW_XDATA_PCIE is not set
 # CONFIG_XILINX_SDFEC is not set
@@ -840,11 +805,6 @@ CONFIG_VMWARE_BALLOON=m
 ##
 # CONFIG_EEPROM_93CX6 is not set
 
-##
-## file: drivers/misc/keba/Kconfig
-##
-# CONFIG_KEBA_CP500 is not set
-
 ##
 ## file: drivers/misc/mei/Kconfig
 ##
@@ -868,8 +828,7 @@ CONFIG_VMWARE_BALLOON=m
 ##
 ## file: drivers/net/Kconfig
 ##
-CONFIG_XEN_NETDEV_FRONTEND=m
+# CONFIG_OVPN is not set
-CONFIG_XEN_NETDEV_BACKEND=m
 # CONFIG_FUJITSU_ES is not set
 
 ##
@@ -1012,6 +971,11 @@ CONFIG_BE2NET_SKYHAWK=y
 ##
 # CONFIG_NET_VENDOR_FUNGIBLE is not set
 
+##
+## file: drivers/net/ethernet/hisilicon/Kconfig
+##
+# CONFIG_NET_VENDOR_HISILICON is not set
+
 ##
 ## file: drivers/net/ethernet/huawei/Kconfig
 ##
@@ -1082,11 +1046,6 @@ CONFIG_FBNIC=m
 ##
 # CONFIG_NET_VENDOR_MICROCHIP is not set
 
-##
-## file: drivers/net/ethernet/microsoft/Kconfig
-##
-CONFIG_MICROSOFT_MANA=m
-
 ##
 ## file: drivers/net/ethernet/mscc/Kconfig
 ##
@@ -1252,11 +1211,6 @@ CONFIG_MICROSOFT_MANA=m
 ##
 # CONFIG_NET_VENDOR_XILINX is not set
 
-##
-## file: drivers/net/hyperv/Kconfig
-##
-CONFIG_HYPERV_NET=m
-
 ##
 ## file: drivers/net/mdio/Kconfig
 ##
@@ -1272,6 +1226,7 @@ CONFIG_HYPERV_NET=m
 ##
 ## file: drivers/net/phy/Kconfig
 ##
+# CONFIG_AS21XXX_PHY is not set
 # CONFIG_AIR_EN8811H_PHY is not set
 # CONFIG_AMD_PHY is not set
 # CONFIG_ADIN_PHY is not set
@@ -1294,7 +1249,7 @@ CONFIG_HYPERV_NET=m
 # CONFIG_MARVELL_88Q2XXX_PHY is not set
 # CONFIG_MARVELL_88X2222_PHY is not set
 # CONFIG_MAXLINEAR_GPHY is not set
-# CONFIG_MEDIATEK_GE_PHY is not set
+# CONFIG_MAXLINEAR_86110_PHY is not set
 # CONFIG_MICREL_PHY is not set
 # CONFIG_MICROCHIP_T1S_PHY is not set
 # CONFIG_MICROCHIP_PHY is not set
@@ -1307,7 +1262,6 @@ CONFIG_HYPERV_NET=m
 # CONFIG_NXP_TJA11XX_PHY is not set
 # CONFIG_NCN26000_PHY is not set
 # CONFIG_QSEMI_PHY is not set
-# CONFIG_REALTEK_PHY is not set
 # CONFIG_RENESAS_PHY is not set
 # CONFIG_ROCKCHIP_PHY is not set
 # CONFIG_SMSC_PHY is not set
@@ -1328,12 +1282,22 @@ CONFIG_HYPERV_NET=m
 ##
 # CONFIG_AQUANTIA_PHY is not set
 
+##
+## file: drivers/net/phy/mediatek/Kconfig
+##
+# CONFIG_MEDIATEK_GE_PHY is not set
+
 ##
 ## file: drivers/net/phy/qcom/Kconfig
 ##
 # CONFIG_QCA83XX_PHY is not set
 # CONFIG_QCA808X_PHY is not set
 
+##
+## file: drivers/net/phy/realtek/Kconfig
+##
+# CONFIG_REALTEK_PHY is not set
+
 ##
 ## file: drivers/net/ppp/Kconfig
 ##
@@ -1376,9 +1340,6 @@ CONFIG_BLK_DEV_PMEM=m
 # CONFIG_NVME_HWMON is not set
 # CONFIG_NVME_RDMA is not set
 CONFIG_NVME_FC=m
-CONFIG_NVME_TCP=m
-# CONFIG_NVME_TCP_TLS is not set
-# CONFIG_NVME_HOST_AUTH is not set
 
 ##
 ## file: drivers/nvme/target/Kconfig
@@ -1386,8 +1347,6 @@ CONFIG_NVME_TCP=m
 CONFIG_NVME_TARGET_RDMA=m
 CONFIG_NVME_TARGET_FC=m
 # CONFIG_NVME_TARGET_FCLOOP is not set
-CONFIG_NVME_TARGET_TCP=m
-# CONFIG_NVME_TARGET_TCP_TLS is not set
 
 ##
 ## file: drivers/of/Kconfig
@@ -1402,14 +1361,12 @@ CONFIG_NVME_TARGET_TCP=m
 ##
 ## file: drivers/pci/Kconfig
 ##
-CONFIG_XEN_PCIDEV_FRONTEND=m
+# CONFIG_PCIE_TPH is not set
-CONFIG_PCI_HYPERV=m
 
 ##
 ## file: drivers/pci/controller/Kconfig
 ##
 # CONFIG_VMD is not set
-CONFIG_PCI_HYPERV_INTERFACE=m
 
 ##
 ## file: drivers/pci/controller/dwc/Kconfig
@@ -1422,6 +1379,7 @@ CONFIG_PCI_HYPERV_INTERFACE=m
 ##
 # CONFIG_HOTPLUG_PCI_ACPI_IBM is not set
 # CONFIG_HOTPLUG_PCI_CPCI is not set
+# CONFIG_HOTPLUG_PCI_OCTEONEP is not set
 # CONFIG_HOTPLUG_PCI_SHPC is not set
 
 ##
@@ -1433,6 +1391,11 @@ CONFIG_PCIEASPM_DEFAULT=y
 # CONFIG_PCIEASPM_POWERSAVE is not set
 ## end choice
 
+##
+## file: drivers/pci/pwrctrl/Kconfig
+##
+# CONFIG_PCI_PWRCTRL_SLOT is not set
+
 ##
 ## file: drivers/pci/switch/Kconfig
 ##
@@ -1522,13 +1485,16 @@ CONFIG_PCIEASPM_DEFAULT=y
 ##
 CONFIG_PPS=m
 
+##
+## file: drivers/pps/generators/Kconfig
+##
+# CONFIG_PPS_GENERATOR_TIO is not set
+
 ##
 ## file: drivers/ptp/Kconfig
 ##
 # CONFIG_DP83640_PHY is not set
 # CONFIG_PTP_1588_CLOCK_INES is not set
-CONFIG_PTP_1588_CLOCK_KVM=m
-CONFIG_PTP_1588_CLOCK_VMW=m
 
 ##
 ## file: drivers/pwm/Kconfig
@@ -1588,8 +1554,6 @@ CONFIG_SCSI_FC_ATTRS=m
 CONFIG_SCSI_SRP_ATTRS=m
 CONFIG_SCSI_BUSLOGIC=m
 # CONFIG_SCSI_FLASHPOINT is not set
-CONFIG_XEN_SCSI_FRONTEND=m
-CONFIG_HYPERV_STORAGE=m
 # CONFIG_LIBFC is not set
 CONFIG_SCSI_IPR=m
 # CONFIG_SCSI_IPR_TRACE is not set
@@ -1642,11 +1606,6 @@ CONFIG_SCSI_MPI3MR=m
 ##
 # CONFIG_SOC_TI is not set
 
-##
-## file: drivers/soundwire/Kconfig
-##
-# CONFIG_SOUNDWIRE is not set
-
 ##
 ## file: drivers/spi/Kconfig
 ##
@@ -1682,7 +1641,9 @@ CONFIG_SCSI_MPI3MR=m
 ##
 # CONFIG_THERMAL_STATISTICS is not set
 # CONFIG_THERMAL_DEBUGFS is not set
+# CONFIG_THERMAL_CORE_TESTING is not set
 # CONFIG_THERMAL_GOV_BANG_BANG is not set
+# CONFIG_PCIE_THERMAL is not set
 
 ##
 ## file: drivers/thunderbolt/Kconfig
@@ -1696,12 +1657,6 @@ CONFIG_SCSI_MPI3MR=m
 # CONFIG_N_GSM is not set
 # CONFIG_NOZOMI is not set
 
-##
-## file: drivers/tty/hvc/Kconfig
-##
-CONFIG_HVC_XEN=y
-CONFIG_HVC_XEN_FRONTEND=y
-
 ##
 ## file: drivers/tty/serial/Kconfig
 ##
@@ -1725,6 +1680,7 @@ CONFIG_HVC_XEN_FRONTEND=y
 # CONFIG_SERIAL_8250_RSA is not set
 # CONFIG_SERIAL_8250_RT288X is not set
 # CONFIG_SERIAL_8250_MID is not set
+# CONFIG_SERIAL_8250_NI is not set
 
 ##
 ## file: drivers/ufs/Kconfig
@@ -1739,7 +1695,6 @@ CONFIG_HVC_XEN_FRONTEND=y
 # CONFIG_UIO_SERCOS3 is not set
 # CONFIG_UIO_NETX is not set
 # CONFIG_UIO_MF624 is not set
-CONFIG_UIO_HV_GENERIC=m
 
 ##
 ## file: drivers/usb/Kconfig
@@ -1768,34 +1723,17 @@ CONFIG_UIO_HV_GENERIC=m
 ##
 CONFIG_FB_CIRRUS=m
 CONFIG_FB_UVESA=m
-CONFIG_XEN_FBDEV_FRONTEND=y
-CONFIG_FB_HYPERV=m
 
 ##
 ## file: drivers/video/fbdev/core/Kconfig
 ##
 # CONFIG_FB_DEVICE is not set
 
-##
-## file: drivers/virt/acrn/Kconfig
-##
-CONFIG_ACRN_HSM=m
-
-##
-## file: drivers/virt/coco/tdx-guest/Kconfig
-##
-CONFIG_TDX_GUEST_DRIVER=m
-
 ##
 ## file: drivers/virt/vboxguest/Kconfig
 ##
 # CONFIG_VBOXGUEST is not set
 
-##
-## file: drivers/virtio/Kconfig
-##
-CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
-
 ##
 ## file: drivers/w1/Kconfig
 ##
@@ -1809,6 +1747,7 @@ CONFIG_WATCHDOG_PRETIMEOUT_GOV_NOOP=m
 CONFIG_WATCHDOG_PRETIMEOUT_GOV_PANIC=m
 CONFIG_SOFT_WATCHDOG_PRETIMEOUT=y
 # CONFIG_LENOVO_SE10_WDT is not set
+# CONFIG_LENOVO_SE30_WDT is not set
 # CONFIG_XILINX_WATCHDOG is not set
 # CONFIG_CADENCE_WATCHDOG is not set
 # CONFIG_DW_WATCHDOG is not set
@@ -1828,6 +1767,7 @@ CONFIG_SOFT_WATCHDOG_PRETIMEOUT=y
 # CONFIG_IBMASR is not set
 # CONFIG_WAFER_WDT is not set
 # CONFIG_IE6XX_WDT is not set
+# CONFIG_INTEL_OC_WATCHDOG is not set
 # CONFIG_IT8712F_WDT is not set
 # CONFIG_IT87_WDT is not set
 # CONFIG_HP_WATCHDOG is not set
@@ -1835,7 +1775,6 @@ CONFIG_SOFT_WATCHDOG_PRETIMEOUT=y
 # CONFIG_PC87413_WDT is not set
 # CONFIG_NV_TCO is not set
 # CONFIG_60XX_WDT is not set
-# CONFIG_CPU5_WDT is not set
 # CONFIG_SMSC_SCH311X_WDT is not set
 # CONFIG_SMSC37B787_WDT is not set
 # CONFIG_TQMX86_WDT is not set
@@ -1847,35 +1786,8 @@ CONFIG_SOFT_WATCHDOG_PRETIMEOUT=y
 # CONFIG_SBC_EPX_C3_WATCHDOG is not set
 # CONFIG_NI903X_WDT is not set
 # CONFIG_NIC7018_WDT is not set
-CONFIG_XEN_WDT=m
 # CONFIG_PCIPCWATCHDOG is not set
 
-##
-## file: drivers/xen/Kconfig
-##
-CONFIG_XEN_BALLOON=y
-CONFIG_XEN_BALLOON_MEMORY_HOTPLUG=y
-CONFIG_XEN_MEMORY_HOTPLUG_LIMIT=512
-CONFIG_XEN_SCRUB_PAGES_DEFAULT=y
-CONFIG_XEN_DEV_EVTCHN=m
-CONFIG_XEN_BACKEND=y
-CONFIG_XENFS=m
-CONFIG_XEN_COMPAT_XENFS=y
-CONFIG_XEN_SYS_HYPERVISOR=y
-CONFIG_XEN_GNTDEV=m
-CONFIG_XEN_GNTDEV_DMABUF=y
-CONFIG_XEN_GRANT_DEV_ALLOC=m
-CONFIG_XEN_GRANT_DMA_ALLOC=y
-CONFIG_XEN_PCIDEV_BACKEND=m
-# CONFIG_XEN_PVCALLS_FRONTEND is not set
-# CONFIG_XEN_PVCALLS_BACKEND is not set
-CONFIG_XEN_SCSI_BACKEND=m
-CONFIG_XEN_PRIVCMD=m
-CONFIG_XEN_PRIVCMD_EVENTFD=y
-CONFIG_XEN_UNPOPULATED_ALLOC=y
-CONFIG_XEN_VIRTIO=y
-# CONFIG_XEN_VIRTIO_FORCE_GRANT is not set
-
 ##
 ## file: fs/Kconfig
 ##
@@ -1901,11 +1813,6 @@ CONFIG_XEN_VIRTIO=y
 ##
 # CONFIG_BFS_FS is not set
 
-##
-## file: fs/btrfs/Kconfig
-##
-# CONFIG_BTRFS_FS is not set
-
 ##
 ## file: fs/coda/Kconfig
 ##
@@ -1931,6 +1838,11 @@ CONFIG_XEN_VIRTIO=y
 ##
 # CONFIG_EFS_FS is not set
 
+##
+## file: fs/erofs/Kconfig
+##
+# CONFIG_EROFS_FS_ZIP_ACCEL is not set
+
 ##
 ## file: fs/f2fs/Kconfig
 ##
@@ -1941,12 +1853,6 @@ CONFIG_XEN_VIRTIO=y
 ##
 # CONFIG_VXFS_FS is not set
 
-##
-## file: fs/fuse/Kconfig
-##
-CONFIG_FUSE_FS=m
-CONFIG_VIRTIO_FS=m
-
 ##
 ## file: fs/gfs2/Kconfig
 ##
@@ -2062,11 +1968,6 @@ CONFIG_PROC_VMCORE=y
 ##
 # CONFIG_QNX6FS_FS is not set
 
-##
-## file: fs/reiserfs/Kconfig
-##
-# CONFIG_REISERFS_FS is not set
-
 ##
 ## file: fs/romfs/Kconfig
 ##
@@ -2078,9 +1979,9 @@ CONFIG_PROC_VMCORE=y
 # CONFIG_CIFS is not set
 
 ##
-## file: fs/sysv/Kconfig
+## file: fs/squashfs/Kconfig
 ##
-# CONFIG_SYSV_FS is not set
+# CONFIG_SQUASHFS_COMP_CACHE_FULL is not set
 
 ##
 ## file: fs/ufs/Kconfig
@@ -2095,24 +1996,12 @@ CONFIG_PROC_VMCORE=y
 ##
 ## file: init/Kconfig
 ##
-## choice: Kernel compression mode
-# CONFIG_KERNEL_XZ is not set
-CONFIG_KERNEL_LZ4=y
-## end choice
 CONFIG_DEFAULT_HOSTNAME="debian-cloud"
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_LOG_CPU_MAX_BUF_SHIFT=12
 # CONFIG_UCLAMP_TASK is not set
 # CONFIG_RT_GROUP_SCHED is not set
 
-##
-## file: kernel/Kconfig.hz
-##
-## choice: Timer frequency
-CONFIG_HZ_100=y
-# CONFIG_HZ_500 is not set
-## end choice
-
 ##
 ## file: kernel/Kconfig.kexec
 ##
@@ -2123,6 +2012,7 @@ CONFIG_KEXEC_SIG=y
 CONFIG_KEXEC_BZIMAGE_VERIFY_SIG=y
 CONFIG_KEXEC_JUMP=y
 CONFIG_CRASH_DUMP=y
+# CONFIG_CRASH_DM_CRYPT is not set
 CONFIG_CRASH_HOTPLUG=y
 CONFIG_CRASH_MAX_MEMORY_RANGES=8192
 
@@ -2131,7 +2021,7 @@ CONFIG_CRASH_MAX_MEMORY_RANGES=8192
 ##
 ## choice: Preemption Model
 CONFIG_PREEMPT_NONE=y
-# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PREEMPT_LAZY is not set
 ## end choice
 # CONFIG_SCHED_CORE is not set
 
@@ -2140,19 +2030,10 @@ CONFIG_PREEMPT_NONE=y
 ##
 # CONFIG_SWIOTLB_DYNAMIC is not set
 
-##
-## file: kernel/module/Kconfig
-##
-## choice: Module compression mode
-CONFIG_MODULE_COMPRESS_NONE=y
-# CONFIG_MODULE_COMPRESS_XZ is not set
-## end choice
-
 ##
 ## file: kernel/power/Kconfig
 ##
 # CONFIG_PM_DEBUG is not set
-# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
 
 ##
 ## file: kernel/rcu/Kconfig
@@ -2192,7 +2073,6 @@ CONFIG_PANIC_TIMEOUT=5
 # CONFIG_FUNCTION_ERROR_INJECTION is not set
 # CONFIG_RUNTIME_TESTING_MENU is not set
 # CONFIG_MEMTEST is not set
-# CONFIG_HYPERV_TESTING is not set
 
 ##
 ## file: lib/Kconfig.kfence
@@ -2203,8 +2083,9 @@ CONFIG_PANIC_TIMEOUT=5
 ## file: mm/Kconfig
 ##
 # CONFIG_ZSWAP is not set
-CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y
+CONFIG_ZSMALLOC=m
 # CONFIG_HWPOISON_INJECT is not set
+# CONFIG_NUMA_EMU is not set
 
 ##
 ## file: mm/Kconfig.debug
@@ -2233,7 +2114,7 @@ CONFIG_MAX_SKB_FRAGS=19
 ##
 ## file: net/9p/Kconfig
 ##
-# CONFIG_NET_9P is not set
+CONFIG_NET_9P_RDMA=m
 
 ##
 ## file: net/appletalk/Kconfig
@@ -2271,17 +2152,6 @@ CONFIG_MAX_SKB_FRAGS=19
 ##
 # CONFIG_CAN is not set
 
-##
-## file: net/dccp/Kconfig
-##
-# CONFIG_IP_DCCP_DEBUG is not set
-
-##
-## file: net/dccp/ccids/Kconfig
-##
-# CONFIG_IP_DCCP_CCID2_DEBUG is not set
-# CONFIG_IP_DCCP_CCID3_DEBUG is not set
-
 ##
 ## file: net/ieee802154/Kconfig
 ##
@@ -2439,11 +2309,6 @@ CONFIG_SUNRPC_XPRT_RDMA=m
 ##
 CONFIG_TIPC_MEDIA_IB=y
 
-##
-## file: net/vmw_vsock/Kconfig
-##
-CONFIG_HYPERV_VSOCKETS=m
-
 ##
 ## file: net/x25/Kconfig
 ##
@@ -2460,10 +2325,16 @@ CONFIG_HYPERV_VSOCKETS=m
 # CONFIG_LIST_HARDENED is not set
 # CONFIG_BUG_ON_DATA_CORRUPTION is not set
 
+##
+## file: security/ipe/Kconfig
+##
+CONFIG_IPE_PROP_DM_VERITY_SIGNATURE=y
+
 ##
 ## file: security/keys/Kconfig
 ##
 # CONFIG_KEYS_REQUEST_CACHE is not set
+# CONFIG_BIG_KEYS is not set
 # CONFIG_TRUSTED_KEYS is not set
 # CONFIG_USER_DECRYPTED_DATA is not set
 
@@ -2481,51 +2352,36 @@ CONFIG_ARCH_HAS_GENERIC_CRASHKERNEL_RESERVATION=y
 CONFIG_ARCH_SELECTS_KEXEC_FILE=y
 CONFIG_BLK_DEV_RNBD=y
 CONFIG_CRASH_RESERVE=y
-CONFIG_CRYPTO_ECC=m
+CONFIG_CRYPTO_CHACHA20_X86_64=m
 CONFIG_CRYPTO_LIB_AESCFB=m
+CONFIG_CRYPTO_LIB_CHACHA=m
+CONFIG_CRYPTO_LIB_CHACHA20POLY1305=m
+CONFIG_CRYPTO_LIB_CHACHA_GENERIC=m
+CONFIG_CRYPTO_LIB_POLY1305=m
+CONFIG_CRYPTO_POLY1305_X86_64=m
 CONFIG_CXL_PORT=y
-CONFIG_FB_IOMEM_HELPERS_DEFERRED=y
-CONFIG_HVC_IRQ=y
-CONFIG_HYPERV_TIMER=y
-CONFIG_HZ=100
 CONFIG_INFINIBAND_ADDR_TRANS_CONFIGFS=y
 CONFIG_INFINIBAND_RTRS=m
 CONFIG_INFINIBAND_USER_MEM=y
 CONFIG_INFINIBAND_VIRT_DMA=y
+CONFIG_INLINE_READ_UNLOCK=y
+CONFIG_INLINE_READ_UNLOCK_IRQ=y
+CONFIG_INLINE_SPIN_UNLOCK_IRQ=y
+CONFIG_INLINE_WRITE_UNLOCK=y
+CONFIG_INLINE_WRITE_UNLOCK_IRQ=y
 CONFIG_IP_VS_PROTO_AH_ESP=y
 CONFIG_KEXEC_CORE=y
 CONFIG_LZ4HC_COMPRESS=m
 CONFIG_LZ4_COMPRESS=m
 CONFIG_MFD_CORE=m
-CONFIG_MMU_GATHER_RCU_TABLE_FREE=y
-CONFIG_MMU_GATHER_TABLE_FREE=y
 CONFIG_ND_BTT=m
 CONFIG_ND_PFN=m
-CONFIG_NETFS_SUPPORT=m
 # CONFIG_NVMEM_LAYOUTS is not set
-CONFIG_PARAVIRT_CLOCK=y
+CONFIG_PLDMFW=y
-CONFIG_PARAVIRT_XXL=y
-CONFIG_PCI_XEN=y
-CONFIG_PGTABLE_LEVELS=5
 CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_RATIONAL=m
 CONFIG_SCSI_COMMON=m
 CONFIG_SCSI_MOD=m
 CONFIG_SCSI_NETLINK=y
-CONFIG_SWIOTLB_XEN=y
-CONFIG_SYS_HYPERVISOR=y
 CONFIG_TCG_TIS_CORE=m
-CONFIG_X86_HV_CALLBACK_VECTOR=y
-CONFIG_XEN_ACPI=y
-CONFIG_XEN_AUTO_XLATE=y
-CONFIG_XEN_EFI=y
-CONFIG_XEN_GRANT_DMA_OPS=y
-CONFIG_XEN_HAVE_PVMMU=y
-CONFIG_XEN_HAVE_VPMU=y
-CONFIG_XEN_PCI_STUB=y
-CONFIG_XEN_PVHVM=y
-CONFIG_XEN_PVHVM_SMP=y
-CONFIG_XEN_PV_SMP=y
-CONFIG_XEN_SAVE_RESTORE=y
-CONFIG_XEN_XENBUS_FRONTEND=y
 CONFIG_ZSTD_COMPRESS=m

debian/config/defines.toml

@@ -11,7 +11,7 @@ name = 'x86'
 name = 'none'
 
 [build]
-compiler = 'gcc-14'
+compiler = 'gcc-15'
 
 [relations.image]
 depends = [

debian/copyright

@@ -25,43 +25,43 @@ Copyright: 1996-2006 Manoj Srivastava
 License: GPL-2
 
 Files:
- arch/arm/boot/dts/armada-370.dtsi
+ arch/arm/boot/dts/allwinner/axp*.dts*
- arch/arm/boot/dts/armada-370-d*.dts*
+ arch/arm/boot/dts/allwinner/sun*.dts*
- arch/arm/boot/dts/armada-370-mirabox.dts
+ arch/arm/boot/dts/amlogic/meson*.dts*
- arch/arm/boot/dts/armada-370-netgear*.dts*
+ arch/arm/boot/dts/arm/mps2*.dts*
- arch/arm/boot/dts/armada-370-rd.dts
+ arch/arm/boot/dts/axis/artpec6.dtsi
- arch/arm/boot/dts/armada-370-synology-ds213j.dts
+ arch/arm/boot/dts/cnxt/cx92755*.dts*
- arch/arm/boot/dts/armada-375*.dts*
- arch/arm/boot/dts/armada-38*.dts*
- arch/arm/boot/dts/armada-39*.dts*
- arch/arm/boot/dts/armada-xp*.dts*
- arch/arm/boot/dts/artpec6.dtsi
- arch/arm/boot/dts/at91sam9260ek.dts
- arch/arm/boot/dts/at91sam9xe.dtsi
- arch/arm/boot/dts/axp*.dts*
- arch/arm/boot/dts/berlin2*.dts*
  arch/arm/boot/dts/cros-ec-sbs.dtsi
- arch/arm/boot/dts/cx92755*.dts*
+ arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_vining_fpga.dts
- arch/arm/boot/dts/imx7*.dts*
+ arch/arm/boot/dts/marvell/armada-370-d*.dts*
- arch/arm/boot/dts/kirkwood-linkstation*.dts*
+ arch/arm/boot/dts/marvell/armada-370-mirabox.dts
- arch/arm/boot/dts/ls*.dts*
+ arch/arm/boot/dts/marvell/armada-370-netgear*.dts*
- arch/arm/boot/dts/meson*.dts*
+ arch/arm/boot/dts/marvell/armada-370-rd.dts
- arch/arm/boot/dts/mps2*.dts*
+ arch/arm/boot/dts/marvell/armada-370-synology-ds213j.dts
- arch/arm/boot/dts/mvebu-linkstation-*.dts*
+ arch/arm/boot/dts/marvell/armada-370.dtsi
- arch/arm/boot/dts/orion5x-kuroboxpro.dts
+ arch/arm/boot/dts/marvell/armada-375*.dts*
- arch/arm/boot/dts/orion5x-linkstation*.dts*
+ arch/arm/boot/dts/marvell/armada-38*.dts*
- arch/arm/boot/dts/orion5x-ls*.dts*
+ arch/arm/boot/dts/marvell/armada-39*.dts*
- arch/arm/boot/dts/qcom-mdm9615*.dts*
+ arch/arm/boot/dts/marvell/armada-xp*.dts*
- arch/arm/boot/dts/rk*.dts
+ arch/arm/boot/dts/marvell/kirkwood-linkstation*.dts*
- arch/arm/boot/dts/sama5d2.dtsi
+ arch/arm/boot/dts/marvell/mvebu-linkstation-*.dts*
- arch/arm/boot/dts/sama5d4.dtsi
+ arch/arm/boot/dts/marvell/orion5x-kuroboxpro.dts
- arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts
+ arch/arm/boot/dts/marvell/orion5x-linkstation*.dts*
- arch/arm/boot/dts/stm*.dts*
+ arch/arm/boot/dts/marvell/orion5x-ls*.dts*
- arch/arm/boot/dts/sun*.dts*
+ arch/arm/boot/dts/microchip/at91sam9260ek.dts
- arch/arm/boot/dts/tegra124-apalis*.dts*
+ arch/arm/boot/dts/microchip/at91sam9xe.dtsi
- arch/arm/boot/dts/uniphier-*.dts*
+ arch/arm/boot/dts/microchip/sama5d2.dtsi
- arch/arm/boot/dts/vf610-colibri*.dts*
+ arch/arm/boot/dts/microchip/sama5d4.dtsi
- arch/arm/boot/dts/vf610m*.dts*
+ arch/arm/boot/dts/nvidia/tegra124-apalis*.dts*
+ arch/arm/boot/dts/nxp/imx/imx7*.dts*
+ arch/arm/boot/dts/nxp/ls/ls*.dts*
+ arch/arm/boot/dts/nxp/vf/vf610-colibri*.dts*
+ arch/arm/boot/dts/nxp/vf/vf610m*.dts*
+ arch/arm/boot/dts/qcom/qcom-mdm9615*.dts*
+ arch/arm/boot/dts/rockchip/rk*.dts
+ arch/arm/boot/dts/socionext/uniphier-*.dts*
+ arch/arm/boot/dts/st/stm*.dts*
+ arch/arm/boot/dts/synaptics/berlin2*.dts*
  arch/arm64/boot/dts/allwinner/*.dts*
  arch/arm64/boot/dts/amlogic/*.dts*
  arch/arm64/boot/dts/cavium/thunder-*.dts*
@@ -78,48 +78,11 @@ Files:
 Copyright: 2012-2018 Linus Torvalds and many others
 License: GPL-2+-or-X11
 
