Adding debian version 6.10.3-1.debian/6.10.3-1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

9 files changed, 244 insertions, 127 deletions

diff --git a/debian/patches/bugfix/all/disable-some-marvell-phys.patch b/debian/patches/bugfix/all/disable-some-marvell-phys.patch
index 472e54ce5b..80a1d58ac0 100644
--- a/debian/patches/bugfix/all/disable-some-marvell-phys.patch
+++ b/debian/patches/bugfix/all/disable-some-marvell-phys.patch
@@ -16,7 +16,7 @@ correctness.
 
 --- a/drivers/net/phy/marvell.c
 +++ b/drivers/net/phy/marvell.c
-@@ -1320,6 +1320,7 @@ static int m88e1118_config_init(struct phy_device *phydev)
+@@ -1366,6 +1366,7 @@ static int m88e1118_config_init(struct p
  	return genphy_soft_reset(phydev);
  }
  
@@ -24,7 +24,7 @@ correctness.
  static int m88e1149_config_init(struct phy_device *phydev)
  {
  	int err;
-@@ -1345,7 +1346,9 @@ static int m88e1149_config_init(struct phy_device *phydev)
+@@ -1391,7 +1392,9 @@ static int m88e1149_config_init(struct p
  
  	return genphy_soft_reset(phydev);
  }
@@ -34,7 +34,7 @@ correctness.
  static int m88e1145_config_init_rgmii(struct phy_device *phydev)
  {
  	int err;
-@@ -1423,6 +1426,7 @@ static int m88e1145_config_init(struct phy_device *phydev)
+@@ -1469,6 +1472,7 @@ static int m88e1145_config_init(struct p
  
  	return 0;
  }
@@ -42,7 +42,7 @@ correctness.
  
