aboutsummaryrefslogtreecommitdiffstats
path: root/debian/patches/series
blob: def1bb5210e6533df3f4f976842d2dfb3dd5788e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
# Changes to support package build system
debian/version.patch
debian/uname-version-timestamp.patch
debian/kernelvariables.patch
debian/gitignore.patch
debian/ia64-hardcode-arch-script-output.patch
debian/mips-disable-werror.patch
debian/mips-boston-disable-its.patch
debian/arch-sh4-fix-uimage-build.patch
debian/powerpcspe-omit-uimage.patch
debian/modpost-symbol-prefix.patch
debian/tools-perf-version.patch
debian/tools-perf-install.patch
debian/wireless-add-debian-wireless-regdb-certificates.patch
debian/export-symbols-needed-by-android-drivers.patch
debian/android-enable-building-ashmem-and-binder-as-modules.patch

# Fixes/improvements to firmware loading
features/all/drivers-media-dvb-usb-af9005-request_firmware.patch
debian/iwlwifi-do-not-request-unreleased-firmware.patch
bugfix/all/firmware_class-log-every-success-and-failure.patch
bugfix/all/firmware-remove-redundant-log-messages-from-drivers.patch
bugfix/all/radeon-amdgpu-firmware-is-required-for-drm-and-kms-on-r600-onward.patch
debian/firmware_class-refer-to-debian-wiki-firmware-page.patch

# Patches from aufs4 repository, imported with
# debian/patches/features/all/aufs4/gen-patch.  These are only the
# changes needed to allow aufs to be built out-of-tree.
features/all/aufs4/aufs4-base.patch
features/all/aufs4/aufs4-mmap.patch
features/all/aufs4/aufs4-standalone.patch

# Change some defaults for security reasons
debian/af_802154-Disable-auto-loading-as-mitigation-against.patch
debian/rds-Disable-auto-loading-as-mitigation-against-local.patch
debian/decnet-Disable-auto-loading-as-mitigation-against-lo.patch
debian/dccp-disable-auto-loading-as-mitigation-against-local-exploits.patch
debian/fs-enable-link-security-restrictions-by-default.patch

# Set various features runtime-disabled by default
debian/sched-autogroup-disabled.patch
debian/yama-disable-by-default.patch
debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch
features/all/security-perf-allow-further-restriction-of-perf_event_open.patch

# Disable autoloading/probing of various drivers by default
debian/cdc_ncm-cdc_mbim-use-ncm-by-default.patch
debian/snd-pcsp-disable-autoload.patch
bugfix/x86/viafb-autoload-on-olpc-xo1.5-only.patch
debian/fjes-disable-autoload.patch

# Taint if dangerous features are used
debian/fanotify-taint-on-use-of-fanotify_access_permissions.patch
debian/btrfs-warn-about-raid5-6-being-experimental-at-mount.patch

# Arch bug fixes
bugfix/arm/arm-dts-kirkwood-fix-sata-pinmux-ing-for-ts419.patch
bugfix/arm64/dts-rockchip-correct-voltage-selector-firefly-RK3399.patch
bugfix/x86/platform-x86-ideapad-laptop-add-ideapad-310-15ikb-to.patch
bugfix/x86/platform-x86-ideapad-laptop-add-ideapad-v310-15isk-t.patch
bugfix/x86/platform-x86-ideapad-laptop-add-y520-15ikbn-to-no_hw.patch
bugfix/x86/platform-x86-ideapad-laptop-add-y720-15ikbn-to-no_hw.patch
bugfix/x86/platform-x86-ideapad-laptop-add-ideapad-v510-15ikb-t.patch
bugfix/x86/platform-x86-ideapad-laptop-add-several-models-to-no.patch
debian/revert-gpu-host1x-add-iommu-support.patch
bugfix/x86/perf-tools-fix-unwind-build-on-i386.patch
bugfix/sh/sh-boot-do-not-use-hyphen-in-exported-variable-name.patch
bugfix/x86/mmap-remember-the-map_fixed-flag-as-vm_fixed.patch
bugfix/x86/mmap-add-an-exception-to-the-stack-gap-for-hotspot-jvm.patch

# Arch features
features/mips/MIPS-increase-MAX-PHYSMEM-BITS-on-Loongson-3-only.patch
features/mips/MIPS-Loongson-3-Add-Loongson-LS3A-RS780E-1-way-machi.patch
features/x86/x86-memtest-WARN-if-bad-RAM-found.patch
features/x86/x86-make-x32-syscall-support-conditional.patch
# Add support for Raspberry PI 3b+
features/armhf/ARM-dts-bcm2837-Add-Raspberry-Pi-3-B.patch
features/arm64/arm64-dts-broadcom-Add-reference-to-Raspberry-Pi-3-B.patch
# Add device-tree for Pinebook from linux next-20180625
features/arm64/pinebook/0001-arm64-allwinner-a64-Add-RTC-clock-to-phandle-32kHz-e.patch
features/arm64/pinebook/0002-arm64-dts-allwinner-a64-add-R_I2C-controller.patch
features/arm64/pinebook/0003-arm64-dts-allwinner-a64-Add-PWM-controllers.patch
features/arm64/pinebook/0004-arm64-dts-allwinner-add-support-for-Pinebook.patch
features/arm64/pinebook/0005-arm64-dts-allwinner-a64-add-SRAM-controller-device-t.patch