-Files: drivers/crypto/vmx/*.pl
-Copyright: 2006,2014 Andy Polyakov <appro@openssl.org>
-License: CRYPTOGAMS
- All rights reserved.
- .
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions
- are met:
- .
- * Redistributions of source code must retain copyright notices, this
-   list of conditions and the following disclaimer.
- * Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the
-   distribution.
- * Neither the name of the CRYPTOGAMS nor the names of its copyright
-   holder and contributors may be used to endorse or promote products
-   derived from this software without specific prior written
-   permission.
- .
- ALTERNATIVELY, provided that this notice is retained in full, this
- product may be distributed under the terms of the GNU General Public
- License (GPL), in which case the provisions of the GPL apply INSTEAD
- OF those given above.
- .
- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS
- "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
 Files: fs/nls/mac-*
 Copyright: 1991-2012 Unicode, Inc.
 License: Unicode-data
  All rights reserved.  Distributed under the Terms of Use in
- http://www.unicode.org/copyright.html.
+ https://www.unicode.org/copyright.html.
  .
  Permission is hereby granted, free of charge, to any person obtaining a
  copy of the Unicode data files and any associated documentation (the "Data
@@ -228,8 +191,7 @@ License: GPL-2
  GNU General Public License for more details.
  .
  You should have received a copy of the GNU General Public License
- along with this package; if not, write to the Free Software
+ along with this program. If not, see <https://www.gnu.org/licenses/>.
- Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  .
  On Debian systems, the complete text of the GNU General Public License version
  2 can be found in `/usr/share/common-licenses/GPL-2'.
@@ -246,7 +208,7 @@ License: LGPL-2.1
  Lesser General Public License for more details.
  .
  You should have received a copy of the GNU Lesser General Public License
- along with this program; If not, see <http://www.gnu.org/licenses/>.
+ along with this program; If not, see <https://www.gnu.org/licenses/>.
  .
  On Debian systems, the complete text of the GNU Lesser General Public
  License version 2.1 can be found in `/usr/share/common-licenses/LGPL-2.1'.

debian/hyperv-daemons.postinst

@@ -9,7 +9,7 @@ configure )
     if [ ${have_systemd} = 1 ] ; then
         if [ -z "$2" ] ; then
             # On initial install make sure udev notifies systemd
-            udevadm trigger || true
+            udevadm trigger || :
         else
             # On upgrade make sure running daemons are restarted
             systemctl try-restart hv-kvp-daemon.service hv-vss-daemon.service

debian/hyperv-daemons.preinst

@@ -14,11 +14,11 @@ upgrade )
         init_service="hyperv-daemons.hv-$i-daemon"
         systemd_unit="${init_service}.service"
         if [ ${have_systemd} = 1 ] ; then
-            systemctl stop "${systemd_unit}" 2>/dev/null || true
+            systemctl stop "${systemd_unit}" 2>/dev/null || :
         fi
-        deb-systemd-helper purge "${systemd_unit}" || true
+        deb-systemd-helper purge "${systemd_unit}" || :
-        invoke-rc.d --skip-systemd-native "${init_service}" stop || true
+        invoke-rc.d --skip-systemd-native "${init_service}" stop || :
-        update-rc.d "${init_service}" remove || true
+        update-rc.d "${init_service}" remove || :
     done ; unset services i init_service systemd_unit
 ;;
 esac

debian/lib/python/debian_linux/config_v2.py

@@ -11,7 +11,6 @@ from pathlib import Path
 from typing import (
     Optional,
     Self,
-    TypeVar,
 )
 
 import dacite
@@ -157,9 +156,6 @@ class ConfigBase:
         return config
 
 
-ConfigT = TypeVar('ConfigT', bound=ConfigBase)
-
-
 @dataclasses.dataclass
 class Config(ConfigBase):
     # Disable basic fields
@@ -227,9 +223,9 @@ class Config(ConfigBase):
         return config
 
     @classmethod
-    def _read_hierarchy(
+    def _read_hierarchy[T: ConfigBase](
-        cls, bases: Iterable[Path], orig: Iterable[ConfigT],
+        cls, bases: Iterable[Path], orig: Iterable[T],
-    ) -> Iterable[ConfigT]:
+    ) -> Iterable[T]:
         for i in orig:
             try:
                 assert i.path is not None

debian/lib/python/debian_linux/dataclasses_deb822.py

@@ -5,22 +5,16 @@ import re
 from typing import (
     Any,
     Callable,
-    Generic,
     IO,
     Iterable,
     Optional,
     overload,
-    TypeVar,
     TYPE_CHECKING,
 )
 
-_T = TypeVar('_T')
-
 if TYPE_CHECKING:
-    from dataclasses import _DataclassT
+    from _typeshed import DataclassInstance as _DataclassInstance
-else:
+
-    # We can only get to _DataclassT during type checking, use a generic type during runtime
-    _DataclassT = _T
 
 __all__ = [
     'field_deb822',
@@ -30,61 +24,61 @@ __all__ = [
 ]
 
 
-class Deb822Field(Generic[_T]):
+class Deb822Field[T]:
     key: str
-    load: Optional[Callable[[str], _T]]
+    load: Optional[Callable[[str], T]]
-    dump: Optional[Callable[[_T], str]]
+    dump: Optional[Callable[[T], str]]
 
     def __init__(
         self, *,
         key: str,
-        load: Optional[Callable[[str], _T]],
+        load: Optional[Callable[[str], T]],
-        dump: Optional[Callable[[_T], str]],
+        dump: Optional[Callable[[T], str]],
     ) -> None:
         self.key = key
         self.load = load
         self.dump = dump
 
 
-# The return type _T is technically wrong, but it allows checking if during
+# The return type T is technically wrong, but it allows checking if during
 # runtime we get the correct type.
 @overload
-def field_deb822(
+def field_deb822[T](
     deb822_key: str,
     /, *,
-    deb822_load: Optional[Callable[[str], _T]] = None,
+    deb822_load: Optional[Callable[[str], T]] = None,
-    deb822_dump: Optional[Callable[[_T], str]] = str,
+    deb822_dump: Optional[Callable[[T], str]] = str,
-    default: _T,
+    default: T,
-) -> _T:
+) -> T:
     ...
 
 
 @overload
-def field_deb822(
+def field_deb822[T](
     deb822_key: str,
     /, *,
-    deb822_load: Optional[Callable[[str], _T]] = None,
+    deb822_load: Optional[Callable[[str], T]] = None,
-    deb822_dump: Optional[Callable[[_T], str]] = str,
+    deb822_dump: Optional[Callable[[T], str]] = str,
-    default_factory: Callable[[], _T],
+    default_factory: Callable[[], T],
-) -> _T:
+) -> T:
     ...
 
 
 @overload
-def field_deb822(
+def field_deb822[T](
     deb822_key: str,
     /, *,
-    deb822_load: Optional[Callable[[str], _T]] = None,
+    deb822_load: Optional[Callable[[str], T]] = None,
-    deb822_dump: Optional[Callable[[_T], str]] = str,
+    deb822_dump: Optional[Callable[[T], str]] = str,
-) -> _T:
+) -> T:
     ...
 
 
-def field_deb822(
+def field_deb822[T](
     deb822_key: str,
     /, *,
-    deb822_load: Optional[Callable[[str], _T]] = None,
+    deb822_load: Optional[Callable[[str], T]] = None,
-    deb822_dump: Optional[Callable[[_T], str]] = str,
+    deb822_dump: Optional[Callable[[T], str]] = str,
     default: Any = dataclasses.MISSING,
     default_factory: Any = dataclasses.MISSING,
 ) -> Any:
@@ -112,8 +106,8 @@ class Deb822DecodeError(ValueError):
     pass
 
 
-class Deb822DecodeState(Generic[_DataclassT]):
+class Deb822DecodeState[T: _DataclassInstance]:
-    cls: type[_DataclassT]
+    cls: type[T]
     fields: dict[str, dataclasses.Field]
     ignore_unknown: bool
 
@@ -132,7 +126,7 @@ class Deb822DecodeState(Generic[_DataclassT]):
 
     def __init__(
         self,
-        cls: type[_DataclassT],
+        cls: type[T],
         ignore_unknown: bool,
     ) -> None:
         self.reset()
@@ -167,7 +161,7 @@ class Deb822DecodeState(Generic[_DataclassT]):
         else:
             raise NotImplementedError
 
-    def generate(self) -> _DataclassT | None:
+    def generate(self) -> T | None:
         if not self.data:
             return None
 
@@ -192,12 +186,12 @@ class Deb822DecodeState(Generic[_DataclassT]):
         return self.cls(**r)
 
 
-def read_deb822(
+def read_deb822[T: _DataclassInstance](
-    cls: type[_DataclassT],
+    cls: type[T],
     file: IO[str],
     /,
     ignore_unknown: bool = False,
-) -> Iterable[_DataclassT]:
+) -> Iterable[T]:
     state = Deb822DecodeState(cls, ignore_unknown)
 
     for linenr, line in enumerate(file):
@@ -217,8 +211,8 @@ def read_deb822(
         yield obj
 
 
-def write_deb822(
+def write_deb822[T: _DataclassInstance](
-    objs: Iterable[_DataclassT],
+    objs: Iterable[T],
     file: IO[str],
     /,
 ) -> None:

debian/lib/python/debian_linux/dataclasses_extra.py

@@ -7,7 +7,6 @@ from dataclasses import (
 )
 from typing import (
     Protocol,
-    TypeVar,
     TYPE_CHECKING,
 )
 
@@ -17,14 +16,11 @@ if TYPE_CHECKING:
     class _HasName(Protocol, _DataclassInstance):
         name: str
 
-    _DataclassT = TypeVar('_DataclassT', bound=_DataclassInstance)
-    _HasNameT = TypeVar('_HasNameT', bound=_HasName)
 
-
+def default[T: _DataclassInstance](
-def default(
+    cls: type[T],
-    cls: type[_DataclassT],
     /,
-) -> _DataclassT:
+) -> T:
     f = {}
 
     for field in fields(cls):
@@ -34,10 +30,10 @@ def default(
     return cls(**f)
 
 
-def merge(
+def merge[T: _DataclassInstance](
-    self: _DataclassT,
+    self: T,
-    other: _DataclassT | None, /,
+    other: T | None, /,
-) -> _DataclassT:
+) -> T:
     if other is None:
         return self
 
@@ -75,22 +71,22 @@ def merge(
     return replace(self, **f)
 
 
-def merge_default(
+def merge_default[T: _DataclassInstance](
-    cls: type[_DataclassT],
+    cls: type[T],
     /,
-    *others: _DataclassT,
+    *others: T,
-) -> _DataclassT:
+) -> T:
-    ret: _DataclassT = default(cls)
+    ret: T = default(cls)
     for o in others:
         ret = merge(ret, o)
     return ret
 
 
-def _merge_assoclist(
+def _merge_assoclist[T: _HasName](
-    self_list: list[_HasNameT],
+    self_list: list[T],
-    other_list: list[_HasNameT],
+    other_list: list[T],
     /,
-) -> list[_HasNameT]:
+) -> list[T]:
     '''
     Merge lists where each item got a "name" attribute
     '''
@@ -99,7 +95,7 @@ def _merge_assoclist(
     if not other_list:
         return self_list
 
-    ret: list[_HasNameT] = []
+    ret: list[T] = []
     other_dict = {
         i.name: i
         for i in other_list

debian/lib/python/debian_linux/debian.py

@@ -175,34 +175,6 @@ class VersionLinux(Version):
         .+?
     )
 )?
-(?:
-    \.dfsg\.
-    (?P<dfsg>
-        \d+
-    )
-)?
-$
-    """, re.X)
-    _revision_re = re.compile(r"""
-\d+
-(\.\d+)?
-(?:
-    (?P<revision_experimental>
-        ~exp\d+
-    )
-    |
-    (?P<revision_security>
-        (?:[~+]deb\d+u\d+)+
-    )?
-    (?P<revision_backports>
-        ~bpo\d+\+\d+
-    )?
-    |
-    (?P<revision_other>
-        .+?
-    )
-)
-(?:\+b\d+)?
 $
     """, re.X)
 
@@ -214,7 +186,6 @@ $
         if up_match is None or rev_match is None:
             raise RuntimeError(u"Invalid debian linux version")
         d = up_match.groupdict()
-        self.linux_modifier = d['modifier']
         self.linux_version = d['version']
         if d['modifier'] is not None:
             assert not d['update']
@@ -222,12 +193,6 @@ $
         else:
             self.linux_upstream = d['version']
         self.linux_upstream_full = self.linux_upstream + d['update']
-        self.linux_dfsg = d['dfsg']
-        d = rev_match.groupdict()
-        self.linux_revision_experimental = d['revision_experimental'] and True
-        self.linux_revision_security = d['revision_security'] and True
-        self.linux_revision_backports = d['revision_backports'] and True
-        self.linux_revision_other = d['revision_other'] and True
 
 
 class PackageArchitecture(set[str]):
@@ -370,9 +335,8 @@ class PackageRelationEntry:
             ret.append(f'({self.operator} {self.version})')
         if self.arches:
             ret.append(f'[{self.arches}]')
-        if self.restrictions:
+        ret.append(str(self.restrictions))
-            ret.append(str(self.restrictions))
+        return ' '.join(i for i in ret if i)
-        return ' '.join(ret)
 
 
 class PackageRelationGroup(list[PackageRelationEntry]):
@@ -443,8 +407,6 @@ class PackageBuildprofileEntry:
     pos: set[str] = dataclasses.field(default_factory=set)
     neg: set[str] = dataclasses.field(default_factory=set)
 
-    __re = re.compile(r'^<(?P<profiles>[a-z0-9. !-]+)>$')
-
     def copy(self) -> Self:
         return self.__class__(
             pos=set(self.pos),
@@ -453,17 +415,15 @@ class PackageBuildprofileEntry:
 
     @classmethod
     def parse(cls, v: str, /) -> Self:
-        match = cls.__re.match(v)
-        if not match:
-            raise RuntimeError('Unable to parse build profile "%s"' % v)
-
         ret = cls()
-        for i in re.split(r' ', match.group('profiles')):
+        for i in re.split(r' ', v):
             if i:
                 if i[0] == '!':
                     ret.neg.add(i[1:])
                 else:
                     ret.pos.add(i)
+        if ret.pos & ret.neg:
+            raise ValueError
         return ret
 
     def __eq__(self, other: object, /) -> bool:
@@ -494,7 +454,7 @@ class PackageBuildprofileEntry:
         return self.pos <= other.pos and self.neg >= other.neg
     __ge__ = issuperset
 
-    def update(self, other: Self, /) -> None:
+    def update(self, other: Self, /) -> Self:
         '''
         Update the build profiles, adding entries from other, merging if possible.
 
@@ -502,20 +462,41 @@ class PackageBuildprofileEntry:
         All others remain if they are used on both sides.
         '''
         diff = (self.pos & other.neg) | (self.neg & other.pos)
-        self.pos &= other.pos - diff
+        self.pos &= other.pos
-        self.neg &= other.neg - diff
+        self.neg &= other.neg
+        self.pos -= diff
+        self.neg -= diff
+        return self
     __ior__ = update
 
+    def intersection_update(self, other: Self, /) -> Self:
+        '''
+        Update the build profiles, creating an intersection of both.
+
+        Negating entries (profile vs !profile) are completely removed.
+        All others remain.
+        '''
+        diff = (self.pos & other.neg) | (self.neg & other.pos)
+        self.pos |= other.pos
+        self.neg |= other.neg
+        self.pos -= diff
+        self.neg -= diff
+        return self
+    __iand__ = intersection_update
+
+    def __len__(self) -> int:
+        
+        return len(self.pos) + len(self.neg)
+
     def __str__(self) -> str:
-        s = ' '.join(itertools.chain(
+        return ' '.join(itertools.chain(
             sorted(self.pos),
             (f'!{i}' for i in sorted(self.neg)),
         ))
-        return f'<{s}>'
 
 
 class PackageBuildprofile(list[PackageBuildprofileEntry]):
-    __re = re.compile(r' *(<[^>]+>)(?: +|$)')
+    __re = re.compile(r' *<(?P<entry>[a-z0-9. !-]+)>(?: +|$)')
 
     def copy(self) -> Self:
         return self.__class__(i.copy() for i in self)
@@ -524,10 +505,10 @@ class PackageBuildprofile(list[PackageBuildprofileEntry]):
     def parse(cls, v: str, /) -> Self:
         ret = cls()
         for match in cls.__re.finditer(v):
-            ret.append(PackageBuildprofileEntry.parse(match.group(1)))
+            ret.append(PackageBuildprofileEntry.parse(match.group('entry')))
         return ret
 
-    def update(self, v: Self, /) -> None:
+    def update(self, v: Self, /) -> Self:
         for i in v:
             for j in self:
                 if not j.isdisjoint(i):
@@ -535,10 +516,23 @@ class PackageBuildprofile(list[PackageBuildprofileEntry]):
                     break
             else:
                 self.append(i)
+        return self
     __ior__ = update
 
+    def intersection_update(self, v: Self, /) -> Self:
+        if len(v) > 1:
+            raise ValueError
+        for i in v:
+            if self:
+                for j in self:
+                    j.intersection_update(i)
+            else:
+                self.append(i)
+        return self
+    __iand__ = intersection_update
+
     def __str__(self) -> str:
-        return ' '.join(str(i) for i in self)
+        return ' '.join(f'<{str(i)}>' for i in self if i)
 
 
 @dataclasses.dataclass

debian/lib/python/debian_linux/gencontrol.py

@@ -189,6 +189,7 @@ class PackagesBundle:
             package.meta_rules_check_packages = check_packages
 
             for name in (
+                    'NEWS',
                     'lintian-overrides',
                     'maintscript',
                     'postinst',
@@ -202,7 +203,11 @@ class PackagesBundle:
                 except KeyError:
                     pass
                 else:
-                    with self.open(f'{package_name}.{name}') as f:
+                    if arch:
+                        out = f'{package_name}.{name}.{arch}'
+                    else:
+                        out = f'{package_name}.{name}'
+                    with self.open(out) as f:
                         f.write(template)
 
         return ret
@@ -341,8 +346,7 @@ class PackagesBundle:
                 for item in group:
                     if package.architecture != arch_all and not item.arches:
                         item.arches = package.architecture
-                    if package.build_profiles and not item.restrictions:
+                    item.restrictions &= package.build_profiles
-                        item.restrictions = package.build_profiles
                 build_dep.merge(group)
 
     def write(self) -> None:

