From 6143dfd1bd8e2919556a6257c895e7f8ad2e4bd5 Mon Sep 17 00:00:00 2001
From: Ben Hutchings <ben@decadent.org.uk>
Date: Tue, 26 Jun 2018 02:38:11 +0100
Subject: [PATCH] Update to 4.18-rc2

Drop/refresh patches as appropriate.

Disable the aufs support patchset since aufs hasn't yet been updated.
---
 debian/changelog                              |   9 +
 ...-redundant-log-messages-from-drivers.patch |  52 +-
 ...and-infiniband_rdmavt-dependencies-f.patch |  49 --
 .../kbuild-fix-recordmcount-dependency.patch  |   4 +-
 ...kbuild-use-nostdinc-in-compile-tests.patch |  30 +-
 ...opy_from_user-the-request-header-onc.patch |  43 --
 ...uilding-ashmem-and-binder-as-modules.patch |   7 +-
 debian/patches/debian/kernelvariables.patch   |   6 +-
 .../debian/modpost-symbol-prefix.patch        |  22 -
 .../revert-gpu-host1x-add-iommu-support.patch | 468 ------------------
 .../patches/debian/tools-perf-version.patch   |  18 +-
 debian/patches/debian/version.patch           |  12 +-
 ...edia-dvb-usb-af9005-request_firmware.patch |  12 +-
 ...e-secure_boot-rules-in-lockdown-mode.patch |  20 +-
 ...ignatures-if-the-kernel-is-locked-do.patch |  18 +-
 ...nel-image-access-functions-when-the-.patch |   6 +-
 ...om-Add-reference-to-Raspberry-Pi-3-B.patch |  39 --
 ...s-allwinner-add-support-for-Pinebook.patch |  12 +-
 ...ARM-dts-bcm2837-Add-Raspberry-Pi-3-B.patch | 185 -------
 debian/patches/series                         |  13 +-
 20 files changed, 109 insertions(+), 916 deletions(-)
 delete mode 100644 debian/patches/bugfix/all/ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-f.patch
 delete mode 100644 debian/patches/bugfix/x86/virt-vbox-Only-copy_from_user-the-request-header-onc.patch
 delete mode 100644 debian/patches/debian/modpost-symbol-prefix.patch
 delete mode 100644 debian/patches/debian/revert-gpu-host1x-add-iommu-support.patch
 delete mode 100644 debian/patches/features/arm64/arm64-dts-broadcom-Add-reference-to-Raspberry-Pi-3-B.patch
 delete mode 100644 debian/patches/features/armhf/ARM-dts-bcm2837-Add-Raspberry-Pi-3-B.patch

diff --git a/debian/changelog b/debian/changelog
index 99331a2f1..3082b43f7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+linux (4.18~rc2-1~exp1) UNRELEASED; urgency=medium
+
+  * New upstream release candidate
+
+  [ Ben Hutchings ]
+  * aufs: Disable support patchset until it is updated for Linux 4.18
+
+ -- Ben Hutchings <ben@decadent.org.uk>  Tue, 26 Jun 2018 01:43:53 +0100
+
 linux (4.17.3-1) UNRELEASED; urgency=medium
 
   * New upstream stable update:
diff --git a/debian/patches/bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch b/debian/patches/bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch
index edc2b0233..5d58925eb 100644
--- a/debian/patches/bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch
+++ b/debian/patches/bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch
@@ -53,7 +53,7 @@ upstream submission.
    rec = (const struct ihex_binrec *)fw->data;
 --- a/drivers/atm/fore200e.c
 +++ b/drivers/atm/fore200e.c
-@@ -2504,10 +2504,9 @@ static int fore200e_load_and_start_fw(st
+@@ -2505,10 +2505,9 @@ static int fore200e_load_and_start_fw(st
  	return err;
  
      sprintf(buf, "%s%s", fore200e->bus->proc_name, FW_EXT);
@@ -175,7 +175,7 @@ upstream submission.
  		       fw->size, fw_name);
 --- a/drivers/dma/imx-sdma.c
 +++ b/drivers/dma/imx-sdma.c
-@@ -1482,11 +1482,8 @@ static void sdma_load_firmware(const str
+@@ -1475,11 +1475,8 @@ static void sdma_load_firmware(const str
  	const struct sdma_script_start_addrs *addr;
  	unsigned short *ram_code;
  
@@ -205,7 +205,7 @@ upstream submission.
  	where = 0;
 --- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
 +++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
-@@ -1839,10 +1839,8 @@ gf100_gr_ctor_fw_legacy(struct gf100_gr
+@@ -1920,10 +1920,8 @@ gf100_gr_ctor_fw_legacy(struct gf100_gr
  	if (ret) {
  		snprintf(f, sizeof(f), "nouveau/%s", fwname);
  		ret = request_firmware(&fw, f, device->dev);
@@ -285,7 +285,7 @@ upstream submission.
  	ret = qib_ibsd_ucode_loaded(dd->pport, fw);
 --- a/drivers/input/touchscreen/atmel_mxt_ts.c
 +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
-@@ -2758,10 +2758,8 @@ static int mxt_load_fw(struct device *de
+@@ -2760,10 +2760,8 @@ static int mxt_load_fw(struct device *de
  	int ret;
  
  	ret = request_firmware(&fw, fn, dev);
@@ -361,7 +361,7 @@ upstream submission.
  	const struct firmware *fw = NULL;
  
 -	if ((ret = request_firmware(&fw, props->firmware, &udev->dev)) != 0) {
--		err("did not find the firmware file. (%s) Please see linux/Documentation/dvb/ for more details on firmware-problems. (%d)",
+-		err("did not find the firmware file '%s' (status %d). You can use <kernel_dir>/scripts/get_dvb_firmware to get the firmware",
 -			props->firmware,ret);
 +	ret = request_firmware(&fw, props->firmware, &udev->dev);
 +	if (ret)
@@ -379,7 +379,7 @@ upstream submission.
  	u8 *buf;
  	if ((ret = request_firmware(&fw, bcm4500_firmware,
 -					&d->udev->dev)) != 0) {
--		err("did not find the bcm4500 firmware file. (%s) Please see linux/Documentation/dvb/ for more details on firmware-problems. (%d)",
+-		err("did not find the bcm4500 firmware file '%s' (status %d). You can use <kernel_dir>/scripts/get_dvb_firmware to get the firmware",
 -			bcm4500_firmware,ret);
 +					&d->udev->dev)) != 0)
  		return ret;
@@ -393,7 +393,7 @@ upstream submission.
 -	info("downloading bcm4500 firmware from file '%s'",bcm4500_firmware);
 -
  	ptr = fw->data;
- 	buf = kmalloc(64, GFP_KERNEL | GFP_DMA);
+ 	buf = kmalloc(64, GFP_KERNEL);
  	if (!buf) {
 --- a/drivers/media/usb/dvb-usb/opera1.c
 +++ b/drivers/media/usb/dvb-usb/opera1.c
@@ -401,7 +401,7 @@ upstream submission.
  	info("start downloading fpga firmware %s",filename);
  
  	if ((ret = request_firmware(&fw, filename, &dev->dev)) != 0) {
--		err("did not find the firmware file. (%s) Please see linux/Documentation/dvb/ for more details on firmware-problems.",
+-		err("did not find the firmware file '%s'. You can use <kernel_dir>/scripts/get_dvb_firmware to get the firmware",
 -			filename);
  		return ret;
  	} else {
@@ -627,7 +627,7 @@ upstream submission.
  		ret = request_firmware(&fw, fw_file, &client->dev);
 -		if (ret) {
 -			dev_err(&client->dev,
--				"did not find the firmware file. (%s) Please see linux/Documentation/dvb/ for more details on firmware-problems. (%d)\n",
+-				"did not find the firmware file '%s' (status %d). You can use <kernel_dir>/scripts/get_dvb_firmware to get the firmware\n",
 -				fw_file, ret);
 +		if (ret)
  			goto error;
@@ -660,7 +660,7 @@ upstream submission.
  	}
 --- a/drivers/media/common/siano/smscoreapi.c
 +++ b/drivers/media/common/siano/smscoreapi.c
-@@ -1162,10 +1162,8 @@ static int smscore_load_firmware_from_fi
+@@ -1164,10 +1164,8 @@ static int smscore_load_firmware_from_fi
  		return -EINVAL;
  
  	rc = request_firmware(&fw, fw_filename, coredev->device);
@@ -671,7 +671,7 @@ upstream submission.
 -	}
  	pr_debug("read fw %s, buffer size=0x%zx\n", fw_filename, fw->size);
  	fw_buf = kmalloc(ALIGN(fw->size + sizeof(struct sms_firmware),
- 			 SMS_ALLOC_ALIGNMENT), GFP_KERNEL | GFP_DMA);
+ 			 SMS_ALLOC_ALIGNMENT), GFP_KERNEL | coredev->gfp_buf_flags);
 --- a/drivers/media/pci/ttpci/av7110.c
 +++ b/drivers/media/pci/ttpci/av7110.c
 @@ -1516,13 +1516,8 @@ static int get_firmware(struct av7110* a
@@ -845,7 +845,7 @@ upstream submission.
  	}
 --- a/drivers/media/usb/cx231xx/cx231xx-417.c
 +++ b/drivers/media/usb/cx231xx/cx231xx-417.c
-@@ -995,11 +995,6 @@ static int cx231xx_load_firmware(struct
+@@ -996,11 +996,6 @@ static int cx231xx_load_firmware(struct
  				  dev->dev);
  
  	if (retval != 0) {
@@ -880,7 +880,7 @@ upstream submission.
  
  		ret = request_firmware(&fw, filename, &dev->pci->dev);
 -		if (ret != 0)
--			pr_err("did not find the firmware file. (%s) Please see linux/Documentation/dvb/ for more details on firmware-problems.",
+-			pr_err("did not find the firmware file '%s'. You can use <kernel_dir>/scripts/get_dvb_firmware to get the firmware.",
 -			       filename);
 -		else
 +		if (ret == 0)
@@ -1103,7 +1103,7 @@ upstream submission.
  
