Merge tag 'debian/4.18.8-1'

Release linux (4.18.8-1).

- Drop ABI reference files and ABI maintenance patch
- Replace ccp driver patch with upstream version that applies to 4.19

6 files changed, 270 insertions, 27 deletions

diff --git a/debian/bin/check-patches.sh b/debian/bin/check-patches.sh
index 5885412f8130..093649bd19ef 100755
--- a/debian/bin/check-patches.sh
+++ b/debian/bin/check-patches.sh
@@ -2,8 +2,10 @@
 
 TMPDIR=$(mktemp -d)
 trap "rm -rf $TMPDIR" EXIT
-sed '/^#/d; /^[[:space:]]*$/d; /^X /d; s/^+ //; s,^,debian/patches/,' debian/patches/series* | sort -u > $TMPDIR/used
-find debian/patches ! -path '*/series*' -type f -name "*.diff" -o -name "*.patch" -printf "%p\n" | sort > $TMPDIR/avail
+for patchdir in debian/patches*; do
+    sed '/^#/d; /^[[:space:]]*$/d; /^X /d; s/^+ //; s,^,'"$patchdir"'/,' "$patchdir"/series
+done | sort -u > $TMPDIR/used
+find debian/patches* ! -path '*/series' -type f -name "*.diff" -o -name "*.patch" -printf "%p\n" | sort > $TMPDIR/avail
 echo "Used patches"
 echo "=============="
 cat $TMPDIR/used
diff --git a/debian/bin/genpatch-aufs b/debian/bin/genpatch-aufs
new file mode 100755
index 000000000000..603c85420892
--- /dev/null
+++ b/debian/bin/genpatch-aufs
@@ -0,0 +1,31 @@
+#!/bin/bash -e
+
+aufs_dir="$1"
+
+export GIT_DIR="$aufs_dir/.git"
+
+from_line='From: J. R. Okajima <hooanon05@yahoo.co.jp>'
+if [ -d "$GIT_DIR" ]; then
+    origin_line="Origin: https://github.com/sfjro/aufs4-standalone/tree/$(git rev-list HEAD -1)"
+else
+    echo >&2 "W: Cannot include a specific origin URL without an aufs git repo"
+    origin_line='Origin: https://github.com/sfjro/aufs4-standalone/branches'
+fi
+bug_line='Bug-Debian: https://bugs.debian.org/541828'
+
+for patch in aufs4-{base,mmap,standalone}.patch; do
+    {
+	echo "$from_line"
+	if [ -d "$GIT_DIR" ]; then
+	    git log --pretty='Date: %ad' HEAD -1 -- "$patch"
+	fi
+	echo -n 'Subject: '
+	grep -v '^SPDX-License-Identifier:' "$aufs_dir/$patch" | head -1
+	echo "$origin_line"
+	echo "$bug_line"
+	echo
+	echo 'Patch headers added by debian/bin/genpatch-aufs'
+	echo
+	sed 's/^+.*EXPORT_SYMBOL\b/&_GPL/' < "$aufs_dir"/"$patch"
+    } > debian/patches/features/all/aufs4/"$patch"
+done
diff --git a/debian/bin/genpatch-lockdown b/debian/bin/genpatch-lockdown
new file mode 100755
index 000000000000..aa8b785132ca
--- /dev/null
+++ b/debian/bin/genpatch-lockdown
@@ -0,0 +1,99 @@
+#!/usr/bin/python3
+
+import codecs, errno, io, os, os.path, re, shutil, subprocess, sys, tempfile
+
+def main(repo, range='torvalds/master..dhowells/efi-lock-down'):
+    patch_dir = 'debian/patches'
+    lockdown_patch_dir = 'features/all/lockdown'
+    series_name = 'series'
+
+    # Only replace patches in this subdirectory and starting with a digit
+    # - the others are presumably Debian-specific for now
+    lockdown_patch_name_re = re.compile(
+        r'^' + re.escape(lockdown_patch_dir) + r'/\d')
+    series_before = []
+    series_after = []
+
+    old_series = set()
+    new_series = set()
+
+    try:
+        with open(os.path.join(patch_dir, series_name), 'r') as series_fh:
+            for line in series_fh:
+                name = line.strip()
+                if lockdown_patch_name_re.match(name):
+                    old_series.add(name)
+                elif len(old_series) == 0:
+                    series_before.append(line)
+                else:
+                    series_after.append(line)
+    except FileNotFoundError:
+        pass
+
+    with open(os.path.join(patch_dir, series_name), 'w') as series_fh:
+        for line in series_before:
+            series_fh.write(line)
+
+        # Add directory prefix to all filenames.
+        # Add Origin to all patch headers.
+        def add_patch(name, source_patch, origin):
+            name = os.path.join(lockdown_patch_dir, name)
+            path = os.path.join(patch_dir, name)
+            try:
+                os.unlink(path)
+            except FileNotFoundError:
+                pass
+            with open(path, 'w') as patch:
+                in_header = True
+                for line in source_patch:
+                    if in_header and re.match(r'^(\n|[^\w\s]|Index:)', line):
+                        patch.write('Origin: %s\n' % origin)
+                        if line != '\n':
+                            patch.write('\n')
+                        in_header = False
+                    patch.write(line)
+            series_fh.write(name)
+            series_fh.write('\n')
+            new_series.add(name)
+
+        # XXX No signature to verify
+
+        env = os.environ.copy()
+        env['GIT_DIR'] = os.path.join(repo, '.git')
+        args = ['git', 'format-patch', '--subject-prefix=', range]
+        format_proc = subprocess.Popen(args,
+                                       cwd=os.path.join(patch_dir, lockdown_patch_dir),
+                                       env=env, stdout=subprocess.PIPE)
+        with io.open(format_proc.stdout.fileno(), encoding='utf-8') as pipe:
+            for line in pipe:
+                name = line.strip('\n')
+                with open(os.path.join(patch_dir, lockdown_patch_dir, name)) as \
+                        source_patch:
+                    patch_from = source_patch.readline()
+                    match = re.match(r'From ([0-9a-f]{40}) ', patch_from)
+                    assert match
+                    origin = 'https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit?id=%s' % match.group(1)
+                    add_patch(name, source_patch, origin)
+
+        for line in series_after:
+            series_fh.write(line)
+
+    for name in new_series:
+        if name in old_series:
+            old_series.remove(name)
+        else:
+            print('Added patch', os.path.join(patch_dir, name))
+
+    for name in old_series:
+        print('Obsoleted patch', os.path.join(patch_dir, name))
+
+if __name__ == '__main__':
+    if not (2 <= len(sys.argv) <= 3):
+        sys.stderr.write('''\
+Usage: %s REPO [REVISION-RANGE]
+REPO is a git repo containing the REVISION-RANGE.  The default range is
+torvalds/master..dhowells/efi-lock-down.
+''' % sys.argv[0])
+        print('BASE is the base branch (default: torvalds/master).')
+        sys.exit(2)
+    main(*sys.argv[1:])
diff --git a/debian/bin/genpatch-rt b/debian/bin/genpatch-rt
new file mode 100755
index 000000000000..00329c4a8a23
--- /dev/null
+++ b/debian/bin/genpatch-rt
@@ -0,0 +1,131 @@
+#!/usr/bin/python3