debian/lib/python/debian_linux/test_debian.py

@@ -1,424 +0,0 @@
-import pytest
-
-from .debian import (
-    Version,
-    VersionLinux,
-    PackageArchitecture,
-    PackageDescription,
-    PackageRelationEntry,
-    PackageRelationGroup,
-    PackageRelation,
-    PackageBuildprofileEntry,
-    PackageBuildprofile,
-)
-
-
-class TestVersion:
-    def test_native(self) -> None:
-        v = Version('1.2+c~4')
-        assert v.epoch is None
-        assert v.upstream == '1.2+c~4'
-        assert v.revision is None
-        assert v.complete == '1.2+c~4'
-        assert v.complete_noepoch == '1.2+c~4'
-
-    def test_nonnative(self) -> None:
-        v = Version('1-2+d~3')
-        assert v.epoch is None
-        assert v.upstream == '1'
-        assert v.revision == '2+d~3'
-        assert v.complete == '1-2+d~3'
-        assert v.complete_noepoch == '1-2+d~3'
-
-    def test_native_epoch(self) -> None:
-        v = Version('5:1.2.3')
-        assert v.epoch == 5
-        assert v.upstream == '1.2.3'
-        assert v.revision is None
-        assert v.complete == '5:1.2.3'
-        assert v.complete_noepoch == '1.2.3'
-
-    def test_nonnative_epoch(self) -> None:
-        v = Version('5:1.2.3-4')
-        assert v.epoch == 5
-        assert v.upstream == '1.2.3'
-        assert v.revision == '4'
-        assert v.complete == '5:1.2.3-4'
-        assert v.complete_noepoch == '1.2.3-4'
-
-    def test_multi_hyphen(self) -> None:
-        v = Version('1-2-3')
-        assert v.epoch is None
-        assert v.upstream == '1-2'
-        assert v.revision == '3'
-        assert v.complete == '1-2-3'
-
-    def test_multi_colon(self) -> None:
-        v = Version('1:2:3')
-        assert v.epoch == 1
-        assert v.upstream == '2:3'
-        assert v.revision is None
-
-    def test_invalid_epoch(self) -> None:
-        with pytest.raises(RuntimeError):
-            Version('a:1')
-        with pytest.raises(RuntimeError):
-            Version('-1:1')
-        with pytest.raises(RuntimeError):
-            Version('1a:1')
-
-    def test_invalid_upstream(self) -> None:
-        with pytest.raises(RuntimeError):
-            Version('1_2')
-        with pytest.raises(RuntimeError):
-            Version('1/2')
-        with pytest.raises(RuntimeError):
-            Version('a1')
-        with pytest.raises(RuntimeError):
-            Version('1 2')
-
-    def test_invalid_revision(self) -> None:
-        with pytest.raises(RuntimeError):
-            Version('1-2_3')
-        with pytest.raises(RuntimeError):
-            Version('1-2/3')
-        with pytest.raises(RuntimeError):
-            Version('1-2:3')
-
-
-class TestVersionLinux:
-    def test_stable(self) -> None:
-        v = VersionLinux('1.2.3-4')
-        assert v.linux_version == '1.2'
-        assert v.linux_upstream == '1.2'
-        assert v.linux_upstream_full == '1.2.3'
-        assert v.linux_modifier is None
-        assert v.linux_dfsg is None
-        assert not v.linux_revision_experimental
-        assert not v.linux_revision_security
-        assert not v.linux_revision_backports
-        assert not v.linux_revision_other
-
-    def test_rc(self) -> None:
-        v = VersionLinux('1.2~rc3-4')
-        assert v.linux_version == '1.2'
-        assert v.linux_upstream == '1.2-rc3'
-        assert v.linux_upstream_full == '1.2-rc3'
-        assert v.linux_modifier == 'rc3'
-        assert v.linux_dfsg is None
-        assert not v.linux_revision_experimental
-        assert not v.linux_revision_security
-        assert not v.linux_revision_backports
-        assert not v.linux_revision_other
-
-    def test_dfsg(self) -> None:
-        v = VersionLinux('1.2~rc3.dfsg.1-4')
-        assert v.linux_version == '1.2'
-        assert v.linux_upstream == '1.2-rc3'
-        assert v.linux_upstream_full == '1.2-rc3'
-        assert v.linux_modifier == 'rc3'
-        assert v.linux_dfsg == '1'
-        assert not v.linux_revision_experimental
-        assert not v.linux_revision_security
-        assert not v.linux_revision_backports
-        assert not v.linux_revision_other
-
-    def test_experimental(self) -> None:
-        v = VersionLinux('1.2~rc3-4~exp5')
-        assert v.linux_upstream_full == '1.2-rc3'
-        assert v.linux_revision_experimental
-        assert not v.linux_revision_security
-        assert not v.linux_revision_backports
-        assert not v.linux_revision_other
-
-    def test_security(self) -> None:
-        v = VersionLinux('1.2.3-4+deb10u1')
-        assert v.linux_upstream_full == '1.2.3'
-        assert not v.linux_revision_experimental
-        assert v.linux_revision_security
-        assert not v.linux_revision_backports
-        assert not v.linux_revision_other
-
-    def test_backports(self) -> None:
-        v = VersionLinux('1.2.3-4~bpo9+10')
-        assert v.linux_upstream_full == '1.2.3'
-        assert not v.linux_revision_experimental
-        assert not v.linux_revision_security
-        assert v.linux_revision_backports
-        assert not v.linux_revision_other
-
-    def test_security_backports(self) -> None:
-        v = VersionLinux('1.2.3-4+deb10u1~bpo9+10')
-        assert v.linux_upstream_full == '1.2.3'
-        assert not v.linux_revision_experimental
-        assert v.linux_revision_security
-        assert v.linux_revision_backports
-        assert not v.linux_revision_other
-
-    def test_lts_backports(self) -> None:
-        # Backport during LTS, as an extra package in the -security
-        # suite.  Since this is not part of a -backports suite it
-        # shouldn't get the linux_revision_backports flag.
-        v = VersionLinux('1.2.3-4~deb9u10')
-        assert v.linux_upstream_full == '1.2.3'
-        assert not v.linux_revision_experimental
-        assert v.linux_revision_security
-        assert not v.linux_revision_backports
-        assert not v.linux_revision_other
-
-    def test_lts_backports_2(self) -> None:
-        # Same but with two security extensions in the revision.
-        v = VersionLinux('1.2.3-4+deb10u1~deb9u10')
-        assert v.linux_upstream_full == '1.2.3'
-        assert not v.linux_revision_experimental
-        assert v.linux_revision_security
-        assert not v.linux_revision_backports
-        assert not v.linux_revision_other
-
-    def test_binnmu(self) -> None:
-        v = VersionLinux('1.2.3-4+b1')
-        assert not v.linux_revision_experimental
-        assert not v.linux_revision_security
-        assert not v.linux_revision_backports
-        assert not v.linux_revision_other
-
-    def test_other_revision(self) -> None:
-        v = VersionLinux('4.16.5-1+revert+crng+ready')  # from #898087
-        assert not v.linux_revision_experimental
-        assert not v.linux_revision_security
-        assert not v.linux_revision_backports
-        assert v.linux_revision_other
-
-    def test_other_revision_binnmu(self) -> None:
-        v = VersionLinux('4.16.5-1+revert+crng+ready+b1')
-        assert not v.linux_revision_experimental
-        assert not v.linux_revision_security
-        assert not v.linux_revision_backports
-        assert v.linux_revision_other
-
-
-class TestPackageArchitecture:
-    def test_init(self) -> None:
-        a = PackageArchitecture()
-        assert a == set()
-
-    def test_init_str(self) -> None:
-        a = PackageArchitecture(' foo  bar\tbaz ')
-        assert a == {'foo', 'bar', 'baz'}
-
-    def test_init_iter(self) -> None:
-        a = PackageArchitecture(('foo', 'bar'))
-        assert a == {'foo', 'bar'}
-
-    def test_init_self(self) -> None:
-        a = PackageArchitecture(PackageArchitecture(('foo', 'bar')))
-        assert a == {'foo', 'bar'}
-
-    def test_str(self) -> None:
-        a = PackageArchitecture(('foo', 'bar'))
-        assert str(a) == 'bar foo'
-
-
-class TestPackageDescription:
-    def test_init(self) -> None:
-        a = PackageDescription()
-        assert a.short == []
-        assert a.long == []
-
-    def test_init_str(self) -> None:
-        a = PackageDescription('Short\nLong1\n.\nLong2')
-        assert a.short == ['Short']
-        assert a.long == ['Long1', 'Long2']
-
-    def test_init_self(self) -> None:
-        a = PackageDescription(PackageDescription('Short\nLong1\n.\nLong2'))
-        assert a.short == ['Short']
-        assert a.long == ['Long1', 'Long2']
-
-    def test_str(self) -> None:
-        a = PackageDescription('Short\nLong1\n.\nLong2')
-        assert str(a) == 'Short\nLong1\n.\nLong2'
-
-
-class TestPackageRelationEntry:
-    def test_init_str(self) -> None:
-        a = PackageRelationEntry('package (>=version) [arch2 arch1] <profile1 >')
-        assert a.name == 'package'
-        assert a.version == 'version'
-        assert a.arches == {'arch1', 'arch2'}
-        # TODO: assert a.profiles
-        assert str(a) == 'package (>= version) [arch1 arch2] <profile1>'
-
-    def test_init_self(self) -> None:
-        a = PackageRelationEntry(PackageRelationEntry('package [arch2 arch1]'))
-        assert a.name == 'package'
-        assert a.arches == {'arch1', 'arch2'}
-        assert str(a) == 'package [arch1 arch2]'
-
-
-class TestPackageRelationGroup:
-    def test_init(self) -> None:
-        a = PackageRelationGroup()
-        assert a == []
-
-    def test_init_str(self) -> None:
-        a = PackageRelationGroup('foo | bar')
-        assert len(a) == 2
-        assert a[0].name == 'foo'
-        assert a[1].name == 'bar'
-
-    def test_init_iter_entry(self) -> None:
-        a = PackageRelationGroup((PackageRelationEntry('foo'), PackageRelationEntry('bar')))
-        assert len(a) == 2
-        assert a[0].name == 'foo'
-        assert a[1].name == 'bar'
-
-    def test_init_iter_str(self) -> None:
-        a = PackageRelationGroup(('foo', 'bar'))
-        assert len(a) == 2
-        assert a[0].name == 'foo'
-        assert a[1].name == 'bar'
-
-    def test_init_self(self) -> None:
-        a = PackageRelationGroup(PackageRelationGroup(['foo', 'bar']))
-        assert len(a) == 2
-        assert a[0].name == 'foo'
-        assert a[1].name == 'bar'
-
-    def test_str(self) -> None:
-        a = PackageRelationGroup('foo|  bar')
-        assert str(a) == 'foo | bar'
-
-
-class TestPackageRelation:
-    def test_init(self) -> None:
-        a = PackageRelation()
-        assert a == []
-
-    def test_init_str(self) -> None:
-        a = PackageRelation('foo1 | foo2, bar')
-        assert len(a) == 2
-        assert len(a[0]) == 2
-        assert a[0][0].name == 'foo1'
-        assert a[0][1].name == 'foo2'
-        assert len(a[1]) == 1
-        assert a[1][0].name == 'bar'
-
-    def test_init_iter_entry(self) -> None:
-        a = PackageRelation([[PackageRelationEntry('foo')], [PackageRelationEntry('bar')]])
-        assert len(a) == 2
-        assert len(a[0]) == 1
-        assert a[0][0].name == 'foo'
-        assert len(a[1]) == 1
-        assert a[1][0].name == 'bar'
-
-    def test_init_iter_str(self) -> None:
-        a = PackageRelation(('foo', 'bar'))
-        assert len(a) == 2
-        assert len(a[0]) == 1
-        assert a[0][0].name == 'foo'
-        assert len(a[1]) == 1
-        assert a[1][0].name == 'bar'
-
-    def test_init_self(self) -> None:
-        a = PackageRelation(PackageRelation(('foo', 'bar')))
-        assert len(a) == 2
-        assert len(a[0]) == 1
-        assert a[0][0].name == 'foo'
-        assert len(a[1]) == 1
-        assert a[1][0].name == 'bar'
-
-    def test_str(self) -> None:
-        a = PackageRelation('foo ,bar')
-        assert str(a) == 'foo, bar'
-
-
-class TestPackageBuildprofileEntry:
-    def test_parse(self) -> None:
-        a = PackageBuildprofileEntry.parse('<profile1 !profile2 profile3 !profile4>')
-        assert a.pos == {'profile1', 'profile3'}
-        assert a.neg == {'profile2', 'profile4'}
-        assert str(a) == '<profile1 profile3 !profile2 !profile4>'
-
-    def test_eq(self) -> None:
-        a = PackageBuildprofileEntry.parse('<profile1 !profile2>')
-        b = PackageBuildprofileEntry(pos={'profile1'}, neg={'profile2'})
-        assert a == b
-
-    def test_isdisjoint(self) -> None:
-        a = PackageBuildprofileEntry.parse('<profile1 profile2>')
-        b = PackageBuildprofileEntry.parse('<profile1 profile3>')
-        assert a.isdisjoint(b)
-
-    def test_issubset_empty(self) -> None:
-        a = PackageBuildprofileEntry.parse('<profile1 profile2>')
-        b = PackageBuildprofileEntry()
-        assert a.issubset(b)
-
-    def test_issubset_pos(self) -> None:
-        a = PackageBuildprofileEntry.parse('<profile1 profile2>')
-        b = PackageBuildprofileEntry.parse('<profile1>')
-        assert a.issubset(b)
-
-    def test_issubset_neg(self) -> None:
-        a = PackageBuildprofileEntry.parse('<!profile1>')
-        b = PackageBuildprofileEntry.parse('<!profile1 !profile2>')
-        assert a.issubset(b)
-
-    def test_issubset_both(self) -> None:
-        a = PackageBuildprofileEntry.parse('<!profile1 !profile2 profile3>')
-        b = PackageBuildprofileEntry.parse('<!profile1 !profile2 !profile3>')
-        assert a.issubset(b)
-
-    def test_issuperset_empty(self) -> None:
-        a = PackageBuildprofileEntry.parse('<profile1 profile2>')
-        b = PackageBuildprofileEntry()
-        assert b.issuperset(a)
-
-    def test_issuperset_pos(self) -> None:
-        a = PackageBuildprofileEntry.parse('<profile1 profile2>')
-        b = PackageBuildprofileEntry.parse('<profile1>')
-        assert b.issuperset(a)
-
-    def test_issuperset_neg(self) -> None:
-        a = PackageBuildprofileEntry.parse('<!profile1>')
-        b = PackageBuildprofileEntry.parse('<!profile1 !profile2>')
-        assert b.issuperset(a)
-
-    def test_issuperset_both(self) -> None:
-        a = PackageBuildprofileEntry.parse('<!profile1 !profile2 profile3>')
-        b = PackageBuildprofileEntry.parse('<!profile1 !profile2 !profile3>')
-        assert b.issuperset(a)
-
-    def test_update_pos(self) -> None:
-        a = PackageBuildprofileEntry.parse('<profile1 profile2>')
-        b = PackageBuildprofileEntry.parse('<profile1>')
-        a.update(b)
-        assert a.pos == {'profile1'}
-        assert a.neg == set()
-
-    def test_update_neg(self) -> None:
-        a = PackageBuildprofileEntry.parse('<!profile1 !profile2>')
-        b = PackageBuildprofileEntry.parse('<!profile1>')
-        a.update(b)
-        assert a.pos == set()
-        assert a.neg == {'profile1'}
-
-    def test_update_both(self) -> None:
-        a = PackageBuildprofileEntry.parse('<profile1 !profile2 profile3>')
-        b = PackageBuildprofileEntry.parse('<profile1 !profile2 !profile3>')
-        a.update(b)
-        assert a.pos == {'profile1'}
-        assert a.neg == {'profile2'}
-
-
-class TestPackageBuildprofile:
-    def test_parse(self) -> None:
-        a = PackageBuildprofile.parse('<profile1> <!profile2> <profile3> <!profile4>')
-        assert str(a) == '<profile1> <!profile2> <profile3> <!profile4>'
-
-    def test_update(self) -> None:
-        a = PackageBuildprofile.parse('<profile1 profile2> <profile2>')
-        b = PackageBuildprofile.parse('<profile1> <profile2 !profile3> <profile3>')
-        a.update(b)
-        assert str(a) == '<profile1> <profile2> <profile3>'

debian/libcpupower1.symbols

@@ -6,6 +6,7 @@ libcpupower.so.1 libcpupower1 #MINVER#
  cpufreq_get_available_governors@Base 4.7~rc2-1~exp1
  cpufreq_get_boost_frequencies@Base 5.5.8-1~exp1
  cpufreq_get_driver@Base 4.7~rc2-1~exp1
+ cpufreq_get_energy_performance_preference@Base 6.14~
  cpufreq_get_freq_hardware@Base 4.7~rc2-1~exp1
  cpufreq_get_freq_kernel@Base 4.7~rc2-1~exp1
  cpufreq_get_hardware_limits@Base 4.7~rc2-1~exp1
@@ -23,6 +24,7 @@ libcpupower.so.1 libcpupower1 #MINVER#
  cpufreq_put_available_governors@Base 4.7~rc2-1~exp1
  cpufreq_put_boost_frequencies@Base 5.5.8-1~exp1
  cpufreq_put_driver@Base 4.7~rc2-1~exp1
+ cpufreq_put_energy_performance_preference@Base 6.14~
  cpufreq_put_policy@Base 4.7~rc2-1~exp1
  cpufreq_put_related_cpus@Base 4.7~rc2-1~exp1
  cpufreq_put_stats@Base 4.7~rc2-1~exp1
@@ -36,6 +38,7 @@ libcpupower.so.1 libcpupower1 #MINVER#
  cpuidle_state_disable@Base 4.7~rc2-1~exp1
  cpuidle_state_latency@Base 4.7~rc2-1~exp1
  cpuidle_state_name@Base 4.7~rc2-1~exp1
+ cpuidle_state_residency@Base 6.12~rc2-1~exp1
  cpuidle_state_time@Base 4.7~rc2-1~exp1
  cpuidle_state_usage@Base 4.7~rc2-1~exp1
  cpupower_is_cpu_online@Base 4.7~rc2-1~exp1

debian/linux-misc-tools.manpages

@@ -0,0 +1,2 @@
+tools/thermal/thermometer/thermometer.8
+tools/thermal/tmon/tmon.8

debian/linux-perf.lintian-overrides.amd64

@@ -1,4 +1,5 @@
 # These executables are needed to handle processes running in compat mode
+linux-perf: binary-from-other-architecture *usr/lib/perf-core/perf-read-vdso32*
 linux-perf: binary-from-other-architecture *usr/lib/perf-core/perf-read-vdsox32*
 
 # Some of these plugins only need symbols from libtraceevent, which

debian/linux-perf.lintian-overrides.arm64

@@ -0,0 +1,10 @@
+# This is a test program that does not link any libraries, either
+# statically or dynamically
+linux-perf: statically-linked-binary [usr/lib/perf-core/tests/shell/coresight/asm_pure_loop/asm_pure_loop]
+
+# Some of these plugins only need symbols from libtraceevent, which
+# loads them and should not have a NEEDED entry
+linux-perf: shared-library-lacks-prerequisites *usr/lib/traceevent/plugins/plugin_*.so*
+
+# This transition was too complex for dh_installdeb to handle
+linux-perf: maintainer-script-should-not-use-dpkg-maintscript-helper "dpkg-maintscript-helper" *

debian/linux-perf.postrm

@@ -9,8 +9,7 @@ if [ -n "${old_version_suffix}" ] ; then
 fi
 unset old_version_suffix
 
-case "$1" in
+if [ "$1" = remove ] ; then
-remove )
     for wrapper in \
       /usr/bin/perf \
       /usr/share/bash-completion/completions/perf \
@@ -19,7 +18,6 @@ remove )
         diversion="${wrapper%/perf*}/perf.wrapper${wrapper#*/perf}"
         dpkg-divert --package linux-perf --divert "${diversion}" --rename --remove "${wrapper}"
     done ; unset wrapper diversion
-;;
+fi
-esac
 
 #DEBHELPER#

debian/patches/bugfix/all/Revert-mmc-dw_mmc-Fix-IDMAC-operation-with-pages-big.patch

@@ -1,24 +0,0 @@
-From ae6a452692f8b02115019b0b62ac82ae2c432f59 Mon Sep 17 00:00:00 2001
-From: Aurelien Jarno <aurelien@aurel32.net>
-Date: Wed, 23 Oct 2024 21:28:33 +0200
-Subject: [PATCH] Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger
- than 4K"
-
-This reverts commit 8396c793ffdf28bb8aee7cfe0891080f8cab7890.
----
- drivers/mmc/host/dw_mmc.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/mmc/host/dw_mmc.c
-+++ b/drivers/mmc/host/dw_mmc.c
-@@ -2957,8 +2957,8 @@ static int dw_mci_init_slot(struct dw_mc
- 	if (host->use_dma == TRANS_MODE_IDMAC) {
- 		mmc->max_segs = host->ring_size;
- 		mmc->max_blk_size = 65535;
--		mmc->max_req_size = DW_MCI_DESC_DATA_LENGTH * host->ring_size;
--		mmc->max_seg_size = mmc->max_req_size;
-+		mmc->max_seg_size = 0x1000;
-+		mmc->max_req_size = mmc->max_seg_size * host->ring_size;
- 		mmc->max_blk_count = mmc->max_req_size / 512;
- 	} else if (host->use_dma == TRANS_MODE_EDMAC) {
- 		mmc->max_segs = 64;

debian/patches/bugfix/all/bootconfig-fix-negative-seeks-on-32-bit-with-lfs-ena.patch

@@ -0,0 +1,45 @@
+From: Ben Hutchings <benh@debian.org>
+Date: Sun, 17 Aug 2025 16:06:28 +0200
+Subject: bootconfig: Fix negative seeks on 32-bit with LFS enabled
+Forwarded: https://lore.kernel.org/linux-trace-kernel/aKHlevxeg6Y7UQrz@decadent.org.uk/T/
+
+Commit 26dda5769509 "tools/bootconfig: Cleanup bootconfig footer size
+calculations" replaced some expressions of type int with the
+BOOTCONFIG_FOOTER_SIZE macro, which expands to an expression of type
+size_t, which is unsigned.
+
+On 32-bit architectures with LFS enabled (i.e. off_t is 64-bit), the
+seek offset of -BOOTCONFIG_FOOTER_SIZE now turns into a positive
+value.
+
+Fix this by casting the size to off_t before negating it.
+
+Just in case someone changes BOOTCONFIG_MAGIC_LEN to have type size_t
+later, do the same thing to the seek offset of -BOOTCONFIG_MAGIC_LEN.
+
+Fixes: 26dda5769509 ("tools/bootconfig: Cleanup bootconfig footer size calculations")
+Signed-off-by: Ben Hutchings <benh@debian.org>
+---
+ tools/bootconfig/main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/bootconfig/main.c
++++ b/tools/bootconfig/main.c
+@@ -193,7 +193,7 @@ static int load_xbc_from_initrd(int fd,
+ 	if (stat.st_size < BOOTCONFIG_FOOTER_SIZE)
+ 		return 0;
+ 
+-	if (lseek(fd, -BOOTCONFIG_MAGIC_LEN, SEEK_END) < 0)
++	if (lseek(fd, -(off_t)BOOTCONFIG_MAGIC_LEN, SEEK_END) < 0)
+ 		return pr_errno("Failed to lseek for magic", -errno);
+ 
+ 	if (read(fd, magic, BOOTCONFIG_MAGIC_LEN) < 0)
+@@ -203,7 +203,7 @@ static int load_xbc_from_initrd(int fd,
+ 	if (memcmp(magic, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN) != 0)
+ 		return 0;
+ 
+-	if (lseek(fd, -BOOTCONFIG_FOOTER_SIZE, SEEK_END) < 0)
++	if (lseek(fd, -(off_t)BOOTCONFIG_FOOTER_SIZE, SEEK_END) < 0)
+ 		return pr_errno("Failed to lseek for size", -errno);
+ 
+ 	if (read(fd, &size, sizeof(uint32_t)) < 0)

debian/patches/bugfix/all/bootconfig-fix-unaligned-access-when-building-footer.patch

@@ -0,0 +1,71 @@
+From: Ben Hutchings <benh@debian.org>
+Date: Wed, 23 Jul 2025 12:17:14 +0200
+Subject: bootconfig: Fix unaligned access when building footer
+Forwarded: https://lore.kernel.org/linux-trace-kernel/aIC-NTw-cdm9ZGFw@decadent.org.uk/T/
+
+Currently we add padding between the bootconfig text and footer to
+ensure that the footer is aligned within the initramfs image.
+However, because only the bootconfig data is held in memory, not the
+full initramfs image, the footer may not be naturally aligned in
+memory.
+
+This can result in an alignment fault (SIGBUS) when writing the footer
+on some architectures, such as sparc.
+
+Build the footer in a struct on the stack before adding it to the
+buffer.
+
+References: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=sparc64&ver=6.16%7Erc7-1%7Eexp1&stamp=1753209801&raw=0
+Signed-off-by: Ben Hutchings <benh@debian.org>
+---
+ tools/bootconfig/main.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+--- a/tools/bootconfig/main.c
++++ b/tools/bootconfig/main.c
+@@ -11,6 +11,7 @@
+ #include <string.h>
+ #include <errno.h>
+ #include <endian.h>
++#include <assert.h>
+ 
+ #include <linux/bootconfig.h>
+ 
+@@ -363,7 +364,12 @@ static int delete_xbc(const char *path)
+ 
+ static int apply_xbc(const char *path, const char *xbc_path)
+ {
+-	char *buf, *data, *p;
++	struct {
++		uint32_t size;
++		uint32_t csum;
++		char magic[BOOTCONFIG_MAGIC_LEN];
++	} footer;
++	char *buf, *data;
+ 	size_t total_size;
+ 	struct stat stat;
+ 	const char *msg;
+@@ -433,17 +439,13 @@ static int apply_xbc(const char *path, c
+ 	size += pad;
+ 
+ 	/* Add a footer */
+-	p = data + size;
+-	*(uint32_t *)p = htole32(size);
+-	p += sizeof(uint32_t);
++	footer.size = htole32(size);
++	footer.csum = htole32(csum);
++	memcpy(footer.magic, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN);
++	static_assert(sizeof(footer) == BOOTCONFIG_FOOTER_SIZE);
++	memcpy(data + size, &footer, BOOTCONFIG_FOOTER_SIZE);
+ 
+-	*(uint32_t *)p = htole32(csum);
+-	p += sizeof(uint32_t);
+-
+-	memcpy(p, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN);
+-	p += BOOTCONFIG_MAGIC_LEN;
+-
+-	total_size = p - data;
++	total_size = size + BOOTCONFIG_FOOTER_SIZE;
+ 
+ 	ret = write(fd, data, total_size);
+ 	if (ret < total_size) {

debian/patches/bugfix/all/disable-some-marvell-phys.patch

@@ -16,7 +16,7 @@ correctness.
 
 --- a/drivers/net/phy/marvell.c
 +++ b/drivers/net/phy/marvell.c
-@@ -1366,6 +1366,7 @@ static int m88e1118_config_init(struct p
+@@ -1409,6 +1409,7 @@ static int m88e1118_config_init(struct p
  	return genphy_soft_reset(phydev);
  }
  
@@ -24,7 +24,7 @@ correctness.
  static int m88e1149_config_init(struct phy_device *phydev)
  {
  	int err;
-@@ -1391,7 +1392,9 @@ static int m88e1149_config_init(struct p
+@@ -1434,7 +1435,9 @@ static int m88e1149_config_init(struct p
  
  	return genphy_soft_reset(phydev);
  }
@@ -34,7 +34,7 @@ correctness.
  static int m88e1145_config_init_rgmii(struct phy_device *phydev)
  {
  	int err;
-@@ -1469,6 +1472,7 @@ static int m88e1145_config_init(struct p
+@@ -1512,6 +1515,7 @@ static int m88e1145_config_init(struct p
  
  	return 0;
  }
@@ -42,7 +42,7 @@ correctness.
  
  static int m88e1540_get_fld(struct phy_device *phydev, u8 *msecs)
  {
-@@ -3790,6 +3794,7 @@ static struct phy_driver marvell_drivers
+@@ -3828,6 +3832,7 @@ static struct phy_driver marvell_drivers
  		.led_hw_control_set = m88e1318_led_hw_control_set,
  		.led_hw_control_get = m88e1318_led_hw_control_get,
  	},
@@ -50,7 +50,7 @@ correctness.
  	{
  		.phy_id = MARVELL_PHY_ID_88E1145,
  		.phy_id_mask = MARVELL_PHY_ID_MASK,
-@@ -3813,6 +3818,8 @@ static struct phy_driver marvell_drivers
+@@ -3851,6 +3856,8 @@ static struct phy_driver marvell_drivers
  		.cable_test_start = m88e1111_vct_cable_test_start,
  		.cable_test_get_status = m88e1111_vct_cable_test_get_status,
  	},
@@ -59,7 +59,7 @@ correctness.
  	{
  		.phy_id = MARVELL_PHY_ID_88E1149R,
  		.phy_id_mask = MARVELL_PHY_ID_MASK,
-@@ -3831,6 +3838,8 @@ static struct phy_driver marvell_drivers
+@@ -3869,6 +3876,8 @@ static struct phy_driver marvell_drivers
  		.get_strings = marvell_get_strings,
  		.get_stats = marvell_get_stats,
  	},
@@ -68,7 +68,7 @@ correctness.
  	{
  		.phy_id = MARVELL_PHY_ID_88E1240,
  		.phy_id_mask = MARVELL_PHY_ID_MASK,
-@@ -3851,6 +3860,7 @@ static struct phy_driver marvell_drivers
+@@ -3889,6 +3898,7 @@ static struct phy_driver marvell_drivers
  		.get_tunable = m88e1011_get_tunable,
  		.set_tunable = m88e1011_set_tunable,
  	},
@@ -76,7 +76,7 @@ correctness.
  	{
  		.phy_id = MARVELL_PHY_ID_88E1116R,
  		.phy_id_mask = MARVELL_PHY_ID_MASK,
-@@ -4139,9 +4149,9 @@ static struct mdio_device_id __maybe_unu
+@@ -4177,9 +4187,9 @@ static const struct mdio_device_id __may
  	{ MARVELL_PHY_ID_88E1111_FINISAR, MARVELL_PHY_ID_MASK },
  	{ MARVELL_PHY_ID_88E1118, MARVELL_PHY_ID_MASK },
  	{ MARVELL_PHY_ID_88E1121R, MARVELL_PHY_ID_MASK },

debian/patches/bugfix/all/documentation-use-relative-source-paths-in-abi-documentation.patch

@@ -1,32 +0,0 @@
-From: Ben Hutchings <benh@debian.org>
-Date: Mon, 16 Sep 2024 00:07:04 +0200
-Subject: Documentation: Use relative source filenames in ABI documentation
-
-Currently the ABI documentation files contain absolute source
-filenames, which makes them unreproducible if the build directory can
-vary.
-
-Remove the source base directory ($srctree) from the source filenames
-shown in the documentation.
-
-Signed-off-by: Ben Hutchings <benh@debian.org>
----
---- a/Documentation/sphinx/kernel_abi.py
-+++ b/Documentation/sphinx/kernel_abi.py
-@@ -103,6 +103,7 @@ class KernelCmd(Directive):
-             lines = code_block + "\n\n"
- 
-         line_regex = re.compile(r"^\.\. LINENO (\S+)\#([0-9]+)$")
-+        srctree = os.path.abspath(os.environ["srctree"])
-         ln = 0
-         n = 0
-         f = fname
-@@ -127,7 +128,7 @@ class KernelCmd(Directive):
-                 # sphinx counts lines from 0
-                 ln = int(match.group(2)) - 1
-             else:
--                content.append(line, f, ln)
-+                content.append(line, os.path.relpath(f, srctree), ln)
- 
-         kernellog.info(self.state.document.settings.env.app, "%s: parsed %i lines" % (fname, n))
- 

debian/patches/bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch

@@ -18,7 +18,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 
 --- a/fs/btrfs/super.c
 +++ b/fs/btrfs/super.c
-@@ -2646,7 +2646,7 @@ module_exit(exit_btrfs_fs)
+@@ -2625,7 +2625,7 @@ module_exit(exit_btrfs_fs)
  
  MODULE_DESCRIPTION("B-Tree File System (BTRFS)");
  MODULE_LICENSE("GPL");
@@ -27,19 +27,9 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  MODULE_SOFTDEP("pre: xxhash64");
  MODULE_SOFTDEP("pre: sha256");
  MODULE_SOFTDEP("pre: blake2b-256");
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -7435,6 +7435,6 @@ static void __exit ext4_exit_fs(void)
- MODULE_AUTHOR("Remy Card, Stephen Tweedie, Andrew Morton, Andreas Dilger, Theodore Ts'o and others");
- MODULE_DESCRIPTION("Fourth Extended Filesystem");
- MODULE_LICENSE("GPL");
--MODULE_SOFTDEP("pre: crc32c");
-+MODULE_SOFTDEP("pre: crypto-crc32c");
- module_init(ext4_init_fs)
- module_exit(ext4_exit_fs)
 --- a/fs/jbd2/journal.c
 +++ b/fs/jbd2/journal.c
-@@ -3194,6 +3194,7 @@ static void __exit journal_exit(void)
+@@ -3157,6 +3157,7 @@ static void __exit journal_exit(void)
  
  MODULE_DESCRIPTION("Generic filesystem journal-writing module");
  MODULE_LICENSE("GPL");
@@ -49,7 +39,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  
 --- a/fs/nfsd/nfsctl.c
 +++ b/fs/nfsd/nfsctl.c
-@@ -2352,5 +2352,8 @@ static void __exit exit_nfsd(void)
+@@ -2353,5 +2353,8 @@ static void __exit exit_nfsd(void)
  MODULE_AUTHOR("Olaf Kirch <okir@monad.swb.de>");
  MODULE_DESCRIPTION("In-kernel NFS server");
  MODULE_LICENSE("GPL");

debian/patches/bugfix/all/kbuild-bpf-fix-btf-reproducibility.patch

@@ -15,16 +15,16 @@ Signed-off-by: Ben Hutchings <benh@debian.org>
 ---
 --- a/scripts/Makefile.btf
 +++ b/scripts/Makefile.btf
-@@ -12,8 +12,6 @@ endif
+@@ -14,8 +14,6 @@ endif
  
  pahole-flags-$(call test-ge, $(pahole-ver), 121)	+= --btf_gen_floats
  
--pahole-flags-$(call test-ge, $(pahole-ver), 122)	+= -j
+-pahole-flags-$(call test-ge, $(pahole-ver), 122)	+= -j$(JOBS)
 -
  pahole-flags-$(call test-ge, $(pahole-ver), 125)	+= --skip_encoding_btf_inconsistent_proto --btf_gen_optimized
  
  else
-@@ -27,6 +25,18 @@ endif
+@@ -31,6 +29,18 @@ endif
  
  endif
  
@@ -35,9 +35,9 @@ Signed-off-by: Ben Hutchings <benh@debian.org>
 +# Assume that if KBUILD_BUILD_TIMESTAMP is set then a reproducible
 +# build is required and we must not use -j alone.
 +ifeq ($(KBUILD_BUILD_TIMESTAMP),)
-+pahole-flags-$(call test-ge, $(pahole-ver), 122)	+= -j
++pahole-flags-$(call test-ge, $(pahole-ver), 122)	+= -j$(JOBS)
 +else
-+pahole-flags-$(call test-ge, $(pahole-ver), 127)	+= -j --btf_features=+reproducible_build
++pahole-flags-$(call test-ge, $(pahole-ver), 127)	+= -j$(JOBS) --btf_features=+reproducible_build
 +endif
 +
  pahole-flags-$(CONFIG_PAHOLE_HAS_LANG_EXCLUDE)		+= --lang_exclude=rust

debian/patches/bugfix/all/kbuild-fix-recordmcount-dependency.patch

@@ -9,7 +9,7 @@ sources.
 
