update ABI file for 4.15.18-30-pve

(generated with debian/scripts/abi-generate)

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>

.gitignore

@@ -1,3 +1,2 @@
 ubuntu-zesty
 *.prepared
-.*/

.gitmodules

@@ -1,6 +1,6 @@
-[submodule "submodules/ubuntu-kernel"]
-	path = submodules/ubuntu-kernel
-	url = https://dev.lirent.ru/c/mirror_ubuntu-kernels.git
 [submodule "submodules/zfsonlinux"]
 	path = submodules/zfsonlinux
-	url = https://dev.lirent.ru/c/zfsonlinux.git
+	url = ../zfsonlinux
+[submodule "submodules/ubuntu-bionic"]
+	path = submodules/ubuntu-bionic
+	url = ../mirror_ubuntu-bionic-kernel

Makefile

@@ -1,134 +1,146 @@
-include /usr/share/dpkg/pkg-info.mk
-
-# also bump proxmox-kernel-meta if the default MAJ.MIN version changes!
-KERNEL_MAJ=6
-KERNEL_MIN=8
-KERNEL_PATCHLEVEL=8
-# increment KREL for every published package release!
+# also bump pve-kernel-meta if either of MAJ.MIN, PATCHLEVEL or KREL change
+KERNEL_MAJ=4
+KERNEL_MIN=15
+KERNEL_PATCHLEVEL=18
+# increment KREL if the ABI changes (abicheck target in debian/rules)
 # rebuild packages with new KREL and run 'make abiupdate'
-KREL=2
+KREL=30
+
+PKGREL=58
 
 KERNEL_MAJMIN=$(KERNEL_MAJ).$(KERNEL_MIN)
 KERNEL_VER=$(KERNEL_MAJMIN).$(KERNEL_PATCHLEVEL)
 
-EXTRAVERSION=-$(KREL)-pve
-KVNAME=$(KERNEL_VER)$(EXTRAVERSION)
-PACKAGE=proxmox-kernel-$(KVNAME)
-HDRPACKAGE=proxmox-headers-$(KVNAME)
+EXTRAVERSION=-${KREL}-pve
+KVNAME=${KERNEL_VER}${EXTRAVERSION}
+PACKAGE=pve-kernel-${KVNAME}
+HDRPACKAGE=pve-headers-${KVNAME}
 
 ARCH=$(shell dpkg-architecture -qDEB_BUILD_ARCH)
 
 # amd64/x86_64/x86 share the arch subdirectory in the kernel, 'x86' so we need
 # a mapping
 KERNEL_ARCH=x86
-ifneq ($(ARCH), amd64)
-KERNEL_ARCH=$(ARCH)
+ifneq (${ARCH}, amd64)
+KERNEL_ARCH=${ARCH}
 endif
 
+GITVERSION:=$(shell git rev-parse HEAD)
+
 SKIPABI=0
 
-BUILD_DIR=proxmox-kernel-$(KERNEL_VER)
+ifeq    ($(CC), cc)
+GCC=gcc
+else
+GCC=$(CC)
+endif
 
-KERNEL_SRC=ubuntu-kernel
+BUILD_DIR=build
+
+KERNEL_SRC=ubuntu-bionic
 KERNEL_SRC_SUBMODULE=submodules/$(KERNEL_SRC)
-KERNEL_CFG_ORG=config-$(KERNEL_VER).org
+KERNEL_CFG_ORG=config-${KERNEL_VER}.org
+
+E1000EDIR=e1000e-3.4.1.1
+E1000ESRC=${E1000EDIR}.tar.gz
+
+IGBDIR=igb-5.3.5.18
+IGBSRC=${IGBDIR}.tar.gz
 
 ZFSONLINUX_SUBMODULE=submodules/zfsonlinux
+SPLDIR=pkg-spl
 ZFSDIR=pkg-zfs
 
 MODULES=modules
-MODULE_DIRS=$(ZFSDIR)
+MODULE_DIRS=${E1000EDIR} ${IGBDIR} ${SPLDIR} ${ZFSDIR}
 
 # exported to debian/rules via debian/rules.d/dirs.mk
-DIRS=KERNEL_SRC ZFSDIR MODULES
+DIRS=KERNEL_SRC E1000EDIR IGBDIR SPLDIR ZFSDIR MODULES
 
-DSC=proxmox-kernel-$(KERNEL_MAJMIN)_$(KERNEL_VER)-$(KREL).dsc
-DST_DEB=$(PACKAGE)_$(KERNEL_VER)-$(KREL)_$(ARCH).deb
-SIGNED_TEMPLATE_DEB=$(PACKAGE)-signed-template_$(KERNEL_VER)-$(KREL)_$(ARCH).deb
-META_DEB=proxmox-kernel-$(KERNEL_MAJMIN)_$(KERNEL_VER)-$(KREL)_all.deb
-HDR_DEB=$(HDRPACKAGE)_$(KERNEL_VER)-$(KREL)_$(ARCH).deb
-META_HDR_DEB=proxmox-headers-$(KERNEL_MAJMIN)_$(KERNEL_VER)-$(KREL)_all.deb
-USR_HDR_DEB=proxmox-kernel-libc-dev_$(KERNEL_VER)-$(KREL)_$(ARCH).deb
-LINUX_TOOLS_DEB=linux-tools-$(KERNEL_MAJMIN)_$(KERNEL_VER)-$(KREL)_$(ARCH).deb
-LINUX_TOOLS_DBG_DEB=linux-tools-$(KERNEL_MAJMIN)-dbgsym_$(KERNEL_VER)-$(KREL)_$(ARCH).deb
+DST_DEB=${PACKAGE}_${KERNEL_VER}-${PKGREL}_${ARCH}.deb
+HDR_DEB=${HDRPACKAGE}_${KERNEL_VER}-${PKGREL}_${ARCH}.deb
+LINUX_TOOLS_DEB=linux-tools-$(KERNEL_MAJMIN)_${KERNEL_VER}-${PKGREL}_${ARCH}.deb
 
-DEBS=$(DST_DEB) $(META_DEB) $(HDR_DEB) $(META_HDR_DEB) $(LINUX_TOOLS_DEB) $(LINUX_TOOLS_DBG_DEB) $(SIGNED_TEMPLATE_DEB) # $(USR_HDR_DEB)
+DEBS=${DST_DEB} ${HDR_DEB} ${LINUX_TOOLS_DEB}
 
-all: deb
-deb: $(DEBS)
+all: check_gcc deb
+deb: ${DEBS}
 
-$(META_DEB) $(META_HDR_DEB) $(LINUX_TOOLS_DEB) $(HDR_DEB): $(DST_DEB)
-$(DST_DEB): $(BUILD_DIR).prepared
-	cd $(BUILD_DIR); dpkg-buildpackage --jobs=auto -b -uc -us
-	lintian $(DST_DEB)
-	#lintian $(HDR_DEB)
-	lintian $(LINUX_TOOLS_DEB)
+check_gcc:
+	$(GCC) --version|grep "6\.3" || false
+	@$(GCC) -Werror -mindirect-branch=thunk-extern -mindirect-branch-register -c -x c /dev/null -o check_gcc.o \
+		|| ( rm -f check_gcc.o; \
+		     echo "Please install gcc-6 packages with indirect thunk / RETPOLINE support"; \
+		     false)
+	@rm -f check_gcc.o
 
-dsc:
-	$(MAKE) $(DSC)
-	lintian $(DSC)
+${LINUX_TOOLS_DEB} ${HDR_DEB}: ${DST_DEB}
+${DST_DEB}: ${BUILD_DIR}.prepared
+	cd ${BUILD_DIR}; dpkg-buildpackage --jobs=auto -b -uc -us
+	lintian ${DST_DEB}
+	#lintian ${HDR_DEB}
+	lintian ${LINUX_TOOLS_DEB}
 
-$(DSC): $(BUILD_DIR).prepared
-	cd $(BUILD_DIR); dpkg-buildpackage -S -uc -us -d
-
-sbuild: $(DSC)
-	sbuild $(DSC)
-
-$(BUILD_DIR).prepared: $(addsuffix .prepared,$(KERNEL_SRC) $(MODULES) debian)
-	cp -a fwlist-previous $(BUILD_DIR)/
-	cp -a abi-prev-* $(BUILD_DIR)/
-	cp -a abi-blacklist $(BUILD_DIR)/
+${BUILD_DIR}.prepared: $(addsuffix .prepared,${KERNEL_SRC} ${MODULES} debian)
+	cp -a fwlist-previous ${BUILD_DIR}/
+	cp -a abi-prev-* ${BUILD_DIR}/
+	cp -a abi-blacklist ${BUILD_DIR}/
 	touch $@
 
-.PHONY: build-dir-fresh
-build-dir-fresh:
-	$(MAKE) clean
-	$(MAKE) $(BUILD_DIR).prepared
-	echo "created build-directory: $(BUILD_DIR).prepared/"
-
 debian.prepared: debian
-	rm -rf $(BUILD_DIR)/debian
-	mkdir -p $(BUILD_DIR)
-	cp -a debian $(BUILD_DIR)/debian
-	echo "git clone git://git.proxmox.com/git/pve-kernel.git\\ngit checkout $(shell git rev-parse HEAD)" \
-	    >$(BUILD_DIR)/debian/SOURCE
-	@$(foreach dir, $(DIRS),echo "$(dir)=$($(dir))" >> $(BUILD_DIR)/debian/rules.d/env.mk;)
-	echo "KVNAME=$(KVNAME)" >> $(BUILD_DIR)/debian/rules.d/env.mk
-	echo "KERNEL_MAJMIN=$(KERNEL_MAJMIN)" >> $(BUILD_DIR)/debian/rules.d/env.mk
-	cd $(BUILD_DIR); debian/rules debian/control
+	rm -rf ${BUILD_DIR}/debian
+	mkdir -p ${BUILD_DIR}
+	cp -a debian ${BUILD_DIR}/debian
+	echo "git clone git://git.proxmox.com/git/pve-kernel.git\\ngit checkout ${GITVERSION}" > ${BUILD_DIR}/debian/SOURCE
+	@$(foreach dir, ${DIRS},echo "${dir}=${${dir}}" >> ${BUILD_DIR}/debian/rules.d/env.mk;)
+	echo "KVNAME=${KVNAME}" >> ${BUILD_DIR}/debian/rules.d/env.mk
+	echo "KERNEL_MAJMIN=${KERNEL_MAJMIN}" >> ${BUILD_DIR}/debian/rules.d/env.mk
+	cd ${BUILD_DIR}; debian/rules debian/control
 	touch $@
 
-$(KERNEL_SRC).prepared: $(KERNEL_SRC_SUBMODULE) | submodule
-	rm -rf $(BUILD_DIR)/$(KERNEL_SRC) $@
-	mkdir -p $(BUILD_DIR)
-	cp -a $(KERNEL_SRC_SUBMODULE) $(BUILD_DIR)/$(KERNEL_SRC)
+${KERNEL_SRC}.prepared: ${KERNEL_SRC_SUBMODULE} | submodule
+	rm -rf ${BUILD_DIR}/${KERNEL_SRC} $@
+	mkdir -p ${BUILD_DIR}
+	cp -a ${KERNEL_SRC_SUBMODULE} ${BUILD_DIR}/${KERNEL_SRC}
 # TODO: split for archs, track and diff in our repository?
-	cd $(BUILD_DIR)/$(KERNEL_SRC); python3 debian/scripts/misc/annotations --arch amd64 --export >../../$(KERNEL_CFG_ORG)
-	cp $(KERNEL_CFG_ORG) $(BUILD_DIR)/$(KERNEL_SRC)/.config
-	sed -i $(BUILD_DIR)/$(KERNEL_SRC)/Makefile -e 's/^EXTRAVERSION.*$$/EXTRAVERSION=$(EXTRAVERSION)/'
-	rm -rf $(BUILD_DIR)/$(KERNEL_SRC)/debian $(BUILD_DIR)/$(KERNEL_SRC)/debian.master
-	set -e; cd $(BUILD_DIR)/$(KERNEL_SRC); \
-	  for patch in ../../patches/kernel/*.patch; do \
-	    echo "applying patch '$$patch'"; \
-	    patch --batch -p1 < "$${patch}"; \
-	  done
+	cat ${BUILD_DIR}/${KERNEL_SRC}/debian.master/config/config.common.ubuntu ${BUILD_DIR}/${KERNEL_SRC}/debian.master/config/${ARCH}/config.common.${ARCH} ${BUILD_DIR}/${KERNEL_SRC}/debian.master/config/${ARCH}/config.flavour.generic > ${KERNEL_CFG_ORG}
+	cp ${KERNEL_CFG_ORG} ${BUILD_DIR}/${KERNEL_SRC}/.config
+	sed -i ${BUILD_DIR}/${KERNEL_SRC}/Makefile -e 's/^EXTRAVERSION.*$$/EXTRAVERSION=${EXTRAVERSION}/'
+	rm -rf ${BUILD_DIR}/${KERNEL_SRC}/debian ${BUILD_DIR}/${KERNEL_SRC}/debian.master
+	set -e; cd ${BUILD_DIR}/${KERNEL_SRC}; for patch in ../../patches/kernel/*.patch; do echo "applying patch '$$patch'" && patch -p1 < $${patch}; done
 	touch $@
 
-$(MODULES).prepared: $(addsuffix .prepared,$(MODULE_DIRS))
+${MODULES}.prepared: $(addsuffix .prepared,${MODULE_DIRS})
 	touch $@
 
-$(ZFSDIR).prepared: $(ZFSONLINUX_SUBMODULE)
-	rm -rf $(BUILD_DIR)/$(MODULES)/$(ZFSDIR) $(BUILD_DIR)/$(MODULES)/tmp $@
-	mkdir -p $(BUILD_DIR)/$(MODULES)/tmp
-	cp -a $(ZFSONLINUX_SUBMODULE)/* $(BUILD_DIR)/$(MODULES)/tmp
-	cd $(BUILD_DIR)/$(MODULES)/tmp; make kernel
-	rm -rf $(BUILD_DIR)/$(MODULES)/tmp
-	touch $(ZFSDIR).prepared
+${E1000EDIR}.prepared: ${E1000ESRC}
+	rm -rf ${BUILD_DIR}/${MODULES}/${E1000EDIR} $@
+	mkdir -p ${BUILD_DIR}/${MODULES}/${E1000EDIR}
+	tar --strip-components=1 -C ${BUILD_DIR}/${MODULES}/${E1000EDIR} -xf ${E1000ESRC}
+	cd ${BUILD_DIR}/${MODULES}/${E1000EDIR}; patch -p1 < ../../../patches/intel/intel-module-gcc6-compat.patch
+	cd ${BUILD_DIR}/${MODULES}/${E1000EDIR}; patch -p1 < ../../../patches/intel/e1000e/e1000e_4.10_max-mtu.patch
+	cd ${BUILD_DIR}/${MODULES}/${E1000EDIR}; patch -p1 < ../../../patches/intel/e1000e/e1000e_4.15-new-timer.patch
+	touch $@
+
+${IGBDIR}.prepared: ${IGBSRC}
+	rm -rf ${BUILD_DIR}/${MODULES}/${IGBDIR} $@
+	mkdir -p ${BUILD_DIR}/${MODULES}/${IGBDIR}
+	tar --strip-components=1 -C ${BUILD_DIR}/${MODULES}/${IGBDIR} -xf ${IGBSRC}
+	cd ${BUILD_DIR}/${MODULES}/${IGBDIR}; patch -p1 < ../../../patches/intel/igb/igb_4.15_mtu.patch
+	touch $@
+
+${SPLDIR}.prepared: ${ZFSDIR}.prepared
+${ZFSDIR}.prepared: ${ZFSONLINUX_SUBMODULE}
+	rm -rf ${BUILD_DIR}/${MODULES}/${SPLDIR} ${BUILD_DIR}/${MODULES}/${ZFSDIR} ${BUILD_DIR}/${MODULES}/tmp $@
+	mkdir -p ${BUILD_DIR}/${MODULES}/tmp
+	cp -a ${ZFSONLINUX_SUBMODULE}/* ${BUILD_DIR}/${MODULES}/tmp
+	cd ${BUILD_DIR}/${MODULES}/tmp; make kernel
+	rm -rf ${BUILD_DIR}/${MODULES}/tmp
+	touch ${ZFSDIR}.prepared ${SPLDIR}.prepared
 
 .PHONY: upload
-upload: UPLOAD_DIST ?= $(DEB_DISTRIBUTION)
-upload: $(DEBS)
-	tar cf - $(DEBS)|ssh -X repoman@repo.proxmox.com -- upload --product pve,pmg,pbs --dist $(UPLOAD_DIST) --arch $(ARCH)
+upload: ${DEBS}
+	tar cf - ${DEBS}|ssh -X repoman@repo.proxmox.com -- upload --product pve,pmg --dist stretch --arch ${ARCH}
 
 .PHONY: distclean
 distclean: clean
@@ -138,18 +150,19 @@ distclean: clean
 .PHONY: update_modules
 update_modules: submodule
 	git submodule foreach 'git pull --ff-only origin master'
-	cd $(ZFSONLINUX_SUBMODULE); git pull --ff-only origin master
+	cd ${ZFSONLINUX_SUBMODULE}; git pull --ff-only origin master
 
 # make sure submodules were initialized
 .PHONY: submodule
 submodule:
-	test -f "$(KERNEL_SRC_SUBMODULE)/README" || git submodule update --init $(KERNEL_SRC_SUBMODULE)
-	test -f "$(ZFSONLINUX_SUBMODULE)/Makefile" || git submodule update --init --recursive $(ZFSONLINUX_SUBMODULE)
+	test -f "${KERNEL_SRC_SUBMODULE}/README" || git submodule update --init ${KERNEL_SRC_SUBMODULE}
+	test -f "${ZFSONLINUX_SUBMODULE}/Makefile" || git submodule update --init ${ZFSONLINUX_SUBMODULE}
+	(test -f "${ZFSONLINUX_SUBMODULE}/zfs/upstream/README.markdown" && test -f "${ZFSONLINUX_SUBMODULE}/spl/upstream/README.markdown") || (cd ${ZFSONLINUX_SUBMODULE}; git submodule update --init)
 
 # call after ABI bump with header deb in working directory
 .PHONY: abiupdate
-abiupdate: abi-prev-$(KVNAME)
-abi-prev-$(KVNAME): abi-tmp-$(KVNAME)
+abiupdate: abi-prev-${KVNAME}
+abi-prev-${KVNAME}: abi-tmp-${KVNAME}
 ifneq ($(strip $(shell git status --untracked-files=no --porcelain -z)),)
 	@echo "working directory unclean, aborting!"
 	@false
@@ -157,15 +170,15 @@ else
 	git rm "abi-prev-*"
 	mv $< $@
 	git add $@
-	git commit -s -m "update ABI file for $(KVNAME)" -m "(generated with debian/scripts/abi-generate)"
-	@echo "update abi-prev-$(KVNAME) committed!"
+	git commit -s -m "update ABI file for ${KVNAME}" -m "(generated with debian/scripts/abi-generate)"
+	@echo "update abi-prev-${KVNAME} committed!"
 endif
 
-abi-tmp-$(KVNAME):
-	@ test -e $(HDR_DEB) || (echo "need $(HDR_DEB) to extract ABI data!" && false)
-	debian/scripts/abi-generate $(HDR_DEB) $@ $(KVNAME) 1
+abi-tmp-${KVNAME}:
+	@ test -e ${HDR_DEB} || (echo "need ${HDR_DEB} to extract ABI data!" && false)
+	debian/scripts/abi-generate ${HDR_DEB} $@ ${KVNAME} 1
 
 .PHONY: clean
 clean:
-	rm -rf *~ proxmox-kernel-[0-9]*/ *.prepared $(KERNEL_CFG_ORG)
-	rm -f *.deb *.dsc *.changes *.buildinfo *.build proxmox-kernel*.tar.*
+	rm -rf *~ build *.prepared ${KERNEL_CFG_ORG}
+	rm -f *.deb *.changes *.buildinfo

README

@@ -1,22 +1,22 @@
 KERNEL SOURCE:
 ==============
 
-We currently use the Ubuntu kernel sources, available from our mirror:
+We currently use the Ubuntu kernel sources, available from:
 
- https://git.proxmox.com/?p=mirror_ubuntu-kernels.git;a=summary
+ http://kernel.ubuntu.com/git/ubuntu/ubuntu-bionic.git/
 
 Ubuntu will maintain those kernels till:
 
  https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable
- or
- https://pve.proxmox.com/pve-docs/chapter-pve-faq.html#faq-support-table
-
- whatever happens to be earlier.
 
 
 Additional/Updated Modules:
 ---------------------------
 
+- include latest e1000e driver from intel/sourceforge
+
+- include latest igb driver from intel/sourceforge
+
 - include native OpenZFS filesystem kernel modules for Linux
 
   * https://github.com/zfsonlinux/
@@ -24,67 +24,6 @@ Additional/Updated Modules:
   For licensing questions, see: http://open-zfs.org/wiki/Talk:FAQ
 
 
-BUILD
-=====
-
-As this is packaging for the Linux kernel with some extra integrations, like
-ZFS, this repo cannot be handled like a plain Linux kernel git repository.
-
-The actual Linux kernel source lives in a git submodule.
-
-For a build you should init the submodules and then handle it like most our
-Debian packaging builds. If unsure you can follow this:
-
-Installing Build-Dependencies
------------------------------
-
-You can either just check the package metadata template `debian/control.in`
-and install the packages listed in the `Build-Depends` section manually
-(replace `debhelper-compat` with just `debhelper`) or use a more automated way
-described below:
-
- # install base build-dependencies and helpers
- apt update
- apt install devscripts
-
- # create build-directory so that we got final packaging control files from the
- # .in templates generated
- make build-dir-fresh
-
- # install build-dependencies (replace BUILD-DIR with actual one)
- mk-build-deps -ir BUILD-DIR/debian/control
-
-
-Package Build
--------------
-
- # start the actual build
- make deb
-
-For simple KConfig modifications you can adapt the list in `debian/rules` file.
-For quick code changes to the actual kernel code you can do them directly in
-the submodule/ubuntu-kernels directory, then re-create the build-directory, e.g.:
-
- make clean
- # now build again, explicitly creating the build-dir isn't required anymore
- # after one has the build-dependencies already installed.
- make deb
-
-
-Modify-Build-Test Cycles
-------------------------
-
-Ideally you avoid the need for doing a full package build and just directly
-build linux from the ubuntu-kernels or the mainline (stable) repo with copying
-over a build-config of a proxmox-kernel to that as .config and then using the
-`make olddefconfig` target.
-
-If you need full package builds you can try to make changes inside the
-BUILD-DIR directly and then continue build from there, e.g., using
-`dpkg-buildpackage -b -uc -us --no-pre-clean`. Depending on what stage you want
-to continue build you might need to touch, or remove some *.prepared files.
-Just check `debian/rules` for how kernel build progress is tracked by make.
-
 SUBMODULE
 =========
 
@@ -96,7 +35,7 @@ get applied with the `patch` tool. From a git point-of-view, the copied
 directory remains clean even with extra patches applied since it does not
 contain a .git directory, but a reference to the (still pristine) submodule:
 
-$ cat build/ubuntu-kernel/.git
+$ cat build/ubuntu-bionic/.git
 
 If you mistakenly cloned the upstream repo as "normal" clone (not via the
 submodule mechanics) this means that you have a real .git directory with its
@@ -121,30 +60,18 @@ top level meta package, depends on current default kernel series meta package.
 
 git clone git://git.proxmox.com/git/proxmox-ve.git
 
-proxmox-default-kernel
-----------------------
+pve-kernel-meta
+---------------
 
-Depends on default kernel and header meta package, e.g., proxmox-kernel-6.2 /
-proxmox-headers-6.2.
+depends on latest kernel and header package within a certain kernel series,
+e.g., pve-kernel-4.15 / pve-headers-4.15
 
 git clone git://git.proxmox.com/git/pve-kernel-meta.git
 
-proxmox-kernel-X.Y
-------------------
-
-Depends on the latest kernel (or header, in case of proxmox-headers-X.Y)
-package within a certain series.
-
-e.g., proxmox-kernel-6.2 depends on proxmox-kernel-6.2.16-6-pve
-
-NOTE: Since Proxmox VE 8, based on Debian 12 Bookworm, the kernel ABI is bumped
-with every version bump due to module signing. Since then the meta package was
-pulled into the kernel repo, before that it lived in pve-kernel-meta.git.
-
 pve-firmware
 ------------
 
-Contains the firmware for all released PVE kernels.
+contains the firmware for all released PVE kernels.
 
 git clone git://git.proxmox.com/git/pve-firmware.git
 
@@ -172,21 +99,9 @@ Watchdog blacklist
 
 By default, all watchdog modules are black-listed because it is totally undefined
 which device is actually used for /dev/watchdog.
-We ship this list in /lib/modprobe.d/blacklist_proxmox-kernel-<VERSION>.conf
+We ship this list in /lib/modprobe.d/blacklist_pve-kernel-<VERSION>.conf
 The user typically edit /etc/modules to enable a specific watchdog device.
 