+
+import codecs, errno, io, os, os.path, re, shutil, subprocess, sys, tempfile
+
+def main(source, version=None):
+    patch_dir = 'debian/patches-rt'
+    series_name = 'series'
+    old_series = set()
+    new_series = set()
+
+    try:
+        with open(os.path.join(patch_dir, series_name), 'r') as series_fh:
+            for line in series_fh:
+                name = line.strip()
+                if name != '' and name[0] != '#':
+                    old_series.add(name)
+    except FileNotFoundError:
+        pass
+
+    with open(os.path.join(patch_dir, series_name), 'w') as series_fh:
+        # Add Origin to all patch headers.
+        def add_patch(name, source_patch, origin):
+            path = os.path.join(patch_dir, name)
+            try:
+                os.unlink(path)
+            except FileNotFoundError:
+                pass
+            with open(path, 'w') as patch:
+                in_header = True
+                for line in source_patch:
+                    if in_header and re.match(r'^(\n|[^\w\s]|Index:)', line):
+                        patch.write('Origin: %s\n' % origin)
+                        if line != '\n':
+                            patch.write('\n')
+                        in_header = False
+                    patch.write(line)
+            new_series.add(name)
+
+        if os.path.isdir(os.path.join(source, '.git')):
+            # Export rebased branch from stable-rt git as patch series
+            up_ver = re.sub(r'-rt\d+$', '', version)
+            env = os.environ.copy()
+            env['GIT_DIR'] = os.path.join(source, '.git')
+            env['DEBIAN_KERNEL_KEYRING'] = 'rt-signing-key.pgp'
+
+            # Validate tag signature
+            gpg_wrapper = os.path.join(os.getcwd(),
+                                       "debian/bin/git-tag-gpg-wrapper")
+            verify_proc = subprocess.Popen(['git',
+                                            '-c', 'gpg.program=%s' % gpg_wrapper,
+                                            'tag', '-v', 'v%s-rebase' % version],
+                                           env=env)
+            if verify_proc.wait():
+                raise RuntimeError("GPG tag verification failed")
+
+            args = ['git', 'format-patch', 'v%s..v%s-rebase' % (up_ver, version)]
+            format_proc = subprocess.Popen(args,
+                                           cwd=patch_dir,
+                                           env=env, stdout=subprocess.PIPE)
+            with io.open(format_proc.stdout.fileno(), encoding='utf-8') as pipe:
+                for line in pipe:
+                    name = line.strip('\n')
+                    with open(os.path.join(patch_dir, name)) as source_patch:
+                        patch_from = source_patch.readline()
+                        match = re.match(r'From ([0-9a-f]{40}) ', patch_from)
+                        assert match
+                        origin = 'https://git.kernel.org/cgit/linux/kernel/git/rt/linux-stable-rt.git/commit?id=%s' % match.group(1)
+                        add_patch(name, source_patch, origin)
+
+        else:
+            # Get version and upstream version
+            if version is None:
+                match = re.search(r'(?:^|/)patches-(.+)\.tar\.[gx]z$', source)
+                assert match, 'no version specified or found in filename'
+                version = match.group(1)
+            match = re.match(r'^(\d+\.\d+)(?:\.\d+|-rc\d+)?-rt\d+$', version)
+            assert match, 'could not parse version string'
+            up_ver = match.group(1)
+
+            # Expect an accompanying signature, and validate it
+            source_sig = re.sub(r'.[gx]z$', '.sign', source)
+            unxz_proc = subprocess.Popen(['xzcat', source],
+                                         stdout=subprocess.PIPE)
+            verify_output = subprocess.check_output(
+                ['gpgv', '--status-fd', '1',
+                 '--keyring', 'debian/upstream/rt-signing-key.pgp',
+                 '--ignore-time-conflict', source_sig, '-'],
+                stdin=unxz_proc.stdout)
+            if unxz_proc.wait() or \
+               not re.search(r'^\[GNUPG:\]\s+VALIDSIG\s',
+                             codecs.decode(verify_output),
+                             re.MULTILINE):
+                os.write(2, verify_output) # bytes not str!
+                raise RuntimeError("GPG signature verification failed")
+
+            temp_dir = tempfile.mkdtemp(prefix='rt-genpatch', dir='debian')
+            try:
+                # Unpack tarball
+                subprocess.check_call(['tar', '-C', temp_dir, '-xaf', source])
+                source_dir = os.path.join(temp_dir, 'patches')
+                assert os.path.isdir(source_dir), 'tarball does not contain patches directory'
+
+                # Copy patch series
+                origin = 'https://www.kernel.org/pub/linux/kernel/projects/rt/%s/older/patches-%s.tar.xz' % (up_ver, version)
+                with open(os.path.join(source_dir, 'series'), 'r') as \
+                        source_series_fh:
+                    for line in source_series_fh:
+                        name = line.strip()
+                        if name != '' and name[0] != '#':
+                            with open(os.path.join(source_dir, name)) as source_patch:
+                                add_patch(name, source_patch, origin)
+                        series_fh.write(line)
+            finally:
+                shutil.rmtree(temp_dir)
+
+    for name in new_series:
+        if name in old_series:
+            old_series.remove(name)
+        else:
+            print('Added patch', os.path.join(patch_dir, name))
+
+    for name in old_series:
+        print('Obsoleted patch', os.path.join(patch_dir, name))
+
+if __name__ == '__main__':
+    if not (1 <= len(sys.argv) <= 3):
+        print('Usage: %s {TAR [RT-VERSION] | REPO RT-VERSION}' % sys.argv[0], file=sys.stderr)
+        print('TAR is a tarball of patches.', file=sys.stderr)
+        print('REPO is a git repo containing the given RT-VERSION.', file=sys.stderr)
+        sys.exit(2)
+    main(*sys.argv[1:])
diff --git a/debian/bin/test-patches b/debian/bin/test-patches
index 98ddd9f93d42..cefcefab8c02 100755
--- a/debian/bin/test-patches
+++ b/debian/bin/test-patches
@@ -64,25 +64,24 @@ if [ "${version%a~test}" = "$version" ]; then
     dch -v "$version" --distribution UNRELEASED "Testing patches $*"
 fi
 
-# Make new directory for patches
-mkdir -p debian/patches/test
-
 # Ignore user's .quiltrc
 alias quilt='quilt --quiltrc -'
 
 # Try to clean up any previous test patches
 if [ "$featureset" = none ]; then
+    patchdir=debian/patches
     while patch="$(quilt next 2>/dev/null || quilt top 2>/dev/null)" && \
 	[ "${patch#test/}" != "$patch" ]; do
         quilt delete -r "$patch"
     done
 else
-    sed -i '/^test\//d' debian/patches/series-${featureset}
+    patchdir=debian/patches-${featureset}
+    sed -i '/^test\//d' $patchdir/series
 fi
 
 # Prepare a new directory for the patches
-rm -rf debian/patches/test/
-mkdir debian/patches/test
+rm -rf $patchdir/test/
+mkdir $patchdir/test
 
 # Regenerate control and included rules
 rm debian/control debian/rules.gen
diff --git a/debian/bin/uscan-hook b/debian/bin/uscan-hook
deleted file mode 100755
index b0631c64e7ec..000000000000
--- a/debian/bin/uscan-hook
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/bash -e
-
-# This script is invoked by uscan after downloading a new tarball
-
-if [ "x$1" != "x--upstream-version" -o $# != 3 ]; then
-   echo >&2 "invalid arguments: $*"
-   exit 2
-fi
-
-version="$2"
-filename="$3"
-
-upstream_tarball="$(readlink -f "$filename")"
-rm "$filename"
-debian/bin/genorig.py --override-version "$version" "$upstream_tarball"
-
-dch -v "$version-1" 'New upstream release'
-
-debian/rules orig