 --- a/scripts/Makefile.build
 +++ b/scripts/Makefile.build
-@@ -210,6 +210,11 @@ cmd_record_mcount = $(if $(findstring $(
+@@ -268,6 +268,11 @@ cmd_record_mcount = $(if $(findstring $(
  	$(sub_cmd_record_mcount))
  endif # CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT
  

debian/patches/bugfix/all/libapi-define-_fortify_source-as-2-not-empty.patch

@@ -7,7 +7,7 @@ Signed-off-by: Ben Hutchings <benh@debian.org>
 ---
 --- a/tools/lib/api/Makefile
 +++ b/tools/lib/api/Makefile
-@@ -39,7 +39,7 @@ endif
+@@ -35,7 +35,7 @@ ifeq ($(DEBUG),0)
  endif
  
  ifeq ($(DEBUG),0)

debian/patches/bugfix/all/libbpf-use-the-standard-fixdep-build-rule.patch

@@ -0,0 +1,41 @@
+From: Ben Hutchings <benh@debian.org>
+Date: Sun, 20 Apr 2025 18:50:44 +0200
+Subject: libbpf: Use the standard fixdep build rule
+
+libbpf's all target depends on the fixdep target defined in
+tools/scripts/Makefile.include.  However the $(BPF_IN_SHARED) and
+$(BPF_IN_STATIC) targets don't use it, but instead rebuild fixdep in
+the staticobjs or sharedobjs subdirectory using a different command.
+
+Change the $(BPF_IN_SHARED) and $(BPF_IN_STATIC) targets to depend on
+fixdep and to symlink the executable into the respective output
+subdirectory.
+
+Signed-off-by: Ben Hutchings <benh@debian.org>
+---
+--- a/tools/lib/bpf/Makefile
++++ b/tools/lib/bpf/Makefile
+@@ -134,7 +134,7 @@ all_cmd: $(CMD_TARGETS) check
+ $(SHARED_OBJDIR) $(STATIC_OBJDIR):
+ 	$(Q)mkdir -p $@
+ 
+-$(BPF_IN_SHARED): force $(BPF_GENERATED) | $(SHARED_OBJDIR)
++$(BPF_IN_SHARED): fixdep force $(BPF_GENERATED) | $(SHARED_OBJDIR)
+ 	@(test -f ../../include/uapi/linux/bpf.h -a -f ../../../include/uapi/linux/bpf.h && ( \
+ 	(diff -B ../../include/uapi/linux/bpf.h ../../../include/uapi/linux/bpf.h >/dev/null) || \
+ 	echo "Warning: Kernel ABI header at 'tools/include/uapi/linux/bpf.h' differs from latest version at 'include/uapi/linux/bpf.h'" >&2 )) || true
+@@ -144,11 +144,11 @@ $(BPF_IN_SHARED): force $(BPF_GENERATED)
+ 	@(test -f ../../include/uapi/linux/if_xdp.h -a -f ../../../include/uapi/linux/if_xdp.h && ( \
+ 	(diff -B ../../include/uapi/linux/if_xdp.h ../../../include/uapi/linux/if_xdp.h >/dev/null) || \
+ 	echo "Warning: Kernel ABI header at 'tools/include/uapi/linux/if_xdp.h' differs from latest version at 'include/uapi/linux/if_xdp.h'" >&2 )) || true
+-	$(SILENT_MAKE) -C $(srctree)/tools/build CFLAGS= LDFLAGS= OUTPUT=$(SHARED_OBJDIR) $(SHARED_OBJDIR)fixdep
++	ln -sf ../fixdep $(SHARED_OBJDIR)/
+ 	$(Q)$(MAKE) $(build)=libbpf OUTPUT=$(SHARED_OBJDIR) CFLAGS="$(CFLAGS) $(SHLIB_FLAGS)"
+ 
+-$(BPF_IN_STATIC): force $(BPF_GENERATED) | $(STATIC_OBJDIR)
+-	$(SILENT_MAKE) -C $(srctree)/tools/build CFLAGS= LDFLAGS= OUTPUT=$(STATIC_OBJDIR) $(STATIC_OBJDIR)fixdep
++$(BPF_IN_STATIC): fixdep force $(BPF_GENERATED) | $(STATIC_OBJDIR)
++	ln -sf ../fixdep $(STATIC_OBJDIR)/
+ 	$(Q)$(MAKE) $(build)=libbpf OUTPUT=$(STATIC_OBJDIR)
+ 
+ $(BPF_HELPER_DEFS): $(srctree)/tools/include/uapi/linux/bpf.h

debian/patches/bugfix/all/module-disable-matching-missing-version-crc.patch

@@ -9,7 +9,7 @@ alternative may allow subverting module signing.
 ---
 --- a/kernel/module/version.c
 +++ b/kernel/module/version.c
-@@ -46,9 +46,8 @@ int check_version(const struct load_info
+@@ -63,9 +63,8 @@ int check_version(const struct load_info
  		goto bad_version;
  	}
  

debian/patches/bugfix/all/perf-docs-Fix-perf-check-manual-page-built-with-asci.patch

@@ -0,0 +1,31 @@
+From: Ben Hutchings <benh@debian.org>
+Date: Sun, 23 Mar 2025 21:04:02 +0100
+Subject: [PATCH] perf docs: Fix perf-check manual page built with asciidoctor
+Forwarded: https://lore.kernel.org/linux-perf-users/Z-BxCE8WrcRmR_5f@decadent.org.uk/
+
+asciidoctor is more picky than asciidoc about the length of heading
+underlines, and currently mis-parses perf-check.txt:
+
+  ASCIIDOC perf-check.1
+asciidoctor: ERROR: perf-check.txt: line 1: non-conforming manpage title
+asciidoctor: ERROR: perf-check.txt: line 1: name section expected
+asciidoctor: WARNING: perf-check.txt: line 2: unterminated example block
+asciidoctor: WARNING: perf-check.txt: line 5: unterminated listing block
+
+Fix the length of the title underline so it works properly.
+
+Fixes: 98ad0b77323c ("perf check: Introduce 'check' subcommand")
+Signed-off-by: Ben Hutchings <benh@debian.org>
+---
+ tools/perf/Documentation/perf-check.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/Documentation/perf-check.txt
++++ b/tools/perf/Documentation/perf-check.txt
+@@ -1,5 +1,5 @@
+ perf-check(1)
+-===============
++=============
+ 
+ NAME
+ ----

debian/patches/bugfix/all/perf-tools-pass-extra_cflags-through-to-libbpf-build-again.patch

@@ -16,7 +16,7 @@ Signed-off-by: Ben Hutchings <benh@debian.org>
 ---
 --- a/tools/perf/Makefile.perf
 +++ b/tools/perf/Makefile.perf
-@@ -951,7 +951,7 @@ $(LIBAPI)-clean:
+@@ -963,7 +963,7 @@ $(LIBAPI)-clean:
  $(LIBBPF): FORCE | $(LIBBPF_OUTPUT)
  	$(Q)$(MAKE) -C $(LIBBPF_DIR) FEATURES_DUMP=$(FEATURE_DUMP_EXPORT) \
  		O= OUTPUT=$(LIBBPF_OUTPUT)/ DESTDIR=$(LIBBPF_DESTDIR) prefix= subdir= \

debian/patches/bugfix/all/radeon-amdgpu-firmware-is-required-for-drm-and-kms-on-r600-onward.patch

@@ -36,7 +36,7 @@ of the patch
 --- a/drivers/gpu/drm/radeon/radeon_drv.c
 +++ b/drivers/gpu/drm/radeon/radeon_drv.c
 @@ -32,6 +32,8 @@
- 
+ #include <linux/aperture.h>
  #include <linux/compat.h>
  #include <linux/module.h>
 +#include <linux/namei.h>
@@ -73,7 +73,7 @@ of the patch
  static int radeon_pci_probe(struct pci_dev *pdev,
  			    const struct pci_device_id *ent)
  {
-@@ -295,6 +319,12 @@ static int radeon_pci_probe(struct pci_d
+@@ -297,6 +321,12 @@ static int radeon_pci_probe(struct pci_d
  	if (vga_switcheroo_client_probe_defer(pdev))
  		return -EPROBE_DEFER;
  
@@ -84,5 +84,5 @@ of the patch
 +	}
 +
  	/* Get rid of things like offb */
- 	ret = drm_aperture_remove_conflicting_pci_framebuffers(pdev, &kms_driver);
+ 	ret = aperture_remove_conflicting_pci_devices(pdev, kms_driver.name);
  	if (ret)

debian/patches/bugfix/all/revert-tools-build-clean-cflags-and-ldflags-for-fixdep.patch

@@ -10,12 +10,12 @@ Signed-off-by: Ben Hutchings <benh@debian.org>
 ---
 --- a/tools/build/Makefile.include
 +++ b/tools/build/Makefile.include
-@@ -2,7 +2,7 @@
+@@ -12,7 +12,7 @@ else
- build := -f $(srctree)/tools/build/Makefile.build dir=. obj
+ endif
  
  fixdep:
--	$(Q)$(MAKE) -C $(srctree)/tools/build CFLAGS= LDFLAGS= $(OUTPUT)fixdep
+-	$(SILENT_MAKE) -C $(srctree)/tools/build CFLAGS= LDFLAGS= $(OUTPUT)fixdep
-+	$(Q)$(MAKE) -C $(srctree)/tools/build $(OUTPUT)fixdep
++	$(SILENT_MAKE) -C $(srctree)/tools/build $(OUTPUT)fixdep
  
  fixdep-clean:
  	$(Q)$(MAKE) -C $(srctree)/tools/build clean

debian/patches/bugfix/all/tools-bootconfig-cleanup-bootconfig-footer-size-calc.patch

@@ -0,0 +1,90 @@
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Thu, 10 Jul 2025 11:24:17 +0900
+Subject: tools/bootconfig: Cleanup bootconfig footer size calculations
+Origin: https://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git/commit?id=26dda57695090e05c1a99c3e8f802f862d1ac474
+
+There are many same pattern of 8 + BOOTCONFIG_MAGIC_LEN for calculating
+the size of bootconfig footer. Use BOOTCONFIG_FOOTER_SIZE macro to
+clean up those magic numbers.
+
+Link: https://lore.kernel.org/all/175211425693.2591046.16029516706923643510.stgit@mhiramat.tok.corp.google.com/
+
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+---
+ tools/bootconfig/main.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/tools/bootconfig/main.c
++++ b/tools/bootconfig/main.c
+@@ -16,6 +16,10 @@
+ 
+ #define pr_err(fmt, ...) fprintf(stderr, fmt, ##__VA_ARGS__)
+ 
++/* Bootconfig footer is [size][csum][BOOTCONFIG_MAGIC]. */
++#define BOOTCONFIG_FOOTER_SIZE	\
++	(sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
++
+ static int xbc_show_value(struct xbc_node *node, bool semicolon)
+ {
+ 	const char *val, *eol;
+@@ -185,7 +189,7 @@ static int load_xbc_from_initrd(int fd,
+ 	if (ret < 0)
+ 		return -errno;
+ 
+-	if (stat.st_size < 8 + BOOTCONFIG_MAGIC_LEN)
++	if (stat.st_size < BOOTCONFIG_FOOTER_SIZE)
+ 		return 0;
+ 
+ 	if (lseek(fd, -BOOTCONFIG_MAGIC_LEN, SEEK_END) < 0)
+@@ -198,7 +202,7 @@ static int load_xbc_from_initrd(int fd,
+ 	if (memcmp(magic, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN) != 0)
+ 		return 0;
+ 
+-	if (lseek(fd, -(8 + BOOTCONFIG_MAGIC_LEN), SEEK_END) < 0)
++	if (lseek(fd, -BOOTCONFIG_FOOTER_SIZE, SEEK_END) < 0)
+ 		return pr_errno("Failed to lseek for size", -errno);
+ 
+ 	if (read(fd, &size, sizeof(uint32_t)) < 0)
+@@ -210,12 +214,12 @@ static int load_xbc_from_initrd(int fd,
+ 	csum = le32toh(csum);
+ 
+ 	/* Wrong size error  */
+-	if (stat.st_size < size + 8 + BOOTCONFIG_MAGIC_LEN) {
++	if (stat.st_size < size + BOOTCONFIG_FOOTER_SIZE) {
+ 		pr_err("bootconfig size is too big\n");
+ 		return -E2BIG;
+ 	}
+ 
+-	if (lseek(fd, stat.st_size - (size + 8 + BOOTCONFIG_MAGIC_LEN),
++	if (lseek(fd, stat.st_size - (size + BOOTCONFIG_FOOTER_SIZE),
+ 		  SEEK_SET) < 0)
+ 		return pr_errno("Failed to lseek", -errno);
+ 
+@@ -346,7 +350,7 @@ static int delete_xbc(const char *path)
+ 		ret = fstat(fd, &stat);
+ 		if (!ret)
+ 			ret = ftruncate(fd, stat.st_size
+-					- size - 8 - BOOTCONFIG_MAGIC_LEN);
++					- size - BOOTCONFIG_FOOTER_SIZE);
+ 		if (ret)
+ 			ret = -errno;
+ 	} /* Ignore if there is no boot config in initrd */
+@@ -376,8 +380,7 @@ static int apply_xbc(const char *path, c
+ 	csum = xbc_calc_checksum(buf, size);
+ 
+ 	/* Backup the bootconfig data */
+-	data = calloc(size + BOOTCONFIG_ALIGN +
+-		      sizeof(uint32_t) + sizeof(uint32_t) + BOOTCONFIG_MAGIC_LEN, 1);
++	data = calloc(size + BOOTCONFIG_ALIGN + BOOTCONFIG_FOOTER_SIZE, 1);
+ 	if (!data)
+ 		return -ENOMEM;
+ 	memcpy(data, buf, size);
+@@ -425,7 +428,7 @@ static int apply_xbc(const char *path, c
+ 	}
+ 
+ 	/* To align up the total size to BOOTCONFIG_ALIGN, get padding size */
+-	total_size = stat.st_size + size + sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN;
++	total_size = stat.st_size + size + BOOTCONFIG_FOOTER_SIZE;
+ 	pad = ((total_size + BOOTCONFIG_ALIGN - 1) & (~BOOTCONFIG_ALIGN_MASK)) - total_size;
+ 	size += pad;
+ 

debian/patches/bugfix/all/tools-build-remove-bpf-run-time-check-at-build-time.patch

@@ -21,7 +21,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 +	 * much older kernel.  Do "use" the attr structure here to avoid
 +	 * a "set but not used" warning.
  	 */
--	return syscall(__NR_bpf, BPF_PROG_LOAD, &attr, sizeof(attr));
+-	return syscall(__NR_bpf, BPF_PROG_LOAD, &attr, sizeof(attr)) == 0;
 +	(void)&attr;
 +	return 0;
  }

debian/patches/bugfix/all/tools-perf-fix-missing-ldflags-for-some-programs.patch

@@ -6,7 +6,7 @@ Signed-off-by: Ben Hutchings <benh@debian.org>
 ---
 --- a/tools/perf/Makefile.perf
 +++ b/tools/perf/Makefile.perf
-@@ -925,7 +925,7 @@ $(OUTPUT)dlfilters/%.o: dlfilters/%.c in
+@@ -937,7 +937,7 @@ $(OUTPUT)dlfilters/%.o: dlfilters/%.c in
  .SECONDARY: $(DLFILTERS:.so=.o)
  
  $(OUTPUT)dlfilters/%.so: $(OUTPUT)dlfilters/%.o

debian/patches/bugfix/all/tools_lib_symbol_use_d_fortify_source_2_for_non_debug_builds.patch

@@ -16,7 +16,7 @@ Acked-by: Ian Rogers <irogers@google.com>
 
 --- a/tools/lib/symbol/Makefile
 +++ b/tools/lib/symbol/Makefile
-@@ -39,7 +39,7 @@ endif
+@@ -35,7 +35,7 @@ ifeq ($(DEBUG),0)
  endif
  
  ifeq ($(DEBUG),0)

debian/patches/bugfix/arm64/arm64-acpi-Add-fixup-for-HPE-m400-quirks.patch

@@ -69,7 +69,7 @@ Signed-off-by: Geoff Levand <geoff@infradead.org>
   * acpi_boot_table_init() called from setup_arch(), always.
   *	1. find RSDP and get its address, and then find XSDT
   *	2. extract all tables and checksums them all
-@@ -257,6 +286,8 @@ done:
+@@ -261,6 +290,8 @@ done:
  
  		if (IS_ENABLED(CONFIG_ACPI_BGRT))
  			acpi_table_parse(ACPI_SIG_BGRT, acpi_parse_bgrt);

debian/patches/bugfix/powerpc/powerpc-boot-fix-missing-crc32poly.h-when-building-with-kernel_xz.patch

@@ -26,7 +26,7 @@ Tested-by: Michal Kubecek <mkubecek@suse.cz>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -97,7 +97,7 @@ BOOTCFLAGS	+= -fno-stack-protector
+@@ -98,7 +98,7 @@ BOOTCFLAGS	+= -fno-stack-protector
  endif
  
  BOOTCFLAGS	+= -include $(srctree)/include/linux/compiler_attributes.h

debian/patches/bugfix/sh/sh-boot-do-not-use-hyphen-in-exported-variable-name.patch

@@ -1,89 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Mon, 07 Feb 2022 00:00:26 +0100
-Subject: sh: Do not use hyphen in exported variable names
-
-arch/sh/Makefile defines and exports ld-bfd to be used by
-arch/sh/boot/Makefile and arch/sh/boot/compressed/Makefile.  However
-some shells, including dash, will not pass through environment
-variables whose name includes a hyphen.  Usually GNU make does not use
-a shell to recurse, but if e.g. $(srctree) contains '~' it will use a
-shell here.
-
-Rename the variable to ld_bfd.
-
-(Another instance of this problem was fixed upstream by commit
-82977af93a0d "sh: rename suffix-y to suffix_y".)
-
-References: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=sh4&ver=4.13%7Erc5-1%7Eexp1&stamp=1502943967&raw=0
-Fixes: ef9b542fce00 ("sh: bzip2/lzma uImage support.")
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
----
- arch/sh/Makefile                 | 10 +++++-----
- arch/sh/boot/compressed/Makefile |  4 ++--
- arch/sh/boot/romimage/Makefile   |  4 ++--
- 3 files changed, 9 insertions(+), 9 deletions(-)
-
---- a/arch/sh/Makefile
-+++ b/arch/sh/Makefile
-@@ -102,16 +102,16 @@ UTS_MACHINE		:= sh
- LDFLAGS_vmlinux		+= -e _stext
- 
- ifdef CONFIG_CPU_LITTLE_ENDIAN
--ld-bfd			:= elf32-sh-linux
--LDFLAGS_vmlinux		+= --defsym jiffies=jiffies_64 --oformat $(ld-bfd)
-+ld_bfd			:= elf32-sh-linux
-+LDFLAGS_vmlinux		+= --defsym jiffies=jiffies_64 --oformat $(ld_bfd)
- KBUILD_LDFLAGS		+= -EL
- else
--ld-bfd			:= elf32-shbig-linux
--LDFLAGS_vmlinux		+= --defsym jiffies=jiffies_64+4 --oformat $(ld-bfd)
-+ld_bfd			:= elf32-shbig-linux
-+LDFLAGS_vmlinux		+= --defsym jiffies=jiffies_64+4 --oformat $(ld_bfd)
- KBUILD_LDFLAGS		+= -EB
- endif
- 
--export ld-bfd
-+export ld_bfd
- 
- # Mach groups
- machdir-$(CONFIG_SOLUTION_ENGINE)		+= mach-se
---- a/arch/sh/boot/compressed/Makefile
-+++ b/arch/sh/boot/compressed/Makefile
-@@ -27,7 +27,7 @@ endif
- 
- ccflags-remove-$(CONFIG_MCOUNT) += -pg
- 
--LDFLAGS_vmlinux := --oformat $(ld-bfd) -Ttext $(IMAGE_OFFSET) -e startup \
-+LDFLAGS_vmlinux := --oformat $(ld_bfd) -Ttext $(IMAGE_OFFSET) -e startup \
- 		   -T $(obj)/../../kernel/vmlinux.lds
- 
- KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
-@@ -51,7 +51,7 @@ $(obj)/vmlinux.bin.lzo: $(obj)/vmlinux.b
- 
- OBJCOPYFLAGS += -R .empty_zero_page
- 
--LDFLAGS_piggy.o := -r --format binary --oformat $(ld-bfd) -T
-+LDFLAGS_piggy.o := -r --format binary --oformat $(ld_bfd) -T
- 
- $(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/vmlinux.bin.$(suffix_y) FORCE
- 	$(call if_changed,ld)
---- a/arch/sh/boot/romimage/Makefile
-+++ b/arch/sh/boot/romimage/Makefile
-@@ -13,7 +13,7 @@ mmcif-obj-$(CONFIG_CPU_SUBTYPE_SH7724)	:
- load-$(CONFIG_ROMIMAGE_MMCIF)		:= $(mmcif-load-y)
- obj-$(CONFIG_ROMIMAGE_MMCIF)		:= $(mmcif-obj-y)
- 
--LDFLAGS_vmlinux := --oformat $(ld-bfd) -Ttext $(load-y) -e romstart \
-+LDFLAGS_vmlinux := --oformat $(ld_bfd) -Ttext $(load-y) -e romstart \
- 		   -T $(obj)/../../kernel/vmlinux.lds
- 
- $(obj)/vmlinux: $(obj)/head.o $(obj-y) $(obj)/piggy.o FORCE
-@@ -24,7 +24,7 @@ OBJCOPYFLAGS += -j .empty_zero_page
- $(obj)/zeropage.bin: vmlinux FORCE
- 	$(call if_changed,objcopy)
- 
--LDFLAGS_piggy.o := -r --format binary --oformat $(ld-bfd) -T
-+LDFLAGS_piggy.o := -r --format binary --oformat $(ld_bfd) -T
- 
- $(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/zeropage.bin arch/sh/boot/zImage FORCE
- 	$(call if_changed,ld)

debian/patches/bugfix/x86/revert-perf-build-fix-libunwind-feature-detection-on.patch

@@ -1,22 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Fri, 25 Sep 2015 22:50:50 +0100
-Subject: Revert "perf build: Fix libunwind feature detection on 32-bit x86"
-Forwarded: no
-
-This reverts commit 05b41775e2edd69a83f592e3534930c934d4038e.
-It broke feature detection that was working just fine for us.
----
- tools/perf/Makefile.config | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/tools/perf/Makefile.config
-+++ b/tools/perf/Makefile.config
-@@ -61,7 +61,7 @@ ifeq ($(SRCARCH),x86)
-     LIBUNWIND_LIBS = -lunwind-x86_64 -lunwind -llzma
-     $(call detected,CONFIG_X86_64)
-   else
--    LIBUNWIND_LIBS = -lunwind-x86 -llzma -lunwind
-+    LIBUNWIND_LIBS = -lunwind -lunwind-x86
-   endif
- endif
- 

debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch

@@ -21,7 +21,7 @@ Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
 
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
-@@ -118,6 +118,12 @@
+@@ -122,6 +122,12 @@
  
  #include <kunit/visibility.h>
  
@@ -34,7 +34,7 @@ Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
  /*
   * Minimum number of threads to boot the kernel
   */
-@@ -2135,6 +2141,10 @@ __latent_entropy struct task_struct *cop
+@@ -1933,6 +1939,10 @@ __latent_entropy struct task_struct *cop
  	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
  		return ERR_PTR(-EINVAL);
  
@@ -45,7 +45,7 @@ Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
  	/*
  	 * Thread groups must share signals as well, and detached threads
  	 * can only be started up within the thread group.
-@@ -3283,6 +3293,12 @@ int ksys_unshare(unsigned long unshare_f
+@@ -3099,6 +3109,12 @@ int ksys_unshare(unsigned long unshare_f
  	if (unshare_flags & CLONE_NEWNS)
  		unshare_flags |= CLONE_FS;
  
@@ -60,21 +60,21 @@ Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
  		goto bad_unshare_out;
 --- a/kernel/sysctl.c
 +++ b/kernel/sysctl.c
-@@ -135,6 +135,10 @@ static enum sysctl_writes_mode sysctl_wr
+@@ -77,6 +77,10 @@ EXPORT_SYMBOL_GPL(sysctl_long_vals);
- int sysctl_legacy_va_layout;
+ static const int ngroups_max = NGROUPS_MAX;
- #endif
+ static const int cap_last_cap = CAP_LAST_CAP;
  
 +#ifdef CONFIG_USER_NS
 +extern int unprivileged_userns_clone;
 +#endif
 +
- #endif /* CONFIG_SYSCTL */
+ #ifdef CONFIG_PROC_SYSCTL
  
- /*
+ /**
-@@ -1618,6 +1622,15 @@ static struct ctl_table kern_table[] = {
+@@ -1581,6 +1585,15 @@ int proc_do_static_key(const struct ctl_
- 		.mode		= 0644,
+ }
- 		.proc_handler	= proc_dointvec,
+ 
- 	},
+ static const struct ctl_table kern_table[] = {
 +#ifdef CONFIG_USER_NS
 +	{
 +		.procname	= "unprivileged_userns_clone",

debian/patches/debian/af_802154-Disable-auto-loading-as-mitigation-against.patch

@@ -21,7 +21,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 
 --- a/net/ieee802154/socket.c
 +++ b/net/ieee802154/socket.c
-@@ -1138,4 +1138,4 @@ module_exit(af_ieee802154_remove);
+@@ -1140,4 +1140,4 @@ module_exit(af_ieee802154_remove);
  
  MODULE_LICENSE("GPL");
  MODULE_DESCRIPTION("IEEE 802.15.4 socket interface");

debian/patches/debian/android-enable-building-binder-as-module.patch

@@ -1,28 +1,19 @@
 From: Ben Hutchings <ben@decadent.org.uk>
-Date: Fri, 22 Jun 2018 17:27:00 +0100
+Date: Tue, 08 Jul 2025 13:30:55 +0200
-Subject: android: Enable building ashmem and binder as modules
+Subject: android: Enable building binder as module
 Bug-Debian: https://bugs.debian.org/901492
 
-We want to enable use of the Android ashmem and binder drivers to
+We want to enable use of the Android binder driver to support
-support Anbox, but they should not be built-in as that would waste
+Waydroid, but it should not be built-in as that would waste resources
-resources and increase security attack surface on systems that don't
+and increase security attack surface on systems that don't need it.
-need them.
 