  static int m88e1540_get_fld(struct phy_device *phydev, u8 *msecs)
  {
-@@ -3414,6 +3418,7 @@ static struct phy_driver marvell_drivers[] = {
+@@ -3790,6 +3794,7 @@ static struct phy_driver marvell_drivers
  		.led_hw_control_set = m88e1318_led_hw_control_set,
  		.led_hw_control_get = m88e1318_led_hw_control_get,
  	},
@@ -50,16 +50,16 @@ correctness.
  	{
  		.phy_id = MARVELL_PHY_ID_88E1145,
  		.phy_id_mask = MARVELL_PHY_ID_MASK,
-@@ -3434,6 +3439,8 @@ static struct phy_driver marvell_drivers[] = {
- 		.get_tunable = m88e1111_get_tunable,
- 		.set_tunable = m88e1111_set_tunable,
+@@ -3813,6 +3818,8 @@ static struct phy_driver marvell_drivers
+ 		.cable_test_start = m88e1111_vct_cable_test_start,
+ 		.cable_test_get_status = m88e1111_vct_cable_test_get_status,
  	},
 +#endif
 +#if 0
  	{
  		.phy_id = MARVELL_PHY_ID_88E1149R,
  		.phy_id_mask = MARVELL_PHY_ID_MASK,
-@@ -3452,6 +3459,8 @@ static struct phy_driver marvell_drivers[] = {
+@@ -3831,6 +3838,8 @@ static struct phy_driver marvell_drivers
  		.get_strings = marvell_get_strings,
  		.get_stats = marvell_get_stats,
  	},
@@ -68,7 +68,7 @@ correctness.
  	{
  		.phy_id = MARVELL_PHY_ID_88E1240,
  		.phy_id_mask = MARVELL_PHY_ID_MASK,
-@@ -3472,6 +3481,7 @@ static struct phy_driver marvell_drivers[] = {
+@@ -3851,6 +3860,7 @@ static struct phy_driver marvell_drivers
  		.get_tunable = m88e1011_get_tunable,
  		.set_tunable = m88e1011_set_tunable,
  	},
@@ -76,7 +76,7 @@ correctness.
  	{
  		.phy_id = MARVELL_PHY_ID_88E1116R,
  		.phy_id_mask = MARVELL_PHY_ID_MASK,
-@@ -3744,9 +4074,9 @@ static struct mdio_device_id __maybe_unused marvell_tbl[] = {
+@@ -4139,9 +4149,9 @@ static struct mdio_device_id __maybe_unu
  	{ MARVELL_PHY_ID_88E1111_FINISAR, MARVELL_PHY_ID_MASK },
  	{ MARVELL_PHY_ID_88E1118, MARVELL_PHY_ID_MASK },
  	{ MARVELL_PHY_ID_88E1121R, MARVELL_PHY_ID_MASK },
diff --git a/debian/patches/bugfix/all/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch b/debian/patches/bugfix/all/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
new file mode 100644
index 0000000000..8b2d5743a2
--- /dev/null
+++ b/debian/patches/bugfix/all/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
@@ -0,0 +1,148 @@
+From: Willem de Bruijn <willemb@google.com>
+Date: Mon, 29 Jul 2024 16:10:12 -0400
+Subject: net: drop bad gso csum_start and offset in virtio_net_hdr
+Origin: https://git.kernel.org/linus/89add40066f9ed9abe5f7f886fe5789ff7e0c50e
+
+Tighten csum_start and csum_offset checks in virtio_net_hdr_to_skb
+for GSO packets.
+
+The function already checks that a checksum requested with
+VIRTIO_NET_HDR_F_NEEDS_CSUM is in skb linear. But for GSO packets
+this might not hold for segs after segmentation.
+
+Syzkaller demonstrated to reach this warning in skb_checksum_help
+
+	offset = skb_checksum_start_offset(skb);
+	ret = -EINVAL;
+	if (WARN_ON_ONCE(offset >= skb_headlen(skb)))
+
+By injecting a TSO packet:
+
+WARNING: CPU: 1 PID: 3539 at net/core/dev.c:3284 skb_checksum_help+0x3d0/0x5b0
+ ip_do_fragment+0x209/0x1b20 net/ipv4/ip_output.c:774
+ ip_finish_output_gso net/ipv4/ip_output.c:279 [inline]
+ __ip_finish_output+0x2bd/0x4b0 net/ipv4/ip_output.c:301
+ iptunnel_xmit+0x50c/0x930 net/ipv4/ip_tunnel_core.c:82
+ ip_tunnel_xmit+0x2296/0x2c70 net/ipv4/ip_tunnel.c:813
+ __gre_xmit net/ipv4/ip_gre.c:469 [inline]
+ ipgre_xmit+0x759/0xa60 net/ipv4/ip_gre.c:661
+ __netdev_start_xmit include/linux/netdevice.h:4850 [inline]
+ netdev_start_xmit include/linux/netdevice.h:4864 [inline]
+ xmit_one net/core/dev.c:3595 [inline]
+ dev_hard_start_xmit+0x261/0x8c0 net/core/dev.c:3611
+ __dev_queue_xmit+0x1b97/0x3c90 net/core/dev.c:4261
+ packet_snd net/packet/af_packet.c:3073 [inline]
+
+The geometry of the bad input packet at tcp_gso_segment:
+
+[   52.003050][ T8403] skb len=12202 headroom=244 headlen=12093 tailroom=0
+[   52.003050][ T8403] mac=(168,24) mac_len=24 net=(192,52) trans=244
+[   52.003050][ T8403] shinfo(txflags=0 nr_frags=1 gso(size=1552 type=3 segs=0))
+[   52.003050][ T8403] csum(0x60000c7 start=199 offset=1536
+ip_summed=3 complete_sw=0 valid=0 level=0)
+
+Mitigate with stricter input validation.
+
+csum_offset: for GSO packets, deduce the correct value from gso_type.
+This is already done for USO. Extend it to TSO. Let UFO be:
+udp[46]_ufo_fragment ignores these fields and always computes the
+checksum in software.
+
+csum_start: finding the real offset requires parsing to the transport
+header. Do not add a parser, use existing segmentation parsing. Thanks
+to SKB_GSO_DODGY, that also catches bad packets that are hw offloaded.
+Again test both TSO and USO. Do not test UFO for the above reason, and
+do not test UDP tunnel offload.
+
+GSO packet are almost always CHECKSUM_PARTIAL. USO packets may be
+CHECKSUM_NONE since commit 10154dbded6d6 ("udp: Allow GSO transmit
+from devices with no checksum offload"), but then still these fields
+are initialized correctly in udp4_hwcsum/udp6_hwcsum_outgoing. So no
+need to test for ip_summed == CHECKSUM_PARTIAL first.
+
+This revises an existing fix mentioned in the Fixes tag, which broke
+small packets with GSO offload, as detected by kselftests.
+
+Link: https://syzkaller.appspot.com/bug?extid=e1db31216c789f552871
+Link: https://lore.kernel.org/netdev/20240723223109.2196886-1-kuba@kernel.org
+Fixes: e269d79c7d35 ("net: missing check virtio")
+Cc: stable@vger.kernel.org
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Link: https://patch.msgid.link/20240729201108.1615114-1-willemdebruijn.kernel@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ include/linux/virtio_net.h | 16 +++++-----------
+ net/ipv4/tcp_offload.c     |  3 +++
+ net/ipv4/udp_offload.c     |  4 ++++
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index d1d7825318c3..6c395a2600e8 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -56,7 +56,6 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ 	unsigned int thlen = 0;
+ 	unsigned int p_off = 0;
+ 	unsigned int ip_proto;
+-	u64 ret, remainder, gso_size;
+ 
+ 	if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+ 		switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
+@@ -99,16 +98,6 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ 		u32 off = __virtio16_to_cpu(little_endian, hdr->csum_offset);
+ 		u32 needed = start + max_t(u32, thlen, off + sizeof(__sum16));
+ 
+-		if (hdr->gso_size) {
+-			gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size);
+-			ret = div64_u64_rem(skb->len, gso_size, &remainder);
+-			if (!(ret && (hdr->gso_size > needed) &&
+-						((remainder > needed) || (remainder == 0)))) {
+-				return -EINVAL;
+-			}
+-			skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG;
+-		}
+-
+ 		if (!pskb_may_pull(skb, needed))
+ 			return -EINVAL;
+ 
+@@ -182,6 +171,11 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ 			if (gso_type != SKB_GSO_UDP_L4)
+ 				return -EINVAL;
+ 			break;
++		case SKB_GSO_TCPV4:
++		case SKB_GSO_TCPV6:
++			if (skb->csum_offset != offsetof(struct tcphdr, check))
++				return -EINVAL;
++			break;
+ 		}
+ 
+ 		/* Kernel has a special handling for GSO_BY_FRAGS. */
+diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
+index 4b791e74529e..e4ad3311e148 100644
+--- a/net/ipv4/tcp_offload.c
++++ b/net/ipv4/tcp_offload.c
+@@ -140,6 +140,9 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb,
+ 	if (thlen < sizeof(*th))
+ 		goto out;
+ 
++	if (unlikely(skb_checksum_start(skb) != skb_transport_header(skb)))
++		goto out;
++
+ 	if (!pskb_may_pull(skb, thlen))
+ 		goto out;
+ 
+diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
+index aa2e0a28ca61..bc8a9da750fe 100644
+--- a/net/ipv4/udp_offload.c
++++ b/net/ipv4/udp_offload.c
+@@ -278,6 +278,10 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
+ 	if (gso_skb->len <= sizeof(*uh) + mss)
+ 		return ERR_PTR(-EINVAL);
+ 
++	if (unlikely(skb_checksum_start(gso_skb) !=
++		     skb_transport_header(gso_skb)))
++		return ERR_PTR(-EINVAL);
++
+ 	if (skb_gso_ok(gso_skb, features | NETIF_F_GSO_ROBUST)) {
+ 		/* Packet is from an untrusted source, reset gso_segs. */
+ 		skb_shinfo(gso_skb)->gso_segs = DIV_ROUND_UP(gso_skb->len - sizeof(*uh),
diff --git a/debian/patches/bugfix/all/spi-spidev-Add-missing-spi_device_id-for-bh2228fv.patch b/debian/patches/bugfix/all/spi-spidev-Add-missing-spi_device_id-for-bh2228fv.patch
new file mode 100644
index 0000000000..ad4d220401
--- /dev/null
+++ b/debian/patches/bugfix/all/spi-spidev-Add-missing-spi_device_id-for-bh2228fv.patch
@@ -0,0 +1,34 @@
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 30 Jul 2024 15:35:47 +0200
+Subject: spi: spidev: Add missing spi_device_id for bh2228fv
+Origin: https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git/commit?id=e4c4638b6a10427d30e29d22351c375886025f47
+
+When the of_device_id entry for "rohm,bh2228fv" was added, the
+corresponding spi_device_id was forgotten, causing a warning message
+during boot-up:
+
+    SPI driver spidev has no spi_device_id for rohm,bh2228fv
+
+Fix module autoloading and shut up the warning by adding the missing
+entry.
+
+Fixes: fc28d1c1fe3b3e2f ("spi: spidev: add correct compatible for Rohm BH2228FV")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/cb571d4128f41175f31319cd9febc829417ea167.1722346539.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+---
+ drivers/spi/spidev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 05e6d007f9a7..5304728c68c2 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -700,6 +700,7 @@ static const struct class spidev_class = {
+ };
+ 
+ static const struct spi_device_id spidev_spi_ids[] = {
++	{ .name = "bh2228fv" },
+ 	{ .name = "dh2228fv" },
+ 	{ .name = "ltc2488" },
+ 	{ .name = "sx1301" },
diff --git a/debian/patches/bugfix/alpha/alpha-fix-missing-symbol-versions-for-str-n-cat-cpy.patch b/debian/patches/bugfix/alpha/alpha-fix-missing-symbol-versions-for-str-n-cat-cpy.patch
deleted file mode 100644
index 3da69882e8..0000000000
--- a/debian/patches/bugfix/alpha/alpha-fix-missing-symbol-versions-for-str-n-cat-cpy.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Thu, 5 Jan 2023 17:04:40 +0100
-Subject: alpha: Fix missing symbol versions for str{,n}{cat,cpy}
-Origin: https://marc.info/?l=linux-alpha&m=167364720725291&w=2
-
-Now that modpost extracts symbol versions from *.cmd files, it can't
-find the versions for these 4 symbols.  This is due to the way we link
-their objects together ahead of the full vmlinux link.  genksyms puts
-their symbol CRCs in .str{,n}{cat,cpy}.o.cmd, but modpost only reads
-the .sty{,n}cpy.o.cmd files.
-
-Add assembly sources that bring the appropriate routines together with
-include directives instead of using the linker for this.
-
-Reported-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
-Fixes: f292d875d0dc ("modpost: extract symbol versions from *.cmd files")
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
----
- arch/alpha/lib/Makefile  | 14 --------------
- arch/alpha/lib/stycpy.S  |  8 ++++++++
- arch/alpha/lib/styncpy.S |  8 ++++++++
- 3 files changed, 16 insertions(+), 14 deletions(-)
- create mode 100644 arch/alpha/lib/stycpy.S
- create mode 100644 arch/alpha/lib/styncpy.S
-
-diff --git a/arch/alpha/lib/Makefile b/arch/alpha/lib/Makefile
-index 1cc74f7b50ef..8f1c32a25a40 100644
---- a/arch/alpha/lib/Makefile
-+++ b/arch/alpha/lib/Makefile
-@@ -45,17 +45,3 @@ AFLAGS___remlu.o =       -DREM -DINTSIZE
- $(addprefix $(obj)/,__divqu.o __remqu.o __divlu.o __remlu.o): \
- 						$(src)/$(ev6-y)divide.S FORCE
- 	$(call if_changed_rule,as_o_S)
--
--# There are direct branches between {str*cpy,str*cat} and stx*cpy.
--# Ensure the branches are within range by merging these objects.
--
--LDFLAGS_stycpy.o := -r
--LDFLAGS_styncpy.o := -r
--
--$(obj)/stycpy.o: $(obj)/strcpy.o $(obj)/$(ev67-y)strcat.o \
--		 $(obj)/$(ev6-y)stxcpy.o FORCE
--	$(call if_changed,ld)
--
--$(obj)/styncpy.o: $(obj)/strncpy.o $(obj)/$(ev67-y)strncat.o \
--		 $(obj)/$(ev6-y)stxncpy.o FORCE
--	$(call if_changed,ld)
-diff --git a/arch/alpha/lib/stycpy.S b/arch/alpha/lib/stycpy.S
-new file mode 100644
-index 000000000000..b4376834c91f
---- /dev/null
-+++ b/arch/alpha/lib/stycpy.S
-@@ -0,0 +1,8 @@
-+#include "strcpy.S"
-+#ifdef CONFIG_ALPHA_EV6
-+#include "ev6-strcat.S"
-+#include "ev6-stxcpy.S"
-+#else
-+#include "strcat.S"
-+#include "stxcpy.S"
-+#endif
-diff --git a/arch/alpha/lib/styncpy.S b/arch/alpha/lib/styncpy.S
-new file mode 100644
-index 000000000000..c393f816ff98
---- /dev/null
-+++ b/arch/alpha/lib/styncpy.S
-@@ -0,0 +1,8 @@
-+#include "strncpy.S"
-+#ifdef CONFIG_ALPHA_EV6
-+#include "ev6-strncat.S"
-+#include "ev6-stxncpy.S"
-+#else
-+#include "strncat.S"
-+#include "stxncpy.S"
-+#endif
diff --git a/debian/patches/bugfix/arm64/arm64-acpi-Add-fixup-for-HPE-m400-quirks.patch b/debian/patches/bugfix/arm64/arm64-acpi-Add-fixup-for-HPE-m400-quirks.patch
index 7a866fdc35..5ec1d51463 100644
--- a/debian/patches/bugfix/arm64/arm64-acpi-Add-fixup-for-HPE-m400-quirks.patch
+++ b/debian/patches/bugfix/arm64/arm64-acpi-Add-fixup-for-HPE-m400-quirks.patch
@@ -19,16 +19,14 @@ experience errors like these on startup:
   Kernel panic - not syncing: Fatal hardware error!
 
 Signed-off-by: Geoff Levand <geoff@infradead.org>
-[bwh: Adjust context to apply to Linux 4.19]
+[bwh: Adjust context and indentation to apply to Linux 6.10]
 ---
- arch/arm64/kernel/acpi.c | 40 ++++++++++++++++++++++++++++++++++++----
+ arch/arm64/kernel/acpi.c | 31 +++++++++++++++++++++++++++++++
  1 file changed, 36 insertions(+), 4 deletions(-)
 
-Index: linux/arch/arm64/kernel/acpi.c
-===================================================================
---- linux.orig/arch/arm64/kernel/acpi.c
-+++ linux/arch/arm64/kernel/acpi.c
-@@ -32,6 +32,8 @@
+--- a/arch/arm64/kernel/acpi.c
++++ b/arch/arm64/kernel/acpi.c
+@@ -35,6 +35,8 @@
  #include <asm/daifflags.h>
  #include <asm/smp_plat.h>
  
@@ -37,7 +35,7 @@ Index: linux/arch/arm64/kernel/acpi.c
  int acpi_noirq = 1;		/* skip ACPI IRQ initialization */
  int acpi_disabled = 1;
  EXPORT_SYMBOL(acpi_disabled);
-@@ -178,6 +180,33 @@ out:
+@@ -174,6 +176,33 @@ out:
  }
  
  /*
@@ -71,22 +69,12 @@ Index: linux/arch/arm64/kernel/acpi.c
   * acpi_boot_table_init() called from setup_arch(), always.
   *	1. find RSDP and get its address, and then find XSDT
   *	2. extract all tables and checksums them all
-@@ -232,11 +261,14 @@ done:
- 	if (acpi_disabled) {
- 		if (earlycon_acpi_spcr_enable)
- 			early_init_dt_scan_chosen_stdout();
--	} else {
--		acpi_parse_spcr(earlycon_acpi_spcr_enable, true);
--		if (IS_ENABLED(CONFIG_ACPI_BGRT))
--			acpi_table_parse(ACPI_SIG_BGRT, acpi_parse_bgrt);
-+		return;
+@@ -240,6 +269,8 @@ done:
+ 		acpi_parse_spcr(earlycon_acpi_spcr_enable, true);
+ 		if (IS_ENABLED(CONFIG_ACPI_BGRT))
+ 			acpi_table_parse(ACPI_SIG_BGRT, acpi_parse_bgrt);
++	
++		acpi_fixup_m400_quirks();
  	}
-+
-+	acpi_parse_spcr(earlycon_acpi_spcr_enable, true);
-+	if (IS_ENABLED(CONFIG_ACPI_BGRT))
-+		acpi_table_parse(ACPI_SIG_BGRT, acpi_parse_bgrt);
-+
-+	acpi_fixup_m400_quirks();
  }
  
- static pgprot_t __acpi_get_writethrough_mem_attribute(void)
diff --git a/debian/patches/debian/documentation-drop-sphinx-version-check.patch b/debian/patches/debian/documentation-drop-sphinx-version-check.patch
index b2ae2626a9..71fca78b7a 100644
--- a/debian/patches/debian/documentation-drop-sphinx-version-check.patch
+++ b/debian/patches/debian/documentation-drop-sphinx-version-check.patch
@@ -10,7 +10,7 @@ Forwarded: not-needed
 
 --- a/Documentation/Makefile
 +++ b/Documentation/Makefile
-@@ -114,7 +114,6 @@ $(YNL_RST_DIR)/%.rst: $(YNL_YAML_DIR)/%.yaml $(YNL_TOOL)
+@@ -118,7 +118,6 @@ $(YNL_RST_DIR)/%.rst: $(YNL_YAML_DIR)/%.
  htmldocs texinfodocs latexdocs epubdocs xmldocs: $(YNL_INDEX)
  
  htmldocs:
@@ -18,15 +18,15 @@ Forwarded: not-needed
  	@+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,html,$(var),,$(var)))
  
  # If Rust support is available and .config exists, add rustdoc generated contents.
-@@ -128,7 +127,6 @@ endif
+@@ -132,7 +131,6 @@ endif
  endif
-
+ 
  texinfodocs:
 -	@$(srctree)/scripts/sphinx-pre-install --version-check
  	@+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,texinfo,$(var),texinfo,$(var)))
  
  # Note: the 'info' Make target is generated by sphinx itself when
-@@ -140,7 +138,6 @@ linkcheckdocs:
+@@ -144,7 +142,6 @@ linkcheckdocs:
  	@$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,linkcheck,$(var),,$(var)))
  
  latexdocs:
@@ -34,15 +34,15 @@ Forwarded: not-needed
  	@+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,latex,$(var),latex,$(var)))
  
  ifeq ($(HAVE_PDFLATEX),0)
-@@ -152,7 +149,6 @@ pdfdocs:
- else # HAVE_PDFLATEX
+@@ -157,7 +154,6 @@ else # HAVE_PDFLATEX
  
+ pdfdocs: DENY_VF = XDG_CONFIG_HOME=$(FONTS_CONF_DENY_VF)
  pdfdocs: latexdocs
 -	@$(srctree)/scripts/sphinx-pre-install --version-check
  	$(foreach var,$(SPHINXDIRS), \
- 	   $(MAKE) PDFLATEX="$(PDFLATEX)" LATEXOPTS="$(LATEXOPTS)" -C $(BUILDDIR)/$(var)/latex || exit; \
+ 	   $(MAKE) PDFLATEX="$(PDFLATEX)" LATEXOPTS="$(LATEXOPTS)" $(DENY_VF) -C $(BUILDDIR)/$(var)/latex || sh $(srctree)/scripts/check-variable-fonts.sh || exit; \
  	   mkdir -p $(BUILDDIR)/$(var)/pdf; \
-@@ -162,11 +158,9 @@ pdfdocs: latexdocs
+@@ -167,11 +163,9 @@ pdfdocs: latexdocs
  endif # HAVE_PDFLATEX
  
  epubdocs:
diff --git a/debian/patches/debian/mips-enable-r2-to-r6-emu-by-default.patch b/debian/patches/debian/mips-enable-r2-to-r6-emu-by-default.patch
new file mode 100644
index 0000000000..41790e6d5d
--- /dev/null
+++ b/debian/patches/debian/mips-enable-r2-to-r6-emu-by-default.patch
@@ -0,0 +1,20 @@
+From: YunQiang Su <syq@debian.org>
+Date: Mon, 14 May 2018 16:16:18 +0800
+Subject: Enable R2 to R6 emulator by default
+Forwarded: not-needed
+
+In upstream code, 'mipsr2emu' kernel option is needed
+to enable R2 to R6 emulator.  Since we need r6 kernel
+for our r2 port, let's always enable it.
+
+--- a/arch/mips/kernel/mips-r2-to-r6-emul.c
++++ b/arch/mips/kernel/mips-r2-to-r6-emul.c
+@@ -56,7 +56,7 @@ extern const unsigned int fpucondbit[8];
+ 
+ #define MIPS_R2_EMUL_TOTAL_PASS	10
+ 
+-int mipsr2_emulation = 0;
++int mipsr2_emulation = 1;
+ 
+ static int __init mipsr2emu_enable(char *s)
+ {
diff --git a/debian/patches/debian/version.patch b/debian/patches/debian/version.patch
index 6cc13c7be4..e58cdce833 100644
--- a/debian/patches/debian/version.patch
+++ b/debian/patches/debian/version.patch
@@ -16,7 +16,7 @@ are set.
 
 --- a/Makefile
 +++ b/Makefile
-@@ -1268,7 +1268,8 @@ PHONY += prepare archprepare
+@@ -1201,7 +1201,8 @@ PHONY += prepare archprepare
  
  archprepare: outputmakefile archheaders archscripts scripts include/config/kernel.release \
  	asm-generic $(version_h) include/generated/utsrelease.h \
@@ -26,7 +26,7 @@ are set.
  
  prepare0: archprepare
  	$(Q)$(MAKE) $(build)=scripts/mod
-@@ -1326,6 +1327,16 @@ define filechk_version.h
+@@ -1259,6 +1260,16 @@ define filechk_version.h
  	echo \#define LINUX_VERSION_SUBLEVEL $(SUBLEVEL)
  endef
  
@@ -40,10 +40,10 @@ are set.
 +endef
 +endif
 +
- $(version_h): PATCHLEVEL := $(or $(PATCHLEVEL), 0)
- $(version_h): SUBLEVEL := $(or $(SUBLEVEL), 0)
+ $(version_h): private PATCHLEVEL := $(or $(PATCHLEVEL), 0)
+ $(version_h): private SUBLEVEL := $(or $(SUBLEVEL), 0)
  $(version_h): FORCE
-@@ -1340,6 +1351,9 @@ filechk_compile.h = $(srctree)/scripts/m
+@@ -1273,6 +1284,9 @@ filechk_compile.h = $(srctree)/scripts/m
  include/generated/compile.h: FORCE
  	$(call filechk,compile.h)
  
@@ -63,7 +63,7 @@ are set.
  
  #include <asm/interrupt.h>
  #include <asm/io.h>
-@@ -1555,8 +1556,9 @@ static void __show_regs(struct pt_regs *
+@@ -1562,8 +1563,9 @@ static void __show_regs(struct pt_regs *
  
  	printk("NIP:  "REG" LR: "REG" CTR: "REG"\n",
  	       regs->nip, regs->link, regs->ctr);
@@ -77,7 +77,7 @@ are set.
  	pr_cont("  CR: %08lx  XER: %08lx\n", regs->ccr, regs->xer);
 --- a/arch/x86/um/sysrq_64.c
 +++ b/arch/x86/um/sysrq_64.c
-@@ -9,6 +9,7 @@
+@@ -10,6 +10,7 @@
  #include <linux/sched.h>
  #include <linux/sched/debug.h>
  #include <linux/utsname.h>
@@ -85,7 +85,7 @@ are set.
  #include <asm/current.h>
  #include <asm/ptrace.h>
  #include <asm/sysrq.h>
-@@ -17,8 +18,9 @@ void show_regs(struct pt_regs *regs)
+@@ -18,8 +19,9 @@ void show_regs(struct pt_regs *regs)
  {
  	printk("\n");
  	print_modules();
@@ -107,7 +107,7 @@ are set.
  
  /*
   * The number of tasks checked:
-@@ -131,10 +132,11 @@ static void check_hung_task(struct task_
+@@ -132,10 +133,11 @@ static void check_hung_task(struct task_
  			sysctl_hung_task_warnings--;
  		pr_err("INFO: task %s:%d blocked for more than %ld seconds.\n",
  		       t->comm, t->pid, (jiffies - t->last_switch_time) / HZ);
diff --git a/debian/patches/series b/debian/patches/series
index 85dc5ff40a..b7f8335509 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -12,6 +12,7 @@ debian/uname-version-timestamp.patch
 debian/kernelvariables.patch
 debian/mips-boston-disable-its.patch
 debian/mips-ieee754-relaxed.patch
+debian/mips-enable-r2-to-r6-emu-by-default.patch
 debian/arch-sh4-fix-uimage-build.patch
 debian/tools-perf-perf-read-vdso-in-libexec.patch
 debian/tools-perf-install-python-bindings.patch
@@ -64,7 +65,6 @@ bugfix/sh/sh-boot-do-not-use-hyphen-in-exported-variable-name.patch
 bugfix/arm/arm-mm-export-__sync_icache_dcache-for-xen-privcmd.patch
 bugfix/powerpc/powerpc-boot-fix-missing-crc32poly.h-when-building-with-kernel_xz.patch
 bugfix/arm64/arm64-acpi-Add-fixup-for-HPE-m400-quirks.patch
-bugfix/alpha/alpha-fix-missing-symbol-versions-for-str-n-cat-cpy.patch
 
 # Arch features
 features/x86/x86-memtest-WARN-if-bad-RAM-found.patch
@@ -73,6 +73,8 @@ features/x86/x86-make-x32-syscall-support-conditional.patch
 # Miscellaneous bug fixes
 bugfix/all/disable-some-marvell-phys.patch
 bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
+bugfix/all/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
+bugfix/all/spi-spidev-Add-missing-spi_device_id-for-bh2228fv.patch
 
 # Miscellaneous features