 --- a/drivers/net/ethernet/broadcom/bnx2.c
 +++ b/drivers/net/ethernet/broadcom/bnx2.c
-@@ -3719,16 +3719,13 @@ static int bnx2_request_uncached_firmwar
+@@ -3720,16 +3720,13 @@ static int bnx2_request_uncached_firmwar
  	}
  
  	rc = request_firmware(&bp->mips_firmware, mips_fw_file, &bp->pdev->dev);
@@ -1140,7 +1140,7 @@ upstream submission.
  	if (rc) {
 --- a/drivers/net/ethernet/broadcom/tg3.c
 +++ b/drivers/net/ethernet/broadcom/tg3.c
-@@ -11378,11 +11378,8 @@ static int tg3_request_firmware(struct t
+@@ -11380,11 +11380,8 @@ static int tg3_request_firmware(struct t
  {
  	const struct tg3_firmware_hdr *fw_hdr;
  
@@ -1211,7 +1211,7 @@ upstream submission.
  	if (ret)
 --- a/drivers/net/ethernet/intel/e100.c
 +++ b/drivers/net/ethernet/intel/e100.c
-@@ -1291,9 +1291,6 @@ static const struct firmware *e100_reque
+@@ -1265,9 +1265,6 @@ static const struct firmware *e100_reque
  
  	if (err) {
  		if (required) {
@@ -1355,7 +1355,7 @@ upstream submission.
  
 --- a/drivers/net/wireless/atmel/atmel.c
 +++ b/drivers/net/wireless/atmel/atmel.c
-@@ -3908,12 +3908,8 @@ static int reset_atmel_card(struct net_d
+@@ -3897,12 +3897,8 @@ static int reset_atmel_card(struct net_d
  					strcpy(priv->firmware_id, "atmel_at76c502.bin");
  				}
  				err = request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev);
@@ -1433,7 +1433,7 @@ upstream submission.
  	}
 --- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c
 +++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
-@@ -8416,12 +8416,8 @@ static int ipw2100_get_firmware(struct i
+@@ -8417,12 +8417,8 @@ static int ipw2100_get_firmware(struct i
  
  	rc = request_firmware(&fw->fw_entry, fw_name, &priv->pci_dev->dev);
  
@@ -1473,7 +1473,7 @@ upstream submission.
  			else
 --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
 +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
-@@ -235,8 +235,6 @@ static int iwl_request_firmware(struct i
+@@ -236,8 +236,6 @@ static int iwl_request_firmware(struct i
  	}
  
  	if (drv->fw_index < cfg->ucode_api_min) {
@@ -1835,7 +1835,7 @@ upstream submission.
  	}
 --- a/drivers/scsi/ipr.c
 +++ b/drivers/scsi/ipr.c
-@@ -4061,10 +4061,8 @@ static ssize_t ipr_store_update_fw(struc
+@@ -4063,10 +4063,8 @@ static ssize_t ipr_store_update_fw(struc
  	if (endline)
  		*endline = '\0';
  
@@ -1873,7 +1873,7 @@ upstream submission.
  	}
 --- a/drivers/scsi/qla2xxx/qla_init.c
 +++ b/drivers/scsi/qla2xxx/qla_init.c
-@@ -7267,8 +7267,6 @@ qla2x00_load_risc(scsi_qla_host_t *vha,
+@@ -7275,8 +7275,6 @@ qla2x00_load_risc(scsi_qla_host_t *vha,
  	/* Load firmware blob. */
  	blob = qla2x00_request_firmware(vha);
  	if (!blob) {
@@ -1882,7 +1882,7 @@ upstream submission.
  		ql_log(ql_log_info, vha, 0x0084,
  		    "Firmware images can be retrieved from: "QLA_FW_URL ".\n");
  		return QLA_FUNCTION_FAILED;
-@@ -7370,8 +7368,6 @@ qla24xx_load_risc_blob(scsi_qla_host_t *
+@@ -7378,8 +7376,6 @@ qla24xx_load_risc_blob(scsi_qla_host_t *
  	/* Load firmware blob. */
  	blob = qla2x00_request_firmware(vha);
  	if (!blob) {
@@ -1908,7 +1908,7 @@ upstream submission.
  	if (qla82xx_validate_firmware_blob(vha,
 --- a/drivers/scsi/qla2xxx/qla_os.c
 +++ b/drivers/scsi/qla2xxx/qla_os.c
-@@ -6511,8 +6511,6 @@ qla2x00_request_firmware(scsi_qla_host_t
+@@ -6517,8 +6517,6 @@ qla2x00_request_firmware(scsi_qla_host_t
  		goto out;
  
  	if (request_firmware(&blob->fw, blob->name, &ha->pdev->dev)) {
@@ -1948,7 +1948,7 @@ upstream submission.
  			release_firmware(fw_entry);
 --- a/drivers/media/usb/go7007/go7007-fw.c
 +++ b/drivers/media/usb/go7007/go7007-fw.c
-@@ -1570,12 +1570,8 @@ int go7007_construct_fw_image(struct go7
+@@ -1573,12 +1573,8 @@ int go7007_construct_fw_image(struct go7
  	default:
  		return -1;
  	}
@@ -1959,7 +1959,7 @@ upstream submission.
 +	if (request_firmware(&fw_entry, GO7007_FW_NAME, go->dev))
  		return -1;
 -	}
- 	code = kzalloc(codespace * 2, GFP_KERNEL);
+ 	code = kcalloc(codespace, 2, GFP_KERNEL);
  	if (code == NULL)
  		goto fw_failed;
 --- a/drivers/media/usb/go7007/go7007-loader.c
@@ -2428,7 +2428,7 @@ upstream submission.
 @@ -60,11 +60,8 @@ static int get_firmware(const struct fir
  		"firmware requested: %s\n", card_fw[fw_index].data);
  	snprintf(name, sizeof(name), "ea/%s", card_fw[fw_index].data);
- 	err = request_firmware(fw_entry, name, pci_device(chip));
+ 	err = request_firmware(fw_entry, name, &chip->pci->dev);
 -	if (err < 0)
 -		dev_err(chip->card->dev,
 -			"get_firmware(): Firmware not available (%d)\n", err);
diff --git a/debian/patches/bugfix/all/ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-f.patch b/debian/patches/bugfix/all/ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-f.patch
deleted file mode 100644
index 3cb594ecb..000000000
--- a/debian/patches/bugfix/all/ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-f.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Wed, 9 May 2018 22:31:41 +0100
-Subject: IB: Fix RDMA_RXE and INFINIBAND_RDMAVT dependencies for DMA_VIRT_OPS
-
-DMA_VIRT_OPS requires that dma_addr_t is at least as wide as a
-pointer, which is expressed as a dependency on !64BIT ||
-ARCH_DMA_ADDR_T_64BIT.
-
-For parisc64 this is not true, and if these IB modules are enabled,
-kconfig warns:
-
-WARNING: unmet direct dependencies detected for DMA_VIRT_OPS
-  Depends on [n]: HAS_DMA [=y] && (!64BIT [=y] || ARCH_DMA_ADDR_T_64BIT)
-  Selected by [m]:
-  - INFINIBAND_RDMAVT [=m] && INFINIBAND [=m] && 64BIT [=y] && PCI [=y]
-  - RDMA_RXE [=m] && INET [=y] && PCI [=y] && INFINIBAND [=m]
-
-Add dependencies to fix this.
-
-Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
----
- drivers/infiniband/sw/rdmavt/Kconfig | 2 +-
- drivers/infiniband/sw/rxe/Kconfig    | 1 +
- 2 files changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/infiniband/sw/rdmavt/Kconfig b/drivers/infiniband/sw/rdmavt/Kconfig
-index 2b5513da7e83..98e798007f75 100644
---- a/drivers/infiniband/sw/rdmavt/Kconfig
-+++ b/drivers/infiniband/sw/rdmavt/Kconfig
-@@ -1,6 +1,6 @@
- config INFINIBAND_RDMAVT
- 	tristate "RDMA verbs transport library"
--	depends on 64BIT
-+	depends on 64BIT && ARCH_DMA_ADDR_T_64BIT
- 	depends on PCI
- 	select DMA_VIRT_OPS
- 	---help---
-diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig
-index bad4a576d7cf..67ae960ab523 100644
---- a/drivers/infiniband/sw/rxe/Kconfig
-+++ b/drivers/infiniband/sw/rxe/Kconfig
-@@ -1,6 +1,7 @@
- config RDMA_RXE
- 	tristate "Software RDMA over Ethernet (RoCE) driver"
- 	depends on INET && PCI && INFINIBAND
-+	depends on !64BIT || ARCH_DMA_ADDR_T_64BIT
- 	select NET_UDP_TUNNEL
- 	select CRYPTO_CRC32
- 	select DMA_VIRT_OPS
diff --git a/debian/patches/bugfix/all/kbuild-fix-recordmcount-dependency.patch b/debian/patches/bugfix/all/kbuild-fix-recordmcount-dependency.patch
index ee3ddd171..ee2355d99 100644
--- a/debian/patches/bugfix/all/kbuild-fix-recordmcount-dependency.patch
+++ b/debian/patches/bugfix/all/kbuild-fix-recordmcount-dependency.patch
@@ -9,8 +9,8 @@ sources.
 