-- Add a MODULE_LICENSE declaration to ashmem
+- Change the Makefiles to build the driver as an object with the
-- Change the Makefiles to build each driver as an object with the
+  "_linux" suffix (which is what Waydroid expects)
-  "_linux" suffix (which is what Anbox expects)
 - Change config symbol types to tristate
-
-Update:
-In upstream commit 721412ed3d titled "staging: remove ashmem" the ashmem
-driver was removed entirely. Secondary commit message:
-"The mainline replacement for ashmem is memfd, so remove the legacy
-code from drivers/staging/"
-Consequently, the ashmem part of this patch has been removed.
 ---
- drivers/android/Kconfig          | 2 +-
+ drivers/android/Kconfig        |    2 +-
- drivers/android/Makefile         | 7 ++++---
+ drivers/android/Makefile       |    7 ++++---
- drivers/android/binder_alloc.c   | 2 +-
+ drivers/android/binder_alloc.c |    2 +-
  3 files changed, 6 insertions(+), 5 deletions(-)
 
 --- a/drivers/android/Kconfig

debian/patches/debian/btrfs-warn-about-raid5-6-being-experimental-at-mount.patch

@@ -22,7 +22,7 @@ implementation went from disk-io.c to super.c; forwarded the issue]
 
 --- a/fs/btrfs/super.c
 +++ b/fs/btrfs/super.c
-@@ -766,6 +766,18 @@ static void set_device_specific_options(
+@@ -761,6 +761,18 @@ static void set_device_specific_options(
  		btrfs_set_opt(fs_info->mount_opt, SSD);
  
  	/*

debian/patches/debian/cdc_ncm-cdc_mbim-use-ncm-by-default.patch

@@ -1,27 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Subject: cdc_ncm,cdc_mbim: Use NCM by default
-Date: Sun, 31 Mar 2013 03:58:04 +0100
-Forwarded: not-needed
-
-Devices that support both NCM and MBIM modes should be kept in NCM
-mode unless there is userland support for MBIM.
-
-Set the default value of cdc_ncm.prefer_mbim to false and leave it to
-userland (modem-manager) to override this with a modprobe.conf file
-once it's ready to speak MBIM.
-
----
---- a/drivers/net/usb/cdc_ncm.c
-+++ b/drivers/net/usb/cdc_ncm.c
-@@ -54,11 +54,7 @@
- #include <linux/usb/cdc.h>
- #include <linux/usb/cdc_ncm.h>
- 
--#if IS_ENABLED(CONFIG_USB_NET_CDC_MBIM)
--static bool prefer_mbim = true;
--#else
- static bool prefer_mbim;
--#endif
- module_param(prefer_mbim, bool, 0644);
- MODULE_PARM_DESC(prefer_mbim, "Prefer MBIM setting on dual NCM/MBIM functions");
- 

debian/patches/debian/dccp-disable-auto-loading-as-mitigation-against-local-exploits.patch

@@ -1,41 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Thu, 16 Feb 2017 19:09:17 +0000
-Subject: dccp: Disable auto-loading as mitigation against local exploits
-Forwarded: not-needed
-
-We can mitigate the effect of vulnerabilities in obscure protocols by
-preventing unprivileged users from loading the modules, so that they
-are only exploitable on systems where the administrator has chosen to
-load the protocol.
-
-The 'dccp' protocol is not actively maintained or widely used.
-Therefore disable auto-loading.
-
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
----
---- a/net/dccp/ipv4.c
-+++ b/net/dccp/ipv4.c
-@@ -1098,8 +1098,8 @@ module_exit(dccp_v4_exit);
-  * values directly, Also cover the case where the protocol is not specified,
-  * i.e. net-pf-PF_INET-proto-0-type-SOCK_DCCP
-  */
--MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 33, 6);
--MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 0, 6);
-+/* MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 33, 6); */
-+/* MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 0, 6); */
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>");
- MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol");
---- a/net/dccp/ipv6.c
-+++ b/net/dccp/ipv6.c
-@@ -1174,8 +1174,8 @@ module_exit(dccp_v6_exit);
-  * values directly, Also cover the case where the protocol is not specified,
-  * i.e. net-pf-PF_INET6-proto-0-type-SOCK_DCCP
-  */
--MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 33, 6);
--MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 0, 6);
-+/* MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 33, 6); */
-+/* MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 0, 6); */
- MODULE_LICENSE("GPL");
- MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>");
- MODULE_DESCRIPTION("DCCPv6 - Datagram Congestion Controlled Protocol");

debian/patches/debian/dfsg/video-remove-nvidiafb-and-rivafb.patch

@@ -15,14 +15,13 @@ probably discontinued 10 years ago.
 ---
 --- a/drivers/video/fbdev/Kconfig
 +++ b/drivers/video/fbdev/Kconfig
-@@ -657,100 +657,6 @@ config FB_ATMEL
+@@ -658,102 +658,6 @@ config FB_ATMEL
  	help
  	  This enables support for the AT91 LCD Controller.
  
 -config FB_NVIDIA
 -	tristate "nVidia Framebuffer Support"
--	depends on FB && PCI
+-	depends on FB && PCI && HAS_IOPORT
--	select FB_BACKLIGHT if FB_NVIDIA_BACKLIGHT
 -	select FB_CFB_FILLRECT
 -	select FB_CFB_COPYAREA
 -	select FB_CFB_IMAGEBLIT
@@ -62,6 +61,8 @@ probably discontinued 10 years ago.
 -config FB_NVIDIA_BACKLIGHT
 -	bool "Support for backlight control"
 -	depends on FB_NVIDIA
+-	depends on BACKLIGHT_CLASS_DEVICE=y || BACKLIGHT_CLASS_DEVICE=FB_NVIDIA
+-	select FB_BACKLIGHT
 -	default y
 -	help
 -	  Say Y here if you want to control the backlight of your display.
@@ -69,7 +70,6 @@ probably discontinued 10 years ago.
 -config FB_RIVA
 -	tristate "nVidia Riva support"
 -	depends on FB && PCI
--	select FB_BACKLIGHT if FB_RIVA_BACKLIGHT
 -	select FB_CFB_FILLRECT
 -	select FB_CFB_COPYAREA
 -	select FB_CFB_IMAGEBLIT
@@ -109,6 +109,8 @@ probably discontinued 10 years ago.
 -config FB_RIVA_BACKLIGHT
 -	bool "Support for backlight control"
 -	depends on FB_RIVA
+-	depends on BACKLIGHT_CLASS_DEVICE=y || BACKLIGHT_CLASS_DEVICE=FB_RIVA
+-	select FB_BACKLIGHT
 -	default y
 -	help
 -	  Say Y here if you want to control the backlight of your display.

debian/patches/debian/documentation-drop-sphinx-version-check.patch

@@ -10,7 +10,7 @@ Forwarded: not-needed
 
 --- a/Documentation/Makefile
 +++ b/Documentation/Makefile
-@@ -118,7 +118,6 @@ $(YNL_RST_DIR)/%.rst: $(YNL_YAML_DIR)/%.
+@@ -119,7 +119,6 @@ $(YNL_RST_DIR)/%.rst: $(YNL_YAML_DIR)/%.
  htmldocs texinfodocs latexdocs epubdocs xmldocs: $(YNL_INDEX)
  
  htmldocs:
@@ -18,7 +18,7 @@ Forwarded: not-needed
  	@+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,html,$(var),,$(var)))
  
  # If Rust support is available and .config exists, add rustdoc generated contents.
-@@ -132,7 +131,6 @@ endif
+@@ -133,7 +132,6 @@ endif
  endif
  
  texinfodocs:
@@ -26,7 +26,7 @@ Forwarded: not-needed
  	@+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,texinfo,$(var),texinfo,$(var)))
  
  # Note: the 'info' Make target is generated by sphinx itself when
-@@ -144,7 +142,6 @@ linkcheckdocs:
+@@ -145,7 +143,6 @@ linkcheckdocs:
  	@$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,linkcheck,$(var),,$(var)))
  
  latexdocs:
@@ -34,7 +34,7 @@ Forwarded: not-needed
  	@+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,latex,$(var),latex,$(var)))
  
  ifeq ($(HAVE_PDFLATEX),0)
-@@ -157,7 +154,6 @@ else # HAVE_PDFLATEX
+@@ -158,7 +155,6 @@ else # HAVE_PDFLATEX
  
  pdfdocs: DENY_VF = XDG_CONFIG_HOME=$(FONTS_CONF_DENY_VF)
  pdfdocs: latexdocs
@@ -42,7 +42,7 @@ Forwarded: not-needed
  	$(foreach var,$(SPHINXDIRS), \
  	   $(MAKE) PDFLATEX="$(PDFLATEX)" LATEXOPTS="$(LATEXOPTS)" $(DENY_VF) -C $(BUILDDIR)/$(var)/latex || sh $(srctree)/scripts/check-variable-fonts.sh || exit; \
  	   mkdir -p $(BUILDDIR)/$(var)/pdf; \
-@@ -167,11 +163,9 @@ pdfdocs: latexdocs
+@@ -168,11 +164,9 @@ pdfdocs: latexdocs
  endif # HAVE_PDFLATEX
  
  epubdocs:

debian/patches/debian/export-symbols-needed-by-binder.patch

@@ -1,5 +1,5 @@
 From: Ben Hutchings <ben@decadent.org.uk>
-Date: Mon, 05 Aug 2024 03:26:48 +0200
+Date: Tue, 08 Jul 2025 13:32:21 +0200
 Subject: Export symbols needed by binder
 Bug-Debian: https://bugs.debian.org/901492
 
@@ -10,19 +10,21 @@ and increase security attack surface on systems that don't need it.
 Export the currently un-exported symbols it depends on.
 
 ---
- fs/file.c               | 1 +
+ fs/file.c               |    1 +
- ipc/msgutil.c           | 1 +
+ ipc/msgutil.c           |    1 +
- ipc/namespace.c         | 1 +
+ ipc/namespace.c         |    1 +
- kernel/sched/syscalls.c | 1 +
+ kernel/sched/syscalls.c |    1 +
- kernel/sched/wait.c     | 1 +
+ kernel/sched/wait.c     |    1 +
- kernel/task_work.c      | 1 +
+ kernel/task_work.c      |    1 +
- mm/memory.c             | 1 +
+ mm/list_lru.c           |    2 ++
- security/security.c     | 4 ++++
+ mm/memory.c             |    1 +
- 8 files changed, 11 insertions(+)
+ mm/mmap_lock.c          |    1 +
+ security/security.c     |    4 ++++
+ 10 files changed, 14 insertions(+)
 
 --- a/fs/file.c
 +++ b/fs/file.c
-@@ -792,6 +792,7 @@ struct file *file_close_fd(unsigned int
+@@ -858,6 +858,7 @@ struct file *file_close_fd(unsigned int
  
  	return file;
  }
@@ -42,7 +44,7 @@ Export the currently un-exported symbols it depends on.
  	struct msg_msgseg *next;
 --- a/ipc/namespace.c
 +++ b/ipc/namespace.c
-@@ -205,6 +205,7 @@ void put_ipc_ns(struct ipc_namespace *ns
+@@ -207,6 +207,7 @@ void put_ipc_ns(struct ipc_namespace *ns
  			schedule_work(&free_ipc_work);
  	}
  }
@@ -72,7 +74,7 @@ Export the currently un-exported symbols it depends on.
   * Note: we use "set_current_state()" _after_ the wait-queue add,
 --- a/kernel/task_work.c
 +++ b/kernel/task_work.c
-@@ -108,6 +108,7 @@ int task_work_add(struct task_struct *ta
+@@ -96,6 +96,7 @@ int task_work_add(struct task_struct *ta
  
  	return 0;
  }
@@ -80,19 +82,47 @@ Export the currently un-exported symbols it depends on.
  
  /**
   * task_work_cancel_match - cancel a pending work added by task_work_add()
+--- a/mm/list_lru.c
++++ b/mm/list_lru.c
+@@ -175,6 +175,7 @@ bool list_lru_add(struct list_lru *lru,
+ 	unlock_list_lru(l, false);
+ 	return false;
+ }
++EXPORT_SYMBOL_GPL(list_lru_add);
+ 
+ bool list_lru_add_obj(struct list_lru *lru, struct list_head *item)
+ {
+@@ -212,6 +213,7 @@ bool list_lru_del(struct list_lru *lru,
+ 	unlock_list_lru(l, false);
+ 	return false;
+ }
++EXPORT_SYMBOL_GPL(list_lru_del);
+ 
+ bool list_lru_del_obj(struct list_lru *lru, struct list_head *item)
+ {
 --- a/mm/memory.c
 +++ b/mm/memory.c
-@@ -1934,6 +1934,7 @@ void zap_page_range_single(struct vm_are
+@@ -2050,6 +2050,7 @@ void zap_page_range_single(struct vm_are
+ 	zap_page_range_single_batched(&tlb, vma, address, size, details);
  	tlb_finish_mmu(&tlb);
- 	hugetlb_zap_end(vma, details);
  }
 +EXPORT_SYMBOL_GPL(zap_page_range_single);
  
  /**
   * zap_vma_ptes - remove ptes mapping the vma
+--- a/mm/mmap_lock.c
++++ b/mm/mmap_lock.c
+@@ -177,6 +177,7 @@ inval:
+ 	count_vm_vma_lock_event(VMA_LOCK_ABORT);
+ 	return NULL;
+ }
++EXPORT_SYMBOL_GPL(lock_vma_under_rcu);
+ #endif /* CONFIG_PER_VMA_LOCK */
+ 
+ #ifdef CONFIG_LOCK_MM_AND_FIND_VMA
 --- a/security/security.c
 +++ b/security/security.c
-@@ -893,6 +893,7 @@ int security_binder_set_context_mgr(cons
+@@ -996,6 +996,7 @@ int security_binder_set_context_mgr(cons
  {
  	return call_int_hook(binder_set_context_mgr, mgr);
  }
@@ -100,7 +130,7 @@ Export the currently un-exported symbols it depends on.
  
  /**
   * security_binder_transaction() - Check if a binder transaction is allowed
-@@ -908,6 +909,7 @@ int security_binder_transaction(const st
+@@ -1011,6 +1012,7 @@ int security_binder_transaction(const st
  {
  	return call_int_hook(binder_transaction, from, to);
  }
@@ -108,7 +138,7 @@ Export the currently un-exported symbols it depends on.
  
  /**
   * security_binder_transfer_binder() - Check if a binder transfer is allowed
-@@ -923,6 +925,7 @@ int security_binder_transfer_binder(cons
+@@ -1026,6 +1028,7 @@ int security_binder_transfer_binder(cons
  {
  	return call_int_hook(binder_transfer_binder, from, to);
  }
@@ -116,7 +146,7 @@ Export the currently un-exported symbols it depends on.
  
  /**
   * security_binder_transfer_file() - Check if a binder file xfer is allowed
-@@ -939,6 +942,7 @@ int security_binder_transfer_file(const
+@@ -1042,6 +1045,7 @@ int security_binder_transfer_file(const
  {
  	return call_int_hook(binder_transfer_file, from, to, file);
  }

debian/patches/debian/fanotify-taint-on-use-of-fanotify_access_permissions.patch

@@ -12,7 +12,7 @@ actually used.
 ---
 --- a/fs/notify/fanotify/fanotify_user.c
 +++ b/fs/notify/fanotify/fanotify_user.c
-@@ -1752,6 +1752,14 @@ static int do_fanotify_mark(int fanotify
+@@ -1878,6 +1878,14 @@ static int do_fanotify_mark(int fanotify
  		umask = FANOTIFY_EVENT_FLAGS;
  	}
  
@@ -24,6 +24,6 @@ actually used.
 +	}
 +#endif
 +
- 	f = fdget(fanotify_fd);
+ 	CLASS(fd, f)(fanotify_fd);
- 	if (unlikely(!f.file))
+ 	if (fd_empty(f))
  		return -EBADF;

debian/patches/debian/firmware_loader-log-direct-loading-failures-as-info-for-d-i.patch

@@ -0,0 +1,37 @@
+From: Ben Hutchings <benh@debian.org>
+Subject: firmware_loader: Log direct loading failures as info for d-i
+Date: Thu, 30 May 2024 13:14:32 +0100
+Forwarded: not-needed
+
+On an installed Debian system, firmware packages will normally be
+installed automatically based on a mapping of device IDs to firmware.
+Within the Debian installer this has not yet happened and we need a
+way to detect missing firmware.
+
+Although many/most drivers log firmware loading failures, they do so
+using many different formats.  This adds a single log message to the
+firmware loader, which the installer's hw-detect package will look
+for.  The log level is set to "info" because some failures are
+expected and we do not want to confuse users with bogus error messages
+(like in bug #966218).
+
+NOTE: The log message format must not be changed without coordinating
+this with the check-missing-firmware.sh in hw-detect.
+---
+ drivers/base/firmware_loader/fallback.c |  2 +-
+ drivers/base/firmware_loader/main.c     | 17 ++++++++---------
+ 2 files changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/base/firmware_loader/main.c
++++ b/drivers/base/firmware_loader/main.c
+@@ -590,6 +590,10 @@ fw_get_filesystem_firmware(struct device
+ 	}
+ 	__putname(path);
+ 
++	if (rc)
++		dev_info(device, "firmware: failed to load %s (%d)\n",
++			 fw_priv->fw_name, rc);
++
+ 	return rc;
+ }
+ 

debian/patches/debian/fixdep-allow-overriding-hostcc-and-hostld.patch

@@ -12,13 +12,13 @@ override HOSTCC and HOSTLD for fixdep only.
 ---
 --- a/tools/build/Makefile.include
 +++ b/tools/build/Makefile.include
-@@ -2,7 +2,10 @@
+@@ -12,7 +12,10 @@ else
- build := -f $(srctree)/tools/build/Makefile.build dir=. obj
+ endif
  
  fixdep:
--	$(Q)$(MAKE) -C $(srctree)/tools/build $(OUTPUT)fixdep
+-	$(SILENT_MAKE) -C $(srctree)/tools/build $(OUTPUT)fixdep
-+	$(Q)$(MAKE) -C $(srctree)/tools/build \
++	$(SILENT_MAKE) -C $(srctree)/tools/build \
-+		$(if $(REALHOSTCC),HOSTCC=$(REALHOSTCC) HOSTCFLAGS=) \
++		$(if $(REALHOSTCC),HOSTCC=$(REALHOSTCC) KBUILD_HOSTCFLAGS=) \
 +		$(if $(REALHOSTLD),HOSTLD=$(REALHOSTLD) KBUILD_HOSTLDFLAGS=) \
 +		$(OUTPUT)fixdep
  

debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch

@@ -9,7 +9,7 @@ This reverts commit 561ec64ae67ef25cac8d72bb9c4bfc955edfd415
 
 --- a/fs/namei.c
 +++ b/fs/namei.c
-@@ -1034,8 +1034,8 @@ static inline void put_link(struct namei
+@@ -1095,8 +1095,8 @@ static inline void put_link(struct namei
  		path_put(&last->link);
  }
  

debian/patches/debian/gitignore.patch

@@ -1,55 +0,0 @@
-From: Ian Campbell <ijc@hellion.org.uk>
-Date: Thu, 17 Jan 2013 08:55:21 +0000
-Subject: Tweak gitignore for Debian pkg-kernel using git
-Forwarded: not-needed
-
-[bwh: Tweak further for pure git]
----
- .gitignore | 25 +++++++------------------
- 1 file changed, 7 insertions(+), 18 deletions(-)
-
---- a/.gitignore
-+++ b/.gitignore
-@@ -78,11 +78,6 @@ modules.order
- /rpmbuild/
- 
- #
--# Debian directory (make deb-pkg)
--#
--/debian/
--
--#
- # Snap directory (make snap-pkg)
- #
- /snap/
-@@ -99,19 +94,6 @@ modules.order
- /pacman/
- 
- #
--# We don't want to ignore the following even if they are dot-files
--#
--!.clang-format
--!.cocciconfig
--!.editorconfig
--!.get_maintainer.ignore
--!.gitattributes
--!.gitignore
--!.kunitconfig
--!.mailmap
--!.rustfmt.toml
--
--#
- # Generated include files
- #
- /include/config/
-@@ -176,3 +158,10 @@ sphinx_*/
- 
- # Rust analyzer configuration
- /rust-project.json
-+
-+#
-+# Debian packaging: ignore everything at the top level, since it isn't
-+# included in our repository
-+#
-+/*
-+!/debian/

debian/patches/debian/hamradio-disable-auto-loading-as-mitigation-against-local-exploits.patch

@@ -15,7 +15,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 ---
 --- a/net/ax25/af_ax25.c
 +++ b/net/ax25/af_ax25.c
-@@ -2066,7 +2066,7 @@ module_init(ax25_init);
+@@ -2067,7 +2067,7 @@ module_init(ax25_init);
  MODULE_AUTHOR("Jonathan Naylor G4KLX <g4klx@g4klx.demon.co.uk>");
  MODULE_DESCRIPTION("The amateur radio AX.25 link layer protocol");
  MODULE_LICENSE("GPL");
@@ -37,7 +37,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  {
 --- a/net/rose/af_rose.c
 +++ b/net/rose/af_rose.c
-@@ -1630,7 +1630,7 @@ MODULE_PARM_DESC(rose_ndevs, "number of
+@@ -1639,7 +1639,7 @@ MODULE_PARM_DESC(rose_ndevs, "number of
  MODULE_AUTHOR("Jonathan Naylor G4KLX <g4klx@g4klx.demon.co.uk>");
  MODULE_DESCRIPTION("The amateur radio ROSE network layer protocol");
  MODULE_LICENSE("GPL");

debian/patches/debian/kbuild-abort-build-if-subdirs-used.patch

@@ -16,8 +16,8 @@ The error message is based on that used in commit 0126be38d988
 ---
 --- a/Makefile
 +++ b/Makefile
-@@ -134,6 +134,18 @@ ifeq ("$(origin M)", "command line")
+@@ -138,6 +138,18 @@ ifeq ("$(origin MO)", "command line")
-   KBUILD_EXTMOD := $(M)
+   KBUILD_EXTMOD_OUTPUT := $(MO)
  endif
  
 +# Old syntax make ... SUBDIRS=$PWD should be rejected to avoid mishaps

debian/patches/debian/kbuild-look-for-module.lds-under-arch-directory-too.patch

@@ -27,27 +27,27 @@ rules.real and change Makefile.modfinal to look for it in both places.
 
 --- a/scripts/Makefile.modfinal
 +++ b/scripts/Makefile.modfinal
-@@ -30,11 +30,13 @@ quiet_cmd_cc_o_c = CC [M]  $@
+@@ -28,11 +28,13 @@ ccflags-remove-y := $(CC_FLAGS_CFI)
- %.mod.o: %.mod.c FORCE
+ .module-common.o: $(srctree)/scripts/module-common.c FORCE
- 	$(call if_changed_dep,cc_o_c)
+ 	$(call if_changed_rule,cc_o_c)
  
-+ARCH_MODULE_LDS := $(word 1,$(wildcard scripts/module.lds arch/$(SRCARCH)/module.lds))
++ARCH_MODULE_LDS := $(word 1,$(wildcard $(objtree)/scripts/module.lds $(objtree)/arch/$(SRCARCH)/module.lds))
 +
  quiet_cmd_ld_ko_o = LD [M]  $@
-       cmd_ld_ko_o +=							\
+       cmd_ld_ko_o =							\
  	$(LD) -r $(KBUILD_LDFLAGS)					\
  		$(KBUILD_LDFLAGS_MODULE) $(LDFLAGS_MODULE)		\
--		-T scripts/module.lds -o $@ $(filter %.o, $^)
+-		-T $(objtree)/scripts/module.lds -o $@ $(filter %.o, $^)
 +		-T $(ARCH_MODULE_LDS) -o $@ $(filter %.o, $^)
  
  quiet_cmd_btf_ko = BTF [M] $@
        cmd_btf_ko = 							\
-@@ -54,7 +56,7 @@ if_changed_except = $(if $(call newer_pr
+@@ -52,7 +54,7 @@ if_changed_except = $(if $(call newer_pr
  	printf '%s\n' 'savedcmd_$@ := $(make-cmd)' > $(dot-target).cmd, @:)
  
  # Re-generate module BTFs if either module's .ko or vmlinux changed
--%.ko: %.o %.mod.o scripts/module.lds $(and $(CONFIG_DEBUG_INFO_BTF_MODULES),$(KBUILD_BUILTIN),vmlinux) FORCE
+-%.ko: %.o %.mod.o .module-common.o $(objtree)/scripts/module.lds $(and $(CONFIG_DEBUG_INFO_BTF_MODULES),$(KBUILD_BUILTIN),$(objtree)/vmlinux) FORCE
-+%.ko: %.o %.mod.o $(ARCH_MODULE_LDS) $(and $(CONFIG_DEBUG_INFO_BTF_MODULES),$(KBUILD_BUILTIN),vmlinux) FORCE
++%.ko: %.o %.mod.o .module-common.o $(ARCH_MODULE_LDS) $(and $(CONFIG_DEBUG_INFO_BTF_MODULES),$(KBUILD_BUILTIN),$(objtree)/vmlinux) FORCE
- 	+$(call if_changed_except,ld_ko_o,vmlinux)
+ 	+$(call if_changed_except,ld_ko_o,$(objtree)/vmlinux)
  ifdef CONFIG_DEBUG_INFO_BTF_MODULES
  	+$(if $(newer-prereqs),$(call cmd,btf_ko))

debian/patches/debian/kernelvariables.patch

@@ -14,10 +14,12 @@ use of $(ARCH) needs to be moved after this.
 
 [bwh: Updated for 5.3: include .kernelvariables from current directory
  rather than using undefined $(obj).]
+
+[carnil: Update for 6.13: Include .kernelvariables from $(objtree).]
 ---
 --- a/Makefile
 +++ b/Makefile
-@@ -380,36 +380,6 @@ include $(srctree)/scripts/subarch.inclu
+@@ -402,36 +402,6 @@ include $(srctree)/scripts/subarch.inclu
  # Note: Some architectures assign CROSS_COMPILE in their arch/*/Makefile
  ARCH		?= $(SUBARCH)
  
@@ -54,11 +56,11 @@ use of $(ARCH) needs to be moved after this.
  KCONFIG_CONFIG	?= .config
  export KCONFIG_CONFIG
  
-@@ -524,6 +494,35 @@ RUSTFLAGS_KERNEL =
+@@ -556,6 +526,35 @@ RUSTFLAGS_KERNEL =
  AFLAGS_KERNEL	=
  LDFLAGS_vmlinux =
  
-+-include .kernelvariables
++-include $(objtree)/.kernelvariables
 +
 +# Architecture as present in compile.h
 +UTS_MACHINE 	:= $(ARCH)

debian/patches/debian/linux-perf-remove-remaining-source-filenames-from-executable.patch

@@ -15,7 +15,7 @@ to the installed location.
 ---
 --- a/tools/perf/builtin-report.c
 +++ b/tools/perf/builtin-report.c
-@@ -655,10 +655,12 @@ static int report__browse_hists(struct r
+@@ -669,10 +669,12 @@ static int report__browse_hists(struct r
  
  	path = system_path(TIPDIR);
  	if (perf_tip(&help, path) || help == NULL) {
@@ -30,10 +30,10 @@ to the installed location.
  	free(path);
 --- a/tools/perf/tests/Build
 +++ b/tools/perf/tests/Build
-@@ -73,7 +73,7 @@ perf-test-$(CONFIG_DWARF_UNWIND) += dwar
+@@ -74,7 +74,7 @@ ifeq ($(SRCARCH),$(filter $(SRCARCH),x86
+ perf-test-$(CONFIG_DWARF_UNWIND) += dwarf-unwind.o
  endif
  
- CFLAGS_attr.o         += -DBINDIR="BUILD_STR($(bindir_SQ))" -DPYTHON="BUILD_STR($(PYTHON_WORD))"
 -CFLAGS_python-use.o   += -DPYTHONPATH="BUILD_STR($(OUTPUT)python)" -DPYTHON="BUILD_STR($(PYTHON_WORD))"
 +CFLAGS_python-use.o   += -DPYTHONPATH="BUILD_STR($(perfexec_instdir_SQ)/scripts/python)" -DPYTHON="BUILD_STR($(PYTHON_WORD))"
  CFLAGS_dwarf-unwind.o += -fno-optimize-sibling-calls
@@ -41,7 +41,7 @@ to the installed location.
  perf-test-y += workloads/
 --- a/tools/perf/Build
 +++ b/tools/perf/Build
-@@ -51,7 +51,7 @@ CFLAGS_perf.o              += -DPERF_HTM
+@@ -52,7 +52,7 @@ CFLAGS_perf.o              += -DPERF_HTM
  			      -DPREFIX="BUILD_STR($(prefix_SQ))"
  CFLAGS_builtin-trace.o	   += -DSTRACE_GROUPS_DIR="BUILD_STR($(STRACE_GROUPS_DIR_SQ))"
  CFLAGS_builtin-report.o	   += -DTIPDIR="BUILD_STR($(tipdir_SQ))"

debian/patches/debian/makefile-make-compiler-version-comparison-optional.patch

@@ -20,7 +20,7 @@ is non-empty.
 ---
 --- a/Makefile
 +++ b/Makefile
-@@ -1807,7 +1807,7 @@ PHONY += prepare
+@@ -1882,7 +1882,7 @@ PHONY += prepare
  # now expand this into a simple variable to reduce the cost of shell evaluations
  prepare: CC_VERSION_TEXT := $(CC_VERSION_TEXT)
  prepare:

debian/patches/debian/tools-perf-install-python-bindings.patch

@@ -10,7 +10,7 @@ Forwarded: not-needed
 
 --- a/tools/perf/Makefile.perf
 +++ b/tools/perf/Makefile.perf
-@@ -1149,7 +1149,7 @@ install-bin: install-tools install-tests
+@@ -1158,7 +1158,7 @@ install-bin: install-tools install-tests
  install: install-bin try-install-man
  
  install-python_ext:

debian/patches/debian/tools-perf-perf-read-vdso-in-libexec.patch

@@ -4,7 +4,7 @@ Subject: linux-tools: Install perf-read-vdso{,x}32 in directory under /usr/lib
 
 --- a/tools/perf/Makefile.perf
 +++ b/tools/perf/Makefile.perf
-@@ -1073,21 +1073,21 @@ install-tools: all install-gtk
+@@ -1085,21 +1085,21 @@ install-tools: all install-gtk
  		$(LN) '$(DESTDIR_SQ)$(bindir_SQ)/perf' '$(DESTDIR_SQ)$(bindir_SQ)/trace'; \
  		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(includedir_SQ)/perf'; \
  		$(INSTALL) -m 644 include/perf/perf_dlfilter.h -t '$(DESTDIR_SQ)$(includedir_SQ)/perf'

debian/patches/debian/uname-version-timestamp.patch

@@ -13,7 +13,7 @@ $KBUILD_BUILD_TIMESTAMP.
 