# Miscellaneous bug fixes
bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch
bugfix/all/disable-some-marvell-phys.patch
bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
bugfix/all/partially-revert-usb-kconfig-using-select-for-usb_co.patch
bugfix/all/kbuild-include-addtree-remove-quotes-before-matching-path.patch
debian/revert-objtool-fix-config_stack_validation-y-warning.patch
bugfix/all/i40e-build-for-64-bit-targets-only.patch
bugfix/all/ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-f.patch

# Miscellaneous features

# Lockdown (formerly 'securelevel') patchset
features/all/lockdown/0001-Add-the-ability-to-lock-down-access-to-the-running-k.patch
features/all/lockdown/0002-Add-a-SysRq-option-to-lift-kernel-lockdown.patch
features/all/lockdown/0003-ima-require-secure_boot-rules-in-lockdown-mode.patch
features/all/lockdown/0004-Enforce-module-signatures-if-the-kernel-is-locked-do.patch
features/all/lockdown/0005-Restrict-dev-mem-kmem-port-when-the-kernel-is-locked.patch
features/all/lockdown/0006-kexec-Disable-at-runtime-if-the-kernel-is-locked-dow.patch
features/all/lockdown/0007-Copy-secure_boot-flag-in-boot-params-across-kexec-re.patch
features/all/lockdown/0008-kexec_file-Restrict-at-runtime-if-the-kernel-is-lock.patch
features/all/lockdown/0009-hibernate-Disable-when-the-kernel-is-locked-down.patch
features/all/lockdown/0010-uswsusp-Disable-when-the-kernel-is-locked-down.patch
features/all/lockdown/0011-PCI-Lock-down-BAR-access-when-the-kernel-is-locked-d.patch
features/all/lockdown/0012-x86-Lock-down-IO-port-access-when-the-kernel-is-lock.patch
features/all/lockdown/0013-x86-msr-Restrict-MSR-access-when-the-kernel-is-locke.patch
features/all/lockdown/0014-asus-wmi-Restrict-debugfs-interface-when-the-kernel-.patch
features/all/lockdown/0015-ACPI-Limit-access-to-custom_method-when-the-kernel-i.patch
features/all/lockdown/0016-acpi-Ignore-acpi_rsdp-kernel-param-when-the-kernel-h.patch
features/all/lockdown/0017-acpi-Disable-ACPI-table-override-if-the-kernel-is-lo.patch
features/all/lockdown/0018-acpi-Disable-APEI-error-injection-if-the-kernel-is-l.patch
features/all/lockdown/0020-Prohibit-PCMCIA-CIS-storage-when-the-kernel-is-locke.patch
features/all/lockdown/0021-Lock-down-TIOCSSERIAL.patch
features/all/lockdown/0022-Lock-down-module-params-that-specify-hardware-parame.patch
features/all/lockdown/0023-x86-mmiotrace-Lock-down-the-testmmiotrace-module.patch
features/all/lockdown/0024-debugfs-Disallow-use-of-debugfs-files-when-the-kerne.patch
features/all/lockdown/0025-Lock-down-proc-kcore.patch
features/all/lockdown/0026-Lock-down-kprobes.patch
features/all/lockdown/0027-bpf-Restrict-kernel-image-access-functions-when-the-.patch
features/all/lockdown/0028-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-b.patch
features/all/lockdown/0029-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mo.patch
# some missing pieces
features/all/lockdown/enable-cold-boot-attack-mitigation.patch
features/all/lockdown/mtd-disable-slram-and-phram-when-locked-down.patch
features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch

# Security fixes
debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
bugfix/x86/virt-vbox-Only-copy_from_user-the-request-header-onc.patch
bugfix/all/tracing-check-for-no-filter-when-processing-event-fi.patch

# Fix exported symbol versions
bugfix/all/module-disable-matching-missing-version-crc.patch

# Tools bug fixes
bugfix/all/usbip-document-tcp-wrappers.patch
bugfix/all/kbuild-fix-recordmcount-dependency.patch
bugfix/all/tools-perf-man-date.patch
bugfix/all/tools-perf-remove-shebangs.patch
bugfix/all/tools-lib-traceevent-use-ldflags.patch
bugfix/x86/revert-perf-build-fix-libunwind-feature-detection-on.patch
bugfix/all/tools-build-remove-bpf-run-time-check-at-build-time.patch
bugfix/all/cpupower-bump-soname-version.patch
bugfix/all/cpupower-fix-checks-for-cpu-existence.patch
bugfix/all/lockdep-stub-nmi-watchdog-reset.patch

# wireless: Disable regulatory.db direct loading (until we sort out signing)
debian/wireless-disable-regulatory.db-direct-loading.patch

# ABI maintenance