-Debug kernel and modules
-------------------------
-
-In order to build a -dbgsym package containing an unstripped copy of the kernel
-image and modules, enable the 'pkg.proxmox-kernel.debug' build profile (e.g. by
-exporting DEB_BUILD_PROFILES='pkg.proxmox-kernel.debug'). The resulting package can
-be used together with 'crash'/'kdump-tools' to debug kernel crashes.
-
-Note: the -dbgsym package is only valid for the proxmox-kernel packages produced by
-the same build. A kernel/module from a different build will likely not match,
-even if both builds are of the same kernel and package version.
-
 Additional information
 ----------------------
 
@@ -210,39 +125,55 @@ NOTE: For the exact and current list see debian/rules (PVE_CONFIG_OPTS)
   	 CONFIG_BLK_DEV_SR=y
   	 CONFIG_BLK_DEV_DM=y
 
+- add workaround for Debian bug #807000 (see
+  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=807000)
+
+  	 CONFIG_BLK_DEV_NVME=y
+
 - compile NBD and RBD modules
 	 CONFIG_BLK_DEV_NBD=m
 	 CONFIG_BLK_DEV_RBD=m
 
 - enable IBM JFS file system as module
-  requested by users (bug #64)
+
+  enable it as requested by users (bug #64)
 
 - enable apple HFS and HFSPLUS as module
-  requested by users
+
+  enable it as requested by users
 
 - enable CONFIG_BCACHE=m (requested by user)
 
 - enable CONFIG_BRIDGE=y
-  to avoid warnings on boot, e.g. that net.bridge.bridge-nf-call-iptables is an unknown key
+
+  Else we get warnings on boot, that
+  net.bridge.bridge-nf-call-iptables is an unknown key
 
 - enable CONFIG_DEFAULT_SECURITY_APPARMOR
+
   We need this for lxc
 
 - set CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+
   because if not set, it can give some dynamic memory or cpu frequencies 
   change, and vms can crash (mainly windows guest).
+
   see http://forum.proxmox.com/threads/18238-Windows-7-x64-VMs-crashing-randomly-during-process-termination?p=93273#post93273
 
 - use 'deadline' as default scheduler
-  This is the suggested setting for KVM. We also measure bad fsync performance with ext4 and cfq.
+
+  This is the suggested setting for KVM. We also measure bad fsync
+  performance with ext4 and cfq.
 
 - disable CONFIG_INPUT_EVBUG
-  Module evbug is not blacklisted on debian, so we simply disable it to avoid
-  key-event logs (which is a big security problem)
+
+  Module evbug is not blacklisted on debian, so we simply disable it
+  to avoid key-event logs (which is a big security problem)
 
 - enable CONFIG_MODVERSIONS (needed for ABI tracking)
 
 - switch default UNWINDER to FRAME_POINTER
+
   the recently introduced ORC_UNWINDER is not 100% stable yet, especially in combination with ZFS
 
 - enable CONFIG_PAGE_TABLE_ISOLATION (Meltdown mitigation)

debian/certs/proxmox-uefi-ca.pem

@@ -1,37 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIGbjCCBFagAwIBAgIUTVo8veNlt0qzt14J+H2mhEB2SNUwDQYJKoZIhvcNAQEL
-BQAwgZMxCzAJBgNVBAYTAkFUMQ8wDQYDVQQIDAZWaWVubmExDzANBgNVBAcMBlZp
-ZW5uYTEmMCQGA1UECgwdUHJveG1veCBTZXJ2ZXIgU29sdXRpb25zIEdtYkgxFzAV
-BgNVBAMMDlNlY3VyZSBCb290IENBMSEwHwYJKoZIhvcNAQkBFhJvZmZpY2VAcHJv
-eG1veC5jb20wHhcNMjMwMzA2MTM1MTM0WhcNMzMwMzAzMTM1MTM0WjCBkzELMAkG
-A1UEBhMCQVQxDzANBgNVBAgMBlZpZW5uYTEPMA0GA1UEBwwGVmllbm5hMSYwJAYD
-VQQKDB1Qcm94bW94IFNlcnZlciBTb2x1dGlvbnMgR21iSDEXMBUGA1UEAwwOU2Vj
-dXJlIEJvb3QgQ0ExITAfBgkqhkiG9w0BCQEWEm9mZmljZUBwcm94bW94LmNvbTCC
-AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJ59mP8gRLqsA6P53ejy0wMk
-0qLlICtDkPXsJoi4QRHjlPErxXv5zsZ4WqSG2bQ8EW95FAf8EOF6ge+G17neYt1w
-DmlvHzLBfqTJj5EBRgVjdWOjX3AkS/elOyzHdq4rKOteUSpQlMP4ub2cAUdy/8rp
-ouTbduttNv8mymAO89/kbXCEmKFiRS+av+hykFFyXH/KTRa2QnvLVadMEkmtA+vm
-+yQhYWCTD8hdisa1o3dKM0Z2l8LyzfIOsVXcwHHB7AhtR4tbLR9Tz2p/m9Gz//vj
-82dBaChh6kxIMZ8kACP28dA561R2P6ZcjzLSJ0Tq5e4tiW9SNEzuTYKTRvFeQoQh
-4usDdSF3ifXDuimShpv8Yaf4fntyIaUfnm6H5tvNr9b9Rw6ZL200LV5VugQ1EpfE
-F0+c3LQfurwT7svISgXSY62Fe/TiHFANOVXM5j3/Dr2ktKyce7BUGN4ewpWPvP99
-io+rdd4bTReuDh8j0nhsSdYKfvuOmvQpgL8Smzno54/hdpuO6cv+slCr1ApDexl8
-gAPPwCZRsH7aPc92g+YPzDm3k77RqkCXPA19KKQLYKvL7a+H3rnqgO81CdGFPHOz
-I5UruKLLeDGAWR0bo0JqDMEL8/oPh9IvGo8lFcTros0NEof6A7p8SGmxM2NodTo9
-spDVs84xDPlp4yX4u8A9AgMBAAGjgbcwgbQwDwYDVR0TAQH/BAUwAwEB/zAOBgNV
-HQ8BAf8EBAMCAYYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwHQYDVR0OBBYEFLXxsR5I
-LbWGkynLl1qjUgX4cs16MB8GA1UdIwQYMBaAFLXxsR5ILbWGkynLl1qjUgX4cs16
-MB0GA1UdEQQWMBSBEm9mZmljZUBwcm94bW94LmNvbTAdBgNVHRIEFjAUgRJvZmZp
-Y2VAcHJveG1veC5jb20wDQYJKoZIhvcNAQELBQADggIBAAUGWTt792ibVtE9yKgq
-9YtmybKGWjDHdMKl5AcnxLD60z7cEgcUBpEXaUbTzic5rz7fYhUM29LZkF8NIA2a
-rzrF0w+J1zZZKG2VvTWmdgynNNKQ/iTRbhgSZ94hEWOwumlEW4O6HwUN+VYFx8wf
-jvyWc1K6cdCc70IeC5POjYTlXKPoDq8ysPMLhxm7dsk7DDWcR0siMbYqGLLK5cJB
-lZE+9Q3Nj/q4m3odjK1ILrDGKqWWJgxopE21e903Ej+TNw+TduXygHqwVloEXUi4
-clmMMwCfhEBI9Vuy0+QSLxvrHKbwYpWd59RBQEsUubi8sT8Oh7njgmEd/Pf9uD7U
-1Rd9I+1MkNOZXyoyvaJQl9NZ9RpyG+ZbeQoFcL2CeCy0jJQQSilI5k4RtiDrGn6R
-GxlRL/FTvGWBkQGNwvoeFwD6i7zYainf1Z7f1Dh83MxKarxpAwX61K+rHpvAvjN/
-Hd4dslj5C+p188FnGaqiFlFAgVcF//F+yZFGYu1sTIQJ5f0C3LiFLeQYi3SPTf0L
-wk78eHgo6x1cIOM3/Ct4mflHBxnrfOJ9YdEAn2MklpDT5dif+9+zpN1myCQn4HoW
-OgoWIacSuvuFczHTQf2IX4ZEEE5SZwE31f7E0cqjgXmwbz1a81UMZHzvr71rDeWi
-oRgE3Pe1htzpOmw5Ygvjtn8k
------END CERTIFICATE-----

debian/certs/proxmox-uefi-signer-2023.pem

@@ -1,37 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIGbzCCBFegAwIBAgIUakjebPHbd0vTEj9dEa3OF+gioGMwDQYJKoZIhvcNAQEL
-BQAwgZMxCzAJBgNVBAYTAkFUMQ8wDQYDVQQIDAZWaWVubmExDzANBgNVBAcMBlZp
-ZW5uYTEmMCQGA1UECgwdUHJveG1veCBTZXJ2ZXIgU29sdXRpb25zIEdtYkgxFzAV
-BgNVBAMMDlNlY3VyZSBCb290IENBMSEwHwYJKoZIhvcNAQkBFhJvZmZpY2VAcHJv
-eG1veC5jb20wHhcNMjMwMzA2MTQwNTI1WhcNMjcwNDE0MTQwNTI1WjCBmjELMAkG
-A1UEBhMCQVQxDzANBgNVBAgMBlZpZW5uYTEPMA0GA1UEBwwGVmllbm5hMSYwJAYD
-VQQKDB1Qcm94bW94IFNlcnZlciBTb2x1dGlvbnMgR21iSDEeMBwGA1UEAwwVU2Vj
-dXJlIEJvb3QgU2lnbiAyMDIzMSEwHwYJKoZIhvcNAQkBFhJvZmZpY2VAcHJveG1v
-eC5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDJGReH5i3aihb/
-frdbzzNueHBt7DC9W2/GXYf0wfl8izCXz2SYM/UIZavbpzF2uhgxli3Dj4M0FyR2
-oTKRseWyy+YMiwuhQcqCw0KRS6uOUiGjOtPHsEqDFO6DP8d1gNjYkF0jzY/CNf0N
-5Sc+w8jknQJgZ9G1RGcC2ihZATx2pgG9nYA30Op8qHyhcF2KrUmh8wpXky21u0Ja
-0/whsNFNSfQrvosgUroxLd2TvBdcBJu3SXt0B15jfY4Qssjmwgfs/oU8YGaAYnIp
-PLJRqzho/kpDA3PH2lsgxv5BJHQgDuODLj3Q3dx09C71Qdb3FlQ6z9hIdFUoPrvC
-kUpZ5lEwGUyvFZtJJQvGm/1BpDj1G7P8lqODyfkJ4c77XoH7M9z945HmxrfAyjP7
-9Jk8NXA9bSy+ygPHPHlTLEc10HKvk/SRg/sGGUveTr9C6rObfP8EmvXogpS46xSn
-W9s2vFSVFyOBvLpdIhU91McBFinvQaqY0r2XTNrsU3Zp5YG3z6hh6BOLCpD/pixc
-BQyfT8wGeI59dobVSSrWqt+1vNxO02I5t7Mlam687Ix1e3C/nk7+i44WMcmB8n+x
-Dq/v/L+UJlQ75u2dsaAiYUrGcsHQWAZ34oIAfec9qCgG+OLTwobwXXiOlaWiO51n
-0xCQ4ePK+vZuDxRHaXL7hOxFCe3iKwIDAQABo4GxMIGuMB0GA1UdDgQWBBRr/2t+
-Hu0KTVTbNhd31p7aJH15IjAfBgNVHSMEGDAWgBS18bEeSC21hpMpy5dao1IF+HLN
-ejAdBgNVHREEFjAUgRJvZmZpY2VAcHJveG1veC5jb20wHQYDVR0SBBYwFIESb2Zm
-aWNlQHByb3htb3guY29tMAwGA1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUH
-AwMwCwYDVR0PBAQDAgbAMA0GCSqGSIb3DQEBCwUAA4ICAQBYmLgWPJSK/pP/CkZE
-iYttW1Vd0Wm4DeZVSyUh2c9AI+A+IT5otEXjCflU8sYU4vm0eEtNwhmGdVf8oZe4
-tS/2eFawDAqEQ8xMsinbMJoqvcYx9uEZPiOOo3GS2YjfUy03Q3BAOV3rMFOjP4y+
-dfYF3IWnKQxvUV0wapRyDbT62plKt4UCtBagUPcm838YRD6ax+4yK/5sojMQM1IW
-2yGgEz8jeCyPI19Ots2RBZTJU2BZ1QqRPLybvLfsENtKgKqOE14BEp6WqtYBaj89
-QZD4tbP9Mqcmnj8AfG89pb1Fj6tq0MLZsboF6i0J7uuQ6CKkb5ksQhLODLMwAZi1
-1EAgWk5btwj6ZvoOHFOjAXGJ13tmUeYt/Zipyy/ie+5LSEdFevQ+zmZzsglfX3QK
-6skoBpHs3kLcuPsoe8uhCvn/b22lHkFdYYkIwIUQFPJgdvBzD8LYHnD8P60UdsQO
-vSSt9qzsq04DCEjwhmNJUeddL9ESGNL8vgpB9GvNjFEq6QMncELkdXDoAeqGFolE
-/dj+8sVq+34plRsvD1GDDx70UWk0ZtQlvhqDJ0kxeT+yYASrwLoujK44SLq8cMJr
-JYxDoxFOy5MSw+EzEXTP9LLkYNdPv/nzPbEz3lEctczyOgBWr22272Kdv3QCHBdP
-v4+vFbHnrXmu8cC9T45r2aX3rQ==
------END CERTIFICATE-----

debian/compat

@@ -0,0 +1 @@
+10

debian/control.in

@@ -1,4 +1,4 @@
-Source: proxmox-kernel-@KVMAJMIN@
+Source: pve-kernel
 Section: devel
 Priority: optional
 Maintainer: Proxmox Support Team <support@proxmox.com>
@@ -7,12 +7,10 @@ Build-Depends: asciidoc-base,
                bc,
                bison,
                cpio,
-               debhelper-compat (= 13),
-               dh-python,
-               dwarves,
+               debhelper (>= 10~),
                file,
                flex,
-               gcc (>= 8.3.0-6),
+               gcc-6 (>= 6.3.0-18+deb9u1),
                git,
                kmod,
                libdw-dev,
@@ -24,16 +22,14 @@ Build-Depends: asciidoc-base,
                libssl-dev,
                libtool,
                lintian,
-               lz4,
-               python3-dev,
-               python3-minimal,
+               perl-modules,
+               python-minimal,
                rsync,
-               sphinx-common,
+               sed,
+               tar,
                xmlto,
                zlib1g-dev,
-               zstd,
-Build-Conflicts: proxmox-headers-@KVNAME@,
-Standards-Version: 4.6.2
+Build-Conflicts: pve-headers-@KVNAME@,
 Vcs-Git: git://git.proxmox.com/git/pve-kernel
 Vcs-Browser: https://git.proxmox.com/?p=pve-kernel.git
 
@@ -41,84 +37,32 @@ Package: linux-tools-@KVMAJMIN@
 Architecture: any
 Section: devel
 Priority: optional
-Depends: linux-base, ${misc:Depends}, ${shlibs:Depends},
+Depends: linux-base,
+         ${misc:Depends},
+         ${shlibs:Depends},
 Description: Linux kernel version specific tools for version @KVMAJMIN@
  This package provides the architecture dependent parts for kernel
  version locked tools (such as perf and x86_energy_perf_policy)
 
-Package: proxmox-headers-@KVNAME@
+Package: pve-headers-@KVNAME@
 Section: devel
 Priority: optional
 Architecture: any
-Provides: linux-headers-@KVNAME@-amd64, pve-headers-@KVNAME@
-Depends: ${misc:Depends},
-Description: Proxmox Kernel Headers
+Provides: linux-headers,
+          linux-headers-2.6,
+Depends: coreutils | fileutils (>= 4.0),
+Description: The Proxmox PVE Kernel Headers
  This package contains the linux kernel headers
 
-Package: proxmox-kernel-@KVNAME@
+Package: pve-kernel-@KVNAME@
 Section: admin
 Priority: optional
 Architecture: any
-Provides: linux-image-@KVNAME@-amd64, pve-kernel-@KVNAME@
+Provides: linux-image,
+          linux-image-2.6,
 Suggests: pve-firmware,
-Depends: busybox, initramfs-tools | linux-initramfs-tool, ${misc:Depends},
-Recommends: grub-pc | grub-efi-amd64 | grub-efi-ia32 | grub-efi-arm64,
-Description: Proxmox Kernel Image
+Depends: busybox,
+         grub-pc | grub-efi-amd64 | grub-efi-ia32 | grub-efi-arm64,
+         initramfs-tools,
+Description: The Proxmox PVE Kernel Image
  This package contains the linux kernel and initial ramdisk used for booting
-
-Package: proxmox-kernel-@KVNAME@-dbgsym
-Architecture: any
-Provides: linux-debug, pve-kernel-@KVNAME@-dbgsym
-Section: devel
-Priority: optional
-Build-Profiles: <pkg.proxmox-kernel.debug>
-Depends: ${misc:Depends},
-Description: Proxmox Kernel debug image
- This package provides the kernel debug image for version @KVNAME@. The debug
- kernel image contained in this package is NOT meant to boot from - it is
- uncompressed, and unstripped, and suitable for use with crash/kdump-tools/..
- to analyze kernel crashes. This package also contains the proxmox-kernel modules
- in their unstripped version.
-
-Package: proxmox-kernel-@KVNAME@-signed-template
-Architecture: amd64
-Depends: ${shlibs:Depends}, ${misc:Depends}, make | build-essential | dpkg-dev
-Description: Template for signed kernel package
- This package is used to control code signing by the Proxmox signing
- service.
-
-Package: proxmox-kernel-libc-dev
-Section: devel
-Priority: optional
-Architecture: any
-Provides: linux-libc-dev (=${binary:Version}), pve-kernel-libc-dev
-Conflicts: linux-libc-dev,
-Replaces: linux-libc-dev, pve-kernel-libc-dev
-Breaks: pve-kernel-libc-dev
-Depends: ${misc:Depends},
-Description: Linux support headers for userspace development
- This package provides userspaces headers from the Linux kernel.  These headers
- are used by the installed headers for GNU libc and other system libraries.
-
-Package: proxmox-headers-@KVMAJMIN@
-Architecture: all
-Section: admin
-Provides: linux-headers-amd64, linux-headers-generic, pve-headers-@KVMAJMIN@
-Replaces: pve-headers-@KVMAJMIN@
-Priority: optional
-Depends: proxmox-headers-@KVNAME@, ${misc:Depends},
-Description: Latest Proxmox Kernel Headers
- This is a metapackage which will install the kernel headers
- for the latest available proxmox kernel from the @KVMAJMIN@
- series.
-
-Package: proxmox-kernel-@KVMAJMIN@
-Architecture: all
-Section: admin
-Provides: linux-image-amd64, linux-image-generic, wireguard-modules (=1.0.0), pve-kernel-@KVMAJMIN@
-Replaces: pve-kernel-@KVMAJMIN@
-Priority: optional
-Depends: pve-firmware, proxmox-kernel-@KVNAME@-signed | proxmox-kernel-@KVNAME@, ${misc:Depends},
-Description: Latest Proxmox Kernel Image
- This is a metapackage which will install the latest available
- proxmox kernel from the @KVMAJMIN@ series.

debian/copyright

@@ -1,8 +1,11 @@
 This is a prepackaged version of the Linux kernel binary image.
 