 --- a/init/Makefile
 +++ b/init/Makefile
-@@ -29,7 +29,7 @@ preempt-flag-$(CONFIG_PREEMPT_DYNAMIC)	:
+@@ -30,7 +30,7 @@ preempt-flag-$(CONFIG_PREEMPT_DYNAMIC)	:
  preempt-flag-$(CONFIG_PREEMPT_RT)	:= PREEMPT_RT
  
  build-version = $(or $(KBUILD_BUILD_VERSION), $(build-version-auto))

debian/patches/debian/yama-disable-by-default.patch

@@ -19,7 +19,7 @@ Forwarded: not-needed
  
  /* describe a ptrace relationship for potential exception */
  struct ptrace_relation {
-@@ -476,7 +476,7 @@ static inline void yama_init_sysctl(void
+@@ -469,7 +469,7 @@ static inline void yama_init_sysctl(void
  
  static int __init yama_init(void)
  {

debian/patches/features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch

@@ -141,10 +141,10 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]
  
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
-@@ -766,7 +766,8 @@ extern void efi_mem_reserve(phys_addr_t
+@@ -753,7 +753,8 @@ extern int efi_mem_desc_lookup(u64 phys_
+ extern int __efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md);
+ extern void efi_mem_reserve(phys_addr_t addr, u64 size);
  extern int efi_mem_reserve_persistent(phys_addr_t addr, u64 size);
- extern void efi_initialize_iomem_resources(struct resource *code_resource,
- 		struct resource *data_resource, struct resource *bss_resource);
 -extern u64 efi_get_fdt_params(struct efi_memory_map_data *data);
 +extern u64 efi_get_fdt_params(struct efi_memory_map_data *data,
 +			      u32 *secure_boot);

debian/patches/features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch

@@ -31,7 +31,7 @@ cc: linux-efi@vger.kernel.org
 
 --- a/arch/x86/kernel/setup.c
 +++ b/arch/x86/kernel/setup.c
-@@ -1065,19 +1065,7 @@ void __init setup_arch(char **cmdline_p)
+@@ -1149,19 +1149,7 @@ void __init setup_arch(char **cmdline_p)
  	/* Allocate bigger log buffer */
  	setup_log_buf(1);
  
@@ -106,11 +106,11 @@ cc: linux-efi@vger.kernel.org
 +}
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
-@@ -877,6 +877,14 @@ static inline int efi_range_is_wc(unsign
+@@ -863,6 +863,14 @@ static inline int efi_range_is_wc(unsign
- #define EFI_MEM_ATTR		10	/* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
+ #define EFI_MEM_ATTR		9	/* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
- #define EFI_MEM_NO_SOFT_RESERVE	11	/* Is the kernel configured to ignore soft reservations? */
+ #define EFI_MEM_NO_SOFT_RESERVE	10	/* Is the kernel configured to ignore soft reservations? */
- #define EFI_PRESERVE_BS_REGIONS	12	/* Are EFI boot-services memory segments available? */
+ #define EFI_PRESERVE_BS_REGIONS	11	/* Are EFI boot-services memory segments available? */
-+#define EFI_SECURE_BOOT		13	/* Are we in Secure Boot mode? */
++#define EFI_SECURE_BOOT		12	/* Are we in Secure Boot mode? */
 +
 +enum efi_secureboot_mode {
 +	efi_secureboot_mode_unset,
@@ -121,7 +121,7 @@ cc: linux-efi@vger.kernel.org
  
  #ifdef CONFIG_EFI
  /*
-@@ -901,6 +909,7 @@ static inline bool efi_rt_services_suppo
+@@ -887,6 +895,7 @@ static inline bool efi_rt_services_suppo
  	return (efi.runtime_supported_mask & mask) == mask;
  }
  extern void efi_find_mirror(void);
@@ -129,7 +129,7 @@ cc: linux-efi@vger.kernel.org
  #else
  static inline bool efi_enabled(int feature)
  {
-@@ -920,6 +929,7 @@ static inline bool efi_rt_services_suppo
+@@ -906,6 +915,7 @@ static inline bool efi_rt_services_suppo
  }
  
  static inline void efi_find_mirror(void) {}
@@ -137,7 +137,7 @@ cc: linux-efi@vger.kernel.org
  #endif
  
  extern int efi_status_to_err(efi_status_t status);
-@@ -1138,13 +1148,6 @@ static inline bool efi_runtime_disabled(
+@@ -1124,13 +1134,6 @@ static inline bool efi_runtime_disabled(
  extern void efi_call_virt_check_flags(unsigned long flags, const void *caller);
  extern unsigned long efi_call_virt_save_flags(void);
  

debian/patches/features/all/lockdown/efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch

@@ -26,7 +26,7 @@ Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
 
 --- a/arch/x86/kernel/setup.c
 +++ b/arch/x86/kernel/setup.c
-@@ -904,6 +904,8 @@ void __init setup_arch(char **cmdline_p)
+@@ -986,6 +986,8 @@ void __init setup_arch(char **cmdline_p)
  	if (efi_enabled(EFI_BOOT))
  		efi_init();
  
@@ -35,7 +35,7 @@ Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
  	reserve_ibft_region();
  	x86_init.resources.dmi_setup();
  
-@@ -1065,8 +1067,6 @@ void __init setup_arch(char **cmdline_p)
+@@ -1149,8 +1151,6 @@ void __init setup_arch(char **cmdline_p)
  	/* Allocate bigger log buffer */
  	setup_log_buf(1);
  
@@ -67,26 +67,26 @@ Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
  		default:
 --- a/include/linux/security.h
 +++ b/include/linux/security.h
-@@ -509,6 +509,7 @@ int security_inode_getsecctx(struct inod
+@@ -573,6 +573,7 @@ int security_inode_notifysecctx(struct i
+ int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
+ int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp);
  int security_locked_down(enum lockdown_reason what);
++int lock_kernel_down(const char *where, enum lockdown_reason level);
  int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
  		      void *val, size_t val_len, u64 id, u64 flags);
-+int lock_kernel_down(const char *where, enum lockdown_reason level);
+ int security_bdev_alloc(struct block_device *bdev);
- #else /* CONFIG_SECURITY */
+@@ -1574,6 +1575,11 @@ static inline int security_locked_down(e
- 
- static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
-@@ -1483,6 +1484,11 @@ static inline int lsm_fill_user_ctx(stru
  {
- 	return -EOPNOTSUPP;
+ 	return 0;
  }
 +static inline int
 +lock_kernel_down(const char *where, enum lockdown_reason level)
 +{
 +	return -EOPNOTSUPP;
 +}
- #endif	/* CONFIG_SECURITY */
+ static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx,
- 
+ 				    u32 *uctx_len, void *val, size_t val_len,
- #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
+ 				    u64 id, u64 flags)
 --- a/security/lockdown/Kconfig
 +++ b/security/lockdown/Kconfig
 @@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTI

debian/patches/features/all/lockdown/mtd-disable-slram-and-phram-when-locked-down.patch

@@ -23,7 +23,7 @@ Cc: linux-mtd@lists.infradead.org
 
 --- a/drivers/mtd/devices/phram.c
 +++ b/drivers/mtd/devices/phram.c
-@@ -364,7 +364,11 @@ static int phram_param_call(const char *
+@@ -365,7 +365,11 @@ static int phram_param_call(const char *
  #endif
  }
  

debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch

@@ -22,9 +22,9 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 
 --- a/include/linux/perf_event.h
 +++ b/include/linux/perf_event.h
-@@ -1589,6 +1589,11 @@ int perf_cpu_time_max_percent_handler(co
+@@ -1761,6 +1761,11 @@ extern int sysctl_perf_event_sample_rate
- int perf_event_max_stack_handler(const struct ctl_table *table, int write,
+ 
- 		void *buffer, size_t *lenp, loff_t *ppos);
+ extern void perf_sample_event_took(u64 sample_len_ns);
  
 +static inline bool perf_paranoid_any(void)
 +{
@@ -36,7 +36,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  
 --- a/kernel/events/core.c
 +++ b/kernel/events/core.c
-@@ -419,8 +419,13 @@ static struct kmem_cache *perf_event_cac
+@@ -463,8 +463,13 @@ static struct kmem_cache *perf_event_cac
   *   0 - disallow raw tracepoint access for unpriv
   *   1 - disallow cpu events for unpriv
   *   2 - disallow kernel profiling for unpriv
@@ -48,9 +48,9 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  int sysctl_perf_event_paranoid __read_mostly = 2;
 +#endif
  
- /* Minimum for 512 kiB + 1 user control page */
+ /* Minimum for 512 kiB + 1 user control page. 'free' kiB per user. */
- int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
+ static int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024);
-@@ -12506,6 +12511,9 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -13382,6 +13387,9 @@ SYSCALL_DEFINE5(perf_event_open,
  	if (err)
  		return err;
  
@@ -58,13 +58,13 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 +		return -EACCES;
 +
  	/* Do we allow access to perf_event_open(2) ? */
- 	err = security_perf_event_open(&attr, PERF_SECURITY_OPEN);
+ 	err = security_perf_event_open(PERF_SECURITY_OPEN);
  	if (err)
 --- a/security/Kconfig
 +++ b/security/Kconfig
-@@ -51,6 +51,15 @@ config PROC_MEM_NO_FORCE
+@@ -72,6 +72,15 @@ config MSEAL_SYSTEM_MAPPINGS
- 
+ 	  For complete descriptions of memory sealing, please see
- endchoice
+ 	  Documentation/userspace-api/mseal.rst
  
 +config SECURITY_PERF_EVENTS_RESTRICT
 +	bool "Restrict unprivileged use of performance events"

debian/patches/features/x86/intel-iommu-add-kconfig-option-to-exclude-igpu-by-default.patch

@@ -15,7 +15,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 ---
 --- a/drivers/iommu/intel/Kconfig
 +++ b/drivers/iommu/intel/Kconfig
-@@ -57,13 +57,24 @@ config INTEL_IOMMU_SVM
+@@ -56,13 +56,24 @@ config INTEL_IOMMU_SVM
  	  to access DMA resources through process address space by
  	  means of a Process Address Space ID (PASID).
  
@@ -48,7 +48,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  	def_bool y
 --- a/drivers/iommu/intel/iommu.c
 +++ b/drivers/iommu/intel/iommu.c
-@@ -214,13 +214,13 @@ static LIST_HEAD(dmar_satc_units);
+@@ -204,13 +204,13 @@ static LIST_HEAD(dmar_satc_units);
  
  static void intel_iommu_domain_free(struct iommu_domain *domain);
  
@@ -64,7 +64,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  static int intel_iommu_superpage = 1;
  static int iommu_identity_mapping;
  static int iommu_skip_te_disable;
-@@ -259,6 +259,7 @@ static int __init intel_iommu_setup(char
+@@ -249,6 +249,7 @@ static int __init intel_iommu_setup(char
  	while (*str) {
  		if (!strncmp(str, "on", 2)) {
  			dmar_disabled = 0;

debian/patches/features/x86/intel-iommu-add-option-to-exclude-integrated-gpu-only.patch

@@ -22,7 +22,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 
 --- a/Documentation/admin-guide/kernel-parameters.txt
 +++ b/Documentation/admin-guide/kernel-parameters.txt
-@@ -2201,6 +2201,8 @@
+@@ -2306,6 +2306,8 @@
  			bypassed by not enabling DMAR with this option. In
  			this case, gfx device will use physical address for
  			DMA.
@@ -33,7 +33,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  		sp_off [Default Off]
 --- a/drivers/iommu/intel/iommu.c
 +++ b/drivers/iommu/intel/iommu.c
-@@ -36,6 +36,9 @@
+@@ -35,6 +35,9 @@
  #define CONTEXT_SIZE		VTD_PAGE_SIZE
  
  #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
@@ -43,7 +43,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  #define IS_USB_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
  #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
  #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
-@@ -217,12 +220,14 @@ int intel_iommu_sm = IS_ENABLED(CONFIG_I
+@@ -207,12 +210,14 @@ int intel_iommu_sm = IS_ENABLED(CONFIG_I
  int intel_iommu_enabled = 0;
  EXPORT_SYMBOL_GPL(intel_iommu_enabled);
  
@@ -58,7 +58,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  
  const struct iommu_ops intel_iommu_ops;
  static const struct iommu_dirty_ops intel_dirty_ops;
-@@ -262,6 +267,9 @@ static int __init intel_iommu_setup(char
+@@ -252,6 +257,9 @@ static int __init intel_iommu_setup(char
  		} else if (!strncmp(str, "igfx_off", 8)) {
  			disable_igfx_iommu = 1;
  			pr_info("Disable GFX device mapping\n");
@@ -68,7 +68,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  		} else if (!strncmp(str, "forcedac", 8)) {
  			pr_warn("intel_iommu=forcedac deprecated; use iommu.forcedac instead\n");
  			iommu_dma_forcedac = true;
-@@ -2156,6 +2164,9 @@ static int device_def_domain_type(struct
+@@ -1899,6 +1907,9 @@ static int device_def_domain_type(struct
  
  		if ((iommu_identity_mapping & IDENTMAP_AZALIA) && IS_AZALIA(pdev))
  			return IOMMU_DOMAIN_IDENTITY;
@@ -78,7 +78,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  	}
  
  	return 0;
-@@ -2456,6 +2467,9 @@ static int __init init_dmars(void)
+@@ -2189,6 +2200,9 @@ static int __init init_dmars(void)
  		iommu_set_root_entry(iommu);
  	}
  
@@ -87,4 +87,4 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 +
  	check_tylersburg_isoch();
  
- 	ret = si_domain_init(hw_pass_through);
+ 	/*

debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch

@@ -29,7 +29,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 
 --- a/Documentation/admin-guide/kernel-parameters.txt
 +++ b/Documentation/admin-guide/kernel-parameters.txt
-@@ -6578,6 +6578,10 @@
+@@ -7117,6 +7117,10 @@
  			later by a loaded module cannot be set this way.
  			Example: sysctl.vm.swappiness=40
  
@@ -42,7 +42,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  			Ignore sysrq setting - this boot parameter will
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
-@@ -3066,6 +3066,14 @@ config COMPAT_32
+@@ -3150,6 +3150,14 @@ config COMPAT_32
  	select HAVE_UID16
  	select OLD_SIGSUSPEND3
  
@@ -57,9 +57,70 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  config COMPAT
  	def_bool y
  	depends on IA32_EMULATION || X86_X32_ABI
---- a/arch/x86/entry/common.c
+--- a/arch/x86/include/asm/elf.h
-+++ b/arch/x86/entry/common.c
++++ b/arch/x86/include/asm/elf.h
-@@ -64,7 +64,7 @@ static __always_inline bool do_syscall_x
+@@ -12,6 +12,9 @@
+ #include <asm/user.h>
+ #include <asm/auxvec.h>
+ #include <asm/fsgsbase.h>
++#ifndef COMPILE_OFFSETS /* avoid a circular dependency on asm-offsets.h */
++#include <asm/syscall.h>
++#endif
+ 
+ typedef unsigned long elf_greg_t;
+ 
+@@ -148,7 +151,8 @@ do {						\
+ 
+ #define compat_elf_check_arch(x)					\
+ 	((elf_check_arch_ia32(x) && ia32_enabled_verbose()) ||		\
+-	 (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64))
++	 (IS_ENABLED(CONFIG_X86_X32_ABI) && x32_enabled &&		\
++	  (x)->e_machine == EM_X86_64))
+ 
+ static inline void elf_common_init(struct thread_struct *t,
+ 				   struct pt_regs *regs, const u16 ds)
+--- a/arch/x86/include/asm/syscall.h
++++ b/arch/x86/include/asm/syscall.h
+@@ -13,6 +13,7 @@
+ #include <uapi/linux/audit.h>
+ #include <linux/sched.h>
+ #include <linux/err.h>
++#include <linux/jump_label.h>
+ #include <asm/thread_info.h>	/* for TS_COMPAT */
+ #include <asm/unistd.h>
+ 
+@@ -28,6 +29,18 @@ extern long ia32_sys_call(const struct p
+ extern long x32_sys_call(const struct pt_regs *, unsigned int nr);
+ extern long x64_sys_call(const struct pt_regs *, unsigned int nr);
+ 
++#if defined(CONFIG_X86_X32_ABI)
++#if defined(CONFIG_X86_X32_DISABLED)
++DECLARE_STATIC_KEY_FALSE(x32_enabled_skey);
++#define x32_enabled static_branch_unlikely(&x32_enabled_skey)
++#else
++DECLARE_STATIC_KEY_TRUE(x32_enabled_skey);
++#define x32_enabled static_branch_likely(&x32_enabled_skey)
++#endif
++#else
++#define x32_enabled 0
++#endif
++
+ /*
+  * Only the low 32 bits of orig_ax are meaningful, so we return int.
+  * This importantly ignores the high bits on 64-bit, so comparisons
+--- a/arch/x86/entry/syscall_64.c
++++ b/arch/x86/entry/syscall_64.c
+@@ -7,6 +7,9 @@
+ #include <linux/syscalls.h>
+ #include <linux/entry-common.h>
+ #include <linux/nospec.h>
++#include <linux/moduleparam.h>
++#undef MODULE_PARAM_PREFIX
++#define MODULE_PARAM_PREFIX "syscall."
+ #include <asm/syscall.h>
+ 
+ #define __SYSCALL(nr, sym) extern long __x64_##sym(const struct pt_regs *);
+@@ -75,7 +78,7 @@ static __always_inline bool do_syscall_x
  	 */
  	unsigned int xnr = nr - __X32_SYSCALL_BIT;
  
@@ -68,23 +129,12 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  		xnr = array_index_nospec(xnr, X32_NR_syscalls);
  		regs->ax = x32_sys_call(regs, xnr);
  		return true;
---- a/arch/x86/entry/syscall_x32.c
+@@ -139,3 +142,48 @@ __visible noinstr bool do_syscall_64(str
-+++ b/arch/x86/entry/syscall_x32.c
+ 	/* Use SYSRET to exit to userspace */
-@@ -4,6 +4,9 @@
+ 	return true;
- #include <linux/linkage.h>
+ }
- #include <linux/sys.h>
- #include <linux/cache.h>
-+#include <linux/moduleparam.h>
-+#undef MODULE_PARAM_PREFIX
-+#define MODULE_PARAM_PREFIX "syscall."
- #include <linux/syscalls.h>
- #include <asm/syscall.h>
- 
-@@ -23,3 +26,46 @@ long x32_sys_call(const struct pt_regs *
- 	default: return __x64_sys_ni_syscall(regs);
- 	}
- };
 +
++#ifdef CONFIG_X86_X32_ABI
 +/* Maybe enable x32 syscalls */
 +
 +#if defined(CONFIG_X86_X32_DISABLED)
@@ -127,54 +177,4 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 +};
 +
 +arch_param_cb(x32, &x32_param_ops, NULL, 0444);
---- a/arch/x86/include/asm/elf.h
-+++ b/arch/x86/include/asm/elf.h
-@@ -12,6 +12,9 @@
- #include <asm/user.h>
- #include <asm/auxvec.h>
- #include <asm/fsgsbase.h>
-+#ifndef COMPILE_OFFSETS /* avoid a circular dependency on asm-offsets.h */
-+#include <asm/syscall.h>
 +#endif
- 
- typedef unsigned long elf_greg_t;
- 
-@@ -151,7 +154,8 @@ do {						\
- 
- #define compat_elf_check_arch(x)					\
- 	((elf_check_arch_ia32(x) && ia32_enabled_verbose()) ||		\
--	 (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64))
-+	 (IS_ENABLED(CONFIG_X86_X32_ABI) && x32_enabled &&		\
-+	  (x)->e_machine == EM_X86_64))
- 
- static inline void elf_common_init(struct thread_struct *t,
- 				   struct pt_regs *regs, const u16 ds)
---- a/arch/x86/include/asm/syscall.h
-+++ b/arch/x86/include/asm/syscall.h
-@@ -13,6 +13,7 @@
- #include <uapi/linux/audit.h>
- #include <linux/sched.h>
- #include <linux/err.h>
-+#include <linux/jump_label.h>
- #include <asm/thread_info.h>	/* for TS_COMPAT */
- #include <asm/unistd.h>
- 
-@@ -28,6 +29,18 @@ extern long ia32_sys_call(const struct p
- extern long x32_sys_call(const struct pt_regs *, unsigned int nr);
- extern long x64_sys_call(const struct pt_regs *, unsigned int nr);
- 
-+#if defined(CONFIG_X86_X32_ABI)
-+#if defined(CONFIG_X86_X32_DISABLED)
-+DECLARE_STATIC_KEY_FALSE(x32_enabled_skey);
-+#define x32_enabled static_branch_unlikely(&x32_enabled_skey)
-+#else
-+DECLARE_STATIC_KEY_TRUE(x32_enabled_skey);
-+#define x32_enabled static_branch_likely(&x32_enabled_skey)
-+#endif
-+#else
-+#define x32_enabled 0
-+#endif
-+
- /*
-  * Only the low 32 bits of orig_ax are meaningful, so we return int.
-  * This importantly ignores the high bits on 64-bit, so comparisons

debian/patches/krd/0001-Revert-objtool-dont-fail-the-kernel-build-on-fatal-errors.patch

@@ -1,52 +0,0 @@
-this reverts following commit:
-
-    From: Josh Poimboeuf <jpoimboe@redhat.com>
-    Date: Thu, 14 Jan 2021 16:32:42 -0600
-    Subject: objtool: Don't fail the kernel build on fatal errors
-
-    [ Upstream commit 655cf86548a3938538642a6df27dd359e13c86bd ]
-
-    This is basically a revert of commit 644592d32837 ("objtool: Fail the
-    kernel build on fatal errors").
-
-    That change turned out to be more trouble than it's worth.  Failing the
-    build is an extreme measure which sometimes gets too much attention and
-    blocks CI build testing.
-
-    These fatal-type warnings aren't yet as rare as we'd hope, due to the
-    ever-increasing matrix of supported toolchains/plugins and their
-    fast-changing nature as of late.
-
-    Also, there are more people (and bots) looking for objtool warnings than
-    ever before, so even non-fatal warnings aren't likely to be ignored for
-    long.
-
-    Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
-    Reviewed-by: Miroslav Benes <mbenes@suse.cz>
-    Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
-    Reviewed-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
-    Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
-    Signed-off-by: Sasha Levin <sashal@kernel.org>
-
---- a/tools/objtool/check.c
-+++ b/tools/objtool/check.c
-@@ -4872,10 +4872,14 @@ int check(struct objtool_file *file)
- 	}
- 
- out:
--	/*
--	 *  For now, don't fail the kernel build on fatal warnings.  These
--	 *  errors are still fairly common due to the growing matrix of
--	 *  supported toolchains and their recent pace of change.
--	 */
-+	if (ret < 0) {
-+		/*
-+		 *  Fatal error.  The binary is corrupt or otherwise broken in
-+		 *  some way, or objtool itself is broken.  Fail the kernel
-+		 *  build.
-+		 */
-+		return ret;
-+	}
-+
- 	return 0;
- }

debian/patches/krd/0002-local-ports.patch

@@ -1,6 +1,6 @@
 --- a/net/ipv4/af_inet.c
 +++ b/net/ipv4/af_inet.c
-@@ -1802,7 +1802,7 @@ static __net_init int inet_init_net(stru
+@@ -1787,7 +1787,7 @@ static __net_init int inet_init_net(stru
  	/*
  	 * Set defaults for local port range
  	 */

debian/patches/krd/0003-bridge-group_fwd_mask.patch

@@ -1,9 +1,9 @@
 --- a/net/bridge/br_input.c
 +++ b/net/bridge/br_input.c
-@@ -374,7 +374,11 @@ static rx_handler_result_t br_handle_fra
+@@ -384,7 +384,11 @@ static rx_handler_result_t br_handle_fra
- 			return RX_HANDLER_PASS;
  
  		case 0x01:	/* IEEE MAC (Pause) */
+ 			reason = SKB_DROP_REASON_MAC_IEEE_MAC_CONTROL;
 -			goto drop;
 +			fwd_mask |= p->br->group_fwd_mask;
 +			if (fwd_mask & (1u << dest[5]))

debian/patches/krd/0004-certs-genkey.patch

@@ -0,0 +1,11 @@
+--- a/certs/Makefile
++++ b/certs/Makefile
+@@ -47,7 +47,7 @@ keytype-$(CONFIG_MODULE_SIG_KEY_TYPE_ECD
+ quiet_cmd_gen_key = GENKEY  $@
+       cmd_gen_key = openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
+ 		-batch -x509 -config $< \
+-		-outform PEM -out $@ -keyout $@ $(keytype-y) 2>&1
++		-outform PEM -out $@ -keyout $@ $(keytype-y) 2>/dev/null
+ 
+ $(obj)/signing_key.pem: $(obj)/x509.genkey FORCE
+ 	$(call if_changed,gen_key)

debian/patches/krd/1001-Revert-perf-x86-rapl-Fix-the-energy-pkg-event-for-AMD-CPUs.patch