 --- a/scripts/Makefile.build
 +++ b/scripts/Makefile.build
-@@ -253,6 +253,11 @@ cmd_record_mcount =						\
- 	fi;
+@@ -242,6 +242,11 @@ cmd_record_mcount =						\
+ endif # -record-mcount
  endif # CONFIG_FTRACE_MCOUNT_RECORD
  
 +# Don't require recordmcount source for an OOT build.
diff --git a/debian/patches/bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch b/debian/patches/bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch
index b546ff5b4..6749793ad 100644
--- a/debian/patches/bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch
+++ b/debian/patches/bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch
@@ -22,7 +22,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 ---
 --- a/scripts/Kbuild.include
 +++ b/scripts/Kbuild.include
-@@ -195,7 +195,7 @@ CC_OPTION_CFLAGS = $(filter-out $(GCC_PL
+@@ -121,7 +121,7 @@ CC_OPTION_CFLAGS = $(filter-out $(GCC_PL
  # Usage: cflags-y += $(call cc-option,-march=winchip-c6,-march=i586)
  
  cc-option = $(call __cc-option, $(CC),\
@@ -31,39 +31,39 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  
  # hostcc-option
  # Usage: cflags-y += $(call hostcc-option,-march=winchip-c6,-march=i586)
-@@ -205,23 +205,24 @@ hostcc-option = $(call __cc-option, $(HO
+@@ -131,23 +131,24 @@ hostcc-option = $(call __cc-option, $(HO
  # cc-option-yn
  # Usage: flag := $(call cc-option-yn,-march=winchip-c6)
- cc-option-yn = $(call try-run-cached,\
+ cc-option-yn = $(call try-run,\
 -	$(CC) -Werror $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",y,n)
 +	$(CC) -Werror $(NOSTDINC_FLAGS) $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",y,n)
  
  # cc-disable-warning
  # Usage: cflags-y += $(call cc-disable-warning,unused-but-set-variable)
- cc-disable-warning = $(call try-run-cached,\
+ cc-disable-warning = $(call try-run,\
 -	$(CC) -Werror $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -W$(strip $(1)) -c -x c /dev/null -o "$$TMP",-Wno-$(strip $(1)))
 +	$(CC) -Werror $(NOSTDINC_FLAGS) $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -W$(strip $(1)) -c -x c /dev/null -o "$$TMP",-Wno-$(strip $(1)))
  
  # cc-name
  # Expands to either gcc or clang
- cc-name = $(call shell-cached,$(CC) -v 2>&1 | grep -q "clang version" && echo clang || echo gcc)
+ cc-name = $(shell $(CC) -v 2>&1 | grep -q "clang version" && echo clang || echo gcc)
  
  # cc-version
--cc-version = $(call shell-cached,$(CONFIG_SHELL) $(srctree)/scripts/gcc-version.sh $(CC))
-+cc-version = $(call shell-cached,$(CONFIG_SHELL) \
+-cc-version = $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-version.sh $(CC))
++cc-version = $(shell $(CONFIG_SHELL) \
 +	$(srctree)/scripts/gcc-version.sh $(CC) $(NOSTDINC_FLAGS))
  
  # cc-fullversion
- cc-fullversion = $(call shell-cached,$(CONFIG_SHELL) \
+ cc-fullversion = $(shell $(CONFIG_SHELL) \
 -	$(srctree)/scripts/gcc-version.sh -p $(CC))
 +	$(srctree)/scripts/gcc-version.sh -p $(CC) $(NOSTDINC_FLAGS))
  
  # cc-ifversion
  # Usage:  EXTRA_CFLAGS += $(call cc-ifversion, -lt, 0402, -O1)
-@@ -234,7 +235,7 @@ cc-if-fullversion = $(shell [ $(cc-fullv
+@@ -160,7 +161,7 @@ cc-if-fullversion = $(shell [ $(cc-fullv
  # cc-ldoption
  # Usage: ldflags += $(call cc-ldoption, -Wl$(comma)--hash-style=both)
- cc-ldoption = $(call try-run-cached,\
+ cc-ldoption = $(call try-run,\
 -	$(CC) $(1) $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2))
 +	$(CC) $(1) $(NOSTDINC_FLAGS) $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2))
  
@@ -71,7 +71,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  # Usage: LDFLAGS += $(call ld-option, -X)
 --- a/Makefile
 +++ b/Makefile
-@@ -652,6 +652,8 @@ endif
+@@ -665,6 +665,8 @@ endif
  KBUILD_CFLAGS += $(call cc-ifversion, -lt, 0409, \
  			$(call cc-disable-warning,maybe-uninitialized,))
  
@@ -80,12 +80,12 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  # Tell gcc to never replace conditional load with a non-conditional one
  KBUILD_CFLAGS	+= $(call cc-option,--param=allow-store-data-races=0)
  
-@@ -803,7 +805,7 @@ KBUILD_CFLAGS	+= $(call cc-option,-fdata
+@@ -772,7 +774,7 @@ KBUILD_CFLAGS_KERNEL	+= $(call cc-option
  endif
  
  # arch Makefile may override CC so keep this after arch Makefile is included
--NOSTDINC_FLAGS += -nostdinc -isystem $(call shell-cached,$(CC) -print-file-name=include)
-+NOSTDINC_FLAGS += -isystem $(call shell-cached,$(CC) -print-file-name=include)
- CHECKFLAGS     += $(NOSTDINC_FLAGS)
+-NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)
++NOSTDINC_FLAGS += -isystem $(shell $(CC) -print-file-name=include)
  
  # warn about C99 declaration after statement
+ KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
diff --git a/debian/patches/bugfix/x86/virt-vbox-Only-copy_from_user-the-request-header-onc.patch b/debian/patches/bugfix/x86/virt-vbox-Only-copy_from_user-the-request-header-onc.patch
deleted file mode 100644
index 4f4db6fe2..000000000
--- a/debian/patches/bugfix/x86/virt-vbox-Only-copy_from_user-the-request-header-onc.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From: Wenwen Wang <wang6495@umn.edu>
-Date: Tue, 8 May 2018 08:50:28 -0500
-Subject: virt: vbox: Only copy_from_user the request-header once
-Origin: https://git.kernel.org/linus/bd23a7269834dc7c1f93e83535d16ebc44b75eba
-Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-12633
-
-In vbg_misc_device_ioctl(), the header of the ioctl argument is copied from
-the userspace pointer 'arg' and saved to the kernel object 'hdr'. Then the
-'version', 'size_in', and 'size_out' fields of 'hdr' are verified.
-
-Before this commit, after the checks a buffer for the entire request would
-be allocated and then all data including the verified header would be
-copied from the userspace 'arg' pointer again.
-
-Given that the 'arg' pointer resides in userspace, a malicious userspace
-process can race to change the data pointed to by 'arg' between the two
-copies. By doing so, the user can bypass the verifications on the ioctl
-argument.
-
-This commit fixes this by using the already checked copy of the header
-to fill the header part of the allocated buffer and only copying the
-remainder of the data from userspace.
-
-Signed-off-by: Wenwen Wang <wang6495@umn.edu>
-Reviewed-by: Hans de Goede <hdegoede@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/virt/vboxguest/vboxguest_linux.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
---- a/drivers/virt/vboxguest/vboxguest_linux.c
-+++ b/drivers/virt/vboxguest/vboxguest_linux.c
-@@ -121,7 +121,9 @@ static long vbg_misc_device_ioctl(struct
- 	if (!buf)
- 		return -ENOMEM;
- 
--	if (copy_from_user(buf, (void *)arg, hdr.size_in)) {
-+	*((struct vbg_ioctl_hdr *)buf) = hdr;
-+	if (copy_from_user(buf + sizeof(hdr), (void *)arg + sizeof(hdr),
-+			   hdr.size_in - sizeof(hdr))) {
- 		ret = -EFAULT;
- 		goto out;
- 	}
diff --git a/debian/patches/debian/android-enable-building-ashmem-and-binder-as-modules.patch b/debian/patches/debian/android-enable-building-ashmem-and-binder-as-modules.patch
index 2f44ad105..033a5a926 100644
--- a/debian/patches/debian/android-enable-building-ashmem-and-binder-as-modules.patch
+++ b/debian/patches/debian/android-enable-building-ashmem-and-binder-as-modules.patch
@@ -22,7 +22,7 @@ need them.
  config ANDROID_BINDER_IPC
 -	bool "Android Binder IPC Driver"
 +	tristate "Android Binder IPC Driver"
- 	depends on MMU
+ 	depends on MMU && !M68K
  	default n
  	---help---
 --- a/drivers/android/Makefile
@@ -45,16 +45,17 @@ need them.
 +	tristate "Enable the Anonymous Shared Memory Subsystem"
  	default n
  	depends on SHMEM
- 	---help---
+ 	help
 --- a/drivers/staging/android/Makefile
 +++ b/drivers/staging/android/Makefile
-@@ -2,4 +2,5 @@ ccflags-y += -I$(src)			# needed for tra
+@@ -2,5 +2,6 @@ ccflags-y += -I$(src)			# needed for tra
  
  obj-y					+= ion/
  
 -obj-$(CONFIG_ASHMEM)			+= ashmem.o
 +obj-$(CONFIG_ASHMEM)			+= ashmem_linux.o
 +ashmem_linux-y += ashmem.o
+ obj-$(CONFIG_ANDROID_VSOC)		+= vsoc.o
 --- a/drivers/staging/android/ashmem.c
 +++ b/drivers/staging/android/ashmem.c
 @@ -24,6 +24,7 @@
diff --git a/debian/patches/debian/kernelvariables.patch b/debian/patches/debian/kernelvariables.patch
index 717fc3572..7cc1778a9 100644
--- a/debian/patches/debian/kernelvariables.patch
+++ b/debian/patches/debian/kernelvariables.patch
@@ -14,9 +14,9 @@ use of $(ARCH) needs to be moved after this.
 
 --- a/Makefile
 +++ b/Makefile
-@@ -323,31 +323,6 @@ SUBARCH := $(shell uname -m | sed -e s/i
+@@ -320,31 +320,6 @@ SUBARCH := $(shell uname -m | sed -e s/i
+ # Note: Some architectures assign CROSS_COMPILE in their arch/*/Makefile
  ARCH		?= $(SUBARCH)
- CROSS_COMPILE	?= $(CONFIG_CROSS_COMPILE:"%"=%)
  
 -# Architecture as present in compile.h
 -UTS_MACHINE 	:= $(ARCH)
@@ -46,7 +46,7 @@ use of $(ARCH) needs to be moved after this.
  KCONFIG_CONFIG	?= .config
  export KCONFIG_CONFIG
  