-For the packaging and all files in the debian/ folder consider:
- Copyright (C) 2007-2022 Proxmox Server Solutions GmbH
- Licensed under the AGPL-3.0-or-later
+This package was put together by Proxmox Server
+Solutions GmbH <support@proxmox.com>.
+
+We use the RHEL7 kernel sources, available from:
+
+ftp://ftp.redhat.com/redhat/rhel/
 
 Linux is copyrighted by Linus Torvalds and others.
 

debian/proxmox-kernel-meta.postinst.in

@@ -1,17 +0,0 @@
-#! /bin/sh
-
-# Abort if any command returns an error value 
-set -e
-
-case "$1" in
-  configure)
-    # setup kernel links for installation CD (rescue boot)
-    mkdir -p /boot/pve
-    ln -sf /boot/vmlinuz-@@KVNAME@@ /boot/pve/vmlinuz-@@KVMAJMIN@@
-    ln -sf /boot/initrd.img-@@KVNAME@@ /boot/pve/initrd.img-@@KVMAJMIN@@
-    ;;
-esac
-
-#DEBHELPER#
-
-exit 0

debian/proxmox-kernel-meta.postrm.in

@@ -1,19 +0,0 @@
-#! /bin/sh
-
-# Abort if any command returns an error value
-set -e
-
-case "$1" in
-    purge|remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
-        # remove kernel symlinks
-        rm -f /boot/pve/vmlinuz-@@KVNAME@@
-        rm -f /boot/pve/initrd.img-@@KVNAME@@
-    ;;
-
-    *)
-        echo "postrm called with unknown argument \`$1'" >&2
-        exit 1
-    ;;
-esac
-
-#DEBHELPER#

debian/proxmox-kernel.postrm.in

@@ -1,46 +0,0 @@
-#!/usr/bin/perl
-
-use strict;
-use warnings;
-
-# Ignore all 'upgrade' invocations .
-exit 0 if $ARGV[0] =~ /upgrade/;
-
-my $imagedir = "/boot";
-
-my $version = "@@KVNAME@@";
-
-if (-d "/etc/kernel/postrm.d") {
-  print STDERR "Examining /etc/kernel/postrm.d.\n";
-  system (
-      "run-parts --verbose --exit-on-error --arg=$version --arg=$imagedir/vmlinuz-$version /etc/kernel/postrm.d"
-  ) && die "Failed to process /etc/kernel/postrm.d";
-}
-
-unlink "$imagedir/initrd.img-$version";
-unlink "$imagedir/initrd.img-$version.bak";
-unlink "/var/lib/initramfs-tools/$version";
-
-# Ignore all invocations except when called on to purge.
-exit 0 unless $ARGV[0] =~ /purge/;
-
-my @files_to_remove = qw{
-    modules.dep modules.isapnpmap modules.pcimap
-    modules.usbmap modules.parportmap
-    modules.generic_string modules.ieee1394map
-    modules.ieee1394map modules.pnpbiosmap
-    modules.alias modules.ccwmap modules.inputmap
-    modules.symbols modules.ofmap
-    modules.seriomap modules.*.bin
-    modules.softdep modules.devname
-};
-
-foreach my $extra_file (@files_to_remove) {
-    for (glob("/lib/modules/$version/$extra_file")) {
-	unlink;
-    }
-}
-
-system ("rmdir", "/lib/modules/$version") if -d "/lib/modules/$version";
-
-exit 0

debian/pve-kernel.postinst.in

@@ -1,7 +1,6 @@
-#!/usr/bin/perl
+#!/usr/bin/perl -w
 
 use strict;
-use warnings;
 
 # Ignore all invocations except when called on to configure.
 exit 0 unless $ARGV[0] =~ /configure/;
@@ -17,9 +16,10 @@ system("depmod $version");
 
 if (-d "/etc/kernel/postinst.d") {
   print STDERR "Examining /etc/kernel/postinst.d.\n";
-  system(
-      "run-parts --verbose --exit-on-error --arg=$version --arg=$imagedir/vmlinuz-$version /etc/kernel/postinst.d"
-  ) && die "Failed to process /etc/kernel/postinst.d";
+  system ("run-parts --verbose --exit-on-error --arg=$version " .
+          "--arg=$imagedir/vmlinuz-$version " .
+          "/etc/kernel/postinst.d") &&
+            die "Failed to process /etc/kernel/postinst.d";
 }
 
 exit 0

debian/pve-kernel.postrm.in

@@ -0,0 +1,46 @@
+#!/usr/bin/perl -w
+
+use strict;
+
+# Ignore all 'upgrade' invocations .
+exit 0 if $ARGV[0] =~ /upgrade/;
+
+my $imagedir = "/boot";
+
+my $version = "@@KVNAME@@";
+
+if (-d "/etc/kernel/postrm.d") {
+  print STDERR "Examining /etc/kernel/postrm.d.\n";
+  system ("run-parts --verbose --exit-on-error --arg=$version " .
+          "--arg=$imagedir/vmlinuz-$version " .
+          "/etc/kernel/postrm.d") &&
+            die "Failed to process /etc/kernel/postrm.d";
+}
+
+unlink "$imagedir/initrd.img-$version";
+unlink "$imagedir/initrd.img-$version.bak";
+unlink "/var/lib/initramfs-tools/$version";
+
+# Ignore all invocations except when called on to purge.
+exit 0 unless $ARGV[0] =~ /purge/;
+
+my @files_to_remove = qw{
+                         modules.dep modules.isapnpmap modules.pcimap
+                         modules.usbmap modules.parportmap
+                         modules.generic_string modules.ieee1394map
+                         modules.ieee1394map modules.pnpbiosmap
+                         modules.alias modules.ccwmap modules.inputmap
+                         modules.symbols modules.ofmap
+                         modules.seriomap modules.*.bin
+			 modules.softdep modules.devname
+                       };
+
+foreach my $extra_file (@files_to_remove) {
+    for (glob("/lib/modules/$version/$extra_file")) {
+	unlink;
+    }
+}
+
+system ("rmdir", "/lib/modules/$version") if -d "/lib/modules/$version";
+
+exit 0

debian/pve-kernel.prerm.in

@@ -1,7 +1,6 @@
-#!/usr/bin/perl
+#!/usr/bin/perl -w
 
 use strict;
-use warnings;
 
 # Ignore all invocations uxcept when called on to remove
 exit 0 unless ($ARGV[0] && $ARGV[0] =~ /remove/) ;
@@ -15,9 +14,10 @@ my $version = "@@KVNAME@@";
 
 if (-d "/etc/kernel/prerm.d") {
   print STDERR "Examining /etc/kernel/prerm.d.\n";
-  system(
-      "run-parts --verbose --exit-on-error --arg=$version --arg=$imagedir/vmlinuz-$version /etc/kernel/prerm.d"
-  ) && die "Failed to process /etc/kernel/prerm.d";
+  system ("run-parts --verbose --exit-on-error --arg=$version " . 
+          "--arg=$imagedir/vmlinuz-$version " .
+          "/etc/kernel/prerm.d") &&
+	  die "Failed to process /etc/kernel/prerm.d";
 }
 
 exit 0

debian/rules

@@ -9,25 +9,17 @@ BUILD_DIR=$(shell pwd)
 
 include /usr/share/dpkg/default.mk
 include debian/rules.d/env.mk
-include debian/rules.d/$(DEB_BUILD_ARCH).mk
-
-MAKEFLAGS += $(subst parallel=,-j,$(filter parallel=%,${DEB_BUILD_OPTIONS}))
+include debian/rules.d/${DEB_BUILD_ARCH}.mk
 
 CHANGELOG_DATE:=$(shell dpkg-parsechangelog -SDate)
-CHANGELOG_DATE_UTC_ISO := $(shell date -u -d '$(CHANGELOG_DATE)' +%Y-%m-%dT%H:%MZ)
 
-PMX_KERNEL_PKG=proxmox-kernel-$(KVNAME)
-PMX_KERNEL_SERIES_PKG=proxmox-kernel-$(KERNEL_MAJMIN)
-PMX_DEBUG_KERNEL_PKG=proxmox-kernel-$(KVNAME)-dbgsym
-PMX_HEADER_PKG=proxmox-headers-$(KVNAME)
-PMX_USR_HEADER_PKG=proxmox-kernel-libc-dev
-PMX_KERNEL_SIGNING_TEMPLATE_PKG=proxmox-kernel-${KVNAME}-signed-template
-PMX_KERNEL_SIGNED_VERSION := $(shell echo ${DEB_VERSION} | sed -e 's/-/+/')
-LINUX_TOOLS_PKG=linux-tools-$(KERNEL_MAJMIN)
-KERNEL_SRC_COPY=$(KERNEL_SRC)_tmp
+PVE_KERNEL_PKG=pve-kernel-${KVNAME}
+PVE_HEADER_PKG=pve-headers-${KVNAME}
+LINUX_TOOLS_PKG=linux-tools-${KERNEL_MAJMIN}
+KERNEL_SRC_COPY=${KERNEL_SRC}_tmp
 
 # TODO: split for archs, move to files?
-PMX_CONFIG_OPTS= \
+PVE_CONFIG_OPTS= \
 -m INTEL_MEI_WDT \
 -d CONFIG_SND_PCM_OSS \
 -e CONFIG_TRANSPARENT_HUGEPAGE_MADVISE \
@@ -35,105 +27,49 @@ PMX_CONFIG_OPTS= \
 -m CONFIG_CEPH_FS \
 -m CONFIG_BLK_DEV_NBD \
 -m CONFIG_BLK_DEV_RBD \
--m CONFIG_BLK_DEV_UBLK \
 -d CONFIG_SND_PCSP \
 -m CONFIG_BCACHE \
 -m CONFIG_JFS_FS \
 -m CONFIG_HFS_FS \
 -m CONFIG_HFSPLUS_FS \
--e CIFS_SMB_DIRECT \
--e CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU \
 -e CONFIG_BRIDGE \
 -e CONFIG_BRIDGE_NETFILTER \
 -e CONFIG_BLK_DEV_SD \
 -e CONFIG_BLK_DEV_SR \
 -e CONFIG_BLK_DEV_DM \
--m CONFIG_BLK_DEV_NVME \
--e CONFIG_NLS_ISO8859_1 \
+-e CONFIG_BLK_DEV_NVME \
 -d CONFIG_INPUT_EVBUG \
 -d CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND \
--d CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL \
 -e CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE \
--e CONFIG_SYSFB_SIMPLEFB \
--e CONFIG_DRM_SIMPLEDRM \
--e CONFIG_MODULE_SIG \
--e CONFIG_MODULE_SIG_ALL \
--e CONFIG_MODULE_SIG_FORMAT \
---set-str CONFIG_MODULE_SIG_HASH sha512 \
---set-str CONFIG_MODULE_SIG_KEY certs/signing_key.pem \
--e CONFIG_MODULE_SIG_KEY_TYPE_RSA \
--e CONFIG_MODULE_SIG_SHA512 \
+-d CONFIG_MODULE_SIG \
 -d CONFIG_MEMCG_DISABLED \
 -e CONFIG_MEMCG_SWAP_ENABLED \
--e CONFIG_HYPERV \
--m CONFIG_VFIO_IOMMU_TYPE1 \
--e CONFIG_VFIO_VIRQFD \
--m CONFIG_VFIO \
--m CONFIG_VFIO_PCI \
--m CONFIG_USB_XHCI_HCD \
--m CONFIG_USB_XHCI_PCI \
--m CONFIG_USB_EHCI_HCD \
--m CONFIG_USB_EHCI_PCI \
--m CONFIG_USB_EHCI_HCD_PLATFORM \
--m CONFIG_USB_OHCI_HCD \
--m CONFIG_USB_OHCI_HCD_PCI \
--m CONFIG_USB_OHCI_HCD_PLATFORM \
--d CONFIG_USB_OHCI_HCD_SSB \
--m CONFIG_USB_UHCI_HCD \
--d CONFIG_USB_SL811_HCD_ISO \
 -e CONFIG_MEMCG_KMEM \
 -d CONFIG_DEFAULT_CFQ \
 -e CONFIG_DEFAULT_DEADLINE \
 -e CONFIG_MODVERSIONS \
--e CONFIG_ZSTD_COMPRESS \
 -d CONFIG_DEFAULT_SECURITY_DAC \
 -e CONFIG_DEFAULT_SECURITY_APPARMOR \
 --set-str CONFIG_DEFAULT_SECURITY apparmor \
--e CONFIG_MODULE_ALLOW_BTF_MISMATCH \
 -d CONFIG_UNWINDER_ORC \
 -d CONFIG_UNWINDER_GUESS \
 -e CONFIG_UNWINDER_FRAME_POINTER \
---set-str CONFIG_SYSTEM_TRUSTED_KEYS ""\
---set-str CONFIG_SYSTEM_REVOCATION_KEYS ""\
--e CONFIG_SECURITY_LOCKDOWN_LSM \
--e CONFIG_SECURITY_LOCKDOWN_LSM_EARLY \
---set-str CONFIG_LSM lockdown,yama,integrity,apparmor \
--e CONFIG_PAGE_TABLE_ISOLATION \
--e CONFIG_ARCH_HAS_CPU_FINALIZE_INIT \
--d CONFIG_GDS_FORCE_MITIGATION \
--d CONFIG_WQ_CPU_INTENSIVE_REPORT \
--d CONFIG_N_GSM \
--d UBSAN_BOUNDS \
+-e CONFIG_PAGE_TABLE_ISOLATION
 
 debian/control: $(wildcard debian/*.in)
-	sed -e 's/@@KVNAME@@/$(KVNAME)/g' < debian/proxmox-kernel.prerm.in > debian/$(PMX_KERNEL_PKG).prerm
-	sed -e 's/@@KVNAME@@/$(KVNAME)/g' < debian/proxmox-kernel.postrm.in > debian/$(PMX_KERNEL_PKG).postrm
-	sed -e 's/@@KVNAME@@/$(KVNAME)/g' < debian/proxmox-kernel.postinst.in > debian/$(PMX_KERNEL_PKG).postinst
-	sed -e 's/@@KVNAME@@/$(KVNAME)/g' < debian/proxmox-headers.postinst.in > debian/$(PMX_HEADER_PKG).postinst
-	sed -e 's/@@KVMAJMIN@@/$(KERNEL_MAJMIN)/g' -e 's/@@KVNAME@@/$(KVNAME)/g' < debian/proxmox-kernel-meta.postrm.in > debian/$(PMX_KERNEL_SERIES_PKG).postrm
-	sed -e 's/@@KVMAJMIN@@/$(KERNEL_MAJMIN)/g' -e 's/@@KVNAME@@/$(KVNAME)/g' < debian/proxmox-kernel-meta.postinst.in > debian/$(PMX_KERNEL_SERIES_PKG).postinst
-	chmod +x debian/$(PMX_KERNEL_PKG).prerm
-	chmod +x debian/$(PMX_KERNEL_PKG).postrm
-	chmod +x debian/$(PMX_KERNEL_PKG).postinst
-	chmod +x debian/$(PMX_KERNEL_SERIES_PKG).postrm
-	chmod +x debian/$(PMX_KERNEL_SERIES_PKG).postinst
-	chmod +x debian/$(PMX_HEADER_PKG).postinst
-	sed -e 's/@KVNAME@/$(KVNAME)/g' -e 's/@KVMAJMIN@/$(KERNEL_MAJMIN)/g' < debian/control.in > debian/control
-
-	# signing-template
-	sed -e '1 s/proxmox-kernel/proxmox-kernel-signed/' -e '1 s/${DEB_VERSION}/${PMX_KERNEL_SIGNED_VERSION}/' < debian/changelog > debian/signing-template/changelog
-	sed -e 's/@KVNAME@/${KVNAME}/g' -e 's/@KVMAJMIN@/$(KERNEL_MAJMIN)/g' -e 's/@UNSIGNED_VERSION@/${DEB_VERSION}/g' < debian/signing-template/control.in > debian/signing-template/control
-	sed -e 's/@KVNAME@/${KVNAME}/g' < debian/signing-template/files.json.in > debian/signing-template/files.json
-	sed -e 's/@KVNAME@/${KVNAME}/g' -e 's/@PKG_VERSION@/${DEB_VERSION}/' < debian/signing-template/rules.in > debian/signing-template/rules
-	sed -e 's/@@KVNAME@@/${KVNAME}/g' < debian/proxmox-kernel.prerm.in > debian/signing-template/prerm
-	sed -e 's/@@KVNAME@@/${KVNAME}/g' < debian/proxmox-kernel.postrm.in > debian/signing-template/postrm
-	sed -e 's/@@KVNAME@@/${KVNAME}/g' < debian/proxmox-kernel.postinst.in > debian/signing-template/postinst
-	rm debian/signing-template/*.in
-	cp debian/SOURCE debian/signing-template/
+	sed -e 's/@@KVNAME@@/${KVNAME}/g' < debian/pve-kernel.prerm.in > debian/${PVE_KERNEL_PKG}.prerm
+	sed -e 's/@@KVNAME@@/${KVNAME}/g' < debian/pve-kernel.postrm.in > debian/${PVE_KERNEL_PKG}.postrm
+	sed -e 's/@@KVNAME@@/${KVNAME}/g' < debian/pve-kernel.postinst.in > debian/${PVE_KERNEL_PKG}.postinst
+	sed -e 's/@@KVNAME@@/${KVNAME}/g' < debian/pve-headers.postinst.in > debian/${PVE_HEADER_PKG}.postinst
+	chmod +x debian/${PVE_KERNEL_PKG}.prerm
+	chmod +x debian/${PVE_KERNEL_PKG}.postrm
+	chmod +x debian/${PVE_KERNEL_PKG}.postinst
+	chmod +x debian/${PVE_HEADER_PKG}.postinst
+	sed -e 's/@KVNAME@/${KVNAME}/g' -e 's/@KVMAJMIN@/${KERNEL_MAJMIN}/g' < debian/control.in > debian/control
 
 build: .compile_mark .tools_compile_mark .modules_compile_mark
 
-install: .install_mark .tools_install_mark .headers_install_mark .usr_headers_install_mark
+install: .install_mark .tools_install_mark .headers_install_mark
 	dh_installdocs -A debian/copyright debian/SOURCE
 	dh_installchangelogs
 	dh_installman
@@ -143,7 +79,7 @@ install: .install_mark .tools_install_mark .headers_install_mark .usr_headers_in
 
 binary: install
 	debian/rules fwcheck abicheck
-	dh_strip -N$(PMX_HEADER_PKG) -N$(PMX_USR_HEADER_PKG)
+	dh_strip -N${PVE_HEADER_PKG}
 	dh_makeshlibs
 	dh_shlibdeps
 	dh_installdeb
@@ -152,106 +88,72 @@ binary: install
 	dh_builddeb
 
 .config_mark:
-	cd $(KERNEL_SRC); scripts/config $(PMX_CONFIG_OPTS)
-	$(MAKE) -C $(KERNEL_SRC) olddefconfig
-	# copy to allow building in parallel to kernel/module compilation without interference
-	rm -rf $(KERNEL_SRC_COPY)
-	cp -ar $(KERNEL_SRC) $(KERNEL_SRC_COPY)
+	cd ${KERNEL_SRC}; scripts/config ${PVE_CONFIG_OPTS}
+	${MAKE} -C ${KERNEL_SRC} oldconfig
 	touch $@
 
 .compile_mark: .config_mark
-	$(MAKE) -C $(KERNEL_SRC) KBUILD_BUILD_VERSION_TIMESTAMP="PMX $(DEB_VERSION) ($(CHANGELOG_DATE_UTC_ISO))"
+	${MAKE} -C ${KERNEL_SRC} KBUILD_BUILD_VERSION_TIMESTAMP="PVE ${DEB_VERSION} (${CHANGELOG_DATE})"
 	touch $@
 
 .install_mark: .compile_mark .modules_compile_mark
-	rm -rf debian/$(PMX_KERNEL_PKG)
-	mkdir -p debian/$(PMX_KERNEL_PKG)/lib/modules/$(KVNAME)
-	mkdir debian/$(PMX_KERNEL_PKG)/boot
-	install -m 644 $(KERNEL_SRC)/.config debian/$(PMX_KERNEL_PKG)/boot/config-$(KVNAME)
-	install -m 644 $(KERNEL_SRC)/System.map debian/$(PMX_KERNEL_PKG)/boot/System.map-$(KVNAME)
-	install -m 644 $(KERNEL_SRC)/$(KERNEL_IMAGE_PATH) debian/$(PMX_KERNEL_PKG)/boot/$(KERNEL_INSTALL_FILE)-$(KVNAME)
-	$(MAKE) -C $(KERNEL_SRC) INSTALL_MOD_PATH=$(BUILD_DIR)/debian/$(PMX_KERNEL_PKG)/ modules_install
+	rm -rf debian/${PVE_KERNEL_PKG}
+	mkdir -p debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}
+	mkdir debian/${PVE_KERNEL_PKG}/boot
+	install -m 644 ${KERNEL_SRC}/.config debian/${PVE_KERNEL_PKG}/boot/config-${KVNAME}
+	install -m 644 ${KERNEL_SRC}/System.map debian/${PVE_KERNEL_PKG}/boot/System.map-${KVNAME}
+	install -m 644 ${KERNEL_SRC}/${KERNEL_IMAGE_PATH} debian/${PVE_KERNEL_PKG}/boot/${KERNEL_INSTALL_FILE}-${KVNAME}
+	${MAKE} -C ${KERNEL_SRC} INSTALL_MOD_PATH=${BUILD_DIR}/debian/${PVE_KERNEL_PKG}/ modules_install
+	## install latest ibg driver
+	install -m 644 ${MODULES}/igb.ko debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/kernel/drivers/net/ethernet/intel/igb/
+	# install latest e1000e driver
+	install -m 644 ${MODULES}/e1000e.ko debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/kernel/drivers/net/ethernet/intel/e1000e/
 	# install zfs drivers
-	install -d -m 0755 debian/$(PMX_KERNEL_PKG)/lib/modules/$(KVNAME)/zfs
-	install -m 644 $(MODULES)/zfs.ko $(MODULES)/spl.ko debian/$(PMX_KERNEL_PKG)/lib/modules/$(KVNAME)/zfs
+	install -d -m 0755 debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/zfs
+	install -m 644 $(addprefix ${MODULES}/,spl.ko splat.ko zfs.ko zavl.ko znvpair.ko zunicode.ko zcommon.ko zpios.ko icp.ko) debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/zfs
 	# remove firmware
-	rm -rf debian/$(PMX_KERNEL_PKG)/lib/firmware
-
-ifeq ($(filter pkg.proxmox-kernel.debug,$(DEB_BUILD_PROFILES)),)
-	echo "'pkg.proxmox-kernel.debug' build profile disabled, skipping -dbgsym creation"
-else
-	echo "'pkg.proxmox-kernel.debug' build profile enabled, creating -dbgsym contents"
-	mkdir -p debian/$(PMX_DEBUG_KERNEL_PKG)/usr/lib/debug/lib/modules/$(KVNAME)
-	mkdir debian/$(PMX_DEBUG_KERNEL_PKG)/usr/lib/debug/boot
-	install -m 644 $(KERNEL_SRC)/vmlinux debian/$(PMX_DEBUG_KERNEL_PKG)/usr/lib/debug/boot/vmlinux-$(KVNAME)
-	cp -r debian/$(PMX_KERNEL_PKG)/lib/modules/$(KVNAME) debian/$(PMX_DEBUG_KERNEL_PKG)/usr/lib/debug/lib/modules/
-	rm -f debian/$(PMX_DEBUG_KERNEL_PKG)/usr/lib/debug/lib/modules/$(KVNAME)/source
-	rm -f debian/$(PMX_DEBUG_KERNEL_PKG)/usr/lib/debug/lib/modules/$(KVNAME)/build
-	rm -f debian/$(PMX_DEBUG_KERNEL_PKG)/usr/lib/debug/lib/modules/$(KVNAME)/modules.*
-endif
-
+	rm -rf debian/${PVE_KERNEL_PKG}/lib/firmware
 	# strip debug info
-	find debian/$(PMX_KERNEL_PKG)/lib/modules -name \*.ko -print | while read f ; do strip --strip-debug "$$f"; done
-
-	# sign modules using ephemeral, embedded key
-	if grep -q CONFIG_MODULE_SIG=y ubuntu-kernel/.config ; then \
-		find debian/$(PMX_KERNEL_PKG)/lib/modules -name \*.ko -print | while read f ; do \
-			./ubuntu-kernel/scripts/sign-file sha512 ./ubuntu-kernel/certs/signing_key.pem ubuntu-kernel/certs/signing_key.x509 "$$f" ; \
-		done; \
-		rm ./ubuntu-kernel/certs/signing_key.pem ; \
-	fi
+	find debian/${PVE_KERNEL_PKG}/lib/modules -name \*.ko -print | while read f ; do strip --strip-debug "$$f"; done
 	# finalize
-	/sbin/depmod -b debian/$(PMX_KERNEL_PKG)/ $(KVNAME)
+	/sbin/depmod -b debian/${PVE_KERNEL_PKG}/ ${KVNAME}
 	# Autogenerate blacklist for watchdog devices (see README)
-	install -m 0755 -d debian/$(PMX_KERNEL_PKG)/lib/modprobe.d
-	ls debian/$(PMX_KERNEL_PKG)/lib/modules/$(KVNAME)/kernel/drivers/watchdog/ > watchdog-blacklist.tmp
+	install -m 0755 -d debian/${PVE_KERNEL_PKG}/lib/modprobe.d
+	ls debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/kernel/drivers/watchdog/ > watchdog-blacklist.tmp
 	echo ipmi_watchdog.ko >> watchdog-blacklist.tmp
-	cat watchdog-blacklist.tmp|sed -e 's/^/blacklist /' -e 's/.ko$$//'|sort -u > debian/$(PMX_KERNEL_PKG)/lib/modprobe.d/blacklist_$(PMX_KERNEL_PKG).conf
-	rm -f debian/$(PMX_KERNEL_PKG)/lib/modules/$(KVNAME)/source
-	rm -f debian/$(PMX_KERNEL_PKG)/lib/modules/$(KVNAME)/build
-
-	# copy signing template contents
-	rm -rf debian/${PMX_KERNEL_SIGNING_TEMPLATE_PKG}
-	mkdir -p debian/${PMX_KERNEL_SIGNING_TEMPLATE_PKG}/usr/share/code-signing/${PMX_KERNEL_SIGNING_TEMPLATE_PKG}/source-template/debian
-	cp -R debian/copyright \
-		debian/signing-template/rules \
-		debian/signing-template/control \
-		debian/signing-template/source \
-		debian/signing-template/changelog \
-		debian/signing-template/prerm \
-		debian/signing-template/postrm \
-		debian/signing-template/postinst \
-		debian/signing-template/SOURCE \
-		debian/${PMX_KERNEL_SIGNING_TEMPLATE_PKG}/usr/share/code-signing/${PMX_KERNEL_SIGNING_TEMPLATE_PKG}/source-template/debian
-	cp debian/signing-template/files.json debian/${PMX_KERNEL_SIGNING_TEMPLATE_PKG}/usr/share/code-signing/${PMX_KERNEL_SIGNING_TEMPLATE_PKG}/
-
+	cat watchdog-blacklist.tmp|sed -e 's/^/blacklist /' -e 's/.ko$$//'|sort -u > debian/${PVE_KERNEL_PKG}/lib/modprobe.d/blacklist_${PVE_KERNEL_PKG}.conf
+	rm -f debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/source
+	rm -f debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/build
 	touch $@
 
 .tools_compile_mark: .compile_mark
-	$(MAKE) -C $(KERNEL_SRC)/tools/perf prefix=/usr NO_LIBTRACEEVENT=1 HAVE_NO_LIBBFD=1 HAVE_CPLUS_DEMANGLE_SUPPORT=1 NO_LIBPYTHON=1 NO_LIBPERL=1 NO_LIBCRYPTO=1 PYTHON=python3
+	${MAKE} -C ${KERNEL_SRC}/tools/perf prefix=/usr HAVE_NO_LIBBFD=1 HAVE_CPLUS_DEMANGLE_SUPPORT=1 NO_LIBPYTHON=1 NO_LIBPERL=1 NO_LIBCRYPTO=1 PYTHON=python2.7
 	echo "checking GPL-2 only perf binary for library linkage with incompatible licenses.."
-	! ldd $(KERNEL_SRC)/tools/perf/perf | grep -q -E '\blibbfd'
-	! ldd $(KERNEL_SRC)/tools/perf/perf | grep -q -E '\blibcrypto'
-	$(MAKE) -C $(KERNEL_SRC)/tools/perf NO_LIBTRACEEVENT=1 man
+	! ldd ${KERNEL_SRC}/tools/perf/perf | grep -q -E '\blibbfd'
+	! ldd ${KERNEL_SRC}/tools/perf/perf | grep -q -E '\blibcrypto'
+	${MAKE} -C ${KERNEL_SRC}/tools/perf man
 	touch $@
 
 .tools_install_mark: .tools_compile_mark
-	rm -rf debian/$(LINUX_TOOLS_PKG)
-	mkdir -p debian/$(LINUX_TOOLS_PKG)/usr/bin
-	mkdir -p debian/$(LINUX_TOOLS_PKG)/usr/share/man/man1
-	install -m 755 $(BUILD_DIR)/$(KERNEL_SRC)/tools/perf/perf debian/$(LINUX_TOOLS_PKG)/usr/bin/perf_$(KERNEL_MAJMIN)
-	for i in $(BUILD_DIR)/$(KERNEL_SRC)/tools/perf/Documentation/*.1; do \
+	rm -rf debian/${LINUX_TOOLS_PKG}
+	mkdir -p debian/${LINUX_TOOLS_PKG}/usr/bin
+	mkdir -p debian/${LINUX_TOOLS_PKG}/usr/share/man/man1
+	install -m 755 ${BUILD_DIR}/${KERNEL_SRC}/tools/perf/perf debian/${LINUX_TOOLS_PKG}/usr/bin/perf_$(KERNEL_MAJMIN)
+	for i in ${BUILD_DIR}/${KERNEL_SRC}/tools/perf/Documentation/*.1; do \
 	    fname="$${i##*/}"; manname="$${fname%.1}"; \
-	    install -m644 "$$i" "debian/$(LINUX_TOOLS_PKG)/usr/share/man/man1/$${manname}_$(KERNEL_MAJMIN).1"; \
+	    install -m644 "$$i" "debian/${LINUX_TOOLS_PKG}/usr/share/man/man1/$${manname}_$(KERNEL_MAJMIN).1"; \
 	done
 	touch $@
 
 .headers_prepare_mark: .config_mark
-	rm -rf debian/$(PMX_HEADER_PKG)
-	mkdir -p debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)
-	install -m 0644 $(KERNEL_SRC)/.config debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)
-	make -C $(KERNEL_SRC_COPY) mrproper
-	cd $(KERNEL_SRC_COPY); find . -path './debian/*' -prune \
+	rm -rf debian/${PVE_HEADER_PKG}
+	mkdir -p debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
+	install -m 0644 ${KERNEL_SRC}/.config debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
+	# copy to allow building in parallel to kernel/module compilation without interference
+	rm -rf ${KERNEL_SRC_COPY}
+	cp -ar ${KERNEL_SRC} ${KERNEL_SRC_COPY}
+	make -C ${KERNEL_SRC_COPY} mrproper
+	cd ${KERNEL_SRC_COPY}; find . -path './debian/*' -prune \
 	    -o -path './include/*' -prune \
 	    -o -path './Documentation' -prune \
 	    -o -path './scripts' -prune \
@@ -263,80 +165,84 @@ endif
 	        -o -name '*.sh' \
 	        -o -name '*.pl' \
 	    \) \
-	    -print | cpio -pd --preserve-modification-time $(BUILD_DIR)/debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)
-	cd $(KERNEL_SRC_COPY); \
+	    -print | cpio -pd --preserve-modification-time ${BUILD_DIR}/debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
+	cd ${KERNEL_SRC_COPY}; cp -a include scripts ${BUILD_DIR}/debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
+	cd ${KERNEL_SRC_COPY}; \
 	    ( \
-	        find arch/$(KERNEL_HEADER_ARCH) -name include -type d -print | \
+	        find arch/${KERNEL_HEADER_ARCH} -name include -type d -print | \
 	        xargs -n1 -i: find : -type f \
 	    ) | \
-	    cpio -pd --preserve-modification-time $(BUILD_DIR)/debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)
+	    cpio -pd --preserve-modification-time ${BUILD_DIR}/debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
 	touch $@
 
 .headers_compile_mark: .headers_prepare_mark
 	# set output to subdir of source to reduce number of hardcoded paths in output files
-	rm -rf $(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG)
-	mkdir -p $(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG)
-	cp $(KERNEL_SRC)/.config $(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG)/.config
-	$(MAKE) -C $(KERNEL_SRC_COPY) O=$(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG) -j1 syncconfig modules_prepare prepare scripts
-	cd $(KERNEL_SRC_COPY); cp -a include scripts $(BUILD_DIR)/debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)
-	find $(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG) -name \*.o.ur-\* -o -name '*.cmd' | xargs rm -f
-	rsync --ignore-existing -r -v -a $(addprefix $(BUILD_DIR)/$(KERNEL_SRC_COPY)/$(PMX_HEADER_PKG)/,arch include kernel scripts tools) $(BUILD_DIR)/debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)/
-	rm -rf $(BUILD_DIR)/$(KERNEL_SRC_COPY)
+	rm -rf ${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG}
+	mkdir -p ${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG}
+	cp ${KERNEL_SRC}/.config ${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG}/.config
+	${MAKE} -C ${KERNEL_SRC_COPY} O=${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG} -j1 silentoldconfig prepare scripts
+	find ${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG} -name \*.o.ur-\* | xargs rm -f
+	rsync --ignore-existing -r -v -a $(addprefix ${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG}/,arch include kernel scripts tools) ${BUILD_DIR}/debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}/
+	rm -rf ${BUILD_DIR}/${KERNEL_SRC_COPY}
 	touch $@
 
 .headers_install_mark: .compile_mark .modules_compile_mark .headers_compile_mark
-	cp $(KERNEL_SRC)/include/generated/compile.h debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)/include/generated/compile.h
-	install -m 0644 $(KERNEL_SRC)/Module.symvers debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)
-	mkdir -p debian/$(PMX_HEADER_PKG)/lib/modules/$(KVNAME)
-	ln -sf /usr/src/linux-headers-$(KVNAME) debian/$(PMX_HEADER_PKG)/lib/modules/$(KVNAME)/build
+	cp ${KERNEL_SRC}/include/generated/compile.h debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}/include/generated/compile.h
+	install -m 0644 ${KERNEL_SRC}/Module.symvers debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
+	mkdir -p debian/${PVE_HEADER_PKG}/lib/modules/${KVNAME}
+	ln -sf /usr/src/linux-headers-${KVNAME} debian/${PVE_HEADER_PKG}/lib/modules/${KVNAME}/build
 	touch $@
 
-.usr_headers_install_mark: PKG_DIR = debian/$(PMX_USR_HEADER_PKG)
-.usr_headers_install_mark: OUT_DIR = $(PKG_DIR)/usr
-.usr_headers_install_mark: .config_mark
-	rm -rf '$(PKG_DIR)'
-	mkdir -p  '$(PKG_DIR)'
-	$(MAKE) -C $(KERNEL_SRC) headers_install ARCH=$(KERNEL_HEADER_ARCH) INSTALL_HDR_PATH='$(CURDIR)'/$(OUT_DIR)
-	rm -rf $(OUT_DIR)/include/drm $(OUT_DIR)/include/scsi
-	find $(OUT_DIR)/include \( -name .install -o -name ..install.cmd \) -execdir rm {} +
-
-# Move include/asm to arch-specific directory
-	mkdir -p $(OUT_DIR)/include/$(DEB_HOST_MULTIARCH)
-	mv $(OUT_DIR)/include/asm $(OUT_DIR)/include/$(DEB_HOST_MULTIARCH)/
-	test ! -d $(OUT_DIR)/include/arch || \
-		mv $(OUT_DIR)/include/arch $(OUT_DIR)/include/$(DEB_HOST_MULTIARCH)/
+.modules_compile_mark: $(addprefix ${MODULES}/,igb.ko e1000e.ko spl.ko zfs.ko)
 	touch $@
 
-.modules_compile_mark: $(MODULES)/zfs.ko
-	touch $@
+${MODULES}/spl.ko: .compile_mark
+	cd ${MODULES}/${SPLDIR}; ./autogen.sh
+	cd ${MODULES}/${SPLDIR}; ./configure --with-config=kernel --with-linux=${BUILD_DIR}/${KERNEL_SRC} --with-linux-obj=${BUILD_DIR}/${KERNEL_SRC}
+	${MAKE} -C ${MODULES}/${SPLDIR}
+	cp ${MODULES}/${SPLDIR}/module/splat/splat.ko ${MODULES}/
+	cp ${MODULES}/${SPLDIR}/module/spl/spl.ko ${MODULES}/
 
-$(MODULES)/zfs.ko: .compile_mark
-	cd $(MODULES)/$(ZFSDIR); ./autogen.sh
-	cd $(MODULES)/$(ZFSDIR); ./configure --with-config=kernel --with-linux=$(BUILD_DIR)/$(KERNEL_SRC) --with-linux-obj=$(BUILD_DIR)/$(KERNEL_SRC)
-	$(MAKE) -C $(MODULES)/$(ZFSDIR)
-	cp $(MODULES)/$(ZFSDIR)/module/zfs.ko $(MODULES)/
-	cp $(MODULES)/$(ZFSDIR)/module/spl.ko $(MODULES)/
+${MODULES}/zfs.ko: .compile_mark ${MODULES}/spl.ko
+	cd ${MODULES}/${ZFSDIR}; ./autogen.sh
+	cd ${MODULES}/${ZFSDIR}; ./configure --with-spl=${BUILD_DIR}/${MODULES}/${SPLDIR} --with-spl-obj=${BUILD_DIR}/${MODULES}/${SPLDIR} --with-config=kernel --with-linux=${BUILD_DIR}/${KERNEL_SRC} --with-linux-obj=${BUILD_DIR}/${KERNEL_SRC}
+	${MAKE} -C ${MODULES}/${ZFSDIR}
+	cp ${MODULES}/${ZFSDIR}/module/avl/zavl.ko ${MODULES}/
+	cp ${MODULES}/${ZFSDIR}/module/nvpair/znvpair.ko ${MODULES}/
+	cp ${MODULES}/${ZFSDIR}/module/unicode/zunicode.ko ${MODULES}/
+	cp ${MODULES}/${ZFSDIR}/module/zcommon/zcommon.ko ${MODULES}/
+	cp ${MODULES}/${ZFSDIR}/module/zpios/zpios.ko ${MODULES}/
+	cp ${MODULES}/${ZFSDIR}/module/icp/icp.ko ${MODULES}/
+	cp ${MODULES}/${ZFSDIR}/module/zfs/zfs.ko ${MODULES}/
 
-fwlist-$(KVNAME): .compile_mark .modules_compile_mark
-	debian/scripts/find-firmware.pl debian/$(PMX_KERNEL_PKG)/lib/modules/$(KVNAME) >fwlist.tmp
+${MODULES}/igb.ko: .compile_mark
+	${MAKE} -C ${MODULES}/${IGBDIR}/src BUILD_KERNEL=${KVNAME} KSRC=${BUILD_DIR}/${KERNEL_SRC}
+	cp ${MODULES}/${IGBDIR}/src/igb.ko ${MODULES}/
+
+${MODULES}/e1000e.ko: .compile_mark
+	${MAKE} -C ${MODULES}/${E1000EDIR}/src BUILD_KERNEL=${KVNAME} KSRC=${BUILD_DIR}/${KERNEL_SRC}
+	cp ${MODULES}/${E1000EDIR}/src/e1000e.ko ${MODULES}/
+
+fwlist-${KVNAME}: .compile_mark .modules_compile_mark
+	debian/scripts/find-firmware.pl debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME} >fwlist.tmp
 	mv fwlist.tmp $@
 
 .PHONY: fwcheck
-fwcheck: fwlist-$(KVNAME) fwlist-previous
+fwcheck: fwlist-${KVNAME} fwlist-previous
 	@echo "checking fwlist for changes since last built firmware package.."
-	@echo "if this check fails, add fwlist-$(KVNAME) to the pve-firmware repository and upload a new firmware package together with the $(KVNAME) kernel"
+	@echo "if this check fails, add fwlist-${KVNAME} to the pve-firmware repository and upload a new firmware package together with the ${KVNAME} kernel"
 	sort fwlist-previous | uniq > fwlist-previous.sorted
-	sort fwlist-$(KVNAME) | uniq > fwlist-$(KVNAME).sorted
-	diff -up -N fwlist-previous.sorted fwlist-$(KVNAME).sorted > fwlist.diff
-	rm fwlist.diff fwlist-previous.sorted fwlist-$(KVNAME).sorted
+	sort fwlist-${KVNAME} | uniq > fwlist-${KVNAME}.sorted
+	diff -up -N fwlist-previous.sorted fwlist-${KVNAME}.sorted > fwlist.diff
+	rm fwlist.diff fwlist-previous.sorted fwlist-${KVNAME}.sorted
 	@echo "done, no need to rebuild pve-firmware"
 
 
-abi-$(KVNAME): .compile_mark
-	debian/scripts/abi-generate debian/$(PMX_HEADER_PKG)/usr/src/linux-headers-$(KVNAME)/Module.symvers abi-$(KVNAME) $(KVNAME)
+abi-${KVNAME}: .compile_mark
+	debian/scripts/abi-generate debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}/Module.symvers abi-${KVNAME} ${KVNAME}
 
 .PHONY: abicheck
-abicheck: debian/scripts/abi-check abi-$(KVNAME) abi-prev-* abi-blacklist
-	debian/scripts/abi-check abi-$(KVNAME) abi-prev-* $(SKIPABI)
+abicheck: debian/scripts/abi-check abi-${KVNAME} abi-prev-* abi-blacklist
+	debian/scripts/abi-check abi-${KVNAME} abi-prev-* ${SKIPABI}
 
 .PHONY: clean

debian/scripts/abi-check

@@ -1,14 +1,12 @@
-#!/usr/bin/perl
-
-use strict;
-use warnings;
+#!/usr/bin/perl -w
 
 my $abinew = shift;
 my $abiold = shift;
 my $skipabi = shift;
 
 # to catch multiple abi-prev-* files being passed in
-die "invalid value '$skipabi' for skipabi parameter\n" if defined($skipabi) && $skipabi !~ /^[01]$/;
+die "invalid value for skipabi parameter\n"
+	if (defined($skipabi) && $skipabi !~ /^[01]$/);
 
 $abinew =~ /abi-(.*)/;
 my $abistr = $1;
@@ -25,30 +23,30 @@ my $count;
 print "II: Checking ABI...\n";
 
 if ($skipabi) {
-    print "WW: Explicitly asked to ignore ABI, running in no-fail mode\n";
-    $fail_exit = 0;
-    $abiskip = 1;
-    $EE = "WW:";
+	print "WW: Explicitly asked to ignore ABI, running in no-fail mode\n";
+	$fail_exit = 0;
+	$abiskip = 1;
+	$EE = "WW:";
 }
 
 if ($prev_abistr ne $abistr) {
-    print "II: Different ABI's, running in no-fail mode\n";
-    $fail_exit = 0;
-    $EE = "WW:";
+	print "II: Different ABI's, running in no-fail mode\n";
+	$fail_exit = 0;
+	$EE = "WW:";
 }
 
 if (not -f "$abinew" or not -f "$abiold") {
-    print "EE: Previous or current ABI file missing!\n";
-    print "    $abinew\n" if not -f "$abinew";
-    print "    $abiold\n" if not -f "$abiold";
+	print "EE: Previous or current ABI file missing!\n";
+	print "    $abinew\n" if not -f "$abinew";
+	print "    $abiold\n" if not -f "$abiold";
 
-    # Exit if the ABI files are missing, but return status based on whether
-    # skip ABI was indicated.
-    if ("$abiskip" eq "1") {
-	exit(0);
-    } else {
-	exit(1);
-    }
+	# Exit if the ABI files are missing, but return status based on whether
+	# skip ABI was indicated.
+	if ("$abiskip" eq "1") {
+		exit(0);
+	} else {
+		exit(1);
+	}
 }
 
 my %symbols;
@@ -60,97 +58,101 @@ my %module_syms;
 my $ignore = 0;
 print "    Reading symbols/modules to ignore...";
 
-for my $file ("abi-blacklist") {
-    next if !-f $file;
-    open(my $IGNORE_FH, '<', $file) or die "Could not open $file - $!";
-
-    while (<$IGNORE_FH>) {
-	chomp;
-	if ($_ =~ m/M: (.*)/) {
-	    $modules_ignore{$1} = 1;
-	} else {
-	    $symbols_ignore{$_} = 1;
+for $file ("abi-blacklist") {
+	if (-f $file) {
+		open(IGNORE, "< $file") or
+			die "Could not open $file";
+		while (<IGNORE>) {
+			chomp;
+			if ($_ =~ m/M: (.*)/) {
+				$modules_ignore{$1} = 1;
+			} else {
+				$symbols_ignore{$_} = 1;
+			}
+			$ignore++;
+		}
+		close(IGNORE);
 	}
-	$ignore++;
-    }
-    close($IGNORE_FH);
 }
 print "read $ignore symbols/modules.\n";
 
 sub is_ignored($$) {
-    my ($mod, $sym) = @_;
+	my ($mod, $sym) = @_;
 
-    die "Missing module name in is_ignored()" if not defined($mod);
-    die "Missing symbol name in is_ignored()" if not defined($sym);
+	die "Missing module name in is_ignored()" if not defined($mod);
+	die "Missing symbol name in is_ignored()" if not defined($sym);
 
-    if (defined($symbols_ignore{$sym}) or defined($modules_ignore{$mod})) {
-	return 1;
-    }
-    return 0;
+	if (defined($symbols_ignore{$sym}) or defined($modules_ignore{$mod})) {
+		return 1;
+	}
+	return 0;
 }
 
 # Read new syms first
 print "    Reading new symbols ($abistr)...";
 $count = 0;
-open(my $NEW_FH, '<', $abinew) or die "Could not open $abinew - $!";
-while (<$NEW_FH>) {
-    chomp;
-    m/^(\S+)\s(.+)\s(0x[0-9a-f]+)\s(.+)$/;
-    $symbols{$4}{'type'} = $1;
-    $symbols{$4}{'loc'} = $2;
-    $symbols{$4}{'hash'} = $3;
-    $module_syms{$2} = 0;
-    $count++;
+open(NEW, "< $abinew") or
+	die "Could not open $abinew";
+while (<NEW>) {
+	chomp;
+	m/^(\S+)\s(.+)\s(0x[0-9a-f]+)\s(.+)$/;
+	$symbols{$4}{'type'} = $1;
+	$symbols{$4}{'loc'} = $2;
+	$symbols{$4}{'hash'} = $3;
+	$module_syms{$2} = 0;
+	$count++;
 }
-close($NEW_FH);
+close(NEW);
 print "read $count symbols.\n";
 
 # Now the old symbols, checking for missing ones
 print "    Reading old symbols...";
 $count = 0;
-open(my $OLD_FH, '<', $abiold) or die "Could not open $abiold - $!";
-while (<$OLD_FH>) {
-    chomp;
-    m/^(\S+)\s(.+)\s(0x[0-9a-f]+)\s(.+)$/;
-    $symbols{$4}{'old_type'} = $1;
-    $symbols{$4}{'old_loc'} = $2;
-    $symbols{$4}{'old_hash'} = $3;
-    $count++;
+open(OLD, "< $abiold") or
+	die "Could not open $abiold";
+while (<OLD>) {
+	chomp;
+	m/^(\S+)\s(.+)\s(0x[0-9a-f]+)\s(.+)$/;
+	$symbols{$4}{'old_type'} = $1;
+	$symbols{$4}{'old_loc'} = $2;
+	$symbols{$4}{'old_hash'} = $3;
+	$count++;
 }
-close($OLD_FH);
+close(OLD);
 
 print "read $count symbols.\n";
 
 print "II: Checking for missing symbols in new ABI...";
 $count = 0;
-for my $sym (keys(%symbols)) {
-    if (!defined($symbols{$sym}{'type'})) {
-	print "\n" if not $count;
-	printf("    MISS : %s%s\n", $sym, is_ignored($symbols{$sym}{'old_loc'}, $sym) ? " (ignored)" : "");
-	$count++ if !is_ignored($symbols{$sym}{'old_loc'}, $sym);
-    }
+foreach $sym (keys(%symbols)) {
+	if (!defined($symbols{$sym}{'type'})) {
+		print "\n" if not $count;
+		printf("    MISS : %s%s\n", $sym,
+			is_ignored($symbols{$sym}{'old_loc'}, $sym) ? " (ignored)" : "");
+		$count++ if !is_ignored($symbols{$sym}{'old_loc'}, $sym);
+	}
 }
 print "    " if $count;
 print "found $count missing symbols\n";
 if ($count) {
-    print "$EE Symbols gone missing (what did you do!?!)\n";
-    $errors++;
+	print "$EE Symbols gone missing (what did you do!?!)\n";
+	$errors++;
 }
 
 
 print "II: Checking for new symbols in new ABI...";
 $count = 0;
-for my $sym (keys(%symbols)) {
-    if (!defined($symbols{$sym}{'old_type'})) {
-	print "\n" if not $count;
-	print "    NEW : $sym\n";
-	$count++;
-    }
+foreach $sym (keys(%symbols)) {
+	if (!defined($symbols{$sym}{'old_type'})) {
+		print "\n" if not $count;
+		print "    NEW : $sym\n";
+		$count++;
+	}
 }
 print "    " if $count;
 print "found $count new symbols\n";
 if ($count) {
-    print "WW: Found new symbols. Not recommended unless ABI was bumped\n";
+	print "WW: Found new symbols. Not recommended unless ABI was bumped\n";
 }
 
 print "II: Checking for changes to ABI...\n";
@@ -158,34 +160,37 @@ $count = 0;
 my $moved = 0;
 my $changed_type = 0;
 my $changed_hash = 0;
-for my $sym (keys(%symbols)) {
-    if (!defined($symbols{$sym}{'old_type'}) or !defined($symbols{$sym}{'type'})) {
-	next;
-    }
+foreach $sym (keys(%symbols)) {
+	if (!defined($symbols{$sym}{'old_type'}) or
+	    !defined($symbols{$sym}{'type'})) {
+		next;
+	}
 
-    # Changes in location don't hurt us, but log it anyway
-    if ($symbols{$sym}{'loc'} ne $symbols{$sym}{'old_loc'}) {
-	printf("    MOVE : %-40s : %s => %s\n", $sym, $symbols{$sym}{'old_loc'}, $symbols{$sym}{'loc'});
-	$moved++;
-    }
+	# Changes in location don't hurt us, but log it anyway
+	if ($symbols{$sym}{'loc'} ne $symbols{$sym}{'old_loc'}) {
+		printf("    MOVE : %-40s : %s => %s\n", $sym, $symbols{$sym}{'old_loc'},
+			$symbols{$sym}{'loc'});
+		$moved++;
+	}
 
-    # Changes to export type are only bad if new type isn't
-    # EXPORT_SYMBOL. Changing things to GPL are bad.
-    if ($symbols{$sym}{'type'} ne $symbols{$sym}{'old_type'}) {
-	printf("    TYPE : %-40s : %s => %s%s\n", $sym, $symbols{$sym}{'old_type'}.
-	    $symbols{$sym}{'type'}, is_ignored($symbols{$sym}{'loc'}, $sym)
-	    ? " (ignored)" : "");
-	$changed_type++ if $symbols{$sym}{'type'} ne "EXPORT_SYMBOL" and !is_ignored($symbols{$sym}{'loc'}, $sym);
-    }
+	# Changes to export type are only bad if new type isn't
+	# EXPORT_SYMBOL. Changing things to GPL are bad.
+	if ($symbols{$sym}{'type'} ne $symbols{$sym}{'old_type'}) {
+		printf("    TYPE : %-40s : %s => %s%s\n", $sym, $symbols{$sym}{'old_type'}.
+			$symbols{$sym}{'type'}, is_ignored($symbols{$sym}{'loc'}, $sym)
+			? " (ignored)" : "");
+		$changed_type++ if $symbols{$sym}{'type'} ne "EXPORT_SYMBOL"
+			and !is_ignored($symbols{$sym}{'loc'}, $sym);
+	}
 
-    # Changes to the hash are always bad
-    if ($symbols{$sym}{'hash'} ne $symbols{$sym}{'old_hash'}) {
-	printf("    HASH : %-40s : %s => %s%s\n", $sym, $symbols{$sym}{'old_hash'},
-	    $symbols{$sym}{'hash'}, is_ignored($symbols{$sym}{'loc'}, $sym)
-	    ? " (ignored)" : "");
-	$changed_hash++ if !is_ignored($symbols{$sym}{'loc'}, $sym);
-	$module_syms{$symbols{$sym}{'loc'}}++;
-    }
+	# Changes to the hash are always bad
+	if ($symbols{$sym}{'hash'} ne $symbols{$sym}{'old_hash'}) {
+		printf("    HASH : %-40s : %s => %s%s\n", $sym, $symbols{$sym}{'old_hash'},
+			$symbols{$sym}{'hash'}, is_ignored($symbols{$sym}{'loc'}, $sym)
+			? " (ignored)" : "");
+		$changed_hash++ if !is_ignored($symbols{$sym}{'loc'}, $sym);
+		$module_syms{$symbols{$sym}{'loc'}}++;
+	}
 }
 
 print "WW: $moved symbols changed location\n" if $moved;
@@ -194,17 +199,17 @@ print "$EE $changed_hash symbols changed hash and weren't ignored\n" if $changed
 
 $errors++ if $changed_hash or $changed_type;
 if ($changed_hash) {
-    print "II: Module hash change summary...\n";
-    for my $mod (sort { $module_syms{$b} <=> $module_syms{$a} } keys %module_syms) {
-	next if ! $module_syms{$mod};
-	printf("    %-40s: %d\n", $mod, $module_syms{$mod});
-    }
+	print "II: Module hash change summary...\n";
+	foreach $mod (sort { $module_syms{$b} <=> $module_syms{$a} } keys %module_syms) {
+		next if ! $module_syms{$mod};
+		printf("    %-40s: %d\n", $mod, $module_syms{$mod});
+	}
 }
 
 print "II: Done\n";
 
 if ($errors) {
-    exit($fail_exit);
+	exit($fail_exit);
 } else {
-    exit(0);
+	exit(0);
 }

debian/scripts/abi-generate

@@ -1,11 +1,8 @@
-#!/usr/bin/perl
+#!/usr/bin/perl -w
 
-use strict;
-use warnings;
+use PVE::Tools;
 
-use PVE::Tools ();
-
-use IO::File ();
+use IO::File;
 
 sub usage {
     die "USAGE: $0 INFILE OUTFILE [ABI INFILE-IS-DEB]\n";

debian/scripts/export-patchqueue

@@ -6,7 +6,7 @@ top=$(pwd)
 
 if [ "$#" -ne 3 ]; then
     echo "USAGE: $0 repo patchdir ref"
-    printf "\t exports patches from 'repo' to 'patchdir' based on 'ref'\n"
+    echo "\t exports patches from 'repo' to 'patchdir' based on 'ref'"
     exit 1
 fi
 
@@ -25,10 +25,10 @@ git format-patch \
     --no-cover-letter \
     --zero-commit \
     --no-signature \
-    --diff-algorithm=myers \
-    --output-directory="${top}/${kernel_patchdir}" \
+    --output-dir \
+    "${top}/${kernel_patchdir}" \
     "${base_ref}.."
 
-git checkout "${base_ref}"
+git checkout ${base_ref}
 
 cd "${top}"

debian/scripts/find-firmware.pl

@@ -1,7 +1,6 @@
-#!/usr/bin/perl
+#!/usr/bin/perl -w
 
 use strict;
-use warnings;
 
 my $dir = shift;
 
@@ -9,25 +8,25 @@ die "no directory to scan" if !$dir;
 
 die "no such directory" if ! -d $dir;
 
-warn "\n\nNOTE: strange directory name: $dir\n\n" if $dir !~ m|^(.*/)?(\d+.\d+.\d+\-\d+\-pve)(/+)?$|;
+die "strange directory name" if $dir !~ m|^(.*/)?(4.15.\d+\-\d+\-pve)(/+)?$|;
 
 my $apiver = $2;
 
-open(my $FIND_KO_FH, "find '$dir' -name '*.ko'|");
-while (defined(my $fn = <$FIND_KO_FH>)) {
+open(TMP, "find '$dir' -name '*.ko'|");
+while (defined(my $fn = <TMP>)) {
     chomp $fn;
     my $relfn = $fn;
     $relfn =~ s|^$dir/*||;
 
     my $cmd = "/sbin/modinfo -F firmware '$fn'";
-    open(my $MOD_FH, "$cmd|");
-    while (defined(my $fw = <$MOD_FH>)) {
+    open(MOD, "$cmd|");
+    while (defined(my $fw = <MOD>)) {
 	chomp $fw;
 	print "$fw $relfn\n";
     }
-    close($MOD_FH);
+    close(MOD);
 
 }
-close($FIND_KO_FH);
+close TMP;
 
 exit 0;

debian/signing-template/control.in

@@ -1,25 +0,0 @@
-Source: proxmox-kernel-signed-@KVMAJMIN@
-Section: kernel
-Priority: optional
-Maintainer: Proxmox Support Team <support@proxmox.com>
-Standards-Version: 4.2.0
-Build-Depends: debhelper-compat (= 12), dh-exec, python3:any, rsync, sbsigntool, proxmox-kernel-@KVNAME@ (= @UNSIGNED_VERSION@)
-Rules-Requires-Root: no
-Vcs-Git: git://git.proxmox.com/git/pve-kernel
-Vcs-Browser: https://git.proxmox.com/?p=pve-kernel.git
-
-Package: proxmox-kernel-@KVNAME@-signed
-Section: admin
-Priority: optional
-Architecture: any
-Provides: linux-image-@KVNAME@-amd64, proxmox-kernel-@KVNAME@
-Depends: ${unsigned:Depends}, ${misc:Depends}
-Recommends: ${unsigned:Recommends}
-Suggests: ${unsigned:Suggests}
-Breaks: ${unsigned:Breaks}
-Conflicts: proxmox-kernel-@KVNAME@
-Replaces: proxmox-kernel-@KVNAME@
-Description: ${unsigned:DescriptionShort} (signed)
- ${unsigned:DescriptionLong}
- .
- This package contains the kernel image signed by the Proxmox Secure Boot CA.

debian/signing-template/files.json.in

@@ -1,13 +0,0 @@
-{
-	"packages": {
-		"proxmox-kernel-@KVNAME@": {
-			"trusted_certs": [],
-			"files": [
-				{
-					"sig_type": "efi",
-					"file": "boot/vmlinuz-@KVNAME@"
-				}
-			]
-		}
-	}
-}

debian/signing-template/rules.in

@@ -1,58 +0,0 @@
-#!/usr/bin/make -f
-
-SHELL := bash -e
-
-export DH_OPTIONS
-
-include /usr/share/dpkg/architecture.mk
-
-KERNEL_VERSION=@KVNAME@
-IMAGE_PACKAGE_NAME=proxmox-kernel-$(KERNEL_VERSION)
-PACKAGE_NAME=$(IMAGE_PACKAGE_NAME)-signed
-PACKAGE_VERSION=@PKG_VERSION@
-PACKAGE_DIR=debian/$(PACKAGE_NAME)
-SIGNATURE_DIR=debian/signatures/${IMAGE_PACKAGE_NAME}
-
-build: build-arch build-indep
-build-arch:
-build-indep:
-
-clean:
-	dh_testdir
-	dh_clean
-
-binary: binary-arch binary-indep
-binary-arch:
-	dh_testdir
-	mkdir -p $(PACKAGE_DIR)/boot
-	rsync -a $(patsubst %,/boot/%-$(KERNEL_VERSION),config System.map vmlinuz) $(PACKAGE_DIR)/boot/
-	if [ -f $(SIGNATURE_DIR)/boot/vmlinuz-$(KERNEL_VERSION).sig ]; then \
-		sbattach --attach $(SIGNATURE_DIR)/boot/vmlinuz-$(KERNEL_VERSION).sig \
-			$(PACKAGE_DIR)/boot/vmlinuz-$(KERNEL_VERSION); \
-	else \
-		echo "No signature for image 'vmlinuz-$(KERNEL_VERSION)' found in '$(SIGNATURE_DIR)'"; \
-		false; \
-	fi
-	mkdir -p $(PACKAGE_DIR)/lib/modules/$(KERNEL_VERSION)
-	rsync -ar /lib/modules/$(KERNEL_VERSION)/ $(PACKAGE_DIR)/lib/modules/$(KERNEL_VERSION)/
-	mkdir -p $(PACKAGE_DIR)/lib/modprobe.d/
-	cp /lib/modprobe.d/blacklist_$(IMAGE_PACKAGE_NAME).conf $(PACKAGE_DIR)/lib/modprobe.d/
-	dh_install
-	dh_installchangelogs
-	dh_installdocs -A debian/copyright debian/SOURCE
-	dh_lintian
-	dh_compress
-	dh_fixperms
-	dh_installdeb
-	# Copy most package relations and description from unsigned package
-	for field in Depends Suggests Recommends Breaks; do \
-		echo >> debian/$(PACKAGE_NAME).substvars "unsigned:$$field=$$(dpkg-query -f '$${'$$field'}' -W $(IMAGE_PACKAGE_NAME))"; \
-	done
-	echo >> debian/$(PACKAGE_NAME).substvars "unsigned:DescriptionShort=$$(dpkg-query -f '$${Description}' -W $(IMAGE_PACKAGE_NAME) | head -n 1)"
-	echo >> debian/$(PACKAGE_NAME).substvars "unsigned:DescriptionLong=$$(dpkg-query -f '$${Description}' -W $(IMAGE_PACKAGE_NAME) | tail -n +2 | sed -rz 's/\$$/$${}/g; s/^ //; s/\n \.?/$${Newline}/g')"
-	dh_gencontrol -- -v$(PACKAGE_VERSION)
-	dh_md5sums
-	dh_builddeb
-binary-indep:
-
-.PHONY: build build-arch build-indep clean binary binary-arch binary-indep

debian/signing-template/source/format

@@ -1 +0,0 @@
-3.0 (native)

debian/source/lintian-overrides

@@ -1,2 +0,0 @@
-debian-control-has-dbgsym-package (in section for proxmox-kernel-*-pve-dbgsym) Package [debian/control:*]
-license-problem-gfdl-invariants invariant part is: with the :ref:`invariant sections <fdl-invariant>` being list their titles, with the :ref:`front-cover texts <fdl-cover-texts>` being list, and with the :ref:`back-cover texts <fdl-cover-texts>` being list [ubuntu-kernel/Documentation/userspace-api/media/fdl-appendix.rst]

patches/intel/e1000e/e1000e_4.10_max-mtu.patch

@@ -0,0 +1,37 @@
+diff --git a/src/netdev.c b/src/netdev.c
+index 73b0f9a..aef1bc2 100644
+--- a/src/netdev.c
++++ b/src/netdev.c
+@@ -6724,19 +6724,12 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
+ 	int max_frame = new_mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
+ 
+ 	/* Jumbo frame support */
+-	if ((max_frame > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) &&
++	if ((new_mtu > ETH_DATA_LEN) &&
+ 	    !(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
+ 		e_err("Jumbo Frames not supported.\n");
+ 		return -EINVAL;
+ 	}
+ 
+-	/* Supported frame sizes */
+-	if ((new_mtu < (VLAN_ETH_ZLEN + ETH_FCS_LEN)) ||
+-	    (max_frame > adapter->max_hw_frame_size)) {
+-		e_err("Unsupported MTU setting\n");
+-		return -EINVAL;
+-	}
+-
+ 	/* Jumbo frame workaround on 82579 and newer requires CRC be stripped */
+ 	if ((adapter->hw.mac.type >= e1000_pch2lan) &&
+ 	    !(adapter->flags2 & FLAG2_CRC_STRIPPING) &&
+@@ -8262,6 +8255,11 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ #endif /* HAVE_NETDEV_VLAN_FEATURES */
+ 	}
+ 
++	/* MTU range: 68 - max_hw_frame_size */
++	netdev->min_mtu = ETH_MIN_MTU;
++	netdev->max_mtu = adapter->max_hw_frame_size -
++	                  (VLAN_ETH_HLEN + ETH_FCS_LEN);
++
+ 	if (e1000e_enable_mng_pass_thru(&adapter->hw))
+ 		adapter->flags |= FLAG_MNG_PT_ENABLED;
+ 

patches/intel/e1000e/e1000e_4.15-new-timer.patch

@@ -0,0 +1,53 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Thomas Lamprecht <t.lamprecht@proxmox.com>
+Date: Tue, 5 Jun 2018 11:16:29 +0200
+Subject: [PATCH] port to new internal kernel timer API
+
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+diff --git a/src/netdev.c b/src/netdev.c
+--- a/src/netdev.c
++++ b/src/netdev.c
+@@ -5389,9 +5389,10 @@
+  * Need to wait a few seconds after link up to get diagnostic information from
+  * the phy
+  **/
+-static void e1000_update_phy_info(unsigned long data)
++static void e1000_update_phy_info(struct timer_list *t)
+ {
+-	struct e1000_adapter *adapter = (struct e1000_adapter *)data;
++	struct e1000_adapter *adapter;
++	adapter = from_timer(adapter, t, phy_info_timer);
+ 
+ 	if (test_bit(__E1000_DOWN, &adapter->state))
+ 		return;
+@@ -5774,9 +5775,10 @@
+  * e1000_watchdog - Timer Call-back
+  * @data: pointer to adapter cast into an unsigned long
+  **/
+-static void e1000_watchdog(unsigned long data)
++static void e1000_watchdog(struct timer_list *t)
+ {
+-	struct e1000_adapter *adapter = (struct e1000_adapter *)data;
++	struct e1000_adapter *adapter;
++	adapter = from_timer(adapter, t, watchdog_timer);
+ 
+ 	/* Do the rest outside of interrupt context */
+ 	schedule_work(&adapter->watchdog_task);
+@@ -8348,13 +8348,9 @@
+ 		goto err_eeprom;
+ 	}
+ 
+-	init_timer(&adapter->watchdog_timer);
+-	adapter->watchdog_timer.function = e1000_watchdog;
+-	adapter->watchdog_timer.data = (unsigned long)adapter;
+-
+-	init_timer(&adapter->phy_info_timer);
+-	adapter->phy_info_timer.function = e1000_update_phy_info;
+-	adapter->phy_info_timer.data = (unsigned long)adapter;
++	timer_setup(&adapter->watchdog_timer, e1000_watchdog, 0);
++
++	timer_setup(&adapter->phy_info_timer, e1000_update_phy_info, 0);
+ 
+ 	INIT_WORK(&adapter->reset_task, e1000_reset_task);
+ 	INIT_WORK(&adapter->watchdog_task, e1000_watchdog_task);

patches/intel/igb/igb_4.15_mtu.patch

@@ -0,0 +1,15 @@
+diff --git a/src/igb_main.c.orig b/src/igb_main.c
+index 3ee1ec7..c8adf04 100644
+--- a/src/igb_main.c.orig
++++ b/src/igb_main.c
+@@ -5888,10 +5888,8 @@ static int igb_change_mtu(struct net_dev
+ 	while (test_and_set_bit(__IGB_RESETTING, &adapter->state))
+ 		usleep_range(1000, 2000);
+ 
+-#ifndef HAVE_NETDEVICE_MIN_MAX_MTU
+ 	/* igb_down has a dependency on max_frame_size */
+ 	adapter->max_frame_size = max_frame;
+-#endif
+ 
+ 	if (netif_running(netdev))
+ 		igb_down(adapter);

patches/intel/intel-module-gcc6-compat.patch

@@ -0,0 +1,18 @@
+diff --git a/src/Makefile.orig b/src/Makefile
+index 8e962f7..50bcdcc 100644
+--- a/src/Makefile.orig
++++ b/src/Makefile
+@@ -123,6 +123,13 @@ ifeq (,$(CC))
+   $(error Compiler not found)
+ endif
+ 
++# workaround for GCC6's default PIE
++ifeq ($(CC),gcc)
++  PIE_TEST = [ -z "`$(CC) -fno-PIE -no-pie -x c -c /dev/null -o /dev/null 2>&1`" ]
++  PIE_FLAGS := $(shell $(PIE_TEST) && echo '-fno-PIE -no-pie')
++  EXTRA_CFLAGS += $(PIE_FLAGS)
++endif
++
+ # we need to know what platform the driver is being built on
+ # some additional features are only built on Intel platforms
+ ARCH := $(shell uname -m | sed 's/i.86/i386/')

patches/kernel/0001-Make-mkcompile_h-accept-an-alternate-timestamp-strin.patch

@@ -17,19 +17,28 @@ $KBUILD_BUILD_TIMESTAMP.
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
- init/Makefile | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
+ scripts/mkcompile_h | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
 
-diff --git a/init/Makefile b/init/Makefile
-index cbac576c57d6..479b1253fcbe 100644
---- a/init/Makefile
-+++ b/init/Makefile
-@@ -29,7 +29,7 @@ preempt-flag-$(CONFIG_PREEMPT_DYNAMIC)	:= PREEMPT_DYNAMIC
- preempt-flag-$(CONFIG_PREEMPT_RT)	:= PREEMPT_RT
+diff --git a/scripts/mkcompile_h b/scripts/mkcompile_h
+index 87f1fc9801d7..4ef868f1f244 100755
+--- a/scripts/mkcompile_h
++++ b/scripts/mkcompile_h
+@@ -33,10 +33,14 @@ else
+ 	VERSION=$KBUILD_BUILD_VERSION
+ fi
  
- build-version = $(or $(KBUILD_BUILD_VERSION), $(build-version-auto))
--build-timestamp = $(or $(KBUILD_BUILD_TIMESTAMP), $(build-timestamp-auto))
-+build-timestamp = $(or $(KBUILD_BUILD_VERSION_TIMESTAMP), $(KBUILD_BUILD_TIMESTAMP), $(build-timestamp-auto))
- 
- # Maximum length of UTS_VERSION is 64 chars
- filechk_uts_version = \
+-if [ -z "$KBUILD_BUILD_TIMESTAMP" ]; then
+-	TIMESTAMP=`date`
++if [ -z "$KBUILD_BUILD_VERSION_TIMESTAMP" ]; then
++	if [ -z "$KBUILD_BUILD_TIMESTAMP" ]; then
++		TIMESTAMP=`date`
++	else
++		TIMESTAMP=$KBUILD_BUILD_TIMESTAMP
++	fi
+ else
+-	TIMESTAMP=$KBUILD_BUILD_TIMESTAMP
++	TIMESTAMP=$KBUILD_BUILD_VERSION_TIMESTAMP
+ fi
+ if test -z "$KBUILD_BUILD_USER"; then
+ 	LINUX_COMPILE_BY=$(whoami | sed 's/\\/\\\\/')

patches/kernel/0002-bridge-keep-MAC-of-first-assigned-port.patch

@@ -19,10 +19,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 1 insertion(+), 4 deletions(-)
 
 diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
-index 75204d36d7f9..1fb5ff73ec1e 100644
+index 808e2b914015..b0ad54384826 100644
 --- a/net/bridge/br_stp_if.c
 +++ b/net/bridge/br_stp_if.c
-@@ -265,10 +265,7 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
+@@ -259,10 +259,7 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
  		return false;
  
  	list_for_each_entry(p, &br->port_list, list) {

patches/kernel/0003-pci-Enable-overrides-for-missing-ACS-capabilities-4..patch

@@ -51,14 +51,14 @@ Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
  .../admin-guide/kernel-parameters.txt         |   9 ++
- drivers/pci/quirks.c                          | 102 ++++++++++++++++++
- 2 files changed, 111 insertions(+)
+ drivers/pci/quirks.c                          | 101 ++++++++++++++++++
+ 2 files changed, 110 insertions(+)
 
 diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
-index 4272acb3d047..d18cc2c1f9c3 100644
+index 325a5dd7813d..a95cc0b61b29 100644
 --- a/Documentation/admin-guide/kernel-parameters.txt
 +++ b/Documentation/admin-guide/kernel-parameters.txt
-@@ -4400,6 +4400,15 @@
+@@ -3181,6 +3181,15 @@
  				Also, it enforces the PCI Local Bus spec
  				rule that those bits should be 0 in system reset
  				events (useful for kexec/kdump cases).
@@ -75,11 +75,11 @@ index 4272acb3d047..d18cc2c1f9c3 100644
  				Safety option to keep boot IRQs enabled. This
  				should never be necessary.
 diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index ce469d84ebae..4f163ef55e7b 100644
+index e5d1a00c481d..7ecd84506d8d 100644
 --- a/drivers/pci/quirks.c
 +++ b/drivers/pci/quirks.c
-@@ -287,6 +287,106 @@ static int __init pci_apply_final_quirks(void)
- }
+@@ -3769,6 +3769,106 @@ static int __init pci_apply_final_quirks(void)
+ 
  fs_initcall_sync(pci_apply_final_quirks);
  
 +static bool acs_on_downstream;
@@ -183,14 +183,13 @@ index ce469d84ebae..4f163ef55e7b 100644
 +}
 +
  /*
-  * Decoding should be disabled for a PCI device during BAR sizing to avoid
-  * conflict. But doing so may cause problems on host bridge and perhaps other
-@@ -5100,6 +5200,8 @@ static const struct pci_dev_acs_enabled {
- 	{ PCI_VENDOR_ID_CAVIUM, 0xA060, pci_quirk_mf_endpoint_acs },
+  * Following are device-specific reset methods which can be used to
+  * reset a single function if other methods (e.g. FLR, PM D0->D3) are
+@@ -4664,6 +4764,7 @@ static const struct pci_dev_acs_enabled {
+ 	{ PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs },
  	/* APM X-Gene */
  	{ PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs },
-+	/* Enable overrides for missing ACS capabilities */
 +	{ PCI_ANY_ID, PCI_ANY_ID, pcie_acs_overrides },
- 	/* Ampere Computing */
- 	{ PCI_VENDOR_ID_AMPERE, 0xE005, pci_quirk_xgene_acs },
- 	{ PCI_VENDOR_ID_AMPERE, 0xE006, pci_quirk_xgene_acs },
+ 	{ 0 }
+ };
+ 

patches/kernel/0004-kvm-disable-default-dynamic-halt-polling-growth.patch

@@ -13,10 +13,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 0f50960b0e3a..37f840f57f32 100644
+index 706b13f0c698..c6749d154ebc 100644
 --- a/virt/kvm/kvm_main.c
 +++ b/virt/kvm/kvm_main.c
-@@ -82,7 +82,7 @@ module_param(halt_poll_ns, uint, 0644);
+@@ -78,7 +78,7 @@ module_param(halt_poll_ns, uint, 0644);
  EXPORT_SYMBOL_GPL(halt_poll_ns);
  
  /* Default doubles per-vcpu halt_poll_ns. */

patches/kernel/0005-ocfs2-make-metadata-estimation-accurate-and-clear.patch

@@ -0,0 +1,59 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Changwei Ge <ge.changwei@h3c.com>
+Date: Wed, 31 Jan 2018 16:15:02 -0800
+Subject: [PATCH] ocfs2: make metadata estimation accurate and clear
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Current code assume that ::w_unwritten_list always has only one item on.
+This is not right and hard to get understood.  So improve how to count
+unwritten item.
+
+Link: http://lkml.kernel.org/r/1515479070-32653-1-git-send-email-ge.changwei@h3c.com
+Signed-off-by: Changwei Ge <ge.changwei@h3c.com>
+Reported-by: John Lightsey <john@nixnuts.net>
+Tested-by: John Lightsey <john@nixnuts.net>
+Cc: Mark Fasheh <mfasheh@versity.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Changwei Ge <ge.changwei@h3c.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+(cherry picked from commit 63de8bd9328bf2a778fc277503da163ae3defa3c)
+Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ fs/ocfs2/aops.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
+index 7de0c9562b70..209cec7efef4 100644
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -797,6 +797,7 @@ struct ocfs2_write_ctxt {
+ 	struct ocfs2_cached_dealloc_ctxt w_dealloc;
+ 
+ 	struct list_head		w_unwritten_list;
++	unsigned int			w_unwritten_count;
+ };
+ 
+ void ocfs2_unlock_and_free_pages(struct page **pages, int num_pages)
+@@ -1386,6 +1387,7 @@ static int ocfs2_unwritten_check(struct inode *inode,
+ 	desc->c_clear_unwritten = 0;
+ 	list_add_tail(&new->ue_ip_node, &oi->ip_unwritten_list);
+ 	list_add_tail(&new->ue_node, &wc->w_unwritten_list);
++	wc->w_unwritten_count++;
+ 	new = NULL;
+ unlock:
+ 	spin_unlock(&oi->ip_lock);
+@@ -2277,7 +2279,7 @@ static int ocfs2_dio_wr_get_block(struct inode *inode, sector_t iblock,
+ 		ue->ue_phys = desc->c_phys;
+ 
+ 		list_splice_tail_init(&wc->w_unwritten_list, &dwc->dw_zero_list);
+-		dwc->dw_zero_count++;
++		dwc->dw_zero_count += wc->w_unwritten_count;
+ 	}
+ 
+ 	ret = ocfs2_write_end_nolock(inode->i_mapping, pos, len, len, wc);

patches/kernel/0006-net-core-downgrade-unregister_netdevice-refcount-lea.patch

@@ -1,28 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Thomas Lamprecht <t.lamprecht@proxmox.com>
-Date: Wed, 7 Oct 2020 17:18:28 +0200
-Subject: [PATCH] net: core: downgrade unregister_netdevice refcount leak from
- emergency to error
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- net/core/dev.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/core/dev.c b/net/core/dev.c
-index c365aa06f886..c9066a7aa4c5 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -10470,7 +10470,7 @@ static struct net_device *netdev_wait_allrefs_any(struct list_head *list)
- 		if (time_after(jiffies, warning_time +
- 			       READ_ONCE(netdev_unregister_timeout_secs) * HZ)) {
- 			list_for_each_entry(dev, list, todo_list) {
--				pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
-+				pr_err("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
- 					 dev->name, netdev_refcnt_read(dev));
- 				ref_tracker_dir_print(&dev->refcnt_tracker, 10);
- 			}

patches/kernel/0006-ocfs2-try-to-reuse-extent-block-in-dealloc-without-m.patch

@@ -0,0 +1,368 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Changwei Ge <ge.changwei@h3c.com>
+Date: Wed, 31 Jan 2018 16:15:06 -0800
+Subject: [PATCH] ocfs2: try to reuse extent block in dealloc without
+ meta_alloc
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A crash issue was reported by John Lightsey with a call trace as follows:
+
+  ocfs2_split_extent+0x1ad3/0x1b40 [ocfs2]
+  ocfs2_change_extent_flag+0x33a/0x470 [ocfs2]
+  ocfs2_mark_extent_written+0x172/0x220 [ocfs2]
+  ocfs2_dio_end_io+0x62d/0x910 [ocfs2]
+  dio_complete+0x19a/0x1a0
+  do_blockdev_direct_IO+0x19dd/0x1eb0
+  __blockdev_direct_IO+0x43/0x50
+  ocfs2_direct_IO+0x8f/0xa0 [ocfs2]
+  generic_file_direct_write+0xb2/0x170
+  __generic_file_write_iter+0xc3/0x1b0
+  ocfs2_file_write_iter+0x4bb/0xca0 [ocfs2]
+  __vfs_write+0xae/0xf0
+  vfs_write+0xb8/0x1b0
+  SyS_write+0x4f/0xb0
+  system_call_fastpath+0x16/0x75
+
+The BUG code told that extent tree wants to grow but no metadata was
+reserved ahead of time.  From my investigation into this issue, the root
+cause it that although enough metadata is not reserved, there should be
+enough for following use.  Rightmost extent is merged into its left one
+due to a certain times of marking extent written.  Because during
+marking extent written, we got many physically continuous extents.  At
+last, an empty extent showed up and the rightmost path is removed from
+extent tree.
+
+Add a new mechanism to reuse extent block cached in dealloc which were
+just unlinked from extent tree to solve this crash issue.
+
+Criteria is that during marking extents *written*, if extent rotation
+and merging results in unlinking extent with growing extent tree later
+without any metadata reserved ahead of time, try to reuse those extents
+in dealloc in which deleted extents are cached.
+
+Also, this patch addresses the issue John reported that ::dw_zero_count
+is not calculated properly.
+
+After applying this patch, the issue John reported was gone.  Thanks for
+the reproducer provided by John.  And this patch has passed
+ocfs2-test(29 cases) suite running by New H3C Group.
+
+[ge.changwei@h3c.com: fix static checker warnning]
+  Link: http://lkml.kernel.org/r/63ADC13FD55D6546B7DECE290D39E373F29196AE@H3CMLB12-EX.srv.huawei-3com.com
+[akpm@linux-foundation.org: brelse(NULL) is legal]
+Link: http://lkml.kernel.org/r/1515479070-32653-2-git-send-email-ge.changwei@h3c.com
+Signed-off-by: Changwei Ge <ge.changwei@h3c.com>
+Reported-by: John Lightsey <john@nixnuts.net>
+Tested-by: John Lightsey <john@nixnuts.net>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Mark Fasheh <mfasheh@versity.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+(cherry picked from commit 71a36944042b7d9dd71f6a5d1c5ea1c2353b5d42)
+Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ fs/ocfs2/alloc.c | 206 ++++++++++++++++++++++++++++++++++++++++++++---
+ fs/ocfs2/alloc.h |   1 +
+ fs/ocfs2/aops.c  |   6 ++
+ 3 files changed, 203 insertions(+), 10 deletions(-)
+
+diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
+index 6b177de324c0..3760888f2e76 100644
+--- a/fs/ocfs2/alloc.c
++++ b/fs/ocfs2/alloc.c
+@@ -165,6 +165,13 @@ static int ocfs2_dinode_insert_check(struct ocfs2_extent_tree *et,
+ 				     struct ocfs2_extent_rec *rec);
+ static int ocfs2_dinode_sanity_check(struct ocfs2_extent_tree *et);
+ static void ocfs2_dinode_fill_root_el(struct ocfs2_extent_tree *et);
++
++static int ocfs2_reuse_blk_from_dealloc(handle_t *handle,
++					struct ocfs2_extent_tree *et,
++					struct buffer_head **new_eb_bh,
++					int blk_wanted, int *blk_given);
++static int ocfs2_is_dealloc_empty(struct ocfs2_extent_tree *et);
++
+ static const struct ocfs2_extent_tree_operations ocfs2_dinode_et_ops = {
+ 	.eo_set_last_eb_blk	= ocfs2_dinode_set_last_eb_blk,
+ 	.eo_get_last_eb_blk	= ocfs2_dinode_get_last_eb_blk,
+@@ -448,6 +455,7 @@ static void __ocfs2_init_extent_tree(struct ocfs2_extent_tree *et,
+ 	if (!obj)
+ 		obj = (void *)bh->b_data;
+ 	et->et_object = obj;
++	et->et_dealloc = NULL;
+ 
+ 	et->et_ops->eo_fill_root_el(et);
+ 	if (!et->et_ops->eo_fill_max_leaf_clusters)
+@@ -1158,7 +1166,7 @@ static int ocfs2_add_branch(handle_t *handle,
+ 			    struct buffer_head **last_eb_bh,
+ 			    struct ocfs2_alloc_context *meta_ac)
+ {
+-	int status, new_blocks, i;
++	int status, new_blocks, i, block_given = 0;
+ 	u64 next_blkno, new_last_eb_blk;
+ 	struct buffer_head *bh;
+ 	struct buffer_head **new_eb_bhs = NULL;
+@@ -1213,11 +1221,31 @@ static int ocfs2_add_branch(handle_t *handle,
+ 		goto bail;
+ 	}
+ 
+-	status = ocfs2_create_new_meta_bhs(handle, et, new_blocks,
+-					   meta_ac, new_eb_bhs);
+-	if (status < 0) {
+-		mlog_errno(status);
+-		goto bail;
++	/* Firstyly, try to reuse dealloc since we have already estimated how
++	 * many extent blocks we may use.
++	 */
++	if (!ocfs2_is_dealloc_empty(et)) {
++		status = ocfs2_reuse_blk_from_dealloc(handle, et,
++						      new_eb_bhs, new_blocks,
++						      &block_given);
++		if (status < 0) {
++			mlog_errno(status);
++			goto bail;
++		}
++	}
++
++	BUG_ON(block_given > new_blocks);
++
++	if (block_given < new_blocks) {
++		BUG_ON(!meta_ac);
++		status = ocfs2_create_new_meta_bhs(handle, et,
++						   new_blocks - block_given,
++						   meta_ac,
++						   &new_eb_bhs[block_given]);
++		if (status < 0) {
++			mlog_errno(status);
++			goto bail;
++		}
+ 	}
+ 
+ 	/* Note: new_eb_bhs[new_blocks - 1] is the guy which will be
+@@ -1340,15 +1368,25 @@ static int ocfs2_shift_tree_depth(handle_t *handle,
+ 				  struct ocfs2_alloc_context *meta_ac,
+ 				  struct buffer_head **ret_new_eb_bh)
+ {
+-	int status, i;
++	int status, i, block_given = 0;
+ 	u32 new_clusters;
+ 	struct buffer_head *new_eb_bh = NULL;
+ 	struct ocfs2_extent_block *eb;
+ 	struct ocfs2_extent_list  *root_el;
+ 	struct ocfs2_extent_list  *eb_el;
+ 
+-	status = ocfs2_create_new_meta_bhs(handle, et, 1, meta_ac,
+-					   &new_eb_bh);
++	if (!ocfs2_is_dealloc_empty(et)) {
++		status = ocfs2_reuse_blk_from_dealloc(handle, et,
++						      &new_eb_bh, 1,
++						      &block_given);
++	} else if (meta_ac) {
++		status = ocfs2_create_new_meta_bhs(handle, et, 1, meta_ac,
++						   &new_eb_bh);
++
++	} else {
++		BUG();
++	}
++
+ 	if (status < 0) {
+ 		mlog_errno(status);
+ 		goto bail;
+@@ -1511,7 +1549,7 @@ static int ocfs2_grow_tree(handle_t *handle, struct ocfs2_extent_tree *et,
+ 	int depth = le16_to_cpu(el->l_tree_depth);
+ 	struct buffer_head *bh = NULL;
+ 
+-	BUG_ON(meta_ac == NULL);
++	BUG_ON(meta_ac == NULL && ocfs2_is_dealloc_empty(et));
+ 
+ 	shift = ocfs2_find_branch_target(et, &bh);
+ 	if (shift < 0) {
+@@ -6585,6 +6623,154 @@ ocfs2_find_per_slot_free_list(int type,
+ 	return fl;
+ }
+ 
++static struct ocfs2_per_slot_free_list *
++ocfs2_find_preferred_free_list(int type,
++			       int preferred_slot,
++			       int *real_slot,
++			       struct ocfs2_cached_dealloc_ctxt *ctxt)
++{
++	struct ocfs2_per_slot_free_list *fl = ctxt->c_first_suballocator;
++
++	while (fl) {
++		if (fl->f_inode_type == type && fl->f_slot == preferred_slot) {
++			*real_slot = fl->f_slot;
++			return fl;
++		}
++
++		fl = fl->f_next_suballocator;
++	}
++
++	/* If we can't find any free list matching preferred slot, just use
++	 * the first one.
++	 */
++	fl = ctxt->c_first_suballocator;
++	*real_slot = fl->f_slot;
++
++	return fl;
++}
++
++/* Return Value 1 indicates empty */
++static int ocfs2_is_dealloc_empty(struct ocfs2_extent_tree *et)
++{
++	struct ocfs2_per_slot_free_list *fl = NULL;
++
++	if (!et->et_dealloc)
++		return 1;
++
++	fl = et->et_dealloc->c_first_suballocator;
++	if (!fl)
++		return 1;
++
++	if (!fl->f_first)
++		return 1;
++
++	return 0;
++}
++
++/* If extent was deleted from tree due to extent rotation and merging, and
++ * no metadata is reserved ahead of time. Try to reuse some extents
++ * just deleted. This is only used to reuse extent blocks.
++ * It is supposed to find enough extent blocks in dealloc if our estimation
++ * on metadata is accurate.
++ */
++static int ocfs2_reuse_blk_from_dealloc(handle_t *handle,
++					struct ocfs2_extent_tree *et,
++					struct buffer_head **new_eb_bh,
++					int blk_wanted, int *blk_given)
++{
++	int i, status = 0, real_slot;
++	struct ocfs2_cached_dealloc_ctxt *dealloc;
++	struct ocfs2_per_slot_free_list *fl;
++	struct ocfs2_cached_block_free *bf;
++	struct ocfs2_extent_block *eb;
++	struct ocfs2_super *osb =
++		OCFS2_SB(ocfs2_metadata_cache_get_super(et->et_ci));
++
++	*blk_given = 0;
++
++	/* If extent tree doesn't have a dealloc, this is not faulty. Just
++	 * tell upper caller dealloc can't provide any block and it should
++	 * ask for alloc to claim more space.
++	 */
++	dealloc = et->et_dealloc;
++	if (!dealloc)
++		goto bail;
++
++	for (i = 0; i < blk_wanted; i++) {
++		/* Prefer to use local slot */
++		fl = ocfs2_find_preferred_free_list(EXTENT_ALLOC_SYSTEM_INODE,
++						    osb->slot_num, &real_slot,
++						    dealloc);
++		/* If no more block can be reused, we should claim more
++		 * from alloc. Just return here normally.
++		 */
++		if (!fl) {
++			status = 0;
++			break;
++		}
++
++		bf = fl->f_first;
++		fl->f_first = bf->free_next;
++
++		new_eb_bh[i] = sb_getblk(osb->sb, bf->free_blk);
++		if (new_eb_bh[i] == NULL) {
++			status = -ENOMEM;
++			mlog_errno(status);
++			goto bail;
++		}
++
++		mlog(0, "Reusing block(%llu) from "
++		     "dealloc(local slot:%d, real slot:%d)\n",
++		     bf->free_blk, osb->slot_num, real_slot);
++
++		ocfs2_set_new_buffer_uptodate(et->et_ci, new_eb_bh[i]);
++
++		status = ocfs2_journal_access_eb(handle, et->et_ci,
++						 new_eb_bh[i],
++						 OCFS2_JOURNAL_ACCESS_CREATE);
++		if (status < 0) {
++			mlog_errno(status);
++			goto bail;
++		}
++
++		memset(new_eb_bh[i]->b_data, 0, osb->sb->s_blocksize);
++		eb = (struct ocfs2_extent_block *) new_eb_bh[i]->b_data;
++
++		/* We can't guarantee that buffer head is still cached, so
++		 * polutlate the extent block again.
++		 */
++		strcpy(eb->h_signature, OCFS2_EXTENT_BLOCK_SIGNATURE);
++		eb->h_blkno = cpu_to_le64(bf->free_blk);
++		eb->h_fs_generation = cpu_to_le32(osb->fs_generation);
++		eb->h_suballoc_slot = cpu_to_le16(real_slot);
++		eb->h_suballoc_loc = cpu_to_le64(bf->free_bg);
++		eb->h_suballoc_bit = cpu_to_le16(bf->free_bit);
++		eb->h_list.l_count =
++			cpu_to_le16(ocfs2_extent_recs_per_eb(osb->sb));
++
++		/* We'll also be dirtied by the caller, so
++		 * this isn't absolutely necessary.
++		 */
++		ocfs2_journal_dirty(handle, new_eb_bh[i]);
++
++		if (!fl->f_first) {
++			dealloc->c_first_suballocator = fl->f_next_suballocator;
++			kfree(fl);
++		}
++		kfree(bf);
++	}
++
++	*blk_given = i;
++
++bail:
++	if (unlikely(status < 0)) {
++		for (i = 0; i < blk_wanted; i++)
++			brelse(new_eb_bh[i]);
++	}
++
++	return status;
++}
++
+ int ocfs2_cache_block_dealloc(struct ocfs2_cached_dealloc_ctxt *ctxt,
+ 			      int type, int slot, u64 suballoc,
+ 			      u64 blkno, unsigned int bit)
+diff --git a/fs/ocfs2/alloc.h b/fs/ocfs2/alloc.h
+index 27b75cf32cfa..250bcacdf9e9 100644
+--- a/fs/ocfs2/alloc.h
++++ b/fs/ocfs2/alloc.h
+@@ -61,6 +61,7 @@ struct ocfs2_extent_tree {
+ 	ocfs2_journal_access_func		et_root_journal_access;
+ 	void					*et_object;
+ 	unsigned int				et_max_leaf_clusters;
++	struct ocfs2_cached_dealloc_ctxt	*et_dealloc;
+ };
+ 
+ /*
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
+index 209cec7efef4..1cf7ac84b70b 100644
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -2353,6 +2353,12 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
+ 
+ 	ocfs2_init_dinode_extent_tree(&et, INODE_CACHE(inode), di_bh);
+ 
++	/* Attach dealloc with extent tree in case that we may reuse extents
++	 * which are already unlinked from current extent tree due to extent
++	 * rotation and merging.
++	 */
++	et.et_dealloc = &dealloc;
++
+ 	ret = ocfs2_lock_allocators(inode, &et, 0, dwc->dw_zero_count*2,
+ 				    &data_ac, &meta_ac);
+ 	if (ret) {

patches/kernel/0007-Revert-UBUNTU-Packaging-retpoline-add-safe-usage-hin.patch

@@ -0,0 +1,54 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbichler@proxmox.com>
+Date: Tue, 3 Apr 2018 14:59:26 +0200
+Subject: [PATCH] Revert "UBUNTU: [Packaging] retpoline -- add safe usage hint
+ support"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This (partially) reverts commit 1e39020902132b3065bedf0a0c33031e89f9f57a.
+
+this modifies the upstream kernel build to call an Ubuntu script which
+we remove before building. it would also be required by any module
+builds afterwards and is not shipped by Ubuntu's kernel packages either.
+
+Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ scripts/Makefile.build | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index 5d72aa39d3c1..451546219dfc 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -295,27 +295,19 @@ objtool_dep = $(objtool_obj)					\
+ 	      $(wildcard include/config/orc/unwinder.h		\
+ 			 include/config/stack/validation.h)
+ 
+-ifdef CONFIG_RETPOLINE
+-cmd_ubuntu_retpoline = $(CONFIG_SHELL) $(srctree)/scripts/ubuntu-retpoline-extract-one $(@) $(<) "$(filter -m16 %code16gcc.h,$(a_flags))";
+-else
+-cmd_ubuntu_retpoline =
+-endif
+-
+ define rule_cc_o_c
+ 	$(call echo-cmd,checksrc) $(cmd_checksrc)			  \
+ 	$(call cmd_and_fixdep,cc_o_c)					  \
+ 	$(cmd_checkdoc)							  \
+ 	$(call echo-cmd,objtool) $(cmd_objtool)				  \
+ 	$(cmd_modversions_c)						  \
+-	$(call echo-cmd,ubuntu-retpoline) $(cmd_ubuntu_retpoline)	  \
+ 	$(call echo-cmd,record_mcount) $(cmd_record_mcount)
+ endef
+ 
+ define rule_as_o_S
+ 	$(call cmd_and_fixdep,as_o_S)					  \
+ 	$(call echo-cmd,objtool) $(cmd_objtool)				  \
+-	$(cmd_modversions_S)						  \
+-	$(call echo-cmd,ubuntu-retpoline) $(cmd_ubuntu_retpoline)
++	$(cmd_modversions_S)
+ endef
+ 
+ # List module undefined symbols (or empty line if not enabled)

patches/kernel/0007-Revert-fortify-Do-not-cast-to-unsigned-char.patch

@@ -1,30 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Thomas Lamprecht <t.lamprecht@proxmox.com>
-Date: Tue, 10 Jan 2023 08:52:40 +0100
-Subject: [PATCH] Revert "fortify: Do not cast to "unsigned char""
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This reverts commit 106b7a61c488d2022f44e3531ce33461c7c0685f.
-
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
----
- include/linux/fortify-string.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h
-index 89a6888f2f9e..66e0b60dcabb 100644
---- a/include/linux/fortify-string.h
-+++ b/include/linux/fortify-string.h
-@@ -18,7 +18,7 @@ void __write_overflow_field(size_t avail, size_t wanted) __compiletime_warning("
- 
- #define __compiletime_strlen(p)					\
- ({								\
--	char *__p = (char *)(p);				\
-+	unsigned char *__p = (unsigned char *)(p);		\
- 	size_t __ret = SIZE_MAX;				\
- 	const size_t __p_size = __member_size(p);		\
- 	if (__p_size != SIZE_MAX &&				\

patches/kernel/0008-KVM-Take-vcpu-mutex-outside-vcpu_load.patch

@@ -0,0 +1,168 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Christoffer Dall <christoffer.dall@linaro.org>
+Date: Mon, 4 Dec 2017 21:35:23 +0100
+Subject: [PATCH] KVM: Take vcpu->mutex outside vcpu_load
+
+As we're about to call vcpu_load() from architecture-specific
+implementations of the KVM vcpu ioctls, but yet we access data
+structures protected by the vcpu->mutex in the generic code, factor
+this logic out from vcpu_load().
+
+x86 is the only architecture which calls vcpu_load() outside of the main
+vcpu ioctl function, and these calls will no longer take the vcpu mutex
+following this patch.  However, with the exception of
+kvm_arch_vcpu_postcreate (see below), the callers are either in the
+creation or destruction path of the VCPU, which means there cannot be
+any concurrent access to the data structure, because the file descriptor
+is not yet accessible, or is already gone.
+
+kvm_arch_vcpu_postcreate makes the newly created vcpu potentially
+accessible by other in-kernel threads through the kvm->vcpus array, and
+we therefore take the vcpu mutex in this case directly.
+
+Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit ec7660ccdd2b71d8c7f0243f8590253713e9b75d)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ arch/x86/kvm/vmx.c       |  4 +---
+ arch/x86/kvm/x86.c       | 16 ++++++----------
+ include/linux/kvm_host.h |  2 +-
+ virt/kvm/kvm_main.c      | 17 ++++++-----------
+ 4 files changed, 14 insertions(+), 25 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 6875c8d13052..5dc2144a0991 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10017,10 +10017,8 @@ static void vmx_switch_vmcs(struct kvm_vcpu *vcpu, struct loaded_vmcs *vmcs)
+ static void vmx_free_vcpu_nested(struct kvm_vcpu *vcpu)
+ {
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+-       int r;
+ 
+-       r = vcpu_load(vcpu);
+-       BUG_ON(r);
++       vcpu_load(vcpu);
+        vmx_switch_vmcs(vcpu, &vmx->vmcs01);
+        free_nested(vmx);
+        vcpu_put(vcpu);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 960b14ba645e..6b1e434ceaf8 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -8061,17 +8061,13 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
+ 
+ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
+ {
+-	int r;
+-
+ 	vcpu->arch.arch_capabilities = kvm_get_arch_capabilities();
+ 	kvm_vcpu_mtrr_init(vcpu);
+-	r = vcpu_load(vcpu);
+-	if (r)
+-		return r;
++	vcpu_load(vcpu);
+ 	kvm_vcpu_reset(vcpu, false);
+ 	kvm_mmu_setup(vcpu);
+ 	vcpu_put(vcpu);
+-	return r;
++	return 0;
+ }
+ 
+ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu)
+@@ -8081,13 +8077,15 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu)
+ 
+ 	kvm_hv_vcpu_postcreate(vcpu);
+ 
+-	if (vcpu_load(vcpu))
++	if (mutex_lock_killable(&vcpu->mutex))
+ 		return;
++	vcpu_load(vcpu);
+ 	msr.data = 0x0;
+ 	msr.index = MSR_IA32_TSC;
+ 	msr.host_initiated = true;
+ 	kvm_write_tsc(vcpu, &msr);
+ 	vcpu_put(vcpu);
++	mutex_unlock(&vcpu->mutex);
+ 
+ 	if (!kvmclock_periodic_sync)
+ 		return;
+@@ -8474,9 +8472,7 @@ int kvm_arch_post_init_vm(struct kvm *kvm)
+ 
+ static void kvm_unload_vcpu_mmu(struct kvm_vcpu *vcpu)
+ {
+-	int r;
+-	r = vcpu_load(vcpu);
+-	BUG_ON(r);
++	vcpu_load(vcpu);
+ 	kvm_mmu_unload(vcpu);
+ 	vcpu_put(vcpu);
+ }
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index f182bbfb0ac5..f8b7ac63219d 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -560,7 +560,7 @@ static inline int kvm_vcpu_get_idx(struct kvm_vcpu *vcpu)
+ int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id);
+ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
+ 
+-int __must_check vcpu_load(struct kvm_vcpu *vcpu);
++void vcpu_load(struct kvm_vcpu *vcpu);
+ void vcpu_put(struct kvm_vcpu *vcpu);
+ 
+ #ifdef __KVM_HAVE_IOAPIC
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index c6749d154ebc..66998264619b 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -172,17 +172,12 @@ bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
+ /*
+  * Switches to specified vcpu, until a matching vcpu_put()
+  */
+-int vcpu_load(struct kvm_vcpu *vcpu)
++void vcpu_load(struct kvm_vcpu *vcpu)
+ {
+-	int cpu;
+-
+-	if (mutex_lock_killable(&vcpu->mutex))
+-		return -EINTR;
+-	cpu = get_cpu();
++	int cpu = get_cpu();
+ 	preempt_notifier_register(&vcpu->preempt_notifier);
+ 	kvm_arch_vcpu_load(vcpu, cpu);
+ 	put_cpu();
+-	return 0;
+ }
+ EXPORT_SYMBOL_GPL(vcpu_load);
+ 
+@@ -192,7 +187,6 @@ void vcpu_put(struct kvm_vcpu *vcpu)
+ 	kvm_arch_vcpu_put(vcpu);
+ 	preempt_notifier_unregister(&vcpu->preempt_notifier);
+ 	preempt_enable();
+-	mutex_unlock(&vcpu->mutex);
+ }
+ EXPORT_SYMBOL_GPL(vcpu_put);
+ 
+@@ -2786,9 +2780,9 @@ static long kvm_vcpu_ioctl(struct file *filp,
+ #endif
+ 
+ 
+-	r = vcpu_load(vcpu);
+-	if (r)
+-		return r;
++	if (mutex_lock_killable(&vcpu->mutex))
++		return -EINTR;
++	vcpu_load(vcpu);
+ 	switch (ioctl) {
+ 	case KVM_RUN: {
+ 		struct pid *oldpid;
+@@ -2961,6 +2955,7 @@ static long kvm_vcpu_ioctl(struct file *filp,
+ 	}
+ out:
+ 	vcpu_put(vcpu);
++	mutex_unlock(&vcpu->mutex);
+ 	kfree(fpu);
+ 	kfree(kvm_sregs);
+ 	return r;

patches/kernel/0008-kvm-xsave-set-mask-out-PKRU-bit-in-xfeatures-if-vCPU.patch

@@ -1,133 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Thomas Lamprecht <t.lamprecht@proxmox.com>
-Date: Fri, 14 Jul 2023 18:10:32 +0200
-Subject: [PATCH] kvm: xsave set: mask-out PKRU bit in xfeatures if vCPU has no
- support
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Fixes live-migrations & snapshot-rollback of VMs with a restricted
-CPU type (e.g., qemu64) from our 5.15 based kernel (default Proxmox
-VE 7.4) to the 6.2 (and future newer) of Proxmox VE 8.0.
-
-Previous to ad856280ddea ("x86/kvm/fpu: Limit guest user_xfeatures to
-supported bits of XCR0") the PKRU bit of the host could leak into the
-state from the guest, which caused trouble when migrating between
-hosts with different CPUs, i.e., where the source supported it but
-the target did not, causing a general protection fault when the guest
-tried to use a pkru related instruction after the migration.
-
-But the fix, while welcome, caused a temporary out-of-sync state when
-migrating such a VM from a kernel without the fix to a kernel with
-the fix, as it threw of KVM when the CPUID of the guest and most of
-the state doesn't report XSAVE and thus any xfeatures, but PKRU and
-the related state is set as enabled, causing the vCPU to spin at 100%
-without any progress forever.
-
-The fix could be at two sites, either in QEMU or in the kernel, I
-choose the kernel as we have all the info there for a targeted
-heuristic so that we don't have to adapt QEMU and qemu-server, the
-latter even on both sides.
-
-Still, a short summary of the possible fixes and short drawbacks:
-* on QEMU-side either
-  - clear the PKRU state in the migration saved state would be rather
-    complicated to implement as the vCPU is initialised way before we
-    have the saved xfeature state available to check what we'd need
-    to do, plus the user-space only gets a memory blob from ioctl
-    KVM_GET_XSAVE2 that it passes to KVM_SET_XSAVE ioctl, there are
-    no ABI guarantees, and while the struct seem stable for 5.15 to
-    6.5-rc1, that doesn't has to be for future kernels, so off the
-    table.
-  - enforce that the CPUID reports PKU support even if it normally
-    wouldn't. While this works (tested by hard-coding it as POC) it
-    is a) not really nice and b) needs some interaction from
-    qemu-server to enable this flag as otherwise we have no good info
-    to decide when it's OK to do this, which means we need to adapt
-    both PVE 7 and 8's qemu-server and also pve-qemu, workable but
-    not optimal
-
-* on Kernel/KVM-side we can hook into the set XSAVE ioctl specific to
-  the KVM subsystem, which already reduces chance of regression for
-  all other places. There we have access to the union/struct
-  definitions of the saved state and thus can savely cast to that.
-  We also got access to the vCPU's CPUID capabilities, meaning we can
-  check if the XCR0 (first XSAVE Control Register) reports
-  that it support the PKRU feature, and if it does *NOT* but the
-  saved xfeatures register from XSAVE *DOES* report it, we can safely
-  assume that this combination is due to an migration from an older,
-  leaky kernel – and clear the bit in the xfeature register before
-  restoring it to the guest vCPU KVM state, avoiding the confusing
-  situation that made the vCPU spin at 100%.
-  This should be safe to do, as the guest vCPU CPUID never reported
-  support for the PKRU feature, and it's also a relatively niche and
-  newish feature.
-
-If it gains us something we can drop this patch a bit in the future
-Proxmox VE 9 major release, but we should ensure that VMs that where
-started before PVE 8 cannot be directly live-migrated to the release
-that includes that change; so we should rather only drop it if the
-maintenance burden is high.
-
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
----
- arch/x86/kvm/cpuid.c |  6 ++++++
- arch/x86/kvm/cpuid.h |  2 ++
- arch/x86/kvm/x86.c   | 13 +++++++++++++
- 3 files changed, 21 insertions(+)
-
-diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
-index 3a02276899db..e07a6089ba4b 100644
---- a/arch/x86/kvm/cpuid.c
-+++ b/arch/x86/kvm/cpuid.c
-@@ -262,6 +262,12 @@ static u64 cpuid_get_supported_xcr0(struct kvm_cpuid_entry2 *entries, int nent)
- 	return (best->eax | ((u64)best->edx << 32)) & kvm_caps.supported_xcr0;
- }
- 
-+bool vcpu_supports_xsave_pkru(struct kvm_vcpu *vcpu) {
-+	u64 guest_supported_xcr0 = cpuid_get_supported_xcr0(
-+	    vcpu->arch.cpuid_entries, vcpu->arch.cpuid_nent);
-+	return (guest_supported_xcr0 & XFEATURE_MASK_PKRU) != 0;
-+}
-+
- static void __kvm_update_cpuid_runtime(struct kvm_vcpu *vcpu, struct kvm_cpuid_entry2 *entries,
- 				       int nent)
- {
-diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
-index 23dbb9eb277c..07da153802e4 100644
---- a/arch/x86/kvm/cpuid.h
-+++ b/arch/x86/kvm/cpuid.h
-@@ -32,6 +32,8 @@ int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
- bool kvm_cpuid(struct kvm_vcpu *vcpu, u32 *eax, u32 *ebx,
- 	       u32 *ecx, u32 *edx, bool exact_only);
- 
-+bool vcpu_supports_xsave_pkru(struct kvm_vcpu *vcpu);
-+
- u32 xstate_required_size(u64 xstate_bv, bool compacted);
- 
- int cpuid_query_maxphyaddr(struct kvm_vcpu *vcpu);
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index c84927216fad..880e2b87777e 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -5580,6 +5580,19 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
- 	if (fpstate_is_confidential(&vcpu->arch.guest_fpu))
- 		return 0;
- 
-+	if (!vcpu_supports_xsave_pkru(vcpu)) {
-+		void *buf = guest_xsave->region;
-+		union fpregs_state *ustate = buf;
-+		if (ustate->xsave.header.xfeatures & XFEATURE_MASK_PKRU) {
-+			printk(
-+				KERN_NOTICE "clearing PKRU xfeature bit as vCPU from PID %d"
-+				" reports no PKRU support - migration from fpu-leaky kernel?",
-+				current->pid
-+			);
-+			ustate->xsave.header.xfeatures &= ~XFEATURE_MASK_PKRU;
-+		}
-+	}
-+
- 	return fpu_copy_uabi_to_guest_fpstate(&vcpu->arch.guest_fpu,
- 					      guest_xsave->region,
- 					      kvm_caps.supported_xcr0,

patches/kernel/0009-allow-opt-in-to-allow-pass-through-on-broken-hardwar.patch

@@ -1,43 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: kiler129 <grzegorz@noflash.pl>
-Date: Mon, 18 Sep 2023 15:19:26 +0200
-Subject: [PATCH] allow opt-in to allow pass-through on broken hardware..
-
-adapted from https://github.com/kiler129/relax-intel-rmrr , licensed under MIT or GPL 2.0+
-
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
----
- drivers/iommu/intel/iommu.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
-index c4c6240d14f9..5e037a9ea6a6 100644
---- a/drivers/iommu/intel/iommu.c
-+++ b/drivers/iommu/intel/iommu.c
-@@ -234,6 +234,7 @@ static int dmar_map_gfx = 1;
- static int dmar_map_ipu = 1;
- static int intel_iommu_superpage = 1;
- static int iommu_identity_mapping;
-+static int intel_relaxable_rmrr = 0;
- static int iommu_skip_te_disable;
- 
- #define IDENTMAP_GFX		2
-@@ -296,6 +297,9 @@ static int __init intel_iommu_setup(char *str)
- 		} else if (!strncmp(str, "tboot_noforce", 13)) {
- 			pr_info("Intel-IOMMU: not forcing on after tboot. This could expose security risk for tboot\n");
- 			intel_iommu_tboot_noforce = 1;
-+		} else if (!strncmp(str, "relax_rmrr", 10)) {
-+			pr_info("Intel-IOMMU: assuming all RMRRs are relaxable. This can lead to instability or data loss\n");
-+			intel_relaxable_rmrr = 1;
- 		} else {
- 			pr_notice("Unknown option - '%s'\n", str);
- 		}
-@@ -2470,7 +2474,7 @@ static bool device_rmrr_is_relaxable(struct device *dev)
- 		return false;
- 
- 	pdev = to_pci_dev(dev);
--	if (IS_USB_DEVICE(pdev) || IS_GFX_DEVICE(pdev))
-+	if (intel_relaxable_rmrr || IS_USB_DEVICE(pdev) || IS_GFX_DEVICE(pdev))
- 		return true;
- 	else
- 		return false;

patches/kernel/0009-kvm-x86-Don-t-modify-MSR_PLATFORM_INFO-on-vCPU-reset.patch

@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jim Mattson <jmattson@google.com>
+Date: Tue, 30 Oct 2018 12:20:21 -0700
+Subject: [PATCH] kvm: x86: Don't modify MSR_PLATFORM_INFO on vCPU reset
+
+If userspace has provided a different value for this MSR (e.g with the
+turbo bits set), the userspace-provided value should survive a vCPU
+reset. For backwards compatibility, MSR_PLATFORM_INFO is initialized
+in kvm_arch_vcpu_setup.
+
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Drew Schmitt <dasch@google.com>
+Cc: Abhiroop Dabral <adabral@paloaltonetworks.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit e53d88af63ab4104e1226b8f9959f1e9903da10b)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ arch/x86/kvm/x86.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 6b1e434ceaf8..93bc3504d39e 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -8062,6 +8062,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
+ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
+ {
+ 	vcpu->arch.arch_capabilities = kvm_get_arch_capabilities();
++	vcpu->arch.msr_platform_info = MSR_PLATFORM_INFO_CPUID_FAULT;
+ 	kvm_vcpu_mtrr_init(vcpu);
+ 	vcpu_load(vcpu);
+ 	kvm_vcpu_reset(vcpu, false);
+@@ -8157,7 +8158,6 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
+ 		kvm_pmu_reset(vcpu);
+ 		vcpu->arch.smbase = 0x30000;
+ 
+-		vcpu->arch.msr_platform_info = MSR_PLATFORM_INFO_CPUID_FAULT;
+ 		vcpu->arch.msr_misc_features_enables = 0;
+ 
+ 		vcpu->arch.xcr0 = XFEATURE_MASK_FP;

patches/kernel/0010-KVM-nSVM-Advertise-support-for-flush-by-ASID.patch

@@ -1,37 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Sean Christopherson <seanjc@google.com>
-Date: Wed, 18 Oct 2023 12:41:04 -0700
-Subject: [PATCH] KVM: nSVM: Advertise support for flush-by-ASID
-
-Advertise support for FLUSHBYASID when nested SVM is enabled, as KVM can
-always emulate flushing TLB entries for a vmcb12 ASID, e.g. by running L2
-with a new, fresh ASID in vmcb02.  Some modern hypervisors, e.g. VMWare
-Workstation 17, require FLUSHBYASID support and will refuse to run if it's
-not present.
-
-Punt on proper support, as "Honor L1's request to flush an ASID on nested
-VMRUN" is one of the TODO items in the (incomplete) list of issues that
-need to be addressed in order for KVM to NOT do a full TLB flush on every
-nested SVM transition (see nested_svm_transition_tlb_flush()).
-
-Reported-by: Stefan Sterz <s.sterz@proxmox.com>
-Closes: https://lkml.kernel.org/r/b9915c9c-4cf6-051a-2d91-44cc6380f455%40proxmox.com
-Signed-off-by: Sean Christopherson <seanjc@google.com>
-Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
----
- arch/x86/kvm/svm/svm.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
-index e90b429c84f1..5c7faf7c447f 100644
---- a/arch/x86/kvm/svm/svm.c
-+++ b/arch/x86/kvm/svm/svm.c
-@@ -5085,6 +5085,7 @@ static __init void svm_set_cpu_caps(void)
- 	if (nested) {
- 		kvm_cpu_cap_set(X86_FEATURE_SVM);
- 		kvm_cpu_cap_set(X86_FEATURE_VMCBCLEAN);
-+		kvm_cpu_cap_set(X86_FEATURE_FLUSHBYASID);
- 
- 		/*
- 		 * KVM currently flushes TLBs on *every* nested SVM transition,