@@ -1,144 +0,0 @@
-this reverts following commit:
-
-    From: Dhananjay Ugwekar <Dhananjay.Ugwekar@amd.com>
-    Date: Tue, 30 Jul 2024 04:49:18 +0000
-    Subject: perf/x86/rapl: Fix the energy-pkg event for AMD CPUs
-
-    commit 8d72eba1cf8cecd76a2b4c1dd7673c2dc775f514 upstream.
-
-    After commit:
-
-    63edbaa48a57 ("x86/cpu/topology: Add support for the AMD 0x80000026 leaf")
-
-    ... on AMD processors that support extended CPUID leaf 0x80000026, the
-    topology_die_cpumask() and topology_logical_die_id() macros no longer
-    return the package cpumask and package ID, instead they return the CCD
-    (Core Complex Die) mask and ID respectively.
-
-    This leads to the energy-pkg event scope to be modified to CCD instead of package.
-
-    So, change the PMU scope for AMD and Hygon back to package.
-
-    On a 12 CCD 1 Package AMD Zen4 Genoa machine:
-
-    Before:
-
-    $ cat /sys/devices/power/cpumask
-    0,8,16,24,32,40,48,56,64,72,80,88.
-
-    The expected cpumask here is supposed to be just "0", as it is a package
-    scope event, only one CPU will be collecting the event for all the CPUs in
-    the package.
-
-    After:
-
-    $ cat /sys/devices/power/cpumask
-    0
-
-    [ mingo: Cleaned up the changelog ]
-
-    Signed-off-by: Dhananjay Ugwekar <Dhananjay.Ugwekar@amd.com>
-    Signed-off-by: Ingo Molnar <mingo@kernel.org>
-    Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
-    Link: https://lore.kernel.org/r/20240904100934.3260-1-Dhananjay.Ugwekar@amd.com
-    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
---- a/arch/x86/events/rapl.c
-+++ b/arch/x86/events/rapl.c
-@@ -103,19 +103,6 @@ static struct perf_pmu_events_attr event
- 	.event_str	= str,							\
- };
- 
--/*
-- * RAPL Package energy counter scope:
-- * 1. AMD/HYGON platforms have a per-PKG package energy counter
-- * 2. For Intel platforms
-- *	2.1. CLX-AP is multi-die and its RAPL MSRs are die-scope
-- *	2.2. Other Intel platforms are single die systems so the scope can be
-- *	     considered as either pkg-scope or die-scope, and we are considering
-- *	     them as die-scope.
-- */
--#define rapl_pmu_is_pkg_scope()				\
--	(boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||	\
--	 boot_cpu_data.x86_vendor == X86_VENDOR_HYGON)
--
- struct rapl_pmu {
- 	raw_spinlock_t		lock;
- 	int			n_active;
-@@ -153,25 +140,9 @@ static unsigned int rapl_cntr_mask;
- static u64 rapl_timer_ms;
- static struct perf_msr *rapl_msrs;
- 
--/*
-- * Helper functions to get the correct topology macros according to the
-- * RAPL PMU scope.
-- */
--static inline unsigned int get_rapl_pmu_idx(int cpu)
--{
--	return rapl_pmu_is_pkg_scope() ? topology_logical_package_id(cpu) :
--					 topology_logical_die_id(cpu);
--}
--
--static inline const struct cpumask *get_rapl_pmu_cpumask(int cpu)
--{
--	return rapl_pmu_is_pkg_scope() ? topology_core_cpumask(cpu) :
--					 topology_die_cpumask(cpu);
--}
--
- static inline struct rapl_pmu *cpu_to_rapl_pmu(unsigned int cpu)
- {
--	unsigned int rapl_pmu_idx = get_rapl_pmu_idx(cpu);
-+	unsigned int rapl_pmu_idx = topology_logical_die_id(cpu);
- 
- 	/*
- 	 * The unsigned check also catches the '-1' return value for non
-@@ -581,7 +552,7 @@ static int rapl_cpu_offline(unsigned int
- 
- 	pmu->cpu = -1;
- 	/* Find a new cpu to collect rapl events */
--	target = cpumask_any_but(get_rapl_pmu_cpumask(cpu), cpu);
-+	target = cpumask_any_but(topology_die_cpumask(cpu), cpu);
- 
- 	/* Migrate rapl events to the new target */
- 	if (target < nr_cpu_ids) {
-@@ -594,11 +565,6 @@ static int rapl_cpu_offline(unsigned int
- 
- static int rapl_cpu_online(unsigned int cpu)
- {
--	s32 rapl_pmu_idx = get_rapl_pmu_idx(cpu);
--	if (rapl_pmu_idx < 0) {
--		pr_err("topology_logical_(package/die)_id() returned a negative value");
--		return -EINVAL;
--	}
- 	struct rapl_pmu *pmu = cpu_to_rapl_pmu(cpu);
- 	int target;
- 
-@@ -613,14 +579,14 @@ static int rapl_cpu_online(unsigned int
- 		pmu->timer_interval = ms_to_ktime(rapl_timer_ms);
- 		rapl_hrtimer_init(pmu);
- 
--		rapl_pmus->pmus[rapl_pmu_idx] = pmu;
-+		rapl_pmus->pmus[topology_logical_die_id(cpu)] = pmu;
- 	}
- 
- 	/*
- 	 * Check if there is an online cpu in the package which collects rapl
- 	 * events already.
- 	 */
--	target = cpumask_any_and(&rapl_cpu_mask, get_rapl_pmu_cpumask(cpu));
-+	target = cpumask_any_and(&rapl_cpu_mask, topology_die_cpumask(cpu));
- 	if (target < nr_cpu_ids)
- 		return 0;
- 
-@@ -709,10 +675,7 @@ static const struct attribute_group *rap
- 
- static int __init init_rapl_pmus(void)
- {
--	int nr_rapl_pmu = topology_max_packages();
--
--	if (!rapl_pmu_is_pkg_scope())
--		nr_rapl_pmu *= topology_max_dies_per_package();
-+	int nr_rapl_pmu = topology_max_packages() * topology_max_dies_per_package();
- 
- 	rapl_pmus = kzalloc(struct_size(rapl_pmus, pmus, nr_rapl_pmu), GFP_KERNEL);
- 	if (!rapl_pmus)

debian/patches/misc-bbr3/0001-net-tcp_bbr-broaden-app-limited-rate-sample-detectio.patch

@@ -1,52 +0,0 @@
-From ce1cd7869a208112a8728d1fe9e373f78a2e4a6e Mon Sep 17 00:00:00 2001
-From: Neal Cardwell <ncardwell@google.com>
-Date: Tue, 11 Jun 2019 12:26:55 -0400
-Subject: [PATCH 01/19] net-tcp_bbr: broaden app-limited rate sample detection
-
-This commit is a bug fix for the Linux TCP app-limited
-(application-limited) logic that is used for collecting rate
-(bandwidth) samples.
-
-Previously the app-limited logic only looked for "bubbles" of
-silence in between application writes, by checking at the start
-of each sendmsg. But "bubbles" of silence can also happen before
-retransmits: e.g. bubbles can happen between an application write
-and a retransmit, or between two retransmits.
-
-Retransmits are triggered by ACKs or timers. So this commit checks
-for bubbles of app-limited silence upon ACKs or timers.
-
-Why does this commit check for app-limited state at the start of
-ACKs and timer handling? Because at that point we know whether
-inflight was fully using the cwnd.  During processing the ACK or
-timer event we often change the cwnd; after changing the cwnd we
-can't know whether inflight was fully using the old cwnd.
-
-Origin-9xx-SHA1: 3fe9b53291e018407780fb8c356adb5666722cbc
-Change-Id: I37221506f5166877c2b110753d39bb0757985e68
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- net/ipv4/tcp_input.c | 1 +
- net/ipv4/tcp_timer.c | 1 +
- 2 files changed, 2 insertions(+)
-
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -3961,6 +3961,7 @@ static int tcp_ack(struct sock *sk, cons
- 
- 	prior_fack = tcp_is_sack(tp) ? tcp_highest_sack_seq(tp) : tp->snd_una;
- 	rs.prior_in_flight = tcp_packets_in_flight(tp);
-+	tcp_rate_check_app_limited(sk);
- 
- 	/* ts_recent update must be made after we are sure that the packet
- 	 * is in window.
---- a/net/ipv4/tcp_timer.c
-+++ b/net/ipv4/tcp_timer.c
-@@ -689,6 +689,7 @@ void tcp_write_timer_handler(struct sock
- 		return;
- 	}
- 
-+	tcp_rate_check_app_limited(sk);
- 	tcp_mstamp_refresh(tcp_sk(sk));
- 	event = icsk->icsk_pending;
- 

debian/patches/misc-bbr3/0002-net-tcp_bbr-v2-shrink-delivered_mstamp-first_tx_msta.patch

@@ -1,74 +0,0 @@
-From b32715fbe2ab96d1060ec37bb9c03feedf366494 Mon Sep 17 00:00:00 2001
-From: Neal Cardwell <ncardwell@google.com>
-Date: Sun, 24 Jun 2018 21:55:59 -0400
-Subject: [PATCH 02/19] net-tcp_bbr: v2: shrink delivered_mstamp,
- first_tx_mstamp to u32 to free up 8 bytes
-
-Free up some space for tracking inflight and losses for each
-bw sample, in upcoming commits.
-
-These timestamps are in microseconds, and are now stored in 32
-bits. So they can only hold time intervals up to roughly 2^12 = 4096
-seconds.  But Linux TCP RTT and RTO tracking has the same 32-bit
-microsecond implementation approach and resulting deployment
-limitations. So this is not introducing a new limit. And these should
-not be a limitation for the foreseeable future.
-
-Effort: net-tcp_bbr
-Origin-9xx-SHA1: 238a7e6b5d51625fef1ce7769826a7b21b02ae55
-Change-Id: I3b779603797263b52a61ad57c565eb91fe42680c
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/net/tcp.h   | 9 +++++++--
- net/ipv4/tcp_rate.c | 7 ++++---
- 2 files changed, 11 insertions(+), 5 deletions(-)
-
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -884,6 +884,11 @@ static inline u32 tcp_stamp_us_delta(u64
- 	return max_t(s64, t1 - t0, 0);
- }
- 
-+static inline u32 tcp_stamp32_us_delta(u32 t1, u32 t0)
-+{
-+	return max_t(s32, t1 - t0, 0);
-+}
-+
- /* provide the departure time in us unit */
- static inline u64 tcp_skb_timestamp_us(const struct sk_buff *skb)
- {
-@@ -973,9 +978,9 @@ struct tcp_skb_cb {
- 			/* pkts S/ACKed so far upon tx of skb, incl retrans: */
- 			__u32 delivered;
- 			/* start of send pipeline phase */
--			u64 first_tx_mstamp;
-+			u32 first_tx_mstamp;
- 			/* when we reached the "delivered" count */
--			u64 delivered_mstamp;
-+			u32 delivered_mstamp;
- 		} tx;   /* only used for outgoing skbs */
- 		union {
- 			struct inet_skb_parm	h4;
---- a/net/ipv4/tcp_rate.c
-+++ b/net/ipv4/tcp_rate.c
-@@ -101,8 +101,9 @@ void tcp_rate_skb_delivered(struct sock
- 		/* Record send time of most recently ACKed packet: */
- 		tp->first_tx_mstamp  = tx_tstamp;
- 		/* Find the duration of the "send phase" of this window: */
--		rs->interval_us = tcp_stamp_us_delta(tp->first_tx_mstamp,
--						     scb->tx.first_tx_mstamp);
-+		rs->interval_us      = tcp_stamp32_us_delta(
-+						tp->first_tx_mstamp,
-+						scb->tx.first_tx_mstamp);
- 
- 	}
- 	/* Mark off the skb delivered once it's sacked to avoid being
-@@ -155,7 +156,7 @@ void tcp_rate_gen(struct sock *sk, u32 d
- 	 * longer phase.
- 	 */
- 	snd_us = rs->interval_us;				/* send phase */
--	ack_us = tcp_stamp_us_delta(tp->tcp_mstamp,
-+	ack_us = tcp_stamp32_us_delta(tp->tcp_mstamp,
- 				    rs->prior_mstamp); /* ack phase */
- 	rs->interval_us = max(snd_us, ack_us);
- 

debian/patches/misc-bbr3/0003-net-tcp_bbr-v2-snapshot-packets-in-flight-at-transmi.patch

@@ -1,109 +0,0 @@
-From 25856231832186fe13189b986cc0e91860c18201 Mon Sep 17 00:00:00 2001
-From: Neal Cardwell <ncardwell@google.com>
-Date: Sat, 5 Aug 2017 11:49:50 -0400
-Subject: [PATCH 03/19] net-tcp_bbr: v2: snapshot packets in flight at transmit
- time and pass in rate_sample
-
-CC algorithms may want to snapshot the number of packets in flight at
-transmit time and pass in rate_sample, to understand the relationship
-between inflight and losses or ECN signals, to try to find the highest
-inflight value that has acceptable levels of loss/ECN marking.
-
-We split out the code to set an skb's tx.in_flight field into its own
-function, so that this code can be used for the TCP_REPAIR "fake send"
-code path that inserts skbs into the rtx queue without sending them.
-
-Effort: net-tcp_bbr
-Origin-9xx-SHA1: b3eb4f2d20efab4ca001f32c9294739036c493ea
-Origin-9xx-SHA1: e880fc907d06ea7354333f60f712748ebce9497b
-Origin-9xx-SHA1: 330f825a08a6fe92cef74d799cc468864c479f63
-Change-Id: I7314047d0ff14dd261a04b1969a46dc658c8836a
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/net/tcp.h     |  6 ++++++
- net/ipv4/tcp_output.c |  1 +
- net/ipv4/tcp_rate.c   | 20 ++++++++++++++++++++
- 3 files changed, 27 insertions(+)
-
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -981,6 +981,10 @@ struct tcp_skb_cb {
- 			u32 first_tx_mstamp;
- 			/* when we reached the "delivered" count */
- 			u32 delivered_mstamp;
-+#define TCPCB_IN_FLIGHT_BITS 20
-+#define TCPCB_IN_FLIGHT_MAX ((1U << TCPCB_IN_FLIGHT_BITS) - 1)
-+			u32 in_flight:20,   /* packets in flight at transmit */
-+			    unused2:12;
- 		} tx;   /* only used for outgoing skbs */
- 		union {
- 			struct inet_skb_parm	h4;
-@@ -1136,6 +1140,7 @@ struct rate_sample {
- 	u64  prior_mstamp; /* starting timestamp for interval */
- 	u32  prior_delivered;	/* tp->delivered at "prior_mstamp" */
- 	u32  prior_delivered_ce;/* tp->delivered_ce at "prior_mstamp" */
-+	u32 tx_in_flight;	/* packets in flight at starting timestamp */
- 	s32  delivered;		/* number of packets delivered over interval */
- 	s32  delivered_ce;	/* number of packets delivered w/ CE marks*/
- 	long interval_us;	/* time for tp->delivered to incr "delivered" */
-@@ -1258,6 +1263,7 @@ static inline void tcp_ca_event(struct s
- void tcp_set_ca_state(struct sock *sk, const u8 ca_state);
- 
- /* From tcp_rate.c */
-+void tcp_set_tx_in_flight(struct sock *sk, struct sk_buff *skb);
- void tcp_rate_skb_sent(struct sock *sk, struct sk_buff *skb);
- void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb,
- 			    struct rate_sample *rs);
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -2765,6 +2765,7 @@ static bool tcp_write_xmit(struct sock *
- 			skb_set_delivery_time(skb, tp->tcp_wstamp_ns, SKB_CLOCK_MONOTONIC);
- 			list_move_tail(&skb->tcp_tsorted_anchor, &tp->tsorted_sent_queue);
- 			tcp_init_tso_segs(skb, mss_now);
-+			tcp_set_tx_in_flight(sk, skb);
- 			goto repair; /* Skip network transmission */
- 		}
- 
---- a/net/ipv4/tcp_rate.c
-+++ b/net/ipv4/tcp_rate.c
-@@ -34,6 +34,24 @@
-  * ready to send in the write queue.
-  */
- 
-+void tcp_set_tx_in_flight(struct sock *sk, struct sk_buff *skb)
-+{
-+	struct tcp_sock *tp = tcp_sk(sk);
-+	u32 in_flight;
-+
-+	/* Check, sanitize, and record packets in flight after skb was sent. */
-+	in_flight = tcp_packets_in_flight(tp) + tcp_skb_pcount(skb);
-+	if (WARN_ONCE(in_flight > TCPCB_IN_FLIGHT_MAX,
-+		      "insane in_flight %u cc %s mss %u "
-+		      "cwnd %u pif %u %u %u %u\n",
-+		      in_flight, inet_csk(sk)->icsk_ca_ops->name,
-+		      tp->mss_cache, tp->snd_cwnd,
-+		      tp->packets_out, tp->retrans_out,
-+		      tp->sacked_out, tp->lost_out))
-+		in_flight = TCPCB_IN_FLIGHT_MAX;
-+	TCP_SKB_CB(skb)->tx.in_flight = in_flight;
-+}
-+
- /* Snapshot the current delivery information in the skb, to generate
-  * a rate sample later when the skb is (s)acked in tcp_rate_skb_delivered().
-  */
-@@ -67,6 +85,7 @@ void tcp_rate_skb_sent(struct sock *sk,
- 	TCP_SKB_CB(skb)->tx.delivered		= tp->delivered;
- 	TCP_SKB_CB(skb)->tx.delivered_ce	= tp->delivered_ce;
- 	TCP_SKB_CB(skb)->tx.is_app_limited	= tp->app_limited ? 1 : 0;
-+	tcp_set_tx_in_flight(sk, skb);
- }
- 
- /* When an skb is sacked or acked, we fill in the rate sample with the (prior)
-@@ -96,6 +115,7 @@ void tcp_rate_skb_delivered(struct sock
- 		rs->prior_mstamp     = scb->tx.delivered_mstamp;
- 		rs->is_app_limited   = scb->tx.is_app_limited;
- 		rs->is_retrans	     = scb->sacked & TCPCB_RETRANS;
-+		rs->tx_in_flight     = scb->tx.in_flight;
- 		rs->last_end_seq     = scb->end_seq;
- 
- 		/* Record send time of most recently ACKed packet: */

debian/patches/misc-bbr3/0004-net-tcp_bbr-v2-count-packets-lost-over-TCP-rate-samp.patch

@@ -1,70 +0,0 @@
-From b1772710e8b5b98c09e96d4f1af620cd938fddf7 Mon Sep 17 00:00:00 2001
-From: Neal Cardwell <ncardwell@google.com>
-Date: Thu, 12 Oct 2017 23:44:27 -0400
-Subject: [PATCH 04/19] net-tcp_bbr: v2: count packets lost over TCP rate
- sampling interval
-
-For understanding the relationship between inflight and packet loss
-signals, to try to find the highest inflight value that has acceptable
-levels of packet losses.
-
-Effort: net-tcp_bbr
-Origin-9xx-SHA1: 4527e26b2bd7756a88b5b9ef1ada3da33dd609ab
-Change-Id: I594c2500868d9c530770e7ddd68ffc87c57f4fd5
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/net/tcp.h   | 5 ++++-
- net/ipv4/tcp_rate.c | 3 +++
- 2 files changed, 7 insertions(+), 1 deletion(-)
-
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -985,6 +985,7 @@ struct tcp_skb_cb {
- #define TCPCB_IN_FLIGHT_MAX ((1U << TCPCB_IN_FLIGHT_BITS) - 1)
- 			u32 in_flight:20,   /* packets in flight at transmit */
- 			    unused2:12;
-+			u32 lost;	/* packets lost so far upon tx of skb */
- 		} tx;   /* only used for outgoing skbs */
- 		union {
- 			struct inet_skb_parm	h4;
-@@ -1138,11 +1139,13 @@ struct ack_sample {
-  */
- struct rate_sample {
- 	u64  prior_mstamp; /* starting timestamp for interval */
-+	u32  prior_lost;	/* tp->lost at "prior_mstamp" */
- 	u32  prior_delivered;	/* tp->delivered at "prior_mstamp" */
- 	u32  prior_delivered_ce;/* tp->delivered_ce at "prior_mstamp" */
- 	u32 tx_in_flight;	/* packets in flight at starting timestamp */
-+	s32  lost;		/* number of packets lost over interval */
- 	s32  delivered;		/* number of packets delivered over interval */
--	s32  delivered_ce;	/* number of packets delivered w/ CE marks*/
-+	s32  delivered_ce;	/* packets delivered w/ CE mark over interval */
- 	long interval_us;	/* time for tp->delivered to incr "delivered" */
- 	u32 snd_interval_us;	/* snd interval for delivered packets */
- 	u32 rcv_interval_us;	/* rcv interval for delivered packets */
---- a/net/ipv4/tcp_rate.c
-+++ b/net/ipv4/tcp_rate.c
-@@ -84,6 +84,7 @@ void tcp_rate_skb_sent(struct sock *sk,
- 	TCP_SKB_CB(skb)->tx.delivered_mstamp	= tp->delivered_mstamp;
- 	TCP_SKB_CB(skb)->tx.delivered		= tp->delivered;
- 	TCP_SKB_CB(skb)->tx.delivered_ce	= tp->delivered_ce;
-+	TCP_SKB_CB(skb)->tx.lost		= tp->lost;
- 	TCP_SKB_CB(skb)->tx.is_app_limited	= tp->app_limited ? 1 : 0;
- 	tcp_set_tx_in_flight(sk, skb);
- }
-@@ -110,6 +111,7 @@ void tcp_rate_skb_delivered(struct sock
- 	if (!rs->prior_delivered ||
- 	    tcp_skb_sent_after(tx_tstamp, tp->first_tx_mstamp,
- 			       scb->end_seq, rs->last_end_seq)) {
-+		rs->prior_lost	     = scb->tx.lost;
- 		rs->prior_delivered_ce  = scb->tx.delivered_ce;
- 		rs->prior_delivered  = scb->tx.delivered;
- 		rs->prior_mstamp     = scb->tx.delivered_mstamp;
-@@ -165,6 +167,7 @@ void tcp_rate_gen(struct sock *sk, u32 d
- 		return;
- 	}
- 	rs->delivered   = tp->delivered - rs->prior_delivered;
-+	rs->lost        = tp->lost - rs->prior_lost;
- 
- 	rs->delivered_ce = tp->delivered_ce - rs->prior_delivered_ce;
- 	/* delivered_ce occupies less than 32 bits in the skb control block */

debian/patches/misc-bbr3/0005-net-tcp_bbr-v2-export-FLAG_ECE-in-rate_sample.is_ece.patch

@@ -1,38 +0,0 @@
-From fdf01142aea8645186e080f1278d3b5a5fd8c66c Mon Sep 17 00:00:00 2001
-From: Neal Cardwell <ncardwell@google.com>
-Date: Mon, 19 Nov 2018 13:48:36 -0500
-Subject: [PATCH 05/19] net-tcp_bbr: v2: export FLAG_ECE in rate_sample.is_ece
-
-For understanding the relationship between inflight and ECN signals,
-to try to find the highest inflight value that has acceptable levels
-ECN marking.
-
-Effort: net-tcp_bbr
-Origin-9xx-SHA1: 3eba998f2898541406c2666781182200934965a8
-Change-Id: I3a964e04cee83e11649a54507043d2dfe769a3b3
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/net/tcp.h    | 1 +
- net/ipv4/tcp_input.c | 1 +
- 2 files changed, 2 insertions(+)
-
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -1157,6 +1157,7 @@ struct rate_sample {
- 	bool is_app_limited;	/* is sample from packet with bubble in pipe? */
- 	bool is_retrans;	/* is sample from retransmission? */
- 	bool is_ack_delayed;	/* is this (likely) a delayed ACK? */
-+	bool is_ece;		/* did this ACK have ECN marked? */
- };
- 
- struct tcp_congestion_ops {
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -4060,6 +4060,7 @@ static int tcp_ack(struct sock *sk, cons
- 	delivered = tcp_newly_delivered(sk, delivered, flag);
- 	lost = tp->lost - lost;			/* freshly marked lost */
- 	rs.is_ack_delayed = !!(flag & FLAG_ACK_MAYBE_DELAYED);
-+	rs.is_ece = !!(flag & FLAG_ECE);
- 	tcp_rate_gen(sk, delivered, lost, is_sack_reneg, sack_state.rate);
- 	tcp_cong_control(sk, ack, delivered, flag, sack_state.rate);
- 	tcp_xmit_recovery(sk, rexmit);

debian/patches/misc-bbr3/0006-net-tcp_bbr-v2-introduce-ca_ops-skb_marked_lost-CC-m.patch

@@ -1,57 +0,0 @@
-From a3e88432c2ebf12de9c2053a13417ddf2ad4cb4e Mon Sep 17 00:00:00 2001
-From: Neal Cardwell <ncardwell@google.com>
-Date: Tue, 7 Aug 2018 21:52:06 -0400
-Subject: [PATCH 06/19] net-tcp_bbr: v2: introduce ca_ops->skb_marked_lost() CC
- module callback API
-
-For connections experiencing reordering, RACK can mark packets lost
-long after we receive the SACKs/ACKs hinting that the packets were
-actually lost.
-
-This means that CC modules cannot easily learn the volume of inflight
-data at which packet loss happens by looking at the current inflight
-or even the packets in flight when the most recently SACKed packet was
-sent. To learn this, CC modules need to know how many packets were in
-flight at the time lost packets were sent. This new callback, combined
-with TCP_SKB_CB(skb)->tx.in_flight, allows them to learn this.
-
-This also provides a consistent callback that is invoked whether
-packets are marked lost upon ACK processing, using the RACK reordering
-timer, or at RTO time.
-
-Effort: net-tcp_bbr
-Origin-9xx-SHA1: afcbebe3374e4632ac6714d39e4dc8a8455956f4
-Change-Id: I54826ab53df636be537e5d3c618a46145d12d51a
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/net/tcp.h    | 3 +++
- net/ipv4/tcp_input.c | 5 +++++
- 2 files changed, 8 insertions(+)
-
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -1184,6 +1184,9 @@ struct tcp_congestion_ops {
- 	/* override sysctl_tcp_min_tso_segs */
- 	u32 (*min_tso_segs)(struct sock *sk);
- 
-+	/* react to a specific lost skb (optional) */
-+	void (*skb_marked_lost)(struct sock *sk, const struct sk_buff *skb);
-+
- 	/* call when packets are delivered to update cwnd and pacing rate,
- 	 * after all the ca_state processing. (optional)
- 	 */
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -1120,7 +1120,12 @@ static void tcp_verify_retransmit_hint(s
-  */
- static void tcp_notify_skb_loss_event(struct tcp_sock *tp, const struct sk_buff *skb)
- {
-+	struct sock *sk = (struct sock *)tp;
-+	const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
-+
- 	tp->lost += tcp_skb_pcount(skb);
-+	if (ca_ops->skb_marked_lost)
-+		ca_ops->skb_marked_lost(sk, skb);
- }
- 
- void tcp_mark_skb_lost(struct sock *sk, struct sk_buff *skb)

debian/patches/misc-bbr3/0007-net-tcp_bbr-v2-adjust-skb-tx.in_flight-upon-merge-in.patch