-@@ -400,6 +375,30 @@ CFLAGS_KERNEL	=
+@@ -397,6 +372,30 @@ CFLAGS_KERNEL	=
  AFLAGS_KERNEL	=
  LDFLAGS_vmlinux =
  
diff --git a/debian/patches/debian/modpost-symbol-prefix.patch b/debian/patches/debian/modpost-symbol-prefix.patch
deleted file mode 100644
index 0bda5f242..000000000
--- a/debian/patches/debian/modpost-symbol-prefix.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From: Chris Boot <debian@bootc.net>
-Date: Mon, 01 Jul 2013 23:10:02 +0100
-Subject: modpost symbol prefix setting
-Forwarded: not-needed
-
-[bwh: The original version of this was added by Bastian Blank.  The
-upstream code includes <generated/autoconf.h> so that <linux/export.h>
-can tell whether C symbols have an underscore prefix.  Since we build
-modpost separately from the kernel, <generated/autoconf.h> won't exist.
-However, no Debian Linux architecture uses the symbol prefix, so we
-can simply omit it.]
-
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -19,7 +19,6 @@
- #include <stdbool.h>
- #include <errno.h>
- #include "modpost.h"
--#include "../../include/generated/autoconf.h"
- #include "../../include/linux/license.h"
- #include "../../include/linux/export.h"
- 
diff --git a/debian/patches/debian/revert-gpu-host1x-add-iommu-support.patch b/debian/patches/debian/revert-gpu-host1x-add-iommu-support.patch
deleted file mode 100644
index 134cbf28d..000000000
--- a/debian/patches/debian/revert-gpu-host1x-add-iommu-support.patch
+++ /dev/null
@@ -1,468 +0,0 @@
-From: Ben Hutchings <ben@decadent.org.uk>
-Date: Sat, 22 Jul 2017 01:14:38 +0100
-Subject: Revert "gpu: host1x: Add IOMMU support"
-Forwarded: no
-
-This reverts commit 404bfb78daf3bedafb0bfab24947059575cbea3d, which
-resulted in a build failure:
-
-drivers/gpu/host1x/cdma.c: In function 'host1x_pushbuffer_init':
-drivers/gpu/host1x/cdma.c:94:48: error: passing argument 3 of 'dma_alloc_wc' from incompatible pointer type [-Werror=incompatible-pointer-types]
-   pb->mapped = dma_alloc_wc(host1x->dev, size, &pb->phys,
-                                                ^
-In file included from drivers/gpu/host1x/cdma.c:22:0:
-include/linux/dma-mapping.h:773:21: note: expected 'dma_addr_t * {aka long long unsigned int *}' but argument is of type 'phys_addr_t * {aka unsigned int *}'
- static inline void *dma_alloc_wc(struct device *dev, size_t size,
-                     ^~~~~~~~~~~~
-
-This code is mixing up dma_addr_t and phys_addr_t, and this looks had
-to avoid when combining the two address mapping APIs.  But with XEN
-enabled and ARM_LPAE not enabled, as in the armmp config, dma_addr_t
-is 64-bit while phys_addr_t is 32-bit.
-
-It also reverts commits fea20995976f "gpu: host1x: Free the IOMMU
-domain when there is no device to attach", 8b3f5ac6b55f "gpu: host1x:
-Don't fail on NULL bo physical address", 1f876c3fcead "gpu: host1x:
-Rewrite conditional for better readability" and 41c3068cc2fd "gpu:
-host1x: Use IOMMU groups" which depend on it.
-
----
---- a/drivers/gpu/host1x/cdma.c
-+++ b/drivers/gpu/host1x/cdma.c
-@@ -51,15 +51,9 @@ static void host1x_pushbuffer_destroy(st
- 	struct host1x_cdma *cdma = pb_to_cdma(pb);
- 	struct host1x *host1x = cdma_to_host1x(cdma);
- 
--	if (!pb->phys)
--		return;
--
--	if (host1x->domain) {
--		iommu_unmap(host1x->domain, pb->dma, pb->alloc_size);
--		free_iova(&host1x->iova, iova_pfn(&host1x->iova, pb->dma));
--	}
--
--	dma_free_wc(host1x->dev, pb->alloc_size, pb->mapped, pb->phys);
-+	if (pb->phys != 0)
-+		dma_free_wc(host1x->dev, pb->size_bytes + 4, pb->mapped,
-+			    pb->phys);
- 
- 	pb->mapped = NULL;
- 	pb->phys = 0;
-@@ -72,64 +66,28 @@ static int host1x_pushbuffer_init(struct
- {
- 	struct host1x_cdma *cdma = pb_to_cdma(pb);
- 	struct host1x *host1x = cdma_to_host1x(cdma);
--	struct iova *alloc;
--	u32 size;
--	int err;
- 
- 	pb->mapped = NULL;
- 	pb->phys = 0;
--	pb->size = HOST1X_PUSHBUFFER_SLOTS * 8;
--
--	size = pb->size + 4;
-+	pb->size_bytes = HOST1X_PUSHBUFFER_SLOTS * 8;
- 
- 	/* initialize buffer pointers */
--	pb->fence = pb->size - 8;
-+	pb->fence = pb->size_bytes - 8;
- 	pb->pos = 0;
- 
--	if (host1x->domain) {
--		unsigned long shift;
--
--		size = iova_align(&host1x->iova, size);
--
--		pb->mapped = dma_alloc_wc(host1x->dev, size, &pb->phys,
--					  GFP_KERNEL);
--		if (!pb->mapped)
--			return -ENOMEM;
--
--		shift = iova_shift(&host1x->iova);
--		alloc = alloc_iova(&host1x->iova, size >> shift,
--				   host1x->iova_end >> shift, true);
--		if (!alloc) {
--			err = -ENOMEM;
--			goto iommu_free_mem;
--		}
--
--		pb->dma = iova_dma_addr(&host1x->iova, alloc);
--		err = iommu_map(host1x->domain, pb->dma, pb->phys, size,
--				IOMMU_READ);
--		if (err)
--			goto iommu_free_iova;
--	} else {
--		pb->mapped = dma_alloc_wc(host1x->dev, size, &pb->phys,
--					  GFP_KERNEL);
--		if (!pb->mapped)
--			return -ENOMEM;
--
--		pb->dma = pb->phys;
--	}
--
--	pb->alloc_size = size;
-+	/* allocate and map pushbuffer memory */
-+	pb->mapped = dma_alloc_wc(host1x->dev, pb->size_bytes + 4, &pb->phys,
-+				  GFP_KERNEL);
-+	if (!pb->mapped)
-+		goto fail;
- 
- 	host1x_hw_pushbuffer_init(host1x, pb);
- 
- 	return 0;
- 
--iommu_free_iova:
--	__free_iova(&host1x->iova, alloc);
--iommu_free_mem:
--	dma_free_wc(host1x->dev, pb->alloc_size, pb->mapped, pb->phys);
--
--	return err;
-+fail:
-+	host1x_pushbuffer_destroy(pb);
-+	return -ENOMEM;
- }
- 
- /*
-@@ -143,7 +101,7 @@ static void host1x_pushbuffer_push(struc
- 	WARN_ON(pb->pos == pb->fence);
- 	*(p++) = op1;
- 	*(p++) = op2;
--	pb->pos = (pb->pos + 8) & (pb->size - 1);
-+	pb->pos = (pb->pos + 8) & (pb->size_bytes - 1);
- }
- 
- /*
-@@ -153,7 +111,7 @@ static void host1x_pushbuffer_push(struc
- static void host1x_pushbuffer_pop(struct push_buffer *pb, unsigned int slots)
- {
- 	/* Advance the next write position */
--	pb->fence = (pb->fence + slots * 8) & (pb->size - 1);
-+	pb->fence = (pb->fence + slots * 8) & (pb->size_bytes - 1);
- }
- 
- /*
-@@ -161,7 +119,7 @@ static void host1x_pushbuffer_pop(struct
-  */
- static u32 host1x_pushbuffer_space(struct push_buffer *pb)
- {
--	return ((pb->fence - pb->pos) & (pb->size - 1)) / 8;
-+	return ((pb->fence - pb->pos) & (pb->size_bytes - 1)) / 8;
- }
- 
- /*
---- a/drivers/gpu/host1x/cdma.h
-+++ b/drivers/gpu/host1x/cdma.h
-@@ -43,12 +43,10 @@ struct host1x_job;
- 
- struct push_buffer {
- 	void *mapped;			/* mapped pushbuffer memory */
--	dma_addr_t dma;			/* device address of pushbuffer */
--	phys_addr_t phys;		/* physical address of pushbuffer */
-+	dma_addr_t phys;		/* physical address of pushbuffer */
- 	u32 fence;			/* index we've written */
- 	u32 pos;			/* index to write to */
--	u32 size;
--	u32 alloc_size;
-+	u32 size_bytes;
- };
- 
- struct buffer_timeout {
---- a/drivers/gpu/host1x/dev.c
-+++ b/drivers/gpu/host1x/dev.c
-@@ -27,7 +27,6 @@
- 
- #define CREATE_TRACE_POINTS
- #include <trace/events/host1x.h>
--#undef CREATE_TRACE_POINTS
- 
- #include "bus.h"
- #include "channel.h"
-@@ -218,44 +217,11 @@ static int host1x_probe(struct platform_
- 		return err;
- 	}
- 
--	host->group = iommu_group_get(&pdev->dev);
--	if (host->group) {
--		struct iommu_domain_geometry *geometry;
--		unsigned long order;
--
--		host->domain = iommu_domain_alloc(&platform_bus_type);
--		if (!host->domain) {
--			err = -ENOMEM;
--			goto put_group;
--		}
--
--		err = iommu_attach_group(host->domain, host->group);
--		if (err) {
--			if (err == -ENODEV) {
--				iommu_domain_free(host->domain);
--				host->domain = NULL;
--				iommu_group_put(host->group);
--				host->group = NULL;
--				goto skip_iommu;
--			}
--
--			goto fail_free_domain;
--		}
--
--		geometry = &host->domain->geometry;
--
--		order = __ffs(host->domain->pgsize_bitmap);
--		init_iova_domain(&host->iova, 1UL << order,
--				 geometry->aperture_start >> order);
--		host->iova_end = geometry->aperture_end;
--	}
--
--skip_iommu:
- 	err = host1x_channel_list_init(&host->channel_list,
- 				       host->info->nb_channels);
- 	if (err) {
- 		dev_err(&pdev->dev, "failed to initialize channel list\n");
--		goto fail_detach_device;
-+		return err;
- 	}
- 
- 	err = clk_prepare_enable(host->clk);
-@@ -300,17 +266,6 @@ fail_unprepare_disable:
- 	clk_disable_unprepare(host->clk);
- fail_free_channels:
- 	host1x_channel_list_free(&host->channel_list);
--fail_detach_device:
--	if (host->group && host->domain) {
--		put_iova_domain(&host->iova);
--		iommu_detach_group(host->domain, host->group);
--	}
--fail_free_domain:
--	if (host->domain)
--		iommu_domain_free(host->domain);
--put_group:
--	iommu_group_put(host->group);
--
- 	return err;
- }
- 
-@@ -324,13 +279,6 @@ static int host1x_remove(struct platform
- 	reset_control_assert(host->rst);
- 	clk_disable_unprepare(host->clk);
- 
--	if (host->domain) {
--		put_iova_domain(&host->iova);
--		iommu_detach_group(host->domain, host->group);
--		iommu_domain_free(host->domain);
--		iommu_group_put(host->group);
--	}
--
- 	return 0;
- }
- 
---- a/drivers/gpu/host1x/dev.h
-+++ b/drivers/gpu/host1x/dev.h
-@@ -18,8 +18,6 @@
- #define HOST1X_DEV_H
- 
- #include <linux/device.h>
--#include <linux/iommu.h>
--#include <linux/iova.h>
- #include <linux/platform_device.h>
- #include <linux/reset.h>
- 
-@@ -117,11 +115,6 @@ struct host1x {
- 	struct clk *clk;
- 	struct reset_control *rst;
- 
--	struct iommu_group *group;
--	struct iommu_domain *domain;
--	struct iova_domain iova;
--	dma_addr_t iova_end;
--
- 	struct mutex intr_mutex;
- 	int intr_syncpt_irq;
- 
---- a/drivers/gpu/host1x/hw/cdma_hw.c
-+++ b/drivers/gpu/host1x/hw/cdma_hw.c
-@@ -30,7 +30,7 @@
-  */
- static void push_buffer_init(struct push_buffer *pb)
- {
--	*(u32 *)(pb->mapped + pb->size) = host1x_opcode_restart(0);
-+	*(u32 *)(pb->mapped + pb->size_bytes) = host1x_opcode_restart(0);
- }
- 
- /*
-@@ -55,8 +55,8 @@ static void cdma_timeout_cpu_incr(struct
- 		*(p++) = HOST1X_OPCODE_NOP;
- 		*(p++) = HOST1X_OPCODE_NOP;
- 		dev_dbg(host1x->dev, "%s: NOP at %pad+%#x\n", __func__,
--			&pb->dma, getptr);
--		getptr = (getptr + 8) & (pb->size - 1);
-+			&pb->phys, getptr);
-+		getptr = (getptr + 8) & (pb->size_bytes - 1);
- 	}
- 
- 	wmb();
-@@ -78,9 +78,10 @@ static void cdma_start(struct host1x_cdm
- 			 HOST1X_CHANNEL_DMACTRL);
- 
- 	/* set base, put and end pointer */
--	host1x_ch_writel(ch, cdma->push_buffer.dma, HOST1X_CHANNEL_DMASTART);
-+	host1x_ch_writel(ch, cdma->push_buffer.phys, HOST1X_CHANNEL_DMASTART);
- 	host1x_ch_writel(ch, cdma->push_buffer.pos, HOST1X_CHANNEL_DMAPUT);
--	host1x_ch_writel(ch, cdma->push_buffer.dma + cdma->push_buffer.size + 4,
-+	host1x_ch_writel(ch, cdma->push_buffer.phys +
-+			 cdma->push_buffer.size_bytes + 4,
- 			 HOST1X_CHANNEL_DMAEND);
- 
- 	/* reset GET */
-@@ -114,8 +115,9 @@ static void cdma_timeout_restart(struct
- 			 HOST1X_CHANNEL_DMACTRL);
- 
- 	/* set base, end pointer (all of memory) */
--	host1x_ch_writel(ch, cdma->push_buffer.dma, HOST1X_CHANNEL_DMASTART);
--	host1x_ch_writel(ch, cdma->push_buffer.dma + cdma->push_buffer.size,
-+	host1x_ch_writel(ch, cdma->push_buffer.phys, HOST1X_CHANNEL_DMASTART);
-+	host1x_ch_writel(ch, cdma->push_buffer.phys +
-+			 cdma->push_buffer.size_bytes,
- 			 HOST1X_CHANNEL_DMAEND);
- 
- 	/* set GET, by loading the value in PUT (then reset GET) */
---- a/drivers/gpu/host1x/job.c
-+++ b/drivers/gpu/host1x/job.c
-@@ -178,10 +178,9 @@ static int do_waitchks(struct host1x_job
- 	return 0;
- }
- 
--static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
-+static unsigned int pin_job(struct host1x_job *job)
- {
- 	unsigned int i;
--	int err;
- 
- 	job->num_unpins = 0;
- 
-@@ -191,12 +190,12 @@ static unsigned int pin_job(struct host1
- 		dma_addr_t phys_addr;
- 
- 		reloc->target.bo = host1x_bo_get(reloc->target.bo);
--		if (!reloc->target.bo) {
--			err = -EINVAL;
-+		if (!reloc->target.bo)
- 			goto unpin;
--		}
- 
- 		phys_addr = host1x_bo_pin(reloc->target.bo, &sgt);
-+		if (!phys_addr)
-+			goto unpin;
- 
- 		job->addr_phys[job->num_unpins] = phys_addr;
- 		job->unpins[job->num_unpins].bo = reloc->target.bo;
-@@ -206,63 +205,28 @@ static unsigned int pin_job(struct host1
- 
- 	for (i = 0; i < job->num_gathers; i++) {
- 		struct host1x_job_gather *g = &job->gathers[i];
--		size_t gather_size = 0;
--		struct scatterlist *sg;
- 		struct sg_table *sgt;
- 		dma_addr_t phys_addr;
--		unsigned long shift;
--		struct iova *alloc;
--		unsigned int j;
- 
- 		g->bo = host1x_bo_get(g->bo);
--		if (!g->bo) {
--			err = -EINVAL;
-+		if (!g->bo)
- 			goto unpin;
--		}
- 
- 		phys_addr = host1x_bo_pin(g->bo, &sgt);
-+		if (!phys_addr)
-+			goto unpin;
- 
--		if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && host->domain) {
--			for_each_sg(sgt->sgl, sg, sgt->nents, j)
--				gather_size += sg->length;
--			gather_size = iova_align(&host->iova, gather_size);
--
--			shift = iova_shift(&host->iova);
--			alloc = alloc_iova(&host->iova, gather_size >> shift,
--					   host->iova_end >> shift, true);
--			if (!alloc) {
--				err = -ENOMEM;
--				goto unpin;
--			}
--
--			err = iommu_map_sg(host->domain,
--					iova_dma_addr(&host->iova, alloc),
--					sgt->sgl, sgt->nents, IOMMU_READ);
--			if (err == 0) {
--				__free_iova(&host->iova, alloc);
--				err = -EINVAL;
--				goto unpin;
--			}
--
--			job->addr_phys[job->num_unpins] =
--				iova_dma_addr(&host->iova, alloc);
--			job->unpins[job->num_unpins].size = gather_size;
--		} else {
--			job->addr_phys[job->num_unpins] = phys_addr;
--		}
--
--		job->gather_addr_phys[i] = job->addr_phys[job->num_unpins];
--
-+		job->addr_phys[job->num_unpins] = phys_addr;
- 		job->unpins[job->num_unpins].bo = g->bo;
- 		job->unpins[job->num_unpins].sgt = sgt;
- 		job->num_unpins++;
- 	}
- 
--	return 0;
-+	return job->num_unpins;
- 
- unpin:
- 	host1x_job_unpin(job);
--	return err;
-+	return 0;
- }
- 
- static int do_relocs(struct host1x_job *job, struct host1x_job_gather *g)
-@@ -631,8 +595,8 @@ int host1x_job_pin(struct host1x_job *jo
- 		host1x_syncpt_load(host->syncpt + i);
- 
- 	/* pin memory */
--	err = pin_job(host, job);
--	if (err)
-+	err = pin_job(job);
-+	if (!err)
- 		goto out;
- 
- 	if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) {
-@@ -680,19 +644,11 @@ EXPORT_SYMBOL(host1x_job_pin);
- 
- void host1x_job_unpin(struct host1x_job *job)
- {
--	struct host1x *host = dev_get_drvdata(job->channel->dev->parent);
- 	unsigned int i;
- 
- 	for (i = 0; i < job->num_unpins; i++) {
- 		struct host1x_job_unpin_data *unpin = &job->unpins[i];
- 
--		if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && host->domain) {
--			iommu_unmap(host->domain, job->addr_phys[i],
--				    unpin->size);
--			free_iova(&host->iova,
--				iova_pfn(&host->iova, job->addr_phys[i]));
--		}
--
- 		host1x_bo_unpin(unpin->bo, unpin->sgt);
- 		host1x_bo_put(unpin->bo);
- 	}
---- a/drivers/gpu/host1x/job.h
-+++ b/drivers/gpu/host1x/job.h
-@@ -30,7 +30,6 @@ struct host1x_job_gather {
- struct host1x_job_unpin_data {
- 	struct host1x_bo *bo;
- 	struct sg_table *sgt;
--	size_t size;
- };
- 
- /*
diff --git a/debian/patches/debian/tools-perf-version.patch b/debian/patches/debian/tools-perf-version.patch
index 4e99ee492..02721edf0 100644
--- a/debian/patches/debian/tools-perf-version.patch
+++ b/debian/patches/debian/tools-perf-version.patch
@@ -9,7 +9,7 @@ version-dependent name.  And do the same for trace.]
 
 --- a/tools/perf/Makefile.perf
 +++ b/tools/perf/Makefile.perf
-@@ -721,23 +721,23 @@ endif
+@@ -750,23 +750,23 @@ endif
  install-tools: all install-gtk
  	$(call QUIET_INSTALL, binaries) \
  		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(bindir_SQ)'; \
@@ -36,10 +36,10 @@ version-dependent name.  And do the same for trace.]
  endif
 -	$(call QUIET_INSTALL, libexec) \
 -		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perfexec_instdir_SQ)'
- 	$(call QUIET_INSTALL, perf-archive) \
- 		$(INSTALL) $(OUTPUT)perf-archive -t '$(DESTDIR_SQ)$(perfexec_instdir_SQ)'
- 	$(call QUIET_INSTALL, perf-with-kcore) \
-@@ -765,7 +765,7 @@ ifndef NO_LIBPYTHON
+ ifndef NO_LIBBPF
+ 	$(call QUIET_INSTALL, lib) \
+ 		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perf_include_instdir_SQ)/bpf'
+@@ -804,7 +804,7 @@ ifndef NO_LIBPYTHON
  endif
  	$(call QUIET_INSTALL, perf_completion-script) \
  		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(sysconfdir_SQ)/bash_completion.d'; \
@@ -48,7 +48,7 @@ version-dependent name.  And do the same for trace.]
  	$(call QUIET_INSTALL, perf-tip) \
  		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(tip_instdir_SQ)'; \
  		$(INSTALL) Documentation/tips.txt -t '$(DESTDIR_SQ)$(tip_instdir_SQ)'
-@@ -790,7 +790,7 @@ install-python_ext:
+@@ -829,7 +829,7 @@ install-python_ext:
  
  # 'make install-doc' should call 'make -C Documentation install'
  $(INSTALL_DOC_TARGETS):
@@ -59,7 +59,7 @@ version-dependent name.  And do the same for trace.]
  
 --- a/tools/perf/Documentation/Makefile
 +++ b/tools/perf/Documentation/Makefile
-@@ -183,14 +183,16 @@ ifdef missing_tools
+@@ -194,14 +194,16 @@ ifdef missing_tools
  	$(error "You need to install $(missing_tools) for man pages")
  endif
  
@@ -84,7 +84,7 @@ version-dependent name.  And do the same for trace.]
  
 --- a/tools/perf/util/Build
 +++ b/tools/perf/util/Build
-@@ -179,6 +179,7 @@ CFLAGS_libstring.o     += -Wno-unused-pa
+@@ -192,6 +192,7 @@ CFLAGS_libstring.o     += -Wno-unused-pa
  CFLAGS_hweight.o       += -Wno-unused-parameter -DETC_PERFCONFIG="BUILD_STR($(ETC_PERFCONFIG_SQ))"
  CFLAGS_parse-events.o  += -Wno-redundant-decls
  CFLAGS_header.o        += -include $(OUTPUT)PERF-VERSION-FILE
@@ -94,7 +94,7 @@ version-dependent name.  And do the same for trace.]
  	$(call rule_mkdir)
 --- a/tools/perf/util/vdso.c
 +++ b/tools/perf/util/vdso.c
-@@ -51,12 +51,12 @@ static struct vdso_info *vdso_info__new(
+@@ -52,12 +52,12 @@ static struct vdso_info *vdso_info__new(
  		.vdso32  = {
  			.temp_file_name = VDSO__TEMP_FILE_NAME,
  			.dso_name = DSO__NAME_VDSO32,
diff --git a/debian/patches/debian/version.patch b/debian/patches/debian/version.patch
index 95c1165ab..28c40e94e 100644
--- a/debian/patches/debian/version.patch
+++ b/debian/patches/debian/version.patch
@@ -9,8 +9,8 @@ are set.
 
 --- a/Makefile
 +++ b/Makefile
-@@ -1103,7 +1103,7 @@ endif
- prepare2: prepare3 prepare-compiler-check outputmakefile asm-generic
+@@ -1077,7 +1077,7 @@ endif
+ prepare2: prepare3 outputmakefile asm-generic
  
  prepare1: prepare2 $(version_h) $(autoksyms_h) include/generated/utsrelease.h \
 -                   include/config/auto.conf
@@ -18,7 +18,7 @@ are set.
  	$(cmd_crmodverdir)
  
  archprepare: archheaders archscripts prepare1 scripts_basic
-@@ -1184,6 +1184,16 @@ define filechk_version.h
+@@ -1121,6 +1121,16 @@ define filechk_version.h
  	echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))';)
  endef
  
@@ -35,7 +35,7 @@ are set.
  $(version_h): $(srctree)/Makefile FORCE
  	$(call filechk,version.h)
  	$(Q)rm -f $(old_version_h)
-@@ -1191,6 +1201,9 @@ $(version_h): $(srctree)/Makefile FORCE
+@@ -1128,6 +1138,9 @@ $(version_h): $(srctree)/Makefile FORCE
  include/generated/utsrelease.h: include/config/kernel.release FORCE
  	$(call filechk,utsrelease.h)
  
@@ -99,7 +99,7 @@ are set.
  
  #include <asm/pgtable.h>
  #include <asm/io.h>
-@@ -1422,8 +1423,9 @@ void show_regs(struct pt_regs * regs)
+@@ -1406,8 +1407,9 @@ void show_regs(struct pt_regs * regs)
  
  	printk("NIP:  "REG" LR: "REG" CTR: "REG"\n",
  	       regs->nip, regs->link, regs->ctr);
@@ -121,7 +121,7 @@ are set.
  
  /*
   * The number of tasks checked:
-@@ -114,10 +115,11 @@ static void check_hung_task(struct task_
+@@ -115,10 +116,11 @@ static void check_hung_task(struct task_
  			sysctl_hung_task_warnings--;
  		pr_err("INFO: task %s:%d blocked for more than %ld seconds.\n",
  			t->comm, t->pid, timeout);
diff --git a/debian/patches/features/all/drivers-media-dvb-usb-af9005-request_firmware.patch b/debian/patches/features/all/drivers-media-dvb-usb-af9005-request_firmware.patch
index 7ab3e6bf1..d40c58db6 100644
--- a/debian/patches/features/all/drivers-media-dvb-usb-af9005-request_firmware.patch
+++ b/debian/patches/features/all/drivers-media-dvb-usb-af9005-request_firmware.patch
@@ -13,7 +13,7 @@ a version of the script which is directly derived from the driver.
 
 --- a/drivers/media/usb/dvb-usb/Kconfig
 +++ b/drivers/media/usb/dvb-usb/Kconfig
-@@ -227,10 +227,10 @@ config DVB_USB_OPERA1
+@@ -246,10 +246,10 @@ config DVB_USB_OPERA1
  
  config DVB_USB_AF9005
  	tristate "Afatech AF9005 DVB-T USB1.1 support"
@@ -27,8 +27,8 @@ a version of the script which is directly derived from the driver.
  	  and the TerraTec Cinergy T USB XE (Rev.1)
 --- a/drivers/media/usb/dvb-usb/af9005-fe.c
 +++ b/drivers/media/usb/dvb-usb/af9005-fe.c
-@@ -22,10 +22,26 @@
-  * see Documentation/dvb/README.dvb-usb for more information
+@@ -18,10 +18,26 @@
+  * see Documentation/media/dvb-drivers/dvb-usb.rst for more information
   */
  #include "af9005.h"
 -#include "af9005-script.h"
@@ -55,7 +55,7 @@ a version of the script which is directly derived from the driver.
  
  struct af9005_fe_state {
  	struct dvb_usb_device *d;
-@@ -816,6 +832,8 @@ static int af9005_fe_init(struct dvb_fro
+@@ -813,6 +829,8 @@ static int af9005_fe_init(struct dvb_fro
  {
  	struct af9005_fe_state *state = fe->demodulator_priv;
  	struct dvb_usb_adapter *adap = fe->dvb->priv;
@@ -64,7 +64,7 @@ a version of the script which is directly derived from the driver.
  	int ret, i, scriptlen;
  	u8 temp, temp0 = 0, temp1 = 0, temp2 = 0;
  	u8 buf[2];
-@@ -968,37 +986,55 @@ static int af9005_fe_init(struct dvb_fro
+@@ -965,37 +983,55 @@ static int af9005_fe_init(struct dvb_fro
  	if ((ret = af9005_write_ofdm_register(state->d, 0xaefb, 0x01)))
  		return ret;
  
@@ -132,7 +132,7 @@ a version of the script which is directly derived from the driver.
  
  	/* save original TOPs */
  	deb_info("save original TOPs\n");
-@@ -1078,6 +1114,10 @@ static int af9005_fe_init(struct dvb_fro
+@@ -1075,6 +1111,10 @@ static int af9005_fe_init(struct dvb_fro
  
  	deb_info("profit!\n");
  	return 0;
diff --git a/debian/patches/features/all/lockdown/0003-ima-require-secure_boot-rules-in-lockdown-mode.patch b/debian/patches/features/all/lockdown/0003-ima-require-secure_boot-rules-in-lockdown-mode.patch
index fd9bc7a67..87b6557b0 100644
--- a/debian/patches/features/all/lockdown/0003-ima-require-secure_boot-rules-in-lockdown-mode.patch
+++ b/debian/patches/features/all/lockdown/0003-ima-require-secure_boot-rules-in-lockdown-mode.patch
@@ -9,15 +9,15 @@ in secure boot lockdown mode.
 
 Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
 Signed-off-by: David Howells <dhowells@redhat.com>
+[bwh: Adjust context to apply after commit 6f0911a666d1
+ "ima: fix updating the ima_appraise flag"]
 ---
  security/integrity/ima/ima_policy.c | 39 +++++++++++++++++++++++++++----------
  1 file changed, 29 insertions(+), 10 deletions(-)
 
-diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
-index 95209a5f8595..49c75e2a1ec5 100644
 --- a/security/integrity/ima/ima_policy.c
 +++ b/security/integrity/ima/ima_policy.c
-@@ -427,14 +427,21 @@ void ima_update_policy_flag(void)
+@@ -459,14 +459,21 @@ static int ima_appraise_flag(enum ima_ho
   */
  void __init ima_init_policy(void)
  {
@@ -45,7 +45,7 @@ index 95209a5f8595..49c75e2a1ec5 100644
  
  	for (i = 0; i < measure_entries; i++)
  		list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
-@@ -455,11 +462,23 @@ void __init ima_init_policy(void)
+@@ -487,12 +494,24 @@ void __init ima_init_policy(void)
  
  	/*
  	 * Insert the appraise rules requiring file signatures, prior to
@@ -53,14 +53,13 @@ index 95209a5f8595..49c75e2a1ec5 100644
 +	 * any other appraise rules.  In secure boot lock-down mode, also
 +	 * require these appraise rules for custom policies.
  	 */
--	for (i = 0; i < secure_boot_entries; i++)
--		list_add_tail(&secure_boot_rules[i].list,
--			      &ima_default_rules);
-+	for (i = 0; i < secure_boot_entries; i++) {
+ 	for (i = 0; i < secure_boot_entries; i++) {
 +		struct ima_rule_entry *entry;
 +
 +		/* Include for builtin policies */
-+		list_add_tail(&secure_boot_rules[i].list, &ima_default_rules);
+ 		list_add_tail(&secure_boot_rules[i].list, &ima_default_rules);
+ 		temp_ima_appraise |=
+ 		    ima_appraise_flag(secure_boot_rules[i].func);
 +
 +		/* Include for custom policies */
 +		if (kernel_locked_down) {
@@ -69,7 +68,6 @@ index 95209a5f8595..49c75e2a1ec5 100644
 +			if (entry)
 +				list_add_tail(&entry->list, &ima_policy_rules);
 +		}
-+	}
+ 	}
  
  	for (i = 0; i < appraise_entries; i++) {
- 		list_add_tail(&default_appraise_rules[i].list,
diff --git a/debian/patches/features/all/lockdown/0004-Enforce-module-signatures-if-the-kernel-is-locked-do.patch b/debian/patches/features/all/lockdown/0004-Enforce-module-signatures-if-the-kernel-is-locked-do.patch
index 87ce05432..285b1a514 100644
--- a/debian/patches/features/all/lockdown/0004-Enforce-module-signatures-if-the-kernel-is-locked-do.patch
+++ b/debian/patches/features/all/lockdown/0004-Enforce-module-signatures-if-the-kernel-is-locked-do.patch
@@ -9,12 +9,12 @@ signatures that we can verify or that IMA can validate the file.
 Signed-off-by: David Howells <dhowells@redhat.com>
 Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
 Reviewed-by: James Morris <james.l.morris@oracle.com>
+[bwh: Adjust context to apply after commit 2c8fd268f418
+ "module: Do not access sig_enforce directly"]
 ---
  kernel/module.c | 19 ++++++++++++-------
  1 file changed, 12 insertions(+), 7 deletions(-)
 
-diff --git a/kernel/module.c b/kernel/module.c
-index de66ec825992..0ce29c8aa75a 100644
 --- a/kernel/module.c
 +++ b/kernel/module.c
 @@ -64,6 +64,7 @@
@@ -25,7 +25,7 @@ index de66ec825992..0ce29c8aa75a 100644
  #include <uapi/linux/module.h>
  #include "module-internal.h"
  
-@@ -2757,7 +2758,8 @@ static inline void kmemleak_load_module(const struct module *mod,
+@@ -2759,7 +2760,8 @@ static inline void kmemleak_load_module(
  #endif
  
  #ifdef CONFIG_MODULE_SIG
@@ -35,12 +35,12 @@ index de66ec825992..0ce29c8aa75a 100644
  {
  	int err = -ENOKEY;
  	const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1;
-@@ -2781,13 +2783,16 @@ static int module_sig_check(struct load_info *info, int flags)
+@@ -2783,13 +2785,16 @@ static int module_sig_check(struct load_
  	}
  
  	/* Not having a signature is only an error if we're strict. */
--	if (err == -ENOKEY && !sig_enforce)
-+	if (err == -ENOKEY && !sig_enforce &&
+-	if (err == -ENOKEY && !is_module_sig_enforced())
++	if (err == -ENOKEY && !is_module_sig_enforced() &&
 +	    (!can_do_ima_check || !is_ima_appraise_enabled()) &&
 +	    !kernel_is_locked_down("Loading of unsigned modules"))
  		err = 0;
@@ -54,7 +54,7 @@ index de66ec825992..0ce29c8aa75a 100644
  {
  	return 0;
  }
-@@ -3630,13 +3635,13 @@ static int unknown_module_param_cb(char *param, char *val, const char *modname,
+@@ -3654,13 +3659,13 @@ static int unknown_module_param_cb(char
  /* Allocate and load the module: note that size of section 0 is always
     zero, and we rely on this for optional sections. */
  static int load_module(struct load_info *info, const char __user *uargs,
@@ -70,7 +70,7 @@ index de66ec825992..0ce29c8aa75a 100644
  	if (err)
  		goto free_copy;
  
-@@ -3830,7 +3835,7 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
+@@ -3849,7 +3854,7 @@ SYSCALL_DEFINE3(init_module, void __user
  	if (err)
  		return err;
  
@@ -79,7 +79,7 @@ index de66ec825992..0ce29c8aa75a 100644
  }
  
  SYSCALL_DEFINE3(finit_module, int, fd, const char __user *, uargs, int, flags)
-@@ -3857,7 +3862,7 @@ SYSCALL_DEFINE3(finit_module, int, fd, const char __user *, uargs, int, flags)
+@@ -3876,7 +3881,7 @@ SYSCALL_DEFINE3(finit_module, int, fd, c
  	info.hdr = hdr;
  	info.len = size;
  
diff --git a/debian/patches/features/all/lockdown/0027-bpf-Restrict-kernel-image-access-functions-when-the-.patch b/debian/patches/features/all/lockdown/0027-bpf-Restrict-kernel-image-access-functions-when-the-.patch
index 4c9eaf972..bd79ea1a6 100644
--- a/debian/patches/features/all/lockdown/0027-bpf-Restrict-kernel-image-access-functions-when-the-.patch
+++ b/debian/patches/features/all/lockdown/0027-bpf-Restrict-kernel-image-access-functions-when-the-.patch
@@ -17,19 +17,21 @@ Signed-off-by: David Howells <dhowells@redhat.com>
 cc: netdev@vger.kernel.org
 cc: Chun-Yi Lee <jlee@suse.com>
 cc: Alexei Starovoitov <alexei.starovoitov@gmail.com>
+[bwh: Adjust context to apply after commit dcab51f19b29
+ "bpf: Expose check_uarg_tail_zero()"]
 ---
  kernel/bpf/syscall.c | 3 +++
  1 file changed, 3 insertions(+)
 
 --- a/kernel/bpf/syscall.c
 +++ b/kernel/bpf/syscall.c
-@@ -1848,6 +1848,9 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf
+@@ -2327,6 +2327,9 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf
  	if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN))
  		return -EPERM;
  
 +	if (kernel_is_locked_down("BPF"))
 +		return -EPERM;
 +
- 	err = check_uarg_tail_zero(uattr, sizeof(attr), size);
+ 	err = bpf_check_uarg_tail_zero(uattr, sizeof(attr), size);
  	if (err)
  		return err;
diff --git a/debian/patches/features/arm64/arm64-dts-broadcom-Add-reference-to-Raspberry-Pi-3-B.patch b/debian/patches/features/arm64/arm64-dts-broadcom-Add-reference-to-Raspberry-Pi-3-B.patch
deleted file mode 100644
index 91188b54b..000000000
--- a/debian/patches/features/arm64/arm64-dts-broadcom-Add-reference-to-Raspberry-Pi-3-B.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From bdd6d1fe1cd84806429467ce62a735bdc6bdbae7 Mon Sep 17 00:00:00 2001
-From: Stefan Wahren <stefan.wahren@i2se.com>
-Date: Sat, 21 Apr 2018 13:28:42 +0200
-Subject: [PATCH 2/2] arm64: dts: broadcom: Add reference to Raspberry Pi 3 B+
-
-This adds a reference to the dts of the Raspberry Pi 3 B+
-in arm, so don't need to maintain the content in arm64.
-
-Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
-Reviewed-by: Eric Anholt <eric@anholt.net>
-Signed-off-by: Eric Anholt <eric@anholt.net>
----
- arch/arm64/boot/dts/broadcom/Makefile                 | 3 ++-
- arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b-plus.dts | 2 ++
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/arch/arm64/boot/dts/broadcom/Makefile b/arch/arm64/boot/dts/broadcom/Makefile
-index 2a2591ef1fee..1193a9e34bbb 100644
---- a/arch/arm64/boot/dts/broadcom/Makefile
-+++ b/arch/arm64/boot/dts/broadcom/Makefile
-@@ -1,5 +1,6 @@
- # SPDX-License-Identifier: GPL-2.0
--dtb-$(CONFIG_ARCH_BCM2835) += bcm2837-rpi-3-b.dtb
-+dtb-$(CONFIG_ARCH_BCM2835) += bcm2837-rpi-3-b.dtb \
-+			      bcm2837-rpi-3-b-plus.dtb
- 
- subdir-y	+= northstar2
- subdir-y	+= stingray
-diff --git a/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b-plus.dts b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b-plus.dts
-new file mode 100644
-index 000000000000..46ad2023cccf
---- /dev/null
-+++ b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b-plus.dts
-@@ -0,0 +1,2 @@
-+// SPDX-License-Identifier: GPL-2.0
-+#include "arm/bcm2837-rpi-3-b-plus.dts"
--- 
-2.11.0
-
diff --git a/debian/patches/features/arm64/pinebook/0004-arm64-dts-allwinner-add-support-for-Pinebook.patch b/debian/patches/features/arm64/pinebook/0004-arm64-dts-allwinner-add-support-for-Pinebook.patch
index 6140232d8..200f16de8 100644
--- a/debian/patches/features/arm64/pinebook/0004-arm64-dts-allwinner-add-support-for-Pinebook.patch
+++ b/debian/patches/features/arm64/pinebook/0004-arm64-dts-allwinner-add-support-for-Pinebook.patch
@@ -45,10 +45,8 @@ Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
  2 files changed, 281 insertions(+)
  create mode 100644 arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
 
-Index: linux-4.17.2/arch/arm64/boot/dts/allwinner/Makefile
-===================================================================
---- linux-4.17.2.orig/arch/arm64/boot/dts/allwinner/Makefile
-+++ linux-4.17.2/arch/arm64/boot/dts/allwinner/Makefile
+--- a/arch/arm64/boot/dts/allwinner/Makefile
++++ b/arch/arm64/boot/dts/allwinner/Makefile
 @@ -4,6 +4,7 @@ dtb-$(CONFIG_ARCH_SUNXI) += sun50i-a64-n
  dtb-$(CONFIG_ARCH_SUNXI) += sun50i-a64-olinuxino.dtb
  dtb-$(CONFIG_ARCH_SUNXI) += sun50i-a64-orangepi-win.dtb
@@ -56,11 +54,9 @@ Index: linux-4.17.2/arch/arm64/boot/dts/allwinner/Makefile
 +dtb-$(CONFIG_ARCH_SUNXI) += sun50i-a64-pinebook.dtb
  dtb-$(CONFIG_ARCH_SUNXI) += sun50i-a64-sopine-baseboard.dtb
  dtb-$(CONFIG_ARCH_SUNXI) += sun50i-a64-teres-i.dtb
- dtb-$(CONFIG_ARCH_SUNXI) += sun50i-h5-orangepi-pc2.dtb
-Index: linux-4.17.2/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
-===================================================================
+ dtb-$(CONFIG_ARCH_SUNXI) += sun50i-h5-libretech-all-h3-cc.dtb
 --- /dev/null
-+++ linux-4.17.2/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
 @@ -0,0 +1,280 @@
 +// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
 +/*
diff --git a/debian/patches/features/armhf/ARM-dts-bcm2837-Add-Raspberry-Pi-3-B.patch b/debian/patches/features/armhf/ARM-dts-bcm2837-Add-Raspberry-Pi-3-B.patch
deleted file mode 100644
index cd9fd85d6..000000000
--- a/debian/patches/features/armhf/ARM-dts-bcm2837-Add-Raspberry-Pi-3-B.patch
+++ /dev/null
@@ -1,185 +0,0 @@
-From 71c0cd2283f29c16049d6459c2d4ce6230c3c81f Mon Sep 17 00:00:00 2001
-From: Stefan Wahren <stefan.wahren@i2se.com>
-Date: Sat, 21 Apr 2018 13:28:37 +0200
-Subject: [PATCH 1/2] ARM: dts: bcm2837: Add Raspberry Pi 3 B+
-
-The Raspberry Pi 3 B+ has the following major differences compared
-to the model 3 B:
-* Microchip LAN7515 (Gigabit Ethernet with integrated USB 2.0 HUB)
-* Cypress CYW43455 (802.11n/ac and BT 4.2)
-
-We need to add the USB LAN chip so the bootloader can add the MAC address.
-This is necessary because there ain't an EEPROM or a valid OTP.
-
-Signed-off-by: Phil Elwell <phil@raspberrypi.org>
-Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
-Reviewed-by: Eric Anholt <eric@anholt.net>
-Signed-off-by: Eric Anholt <eric@anholt.net>
----
- arch/arm/boot/dts/Makefile                 |   1 +
- arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 108 +++++++++++++++++++++++++++++
- arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi |  27 ++++++++
- 3 files changed, 136 insertions(+)
-
-diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
-index 7e2424957809..a300a3599d59 100644
---- a/arch/arm/boot/dts/Makefile
-+++ b/arch/arm/boot/dts/Makefile
-@@ -75,6 +75,7 @@ dtb-$(CONFIG_ARCH_BCM2835) += \
- 	bcm2835-rpi-a-plus.dtb \
- 	bcm2836-rpi-2-b.dtb \
- 	bcm2837-rpi-3-b.dtb \
-+	bcm2837-rpi-3-b-plus.dtb \
- 	bcm2835-rpi-zero.dtb \
- 	bcm2835-rpi-zero-w.dtb
- dtb-$(CONFIG_ARCH_BCM_5301X) += \
-diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
-new file mode 100644
-index 000000000000..4adb85e66be3
---- /dev/null
-+++ b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts
-@@ -0,0 +1,108 @@
-+// SPDX-License-Identifier: GPL-2.0
-+/dts-v1/;
-+#include "bcm2837.dtsi"
-+#include "bcm2835-rpi.dtsi"
-+#include "bcm283x-rpi-lan7515.dtsi"
-+#include "bcm283x-rpi-usb-host.dtsi"
-+
-+/ {
-+	compatible = "raspberrypi,3-model-b-plus", "brcm,bcm2837";
-+	model = "Raspberry Pi 3 Model B+";
-+
-+	chosen {
-+		/* 8250 auxiliary UART instead of pl011 */
-+		stdout-path = "serial1:115200n8";
-+	};
-+
-+	memory {
-+		reg = <0 0x40000000>;
-+	};
-+
-+	leds {
-+		act {
-+			gpios = <&gpio 29 GPIO_ACTIVE_HIGH>;
-+		};
-+
-+		pwr {
-+			label = "PWR";
-+			gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
-+		};
-+	};
-+
-+	wifi_pwrseq: wifi-pwrseq {
-+		compatible = "mmc-pwrseq-simple";
-+		reset-gpios = <&expgpio 1 GPIO_ACTIVE_HIGH>;
-+	};
-+};
-+
-+&firmware {
-+	expgpio: gpio {
-+		compatible = "raspberrypi,firmware-gpio";
-+		gpio-controller;
-+		#gpio-cells = <2>;
-+		gpio-line-names = "BT_ON",
-+				  "WL_ON",
-+				  "STATUS_LED",
-+				  "LAN_RUN",
-+				  "",
-+				  "CAM_GPIO0",
-+				  "CAM_GPIO1",
-+				  "";
-+		status = "okay";
-+	};
-+};
-+
-+&hdmi {
-+	hpd-gpios = <&gpio 28 GPIO_ACTIVE_LOW>;
-+};
-+
-+&pwm {
-+	pinctrl-names = "default";
-+	pinctrl-0 = <&pwm0_gpio40 &pwm1_gpio41>;
-+	status = "okay";
-+};
-+
-+/* SDHCI is used to control the SDIO for wireless */
-+&sdhci {
-+	#address-cells = <1>;
-+	#size-cells = <0>;
-+	pinctrl-names = "default";
-+	pinctrl-0 = <&emmc_gpio34>;
-+	status = "okay";
-+	bus-width = <4>;
-+	non-removable;
-+	mmc-pwrseq = <&wifi_pwrseq>;
-+
-+	brcmf: wifi@1 {
-+		reg = <1>;
-+		compatible = "brcm,bcm4329-fmac";
-+	};
-+};
-+
-+/* SDHOST is used to drive the SD card */
-+&sdhost {
-+	pinctrl-names = "default";
-+	pinctrl-0 = <&sdhost_gpio48>;
-+	status = "okay";
-+	bus-width = <4>;
-+};
-+
-+/* uart0 communicates with the BT module */
-+&uart0 {
-+	pinctrl-names = "default";
-+	pinctrl-0 = <&uart0_ctsrts_gpio30 &uart0_gpio32 &gpclk2_gpio43>;
-+	status = "okay";
-+
-+	bluetooth {
-+		compatible = "brcm,bcm43438-bt";
-+		max-speed = <2000000>;
-+		shutdown-gpios = <&expgpio 0 GPIO_ACTIVE_HIGH>;
-+	};
-+};
-+
-+/* uart1 is mapped to the pin header */
-+&uart1 {
-+	pinctrl-names = "default";
-+	pinctrl-0 = <&uart1_gpio14>;
-+	status = "okay";
-+};
-diff --git a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
-new file mode 100644
-index 000000000000..9403da0990d0
---- /dev/null
-+++ b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
-@@ -0,0 +1,27 @@
-+// SPDX-License-Identifier: GPL-2.0
-+/ {
-+	aliases {
-+		ethernet0 = &ethernet;
-+	};
-+};
-+
-+&usb {
-+	usb-port@1 {
-+		compatible = "usb424,2514";
-+		reg = <1>;
-+		#address-cells = <1>;
-+		#size-cells = <0>;
-+
-+		usb-port@1 {
-+			compatible = "usb424,2514";
-+			reg = <1>;
-+			#address-cells = <1>;
-+			#size-cells = <0>;
-+
-+			ethernet: ethernet@1 {
-+				compatible = "usb424,7800";
-+				reg = <1>;
-+			};
-+		};
-+	};
-+};
--- 
-2.11.0
-
diff --git a/debian/patches/series b/debian/patches/series
index 6736bbfa8..4caf666e4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,7 +8,6 @@ debian/mips-disable-werror.patch
 debian/mips-boston-disable-its.patch
 debian/arch-sh4-fix-uimage-build.patch
 debian/powerpcspe-omit-uimage.patch
-debian/modpost-symbol-prefix.patch
 debian/tools-perf-version.patch
 debian/tools-perf-install.patch
 debian/wireless-add-debian-wireless-regdb-certificates.patch
@@ -25,9 +24,9 @@ debian/firmware_class-refer-to-debian-wiki-firmware-page.patch
 # Patches from aufs4 repository, imported with
 # debian/patches/features/all/aufs4/gen-patch.  These are only the
 # changes needed to allow aufs to be built out-of-tree.
-features/all/aufs4/aufs4-base.patch
-features/all/aufs4/aufs4-mmap.patch
-features/all/aufs4/aufs4-standalone.patch
+#features/all/aufs4/aufs4-base.patch
+#features/all/aufs4/aufs4-mmap.patch
+#features/all/aufs4/aufs4-standalone.patch
 
 # Change some defaults for security reasons
 debian/af_802154-Disable-auto-loading-as-mitigation-against.patch
@@ -61,7 +60,6 @@ bugfix/x86/platform-x86-ideapad-laptop-add-y520-15ikbn-to-no_hw.patch
 bugfix/x86/platform-x86-ideapad-laptop-add-y720-15ikbn-to-no_hw.patch
 bugfix/x86/platform-x86-ideapad-laptop-add-ideapad-v510-15ikb-t.patch
 bugfix/x86/platform-x86-ideapad-laptop-add-several-models-to-no.patch
-debian/revert-gpu-host1x-add-iommu-support.patch
 bugfix/x86/perf-tools-fix-unwind-build-on-i386.patch
 bugfix/sh/sh-boot-do-not-use-hyphen-in-exported-variable-name.patch
 bugfix/x86/mmap-remember-the-map_fixed-flag-as-vm_fixed.patch
@@ -72,9 +70,6 @@ features/mips/MIPS-increase-MAX-PHYSMEM-BITS-on-Loongson-3-only.patch
 features/mips/MIPS-Loongson-3-Add-Loongson-LS3A-RS780E-1-way-machi.patch
 features/x86/x86-memtest-WARN-if-bad-RAM-found.patch
 features/x86/x86-make-x32-syscall-support-conditional.patch
-# Add support for Raspberry PI 3b+
-features/armhf/ARM-dts-bcm2837-Add-Raspberry-Pi-3-B.patch
-features/arm64/arm64-dts-broadcom-Add-reference-to-Raspberry-Pi-3-B.patch
 # Add device-tree for Pinebook from linux next-20180625
 features/arm64/pinebook/0001-arm64-allwinner-a64-Add-RTC-clock-to-phandle-32kHz-e.patch
 features/arm64/pinebook/0002-arm64-dts-allwinner-a64-add-R_I2C-controller.patch
@@ -90,7 +85,6 @@ bugfix/all/partially-revert-usb-kconfig-using-select-for-usb_co.patch
 bugfix/all/kbuild-include-addtree-remove-quotes-before-matching-path.patch
 debian/revert-objtool-fix-config_stack_validation-y-warning.patch
 bugfix/all/i40e-build-for-64-bit-targets-only.patch
-bugfix/all/ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-f.patch
 
 # Miscellaneous features
 
@@ -130,7 +124,6 @@ features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch
 
 # Security fixes
 debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
-bugfix/x86/virt-vbox-Only-copy_from_user-the-request-header-onc.patch
 
 # Fix exported symbol versions
 bugfix/all/module-disable-matching-missing-version-crc.patch