patches/kernel/0010-ntb-test-remove-unused-conflicting-SZ_4G-define.patch

@@ -0,0 +1,22 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Thomas Lamprecht <t.lamprecht@proxmox.com>
+Date: Fri, 6 Sep 2019 13:04:30 +0200
+Subject: [PATCH] ntb test: remove unused conflicting SZ_4G define
+
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ drivers/ntb/test/ntb_perf.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
+index 427112cf101a..1f8ee33a07a2 100644
+--- a/drivers/ntb/test/ntb_perf.c
++++ b/drivers/ntb/test/ntb_perf.c
+@@ -74,7 +74,6 @@
+ #define MAX_SRCS		32
+ #define DMA_OUT_RESOURCE_TO	msecs_to_jiffies(50)
+ #define DMA_RETRIES		20
+-#define SZ_4G			(1ULL << 32)
+ #define MAX_SEG_ORDER		20 /* no larger than 1M for kmalloc buffer */
+ #define PIDX			NTB_DEF_PEER_IDX
+ 

patches/kernel/0011-revert-memfd-improve-userspace-warnings-for-missing-.patch

@@ -1,44 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Thomas Lamprecht <t.lamprecht@proxmox.com>
-Date: Mon, 6 Nov 2023 10:17:02 +0100
-Subject: [PATCH] revert "memfd: improve userspace warnings for missing
- exec-related flags".
-
-This warning is telling userspace developers to pass MFD_EXEC and
-MFD_NOEXEC_SEAL to memfd_create().  Commit 434ed3350f57 ("memfd: improve
-userspace warnings for missing exec-related flags") made the warning more
-frequent and visible in the hope that this would accelerate the fixing of
-errant userspace.
-
-But the overall effect is to generate far too much dmesg noise.
-
-Fixes: 434ed3350f57 ("memfd: improve userspace warnings for missing exec-related flags")
-Reported-by: Damian Tometzki <dtometzki@fedoraproject.org>
-Closes: https://lkml.kernel.org/r/ZPFzCSIgZ4QuHsSC@fedora.fritz.box
-Cc: Aleksa Sarai <cyphar@cyphar.com>
-Cc: Christian Brauner <brauner@kernel.org>
-Cc: Daniel Verkamp <dverkamp@chromium.org>
-Cc: Jeff Xu <jeffxu@google.com>
-Cc: Kees Cook <keescook@chromium.org>
-Cc: Shuah Khan <shuah@kernel.org>
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
- (cherry picked from commit 2562d67b1bdf91c7395b0225d60fdeb26b4bc5a0)
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
----
- mm/memfd.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mm/memfd.c b/mm/memfd.c
-index d3a1ba4208c9..6a9de5d9105e 100644
---- a/mm/memfd.c
-+++ b/mm/memfd.c
-@@ -282,7 +282,7 @@ static int check_sysctl_memfd_noexec(unsigned int *flags)
- 	}
- 
- 	if (!(*flags & MFD_NOEXEC_SEAL) && sysctl >= MEMFD_NOEXEC_SCOPE_NOEXEC_ENFORCED) {
--		pr_err_ratelimited(
-+		pr_warn_once(
- 			"%s[%d]: memfd_create() requires MFD_NOEXEC_SEAL with vm.memfd_noexec=%d\n",
- 			current->comm, task_pid_nr(current), sysctl);
- 		return -EACCES;

patches/kernel/0012-apparmor-expect-msg_namelen-0-for-recvmsg-calls.patch

@@ -1,31 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Wed, 10 Apr 2024 13:21:59 +0200
-Subject: [PATCH] apparmor: expect msg_namelen=0 for recvmsg calls
-
-When coming from sys_recvmsg, msg->msg_namelen is explicitly set to
-zero early on. (see ____sys_recvmsg in net/socket.c)
-We still end up in 'map_addr' where the assumption is that addr !=
-NULL means addrlen has a valid size.
-
-This is likely not a final fix, it was suggested by jjohansen on irc
-to get things going until this is resolved properly.
-
-Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
----
- security/apparmor/af_inet.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/security/apparmor/af_inet.c b/security/apparmor/af_inet.c
-index 57b710054a76..35f905d9b960 100644
---- a/security/apparmor/af_inet.c
-+++ b/security/apparmor/af_inet.c
-@@ -766,7 +766,7 @@ int aa_inet_msg_perm(const char *op, u32 request, struct socket *sock,
- 	/* do we need early bailout for !family ... */
- 	return sk_has_perm2(sock->sk, op, request, profile, ad,
- 			    map_sock_addr(sock, ADDR_LOCAL, &laddr, &ad),
--			    map_addr(msg->msg_name, msg->msg_namelen, 0,
-+			    map_addr(msg->msg_namelen == 0 ? NULL : msg->msg_name, msg->msg_namelen, 0,
- 				     ADDR_REMOTE, &raddr, &ad),
- 			    profile_remote_perm(profile, sock->sk, request,
- 						&raddr, &laddr.maddr, &ad));

patches/kernel/0013-x86-CPU-AMD-Improve-the-erratum-1386-workaround.patch

@@ -1,79 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Borislav Petkov (AMD)" <bp@alien8.de>
-Date: Sun, 24 Mar 2024 20:51:35 +0100
-Subject: [PATCH] x86/CPU/AMD: Improve the erratum 1386 workaround
-
-Disable XSAVES only on machines which haven't loaded the microcode
-revision containing the erratum fix.
-
-This will come in handy when running archaic OSes as guests. OSes whose
-brilliant programmers thought that CPUID is overrated and one should not
-query it but use features directly, ala shoot first, ask questions
-later... but only if you're alive after the shooting.
-
-Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
-Tested-by: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
-Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
-Link: https://lore.kernel.org/r/20240324200525.GBZgCHhYFsBj12PrKv@fat_crate.local
----
- arch/x86/include/asm/cpu_device_id.h |  8 ++++++++
- arch/x86/kernel/cpu/amd.c            | 12 ++++++++++++
- 2 files changed, 20 insertions(+)
-
-diff --git a/arch/x86/include/asm/cpu_device_id.h b/arch/x86/include/asm/cpu_device_id.h
-index eb8fcede9e3b..bf4e065cf1e2 100644
---- a/arch/x86/include/asm/cpu_device_id.h
-+++ b/arch/x86/include/asm/cpu_device_id.h
-@@ -190,6 +190,14 @@ struct x86_cpu_desc {
- 	.x86_microcode_rev	= (revision),			\
- }
- 
-+#define AMD_CPU_DESC(fam, model, stepping, revision) {		\
-+	.x86_family		= (fam),			\
-+	.x86_vendor		= X86_VENDOR_AMD,		\
-+	.x86_model		= (model),			\
-+	.x86_stepping		= (stepping),			\
-+	.x86_microcode_rev	= (revision),			\
-+}
-+
- extern const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match);
- extern bool x86_cpu_has_min_microcode_rev(const struct x86_cpu_desc *table);
- 
-diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
-index dfa8d0cf5e18..22a263b1a884 100644
---- a/arch/x86/kernel/cpu/amd.c
-+++ b/arch/x86/kernel/cpu/amd.c
-@@ -13,6 +13,7 @@
- #include <asm/apic.h>
- #include <asm/cacheinfo.h>
- #include <asm/cpu.h>
-+#include <asm/cpu_device_id.h>
- #include <asm/spec-ctrl.h>
- #include <asm/smp.h>
- #include <asm/numa.h>
-@@ -926,6 +927,11 @@ static void init_amd_bd(struct cpuinfo_x86 *c)
- 	clear_rdrand_cpuid_bit(c);
- }
- 
-+static const struct x86_cpu_desc erratum_1386_microcode[] = {
-+	AMD_CPU_DESC(0x17,  0x1, 0x2, 0x0800126e),
-+	AMD_CPU_DESC(0x17, 0x31, 0x0, 0x08301052),
-+};
-+
- static void fix_erratum_1386(struct cpuinfo_x86 *c)
- {
- 	/*
-@@ -935,7 +941,13 @@ static void fix_erratum_1386(struct cpuinfo_x86 *c)
- 	 *
- 	 * Affected parts all have no supervisor XSAVE states, meaning that
- 	 * the XSAVEC instruction (which works fine) is equivalent.
-+	 *
-+	 * Clear the feature flag only on microcode revisions which
-+	 * don't have the fix.
- 	 */
-+	if (x86_cpu_has_min_microcode_rev(erratum_1386_microcode))
-+		return;
-+
- 	clear_cpu_cap(c, X86_FEATURE_XSAVES);
- }
- 

patches/kernel/0014-block-fix-request.queuelist-usage-in-flush.patch

@@ -1,64 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Chengming Zhou <chengming.zhou@linux.dev>
-Date: Sat, 8 Jun 2024 22:31:15 +0800
-Subject: [PATCH] block: fix request.queuelist usage in flush
-
-Friedrich Weber reported a kernel crash problem and bisected to commit
-81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine").
-
-The root cause is that we use "list_move_tail(&rq->queuelist, pending)"
-in the PREFLUSH/POSTFLUSH sequences. But rq->queuelist.next == xxx since
-it's popped out from plug->cached_rq in __blk_mq_alloc_requests_batch().
-We don't initialize its queuelist just for this first request, although
-the queuelist of all later popped requests will be initialized.
-
-Fix it by changing to use "list_add_tail(&rq->queuelist, pending)" so
-rq->queuelist doesn't need to be initialized. It should be ok since rq
-can't be on any list when PREFLUSH or POSTFLUSH, has no move actually.
-
-Please note the commit 81ada09cc25e ("blk-flush: reuse rq queuelist in
-flush state machine") also has another requirement that no drivers would
-touch rq->queuelist after blk_mq_end_request() since we will reuse it to
-add rq to the post-flush pending list in POSTFLUSH. If this is not true,
-we will have to revert that commit IMHO.
-
-This updated version adds "list_del_init(&rq->queuelist)" in flush rq
-callback since the dm layer may submit request of a weird invalid format
-(REQ_FSEQ_PREFLUSH | REQ_FSEQ_POSTFLUSH), which causes double list_add
-if without this "list_del_init(&rq->queuelist)". The weird invalid format
-problem should be fixed in dm layer.
-
-Reported-by: Friedrich Weber <f.weber@proxmox.com>
-Closes: https://lore.kernel.org/lkml/14b89dfb-505c-49f7-aebb-01c54451db40@proxmox.com/
-Closes: https://lore.kernel.org/lkml/c9d03ff7-27c5-4ebd-b3f6-5a90d96f35ba@proxmox.com/
-Fixes: 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine")
-Cc: Christoph Hellwig <hch@lst.de>
-Cc: ming.lei@redhat.com
-Cc: bvanassche@acm.org
-Tested-by: Friedrich Weber <f.weber@proxmox.com>
-Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev>
----
- block/blk-flush.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/block/blk-flush.c b/block/blk-flush.c
-index 3f4d41952ef2..d72b57898b23 100644
---- a/block/blk-flush.c
-+++ b/block/blk-flush.c
-@@ -183,7 +183,7 @@ static void blk_flush_complete_seq(struct request *rq,
- 		/* queue for flush */
- 		if (list_empty(pending))
- 			fq->flush_pending_since = jiffies;
--		list_move_tail(&rq->queuelist, pending);
-+		list_add_tail(&rq->queuelist, pending);
- 		break;
- 
- 	case REQ_FSEQ_DATA:
-@@ -261,6 +261,7 @@ static enum rq_end_io_ret flush_end_io(struct request *flush_rq,
- 		unsigned int seq = blk_flush_cur_seq(rq);
- 
- 		BUG_ON(seq != REQ_FSEQ_PREFLUSH && seq != REQ_FSEQ_POSTFLUSH);
-+		list_del_init(&rq->queuelist);
- 		blk_flush_complete_seq(rq, fq, seq, error);
- 	}
- 

patches/kernel/0015-scsi-core-Handle-devices-which-return-an-unusually-l.patch

@@ -1,49 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Martin K. Petersen" <martin.petersen@oracle.com>
-Date: Mon, 20 May 2024 22:30:40 -0400
-Subject: [PATCH] scsi: core: Handle devices which return an unusually large
- VPD page count
-
-Peter Schneider reported that a system would no longer boot after
-updating to 6.8.4.  Peter bisected the issue and identified commit
-b5fc07a5fb56 ("scsi: core: Consult supported VPD page list prior to
-fetching page") as being the culprit.
-
-Turns out the enclosure device in Peter's system reports a byteswapped
-page length for VPD page 0. It reports "02 00" as page length instead
-of "00 02". This causes us to attempt to access 516 bytes (page length
-+ header) of information despite only 2 pages being present.
-
-Limit the page search scope to the size of our VPD buffer to guard
-against devices returning a larger page count than requested.
-
-Link: https://lore.kernel.org/r/20240521023040.2703884-1-martin.petersen@oracle.com
-Fixes: b5fc07a5fb56 ("scsi: core: Consult supported VPD page list prior to fetching page")
-Cc: stable@vger.kernel.org
-Reported-by: Peter Schneider <pschneider1968@googlemail.com>
-Closes: https://lore.kernel.org/all/eec6ebbf-061b-4a7b-96dc-ea748aa4d035@googlemail.com/
-Tested-by: Peter Schneider <pschneider1968@googlemail.com>
-Reviewed-by: Bart Van Assche <bvanassche@acm.org>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
----
- drivers/scsi/scsi.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
-index 8cad9792a562..b3ff3a633a1e 100644
---- a/drivers/scsi/scsi.c
-+++ b/drivers/scsi/scsi.c
-@@ -350,6 +350,13 @@ static int scsi_get_vpd_size(struct scsi_device *sdev, u8 page)
- 		if (result < SCSI_VPD_HEADER_SIZE)
- 			return 0;
- 
-+		if (result > sizeof(vpd)) {
-+			dev_warn_once(&sdev->sdev_gendev,
-+				      "%s: long VPD page 0 length: %d bytes\n",
-+				      __func__, result);
-+			result = sizeof(vpd);
-+		}
-+
- 		result -= SCSI_VPD_HEADER_SIZE;
- 		if (!memchr(&vpd[SCSI_VPD_HEADER_SIZE], page, result))
- 			return 0;

patches/kernel/0016-e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch

@@ -1,73 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Vitaly Lifshits <vitaly.lifshits@intel.com>
-Date: Mon, 29 Apr 2024 10:10:40 -0700
-Subject: [PATCH] e1000e: change usleep_range to udelay in PHY mdic access
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is a partial revert of commit 6dbdd4de0362 ("e1000e: Workaround
-for sporadic MDI error on Meteor Lake systems"). The referenced commit
-used usleep_range inside the PHY access routines, which are sometimes
-called from an atomic context. This can lead to a kernel panic in some
-scenarios, such as cable disconnection and reconnection on vPro systems.
-
-Solve this by changing the usleep_range calls back to udelay.
-
-Fixes: 6dbdd4de0362 ("e1000e: Workaround for sporadic MDI error on Meteor Lake systems")
-Cc: stable@vger.kernel.org
-Reported-by: Jérôme Carretero <cJ@zougloub.eu>
-Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218740
-Closes: https://lore.kernel.org/lkml/a7eb665c74b5efb5140e6979759ed243072cb24a.camel@zougloub.eu/
-Co-developed-by: Sasha Neftin <sasha.neftin@intel.com>
-Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
-Signed-off-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
-Tested-by: Dima Ruinskiy <dima.ruinskiy@intel.com>
-Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
-Reviewed-by: Simon Horman <horms@kernel.org>
-Link: https://lore.kernel.org/r/20240429171040.1152516-1-anthony.l.nguyen@intel.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
----
- drivers/net/ethernet/intel/e1000e/phy.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
-index 93544f1cc2a5..f7ae0e0aa4a4 100644
---- a/drivers/net/ethernet/intel/e1000e/phy.c
-+++ b/drivers/net/ethernet/intel/e1000e/phy.c
-@@ -157,7 +157,7 @@ s32 e1000e_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data)
- 		 * the lower time out
- 		 */
- 		for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) {
--			usleep_range(50, 60);
-+			udelay(50);
- 			mdic = er32(MDIC);
- 			if (mdic & E1000_MDIC_READY)
- 				break;
-@@ -181,7 +181,7 @@ s32 e1000e_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data)
- 		 * reading duplicate data in the next MDIC transaction.
- 		 */
- 		if (hw->mac.type == e1000_pch2lan)
--			usleep_range(100, 150);
-+			udelay(100);
- 
- 		if (success) {
- 			*data = (u16)mdic;
-@@ -237,7 +237,7 @@ s32 e1000e_write_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 data)
- 		 * the lower time out
- 		 */
- 		for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) {
--			usleep_range(50, 60);
-+			udelay(50);
- 			mdic = er32(MDIC);
- 			if (mdic & E1000_MDIC_READY)
- 				break;
-@@ -261,7 +261,7 @@ s32 e1000e_write_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 data)
- 		 * reading duplicate data in the next MDIC transaction.
- 		 */
- 		if (hw->mac.type == e1000_pch2lan)
--			usleep_range(100, 150);
-+			udelay(100);
- 
- 		if (success)
- 			return 0;

patches/kernel/0017-virtio-pci-Check-if-is_avq-is-NULL.patch

@@ -1,48 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Li Zhang <zhanglikernel@gmail.com>
-Date: Tue, 18 Jun 2024 07:28:00 +0200
-Subject: [PATCH] virtio-pci: Check if is_avq is NULL
-
-BugLink: https://bugs.launchpad.net/bugs/2067862
-
-[bug]
-In the virtio_pci_common.c function vp_del_vqs, vp_dev->is_avq is involved
-to determine whether it is admin virtqueue, but this function vp_dev->is_avq
- may be empty. For installations, virtio_pci_legacy does not assign a value
- to vp_dev->is_avq.
-
-[fix]
-Check whether it is vp_dev->is_avq before use.
-
-[test]
-Test with virsh Attach device
-Before this patch, the following command would crash the guest system
-
-After applying the patch, everything seems to be working fine.
-
-Signed-off-by: Li Zhang <zhanglikernel@gmail.com>
-Message-Id: <1710566754-3532-1-git-send-email-zhanglikernel@gmail.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-
-(cherry picked from commit c8fae27d141a32a1624d0d0d5419d94252824498)
-Signed-off-by: Matthew Ruffell <matthew.ruffell@canonical.com>
-Acked-by: Paolo Pisati <paolo.pisati@canonical.com>
-Acked-by: Manuel Diewald <manuel.diewald@canonical.com>
-Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
----
- drivers/virtio/virtio_pci_common.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
-index b655fccaf773..3c18fc14cd66 100644
---- a/drivers/virtio/virtio_pci_common.c
-+++ b/drivers/virtio/virtio_pci_common.c
-@@ -236,7 +236,7 @@ void vp_del_vqs(struct virtio_device *vdev)
- 	int i;
- 
- 	list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
--		if (vp_dev->is_avq(vdev, vq->index))
-+		if (vp_dev->is_avq && vp_dev->is_avq(vdev, vq->index))
- 			continue;
- 
- 		if (vp_dev->per_vq_vectors) {

patches/kernel/9998-rdtsc-spoof-hook-0.patch

@@ -1,14 +0,0 @@
-diff -Naur --no-dereference a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
---- a/arch/x86/kvm/vmx/vmx.c     2024-07-01 21:03:34.000000000 +0300
-+++ b/arch/x86/kvm/vmx/vmx.c     2024-07-01 20:24:05.000000000 +0300
-@@ -6137,6 +6137,10 @@
- 	[EXIT_REASON_ENCLS]		      = handle_encls,
- 	[EXIT_REASON_BUS_LOCK]                = handle_bus_lock_vmexit,
- 	[EXIT_REASON_NOTIFY]		      = handle_notify,
-+	[EXIT_REASON_RDTSC]                        = handle_rdtsc,
-+	[EXIT_REASON_RDTSCP]               = handle_rdtscp,
-+	[EXIT_REASON_UMWAIT]                  = handle_umwait,
-+	[EXIT_REASON_TPAUSE]                  = handle_tpause,
- };
- 
- static const int kvm_vmx_max_exit_handlers =

patches/kernel/9999-rdtsc-spoof-hook-1.patch

@@ -1,40 +0,0 @@
-diff -Naur --no-dereference a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
---- a/arch/x86/kvm/vmx/vmx.c     2024-07-01 21:03:34.000000000 +0300
-+++ b/arch/x86/kvm/vmx/vmx.c     2024-07-01 20:24:05.000000000 +0300
-@@ -6079,6 +6079,36 @@
- 	return 1;
- }
- 
-+static int handle_rdtsc(struct kvm_vcpu *vcpu)
-+{
-+	u64 _rdtsc = rdtsc();
-+	printk_once("[HookEntry] hook entry function handle_rdtsc is working, return the rdtsc() if no hook , you can hook here!\n");
-+	vcpu->arch.regs[VCPU_REGS_RAX] = _rdtsc & -1u;
-+	vcpu->arch.regs[VCPU_REGS_RDX] = (_rdtsc >> 32) & -1u;
-+	return kvm_skip_emulated_instruction(vcpu);
-+}
-+
-+static int handle_rdtscp(struct kvm_vcpu *vcpu)
-+{
-+	u64 _rdtsc = rdtsc();
-+	printk_once("[HookEntry] hook entry function handle_rdtscp is working, return the rdtsc() if no hook , you can hook here!\n");
-+	vcpu->arch.regs[VCPU_REGS_RAX] = _rdtsc & -1u;
-+	vcpu->arch.regs[VCPU_REGS_RDX] = (_rdtsc >> 32) & -1u;
-+	return kvm_skip_emulated_instruction(vcpu);
-+}
-+
-+static int handle_umwait(struct kvm_vcpu *vcpu)
-+{
-+	kvm_skip_emulated_instruction(vcpu);
-+	return 1;
-+}
-+
-+static int handle_tpause(struct kvm_vcpu *vcpu)
-+{
-+	kvm_skip_emulated_instruction(vcpu);
-+	return 1;
-+}
-+
- /*
-  * The exit handlers return 1 if the exit was handled fully and guest execution
-  * may resume.  Otherwise they set the kvm_run parameter to indicate what needs

submodules/ubuntu-bionic

@@ -0,0 +1 @@
+Subproject commit 0402610fed7152bb5c2689b1740d40b17a78cfa7

submodules/ubuntu-kernel

@@ -1 +0,0 @@
-Subproject commit 52a389ffcb4a5a544790d46c53f79c845364692e

submodules/zfsonlinux

@@ -1 +1 @@
-Subproject commit f5c9e3a9a85e73ef96f02375a745b10115a319b3
+Subproject commit 020d1fc78cc56f328e9c45dc066ec921482440bf