@@ -1,59 +0,0 @@
-From af7d33e71649b8e2ae00dccf336720a8ab891606 Mon Sep 17 00:00:00 2001
-From: Neal Cardwell <ncardwell@google.com>
-Date: Wed, 1 May 2019 20:16:33 -0400
-Subject: [PATCH 07/19] net-tcp_bbr: v2: adjust skb tx.in_flight upon merge in
- tcp_shifted_skb()
-
-When tcp_shifted_skb() updates state as adjacent SACKed skbs are
-coalesced, previously the tx.in_flight was not adjusted, so we could
-get contradictory state where the skb's recorded pcount was bigger
-than the tx.in_flight (the number of segments that were in_flight
-after sending the skb).
-
-Normally have a SACKed skb with contradictory pcount/tx.in_flight
-would not matter. However, with SACK reneging, the SACKed bit is
-removed, and an skb once again becomes eligible for retransmitting,
-fragmenting, SACKing, etc. Packetdrill testing verified the following
-sequence is possible in a kernel that does not have this commit:
-
- - skb N is SACKed
- - skb N+1 is SACKed and combined with skb N using tcp_shifted_skb()
-   - tcp_shifted_skb() will increase the pcount of prev,
-     but leave tx.in_flight as-is
-   - so prev skb can have pcount > tx.in_flight
- - RTO, tcp_timeout_mark_lost(), detect reneg,
-   remove "SACKed" bit, mark skb N as lost
-   - find pcount of skb N is greater than its tx.in_flight
-
-I suspect this issue iw what caused the bbr2_inflight_hi_from_lost_skb():
-  WARN_ON_ONCE(inflight_prev < 0)
-to fire in production machines using bbr2.
-
-Effort: net-tcp_bbr
-Origin-9xx-SHA1: 1a3e997e613d2dcf32b947992882854ebe873715
-Change-Id: I1b0b75c27519953430c7db51c6f358f104c7af55
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- net/ipv4/tcp_input.c | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -1506,6 +1506,17 @@ static bool tcp_shifted_skb(struct sock
- 	WARN_ON_ONCE(tcp_skb_pcount(skb) < pcount);
- 	tcp_skb_pcount_add(skb, -pcount);
- 
-+	/* Adjust tx.in_flight as pcount is shifted from skb to prev. */
-+	if (WARN_ONCE(TCP_SKB_CB(skb)->tx.in_flight < pcount,
-+		      "prev in_flight: %u skb in_flight: %u pcount: %u",
-+		      TCP_SKB_CB(prev)->tx.in_flight,
-+		      TCP_SKB_CB(skb)->tx.in_flight,
-+		      pcount))
-+		TCP_SKB_CB(skb)->tx.in_flight = 0;
-+	else
-+		TCP_SKB_CB(skb)->tx.in_flight -= pcount;
-+	TCP_SKB_CB(prev)->tx.in_flight += pcount;
-+
- 	/* When we're adding to gso_segs == 1, gso_size will be zero,
- 	 * in theory this shouldn't be necessary but as long as DSACK
- 	 * code can come after this skb later on it's better to keep

debian/patches/misc-bbr3/0008-net-tcp_bbr-v2-adjust-skb-tx.in_flight-upon-split-in.patch

@@ -1,97 +0,0 @@
-From a4d44bce49f61f8755f558dc40edff5f8958b7c6 Mon Sep 17 00:00:00 2001
-From: Neal Cardwell <ncardwell@google.com>
-Date: Wed, 1 May 2019 20:16:25 -0400
-Subject: [PATCH 08/19] net-tcp_bbr: v2: adjust skb tx.in_flight upon split in
- tcp_fragment()
-
-When we fragment an skb that has already been sent, we need to update
-the tx.in_flight for the first skb in the resulting pair ("buff").
-
-Because we were not updating the tx.in_flight, the tx.in_flight value
-was inconsistent with the pcount of the "buff" skb (tx.in_flight would
-be too high). That meant that if the "buff" skb was lost, then
-bbr2_inflight_hi_from_lost_skb() would calculate an inflight_hi value
-that is too high. This could result in longer queues and higher packet
-loss.
-
-Packetdrill testing verified that without this commit, when the second
-half of an skb is SACKed and then later the first half of that skb is
-marked lost, the calculated inflight_hi was incorrect.
-
-Effort: net-tcp_bbr
-Origin-9xx-SHA1: 385f1ddc610798fab2837f9f372857438b25f874
-Origin-9xx-SHA1: a0eb099690af net-tcp_bbr: v2: fix tcp_fragment() tx.in_flight recomputation [prod feb 8 2021; use as a fixup]
-Origin-9xx-SHA1: 885503228153ff0c9114e net-tcp_bbr: v2: introduce tcp_skb_tx_in_flight_is_suspicious() helper for warnings
-Change-Id: I617f8cab4e9be7a0b8e8d30b047bf8645393354d
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/net/tcp.h     | 15 +++++++++++++++
- net/ipv4/tcp_output.c | 26 +++++++++++++++++++++++++-
- 2 files changed, 40 insertions(+), 1 deletion(-)
-
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -1283,6 +1283,21 @@ static inline bool tcp_skb_sent_after(u6
- 	return t1 > t2 || (t1 == t2 && after(seq1, seq2));
- }
- 
-+/* If a retransmit failed due to local qdisc congestion or other local issues,
-+ * then we may have called tcp_set_skb_tso_segs() to increase the number of
-+ * segments in the skb without increasing the tx.in_flight. In all other cases,
-+ * the tx.in_flight should be at least as big as the pcount of the sk_buff.  We
-+ * do not have the state to know whether a retransmit failed due to local qdisc
-+ * congestion or other local issues, so to avoid spurious warnings we consider
-+ * that any skb marked lost may have suffered that fate.
-+ */
-+static inline bool tcp_skb_tx_in_flight_is_suspicious(u32 skb_pcount,
-+						      u32 skb_sacked_flags,
-+						      u32 tx_in_flight)
-+{
-+	return (skb_pcount > tx_in_flight) && !(skb_sacked_flags & TCPCB_LOST);
-+}
-+
- /* These functions determine how the current flow behaves in respect of SACK
-  * handling. SACK is negotiated with the peer, and therefore it can vary
-  * between different flows.
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -1601,7 +1601,7 @@ int tcp_fragment(struct sock *sk, enum t
- {
- 	struct tcp_sock *tp = tcp_sk(sk);
- 	struct sk_buff *buff;
--	int old_factor;
-+	int old_factor, inflight_prev;
- 	long limit;
- 	int nlen;
- 	u8 flags;
-@@ -1676,6 +1676,30 @@ int tcp_fragment(struct sock *sk, enum t
- 
- 		if (diff)
- 			tcp_adjust_pcount(sk, skb, diff);
-+
-+		inflight_prev = TCP_SKB_CB(skb)->tx.in_flight - old_factor;
-+		if (inflight_prev < 0) {
-+			WARN_ONCE(tcp_skb_tx_in_flight_is_suspicious(
-+					  old_factor,
-+					  TCP_SKB_CB(skb)->sacked,
-+					  TCP_SKB_CB(skb)->tx.in_flight),
-+				  "inconsistent: tx.in_flight: %u "
-+				  "old_factor: %d mss: %u sacked: %u "
-+				  "1st pcount: %d 2nd pcount: %d "
-+				  "1st len: %u 2nd len: %u ",
-+				  TCP_SKB_CB(skb)->tx.in_flight, old_factor,
-+				  mss_now, TCP_SKB_CB(skb)->sacked,
-+				  tcp_skb_pcount(skb), tcp_skb_pcount(buff),
-+				  skb->len, buff->len);
-+			inflight_prev = 0;
-+		}
-+		/* Set 1st tx.in_flight as if 1st were sent by itself: */
-+		TCP_SKB_CB(skb)->tx.in_flight = inflight_prev +
-+						 tcp_skb_pcount(skb);
-+		/* Set 2nd tx.in_flight with new 1st and 2nd pcounts: */
-+		TCP_SKB_CB(buff)->tx.in_flight = inflight_prev +
-+						 tcp_skb_pcount(skb) +
-+						 tcp_skb_pcount(buff);
- 	}
- 
- 	/* Link BUFF into the send queue. */

debian/patches/misc-bbr3/0009-net-tcp-add-new-ca-opts-flag-TCP_CONG_WANTS_CE_EVENT.patch

@@ -1,73 +0,0 @@
-From 65cca0e8fd954a150ec874650af47f7800ea3049 Mon Sep 17 00:00:00 2001
-From: Yousuk Seung <ysseung@google.com>
-Date: Wed, 23 May 2018 17:55:54 -0700
-Subject: [PATCH 09/19] net-tcp: add new ca opts flag TCP_CONG_WANTS_CE_EVENTS
-
-Add a a new ca opts flag TCP_CONG_WANTS_CE_EVENTS that allows a
-congestion control module to receive CE events.
-
-Currently congestion control modules have to set the TCP_CONG_NEEDS_ECN
-bit in opts flag to receive CE events but this may incur changes in ECN
-behavior elsewhere. This patch adds a new bit TCP_CONG_WANTS_CE_EVENTS
-that allows congestion control modules to receive CE events
-independently of TCP_CONG_NEEDS_ECN.
-
-Effort: net-tcp
-Origin-9xx-SHA1: 9f7e14716cde760bc6c67ef8ef7e1ee48501d95b
-Change-Id: I2255506985242f376d910c6fd37daabaf4744f24
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/net/tcp.h    | 14 +++++++++++++-
- net/ipv4/tcp_input.c |  4 ++--
- 2 files changed, 15 insertions(+), 3 deletions(-)
-
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -1119,7 +1119,11 @@ enum tcp_ca_ack_event_flags {
- #define TCP_CONG_NON_RESTRICTED 0x1
- /* Requires ECN/ECT set on all packets */
- #define TCP_CONG_NEEDS_ECN	0x2
--#define TCP_CONG_MASK	(TCP_CONG_NON_RESTRICTED | TCP_CONG_NEEDS_ECN)
-+/* Wants notification of CE events (CA_EVENT_ECN_IS_CE, CA_EVENT_ECN_NO_CE). */
-+#define TCP_CONG_WANTS_CE_EVENTS	0x4
-+#define TCP_CONG_MASK	(TCP_CONG_NON_RESTRICTED | \
-+			 TCP_CONG_NEEDS_ECN | \
-+			 TCP_CONG_WANTS_CE_EVENTS)
- 
- union tcp_cc_info;
- 
-@@ -1251,6 +1255,14 @@ static inline char *tcp_ca_get_name_by_k
- }
- #endif
- 
-+static inline bool tcp_ca_wants_ce_events(const struct sock *sk)
-+{
-+	const struct inet_connection_sock *icsk = inet_csk(sk);
-+
-+	return icsk->icsk_ca_ops->flags & (TCP_CONG_NEEDS_ECN |
-+					   TCP_CONG_WANTS_CE_EVENTS);
-+}
-+
- static inline bool tcp_ca_needs_ecn(const struct sock *sk)
- {
- 	const struct inet_connection_sock *icsk = inet_csk(sk);
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -370,7 +370,7 @@ static void __tcp_ecn_check_ce(struct so
- 			tcp_enter_quickack_mode(sk, 2);
- 		break;
- 	case INET_ECN_CE:
--		if (tcp_ca_needs_ecn(sk))
-+		if (tcp_ca_wants_ce_events(sk))
- 			tcp_ca_event(sk, CA_EVENT_ECN_IS_CE);
- 
- 		if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
-@@ -381,7 +381,7 @@ static void __tcp_ecn_check_ce(struct so
- 		tp->ecn_flags |= TCP_ECN_SEEN;
- 		break;
- 	default:
--		if (tcp_ca_needs_ecn(sk))
-+		if (tcp_ca_wants_ce_events(sk))
- 			tcp_ca_event(sk, CA_EVENT_ECN_NO_CE);
- 		tp->ecn_flags |= TCP_ECN_SEEN;
- 		break;

debian/patches/misc-bbr3/0010-net-tcp-re-generalize-TSO-sizing-in-TCP-CC-module-AP.patch

@@ -1,118 +0,0 @@
-From 3acb852e1cfcdeea388bd428c6dd81609fd40792 Mon Sep 17 00:00:00 2001
-From: Neal Cardwell <ncardwell@google.com>
-Date: Fri, 27 Sep 2019 17:10:26 -0400
-Subject: [PATCH 10/19] net-tcp: re-generalize TSO sizing in TCP CC module API
-
-Reorganize the API for CC modules so that the CC module once again
-gets complete control of the TSO sizing decision. This is how the API
-was set up around 2016 and the initial BBRv1 upstreaming. Later Eric
-Dumazet simplified it. But with wider testing it now seems that to
-avoid CPU regressions BBR needs to have a different TSO sizing
-function.
-
-This is necessary to handle cases where there are many flows
-bottlenecked on the sender host's NIC, in which case BBR's pacing rate
-is much lower than CUBIC/Reno/DCTCP's. Why does this happen? Because
-BBR's pacing rate adapts to the low bandwidth share each flow sees. By
-contrast, CUBIC/Reno/DCTCP see no loss or ECN, so they grow a very
-large cwnd, and thus large pacing rate and large TSO burst size.
-
-Change-Id: Ic8ccfdbe4010ee8d4bf6a6334c48a2fceb2171ea
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/net/tcp.h     |  4 ++--
- net/ipv4/tcp_bbr.c    | 37 ++++++++++++++++++++++++++-----------
- net/ipv4/tcp_output.c | 11 +++++------
- 3 files changed, 33 insertions(+), 19 deletions(-)
-
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -1185,8 +1185,8 @@ struct tcp_congestion_ops {
- 	/* hook for packet ack accounting (optional) */
- 	void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample);
- 
--	/* override sysctl_tcp_min_tso_segs */
--	u32 (*min_tso_segs)(struct sock *sk);
-+	/* pick target number of segments per TSO/GSO skb (optional): */
-+	u32 (*tso_segs)(struct sock *sk, unsigned int mss_now);
- 
- 	/* react to a specific lost skb (optional) */
- 	void (*skb_marked_lost)(struct sock *sk, const struct sk_buff *skb);
---- a/net/ipv4/tcp_bbr.c
-+++ b/net/ipv4/tcp_bbr.c
-@@ -301,20 +301,35 @@ __bpf_kfunc static u32 bbr_min_tso_segs(
- 	return READ_ONCE(sk->sk_pacing_rate) < (bbr_min_tso_rate >> 3) ? 1 : 2;
- }
- 
-+/* Return the number of segments BBR would like in a TSO/GSO skb, given
-+ * a particular max gso size as a constraint.
-+ */
-+static u32 bbr_tso_segs_generic(struct sock *sk, unsigned int mss_now,
-+				u32 gso_max_size)
-+{
-+	u32 segs;
-+	u64 bytes;
-+
-+	/* Budget a TSO/GSO burst size allowance based on bw (pacing_rate). */
-+	bytes = READ_ONCE(sk->sk_pacing_rate) >> READ_ONCE(sk->sk_pacing_shift);
-+
-+	bytes = min_t(u32, bytes, gso_max_size - 1 - MAX_TCP_HEADER);
-+	segs = max_t(u32, bytes / mss_now, bbr_min_tso_segs(sk));
-+	return segs;
-+}
-+
-+/* Custom tcp_tso_autosize() for BBR, used at transmit time to cap skb size. */
-+static u32  bbr_tso_segs(struct sock *sk, unsigned int mss_now)
-+{
-+	return bbr_tso_segs_generic(sk, mss_now, sk->sk_gso_max_size);
-+}
-+
-+/* Like bbr_tso_segs(), using mss_cache, ignoring driver's sk_gso_max_size. */
- static u32 bbr_tso_segs_goal(struct sock *sk)
- {
- 	struct tcp_sock *tp = tcp_sk(sk);
--	u32 segs, bytes;
--
--	/* Sort of tcp_tso_autosize() but ignoring
--	 * driver provided sk_gso_max_size.
--	 */
--	bytes = min_t(unsigned long,
--		      READ_ONCE(sk->sk_pacing_rate) >> READ_ONCE(sk->sk_pacing_shift),
--		      GSO_LEGACY_MAX_SIZE - 1 - MAX_TCP_HEADER);
--	segs = max_t(u32, bytes / tp->mss_cache, bbr_min_tso_segs(sk));
- 
--	return min(segs, 0x7FU);
-+	return bbr_tso_segs_generic(sk, tp->mss_cache, GSO_MAX_SIZE);
- }
- 
- /* Save "last known good" cwnd so we can restore it after losses or PROBE_RTT */
-@@ -1150,7 +1165,7 @@ static struct tcp_congestion_ops tcp_bbr
- 	.undo_cwnd	= bbr_undo_cwnd,
- 	.cwnd_event	= bbr_cwnd_event,
- 	.ssthresh	= bbr_ssthresh,
--	.min_tso_segs	= bbr_min_tso_segs,
-+	.tso_segs	= bbr_tso_segs,
- 	.get_info	= bbr_get_info,
- 	.set_state	= bbr_set_state,
- };
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -2057,13 +2057,12 @@ static u32 tcp_tso_autosize(const struct
- static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now)
- {
- 	const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops;
--	u32 min_tso, tso_segs;
-+	u32 tso_segs;
- 
--	min_tso = ca_ops->min_tso_segs ?
--			ca_ops->min_tso_segs(sk) :
--			READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
--
--	tso_segs = tcp_tso_autosize(sk, mss_now, min_tso);
-+	tso_segs = ca_ops->tso_segs ?
-+		ca_ops->tso_segs(sk, mss_now) :
-+		tcp_tso_autosize(sk, mss_now,
-+				 sock_net(sk)->ipv4.sysctl_tcp_min_tso_segs);
- 	return min_t(u32, tso_segs, sk->sk_gso_max_segs);
- }
- 

debian/patches/misc-bbr3/0011-net-tcp-add-fast_ack_mode-1-skip-rwin-check-in-tcp_f.patch

@@ -1,72 +0,0 @@
-From 3741ada76bab5111cbb9c279cf27e67a0334eb05 Mon Sep 17 00:00:00 2001
-From: Neal Cardwell <ncardwell@google.com>
-Date: Sun, 7 Jan 2024 21:11:26 -0300
-Subject: [PATCH 11/19] net-tcp: add fast_ack_mode=1: skip rwin check in
- tcp_fast_ack_mode__tcp_ack_snd_check()
-
-Add logic for an experimental TCP connection behavior, enabled with
-tp->fast_ack_mode = 1, which disables checking the receive window
-before sending an ack in __tcp_ack_snd_check(). If this behavior is
-enabled, the data receiver sends an ACK if the amount of data is >
-RCV.MSS.
-
-Change-Id: Iaa0a0fd7108221f883137a79d5bfa724f1b096d4
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/linux/tcp.h  | 3 ++-
- net/ipv4/tcp.c       | 1 +
- net/ipv4/tcp_cong.c  | 1 +
- net/ipv4/tcp_input.c | 5 +++--
- 4 files changed, 7 insertions(+), 3 deletions(-)
-
---- a/include/linux/tcp.h
-+++ b/include/linux/tcp.h
-@@ -369,7 +369,8 @@ struct tcp_sock {
- 	u8	compressed_ack;
- 	u8	dup_ack_counter:2,
- 		tlp_retrans:1,	/* TLP is a retransmission */
--		unused:5;
-+		fast_ack_mode:2, /* which fast ack mode ? */
-+		unused:3;
- 	u8	thin_lto    : 1,/* Use linear timeouts for thin streams */
- 		fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */
- 		fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -3123,6 +3123,7 @@ int tcp_disconnect(struct sock *sk, int
- 	tp->rx_opt.dsack = 0;
- 	tp->rx_opt.num_sacks = 0;
- 	tp->rcv_ooopack = 0;
-+	tp->fast_ack_mode = 0;
- 
- 
- 	/* Clean up fastopen related fields */
---- a/net/ipv4/tcp_cong.c
-+++ b/net/ipv4/tcp_cong.c
-@@ -237,6 +237,7 @@ void tcp_init_congestion_control(struct
- 	struct inet_connection_sock *icsk = inet_csk(sk);
- 
- 	tcp_sk(sk)->prior_ssthresh = 0;
-+	tcp_sk(sk)->fast_ack_mode = 0;
- 	if (icsk->icsk_ca_ops->init)
- 		icsk->icsk_ca_ops->init(sk);
- 	if (tcp_ca_needs_ecn(sk))
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -5763,13 +5763,14 @@ static void __tcp_ack_snd_check(struct s
- 
- 	    /* More than one full frame received... */
- 	if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss &&
-+	     (tp->fast_ack_mode == 1 ||
- 	     /* ... and right edge of window advances far enough.
- 	      * (tcp_recvmsg() will send ACK otherwise).
- 	      * If application uses SO_RCVLOWAT, we want send ack now if
- 	      * we have not received enough bytes to satisfy the condition.
- 	      */
--	    (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat ||
--	     __tcp_select_window(sk) >= tp->rcv_wnd)) ||
-+	      (tp->rcv_nxt - tp->copied_seq < sk->sk_rcvlowat ||
-+	       __tcp_select_window(sk) >= tp->rcv_wnd))) ||
- 	    /* We ACK each frame or... */
- 	    tcp_in_quickack_mode(sk) ||
- 	    /* Protocol state mandates a one-time immediate ACK */

debian/patches/misc-bbr3/0012-net-tcp_bbr-v2-record-app-limited-status-of-TLP-repa.patch

@@ -1,45 +0,0 @@
-From e5d35b7c882b7001f8a31b14c9f08917230dedc3 Mon Sep 17 00:00:00 2001
-From: Jianfeng Wang <jfwang@google.com>
-Date: Fri, 19 Jun 2020 17:33:45 +0000
-Subject: [PATCH 12/19] net-tcp_bbr: v2: record app-limited status of
- TLP-repaired flight
-
-When sending a TLP retransmit, record whether the outstanding flight
-of data is application limited. This is important for congestion
-control modules that want to respond to losses repaired by TLP
-retransmits. This is important because the following scenarios convey
-very different information:
- (1) a packet loss with a small number of packets in flight;
- (2) a packet loss with the maximum amount of data in flight allowed
-     by the CC module;
-
-Effort: net-tcp_bbr
-Change-Id: Ic8ae567caa4e4bfd5fd82c3d4be12a5d9171655e
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/linux/tcp.h   | 3 ++-
- net/ipv4/tcp_output.c | 1 +
- 2 files changed, 3 insertions(+), 1 deletion(-)
-
---- a/include/linux/tcp.h
-+++ b/include/linux/tcp.h
-@@ -370,7 +370,8 @@ struct tcp_sock {
- 	u8	dup_ack_counter:2,
- 		tlp_retrans:1,	/* TLP is a retransmission */
- 		fast_ack_mode:2, /* which fast ack mode ? */
--		unused:3;
-+		tlp_orig_data_app_limited:1, /* app-limited before TLP rtx? */
-+		unused:2;
- 	u8	thin_lto    : 1,/* Use linear timeouts for thin streams */
- 		fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */
- 		fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -3003,6 +3003,7 @@ void tcp_send_loss_probe(struct sock *sk
- 	if (WARN_ON(!skb || !tcp_skb_pcount(skb)))
- 		goto rearm_timer;
- 
-+	tp->tlp_orig_data_app_limited = TCP_SKB_CB(skb)->tx.is_app_limited;
- 	if (__tcp_retransmit_skb(sk, skb, 1))
- 		goto rearm_timer;
- 

debian/patches/misc-bbr3/0013-net-tcp_bbr-v2-inform-CC-module-of-losses-repaired-b.patch

@@ -1,45 +0,0 @@
-From 77e7c22b63f8934206b1e89c173558c3967f0779 Mon Sep 17 00:00:00 2001
-From: Jianfeng Wang <jfwang@google.com>
-Date: Tue, 16 Jun 2020 17:41:19 +0000
-Subject: [PATCH 13/19] net-tcp_bbr: v2: inform CC module of losses repaired by
- TLP probe
-
-Before this commit, when there is a packet loss that creates a sequence
-hole that is filled by a TLP loss probe, then tcp_process_tlp_ack()
-only informs the congestion control (CC) module via a back-to-back entry
-and exit of CWR. But some congestion control modules (e.g. BBR) do not
-respond to CWR events.
-
-This commit adds a new CA event with which the core TCP stack notifies
-the CC module when a loss is repaired by a TLP. This will allow CC
-modules that do not use the CWR mechanism to have a custom handler for
-such TLP recoveries.
-
-Effort: net-tcp_bbr
-Change-Id: Ieba72332b401b329bff5a641d2b2043a3fb8f632
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/net/tcp.h    | 1 +
- net/ipv4/tcp_input.c | 1 +
- 2 files changed, 2 insertions(+)
-
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -1097,6 +1097,7 @@ enum tcp_ca_event {
- 	CA_EVENT_LOSS,		/* loss timeout */
- 	CA_EVENT_ECN_NO_CE,	/* ECT set, but not CE marked */
- 	CA_EVENT_ECN_IS_CE,	/* received CE marked IP packet */
-+	CA_EVENT_TLP_RECOVERY,	/* a lost segment was repaired by TLP probe */
- };
- 
- /* Information about inbound ACK, passed to cong_ops->in_ack_event() */
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -3859,6 +3859,7 @@ static void tcp_process_tlp_ack(struct s
- 		/* ACK advances: there was a loss, so reduce cwnd. Reset
- 		 * tlp_high_seq in tcp_init_cwnd_reduction()
- 		 */
-+		tcp_ca_event(sk, CA_EVENT_TLP_RECOVERY);
- 		tcp_init_cwnd_reduction(sk);
- 		tcp_set_ca_state(sk, TCP_CA_CWR);
- 		tcp_end_cwnd_reduction(sk);

debian/patches/misc-bbr3/0014-net-tcp_bbr-v2-introduce-is_acking_tlp_retrans_seq-i.patch

@@ -1,73 +0,0 @@
-From cab22a8e2e87870e8334a12ffcd0ba04ea81126f Mon Sep 17 00:00:00 2001
-From: Neal Cardwell <ncardwell@google.com>
-Date: Mon, 21 Sep 2020 14:46:26 -0400
-Subject: [PATCH 14/19] net-tcp_bbr: v2: introduce is_acking_tlp_retrans_seq
- into rate_sample
-
-Introduce is_acking_tlp_retrans_seq into rate_sample. This bool will
-export to the CC module the knowledge of whether the current ACK
-matched a TLP retransmit.
-
-Note that when this bool is true, we cannot yet tell (in general) whether
-this ACK is for the original or the TLP retransmit.
-
-Effort: net-tcp_bbr
-Change-Id: I2e6494332167e75efcbdc99bd5c119034e9c39b4
-Signed-off-by: Alexandre Frade <kernel@xanmod.org>
----
- include/net/tcp.h    |  1 +
- net/ipv4/tcp_input.c | 12 +++++++++---
- 2 files changed, 10 insertions(+), 3 deletions(-)
-
---- a/include/net/tcp.h
-+++ b/include/net/tcp.h
-@@ -1161,6 +1161,7 @@ struct rate_sample {
- 	u32  last_end_seq;	/* end_seq of most recently ACKed packet */
- 	bool is_app_limited;	/* is sample from packet with bubble in pipe? */
- 	bool is_retrans;	/* is sample from retransmission? */
-+	bool is_acking_tlp_retrans_seq;  /* ACKed a TLP retransmit sequence? */
- 	bool is_ack_delayed;	/* is this (likely) a delayed ACK? */
- 	bool is_ece;		/* did this ACK have ECN marked? */
- };
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -3842,7 +3842,8 @@ static void tcp_replace_ts_recent(struct
- /* This routine deals with acks during a TLP episode and ends an episode by
-  * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack
-  */
--static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
-+static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag,
-+				struct rate_sample *rs)
- {
- 	struct tcp_sock *tp = tcp_sk(sk);
- 
-@@ -3870,6 +3871,11 @@ static void tcp_process_tlp_ack(struct s
- 			     FLAG_NOT_DUP | FLAG_DATA_SACKED))) {
- 		/* Pure dupack: original and TLP probe arrived; no loss */
- 		tp->tlp_high_seq = 0;
-+	} else {
-+		/* This ACK matches a TLP retransmit. We cannot yet tell if
-+		 * this ACK is for the original or the TLP retransmit.
-+		 */
-+		rs->is_acking_tlp_retrans_seq = 1;
- 	}
- }
- 
-@@ -4053,7 +4059,7 @@ static int tcp_ack(struct sock *sk, cons
- 	tcp_rack_update_reo_wnd(sk, &rs);
- 
- 	if (tp->tlp_high_seq)
--		tcp_process_tlp_ack(sk, ack, flag);
-+		tcp_process_tlp_ack(sk, ack, flag, &rs);
- 
- 	if (tcp_ack_is_dubious(sk, flag)) {
- 		if (!(flag & (FLAG_SND_UNA_ADVANCED |
-@@ -4097,7 +4103,7 @@ no_queue:
- 	tcp_ack_probe(sk);
- 
- 	if (tp->tlp_high_seq)
--		tcp_process_tlp_ack(sk, ack, flag);
-+		tcp_process_tlp_ack(sk, ack, flag, &rs);
- 	return 1;
- 
- old_ack: