Home Home > GIT Browse > openSUSE-15.0
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-03-26 07:04:31 +0100
committerKernel Build Daemon <kbuild@suse.de>2019-03-26 07:04:31 +0100
commitffb3ca06768e3e5d6f959303eaa4afc1db4c8075 (patch)
treeb7b1d1b38ab29771771d0d80e0f11a5fd8786b41
parent346b7259cf6d428a93fea74c5e685f432e0d3c60 (diff)
parent59344406ef6657b778a17c5c3aa568942a2508ba (diff)
Merge branch 'SLE15' into openSUSE-15.0openSUSE-15.0
-rw-r--r--patches.arch/svm-fix-improper-check-when-deactivate-avic52
-rw-r--r--patches.drivers/Input-matrix_keypad-use-flush_delayed_work.patch36
-rw-r--r--patches.drivers/Input-st-keyscan-fix-potential-zalloc-NULL-dereferen.patch47
-rw-r--r--patches.drivers/auxdisplay-hd44780-Fix-memory-leak-on-remove.patch36
-rw-r--r--patches.drivers/auxdisplay-ht16k33-fix-potential-user-after-free-on-.patch46
-rw-r--r--patches.drivers/clk-clk-twl6040-Fix-imprecise-external-abort-for-pdm.patch121
-rw-r--r--patches.drivers/clk-ingenic-Fix-doc-of-ingenic_cgu_div_info.patch38
-rw-r--r--patches.drivers/clk-ingenic-Fix-round_rate-misbehaving-with-non-inte.patch67
-rw-r--r--patches.drivers/clk-sunxi-ng-v3s-Fix-TCON-reset-de-assert-bit.patch37
-rw-r--r--patches.drivers/clk-vc5-Abort-clock-configuration-without-upstream-c.patch52
-rw-r--r--patches.drivers/clocksource-drivers-exynos_mct-Clear-timer-interrupt.patch40
-rw-r--r--patches.drivers/clocksource-drivers-exynos_mct-Move-one-shot-check-f.patch77
-rw-r--r--patches.drivers/cpcap-charger-generate-events-for-userspace.patch41
-rw-r--r--patches.drivers/cpufreq-pxa2xx-remove-incorrect-__init-annotation.patch57
-rw-r--r--patches.drivers/cpufreq-tegra124-add-missing-of_node_put.patch39
-rw-r--r--patches.drivers/i2c-tegra-fix-maximum-transfer-size.patch36
-rw-r--r--patches.drivers/iommu-amd-fix-null-dereference-bug-in-match_hid_uid39
-rw-r--r--patches.drivers/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size77
-rw-r--r--patches.drivers/iommu-vt-d-check-capability-before-disabling-protected-memory37
-rw-r--r--patches.drivers/mmc-pxamci-fix-enum-type-confusion.patch51
-rw-r--r--patches.drivers/regulator-max77620-Initialize-values-for-DT-properti.patch54
-rw-r--r--patches.drivers/regulator-s2mpa01-Fix-step-values-for-some-LDOs.patch60
-rw-r--r--patches.drivers/rtc-88pm80x-fix-unintended-sign-extension.patch93
-rw-r--r--patches.drivers/rtc-88pm860x-fix-unintended-sign-extension.patch90
-rw-r--r--patches.drivers/rtc-cmos-ignore-bogus-century-byte.patch45
-rw-r--r--patches.drivers/rtc-ds1672-fix-unintended-sign-extension.patch43
-rw-r--r--patches.drivers/rtc-pm8xxx-fix-unintended-sign-extension.patch53
-rw-r--r--patches.drivers/serial-8250_of-assume-reg-shift-of-2-for-mrvl-mmp-ua.patch37
-rw-r--r--patches.drivers/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch35
-rw-r--r--patches.drivers/spi-pxa2xx-Setup-maximum-supported-DMA-transfer-leng.patch47
-rw-r--r--patches.drivers/spi-ti-qspi-Fix-mmap-read-when-more-than-one-CS-in-u.patch52
-rw-r--r--patches.drivers/spi-topcliff_pch-Fix-potential-NULL-dereference-on-a.patch47
-rw-r--r--patches.drivers/thermal-bcm2835-Fix-crash-in-bcm2835_thermal_debugfs.patch62
-rw-r--r--patches.drivers/usb-dwc3-gadget-Fix-the-uninitialized-link_state-whe.patch59
-rw-r--r--patches.drivers/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch40
-rw-r--r--patches.drivers/usb-gadget-Potential-NULL-dereference-on-allocation-.patch39
-rw-r--r--patches.drivers/usb-phy-fix-link-errors.patch60
-rw-r--r--patches.drivers/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch41
-rw-r--r--patches.drm/drm-i915-Relax-mmap-VMA-check.patch54
-rw-r--r--patches.drm/drm-imx-ignore-plane-updates-on-disabled-crtcs.patch43
-rw-r--r--patches.drm/drm-imx-imx-ldb-add-missing-of_node_puts.patch120
-rw-r--r--patches.fixes/0001-Revert-ipv4-keep-skb-dst-around-in-presence-of-IP-op.patch40
-rw-r--r--patches.fixes/0001-USB-serial-cp210x-add-ID-for-Ingenico-3070.patch42
-rw-r--r--patches.fixes/0001-USB-serial-ftdi_sio-add-ID-for-Hjelmslund-Electronic.patch53
-rw-r--r--patches.fixes/0001-USB-serial-option-add-Telit-ME910-ECM-composition.patch34
-rw-r--r--patches.fixes/0001-ip6-fix-PMTU-discovery-when-using-127-subnets.patch75
-rw-r--r--patches.fixes/0001-ip6mr-Do-not-call-__IP6_INC_STATS-from-preemptible-c.patch69
-rw-r--r--patches.fixes/0001-ipv4-route-fail-early-when-inet-dev-is-missing.patch52
-rw-r--r--patches.fixes/0001-iwlwifi-mvm-fix-firmware-statistics-usage.patch112
-rw-r--r--patches.fixes/0001-net-ncsi-Fix-AEN-HNCDSC-packet-length.patch32
-rw-r--r--patches.fixes/0001-net-ncsi-Stop-monitor-if-channel-times-out-or-is-ina.patch87
-rw-r--r--patches.fixes/0001-net-sysfs-Fix-mem-leak-in-netdev_register_kobject.patch57
-rw-r--r--patches.fixes/0001-netfilter-check-for-seqadj-ext-existence-before-addi.patch64
-rw-r--r--patches.fixes/0001-rtnetlink-bring-NETDEV_CHANGEUPPER-event-process-bac.patch36
-rw-r--r--patches.fixes/0001-rtnetlink-bring-NETDEV_CHANGE_TX_QUEUE_LEN-event-pro.patch39
-rw-r--r--patches.fixes/0001-rtnetlink-bring-NETDEV_POST_TYPE_CHANGE-event-proces.patch39
-rw-r--r--patches.fixes/0001-rtnetlink-check-DO_SETLINK_NOTIFY-correctly-in-do_se.patch46
-rw-r--r--patches.fixes/PM-wakeup-Rework-wakeup-source-timer-cancellation.patch55
-rw-r--r--patches.fixes/SMB3-Fix-SMB3.1.1-guest-mounts-to-Samba.patch54
-rw-r--r--patches.fixes/cifs-allow-guest-mounts-to-work-for-smb3.11.patch43
-rw-r--r--patches.fixes/device-property-Fix-the-length-used-in-PROPERTY_ENTR.patch40
-rw-r--r--patches.fixes/ext4-Avoid-panic-during-forced-reboot.patch61
-rw-r--r--patches.fixes/mac80211-Fix-Tx-aggregation-session-tear-down-with-I.patch58
-rw-r--r--patches.fixes/mac80211_hwsim-propagate-genlmsg_reply-return-code.patch34
-rw-r--r--patches.suse/ACPI-acpi_pad-Do-not-launch-acpi_pad-threads-on-idle-cpus.patch105
-rw-r--r--series.conf67
66 files changed, 3593 insertions, 1 deletions
diff --git a/patches.arch/svm-fix-improper-check-when-deactivate-avic b/patches.arch/svm-fix-improper-check-when-deactivate-avic
new file mode 100644
index 0000000000..067f8b8e7b
--- /dev/null
+++ b/patches.arch/svm-fix-improper-check-when-deactivate-avic
@@ -0,0 +1,52 @@
+From: "Suthikulpanit, Suravee" <Suravee.Suthikulpanit@amd.com>
+Date: Tue, 29 Jan 2019 08:09:46 +0000
+Subject: svm: Fix improper check when deactivate AVIC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: c57cd3c89ecf2812976f53e494580a396f93efd2
+Patch-mainline: v5.1-rc1
+References: bsc#1130335
+
+The function svm_refresh_apicv_exec_ctrl() always returning prematurely
+as kvm_vcpu_apicv_active() always return false when calling from
+the function arch/x86/kvm/x86.c:kvm_vcpu_deactivate_apicv().
+This is because the apicv_active is set to false just before calling
+refresh_apicv_exec_ctrl().
+
+Also, we need to mark VMCB_AVIC bit as dirty instead of VMCB_INTR.
+
+So, fix svm_refresh_apicv_exec_ctrl() to properly deactivate AVIC.
+
+Fixes: 67034bb9dd5e ('KVM: SVM: Add irqchip_split() checks before enabling AVIC')
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/svm.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 01b66bbcdd7a..74ceda470eae 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -5122,11 +5122,11 @@ static void svm_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
+ struct vcpu_svm *svm = to_svm(vcpu);
+ struct vmcb *vmcb = svm->vmcb;
+
+- if (!kvm_vcpu_apicv_active(&svm->vcpu))
+- return;
+-
+- vmcb->control.int_ctl &= ~AVIC_ENABLE_MASK;
+- mark_dirty(vmcb, VMCB_INTR);
++ if (kvm_vcpu_apicv_active(vcpu))
++ vmcb->control.int_ctl |= AVIC_ENABLE_MASK;
++ else
++ vmcb->control.int_ctl &= ~AVIC_ENABLE_MASK;
++ mark_dirty(vmcb, VMCB_AVIC);
+ }
+
+ static void svm_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
+
diff --git a/patches.drivers/Input-matrix_keypad-use-flush_delayed_work.patch b/patches.drivers/Input-matrix_keypad-use-flush_delayed_work.patch
new file mode 100644
index 0000000000..ca5697fe04
--- /dev/null
+++ b/patches.drivers/Input-matrix_keypad-use-flush_delayed_work.patch
@@ -0,0 +1,36 @@
+From a342083abe576db43594a32d458a61fa81f7cb32 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Thu, 7 Feb 2019 14:39:40 -0800
+Subject: [PATCH] Input: matrix_keypad - use flush_delayed_work()
+Git-commit: a342083abe576db43594a32d458a61fa81f7cb32
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+We should be using flush_delayed_work() instead of flush_work() in
+matrix_keypad_stop() to ensure that we are not missing work that is
+scheduled but not yet put in the workqueue (i.e. its delay timer has not
+expired yet).
+
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/keyboard/matrix_keypad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
+index 403452ef00e6..3d1cb7bf5e35 100644
+--- a/drivers/input/keyboard/matrix_keypad.c
++++ b/drivers/input/keyboard/matrix_keypad.c
+@@ -222,7 +222,7 @@ static void matrix_keypad_stop(struct input_dev *dev)
+ keypad->stopped = true;
+ spin_unlock_irq(&keypad->lock);
+
+- flush_work(&keypad->work.work);
++ flush_delayed_work(&keypad->work);
+ /*
+ * matrix_keypad_scan() will leave IRQs enabled;
+ * we should disable them now.
+--
+2.16.4
+
diff --git a/patches.drivers/Input-st-keyscan-fix-potential-zalloc-NULL-dereferen.patch b/patches.drivers/Input-st-keyscan-fix-potential-zalloc-NULL-dereferen.patch
new file mode 100644
index 0000000000..f238ef8d6a
--- /dev/null
+++ b/patches.drivers/Input-st-keyscan-fix-potential-zalloc-NULL-dereferen.patch
@@ -0,0 +1,47 @@
+From 2439d37e1bf8a34d437573c086572abe0f3f1b15 Mon Sep 17 00:00:00 2001
+From: Gabriel Fernandez <gabriel.fernandez@st.com>
+Date: Sat, 16 Feb 2019 21:10:16 -0800
+Subject: [PATCH] Input: st-keyscan - fix potential zalloc NULL dereference
+Git-commit: 2439d37e1bf8a34d437573c086572abe0f3f1b15
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+This patch fixes the following static checker warning:
+
+drivers/input/keyboard/st-keyscan.c:156 keyscan_probe()
+Error: potential zalloc NULL dereference: 'keypad_data->input_dev'
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Gabriel Fernandez <gabriel.fernandez@st.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/keyboard/st-keyscan.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/keyboard/st-keyscan.c b/drivers/input/keyboard/st-keyscan.c
+index babcfb165e4f..3b85631fde91 100644
+--- a/drivers/input/keyboard/st-keyscan.c
++++ b/drivers/input/keyboard/st-keyscan.c
+@@ -153,6 +153,8 @@ static int keyscan_probe(struct platform_device *pdev)
+
+ input_dev->id.bustype = BUS_HOST;
+
++ keypad_data->input_dev = input_dev;
++
+ error = keypad_matrix_key_parse_dt(keypad_data);
+ if (error)
+ return error;
+@@ -168,8 +170,6 @@ static int keyscan_probe(struct platform_device *pdev)
+
+ input_set_drvdata(input_dev, keypad_data);
+
+- keypad_data->input_dev = input_dev;
+-
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ keypad_data->base = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(keypad_data->base))
+--
+2.16.4
+
diff --git a/patches.drivers/auxdisplay-hd44780-Fix-memory-leak-on-remove.patch b/patches.drivers/auxdisplay-hd44780-Fix-memory-leak-on-remove.patch
new file mode 100644
index 0000000000..bdf378ba91
--- /dev/null
+++ b/patches.drivers/auxdisplay-hd44780-Fix-memory-leak-on-remove.patch
@@ -0,0 +1,36 @@
+From 41c8d0adf3c4df1867d98cee4a2c4531352a33ad Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 12 Mar 2019 16:44:28 +0200
+Subject: [PATCH] auxdisplay: hd44780: Fix memory leak on ->remove()
+Git-commit: 41c8d0adf3c4df1867d98cee4a2c4531352a33ad
+Patch-mainline: v5.1-rc2
+References: bsc#1051510
+
+We have to free on ->remove() the allocated resources on ->probe().
+
+Fixes: d47d88361fee ("auxdisplay: Add HD44780 Character LCD support")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/auxdisplay/hd44780.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/auxdisplay/hd44780.c b/drivers/auxdisplay/hd44780.c
+index 9ad93ea42fdc..3cde351fb5c9 100644
+--- a/drivers/auxdisplay/hd44780.c
++++ b/drivers/auxdisplay/hd44780.c
+@@ -280,6 +280,8 @@ static int hd44780_remove(struct platform_device *pdev)
+ struct charlcd *lcd = platform_get_drvdata(pdev);
+
+ charlcd_unregister(lcd);
++
++ kfree(lcd);
+ return 0;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/auxdisplay-ht16k33-fix-potential-user-after-free-on-.patch b/patches.drivers/auxdisplay-ht16k33-fix-potential-user-after-free-on-.patch
new file mode 100644
index 0000000000..df19644ad5
--- /dev/null
+++ b/patches.drivers/auxdisplay-ht16k33-fix-potential-user-after-free-on-.patch
@@ -0,0 +1,46 @@
+From 69ef9bc54715fb1cb7786ada15774e469e822209 Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
+Date: Sat, 9 Feb 2019 00:38:45 +0100
+Subject: [PATCH] auxdisplay: ht16k33: fix potential user-after-free on module unload
+Git-commit: 69ef9bc54715fb1cb7786ada15774e469e822209
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+On module unload/remove, we need to ensure that work does not run
+after we have freed resources. Concretely, cancel_delayed_work()
+may return while the callback function is still running.
+
+From kernel/workqueue.c:
+
+ The work callback function may still be running on return,
+ unless it returns true and the work doesn't re-arm itself.
+ Explicitly flush or use cancel_delayed_work_sync() to wait on it.
+
+Link: https://lore.kernel.org/lkml/20190204220952.30761-1-TheSven73@googlemail.com/
+Reported-by: Sven Van Asbroeck <thesven73@gmail.com>
+Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Reviewed-by: Sven Van Asbroeck <TheSven73@gmail.com>
+Acked-by: Robin van der Gracht <robin@protonic.nl>
+Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/auxdisplay/ht16k33.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
+index a43276c76fc6..21393ec3b9a4 100644
+--- a/drivers/auxdisplay/ht16k33.c
++++ b/drivers/auxdisplay/ht16k33.c
+@@ -509,7 +509,7 @@ static int ht16k33_remove(struct i2c_client *client)
+ struct ht16k33_priv *priv = i2c_get_clientdata(client);
+ struct ht16k33_fbdev *fbdev = &priv->fbdev;
+
+- cancel_delayed_work(&fbdev->work);
++ cancel_delayed_work_sync(&fbdev->work);
+ unregister_framebuffer(fbdev->info);
+ framebuffer_release(fbdev->info);
+ free_page((unsigned long) fbdev->buffer);
+--
+2.16.4
+
diff --git a/patches.drivers/clk-clk-twl6040-Fix-imprecise-external-abort-for-pdm.patch b/patches.drivers/clk-clk-twl6040-Fix-imprecise-external-abort-for-pdm.patch
new file mode 100644
index 0000000000..e1742d11c9
--- /dev/null
+++ b/patches.drivers/clk-clk-twl6040-Fix-imprecise-external-abort-for-pdm.patch
@@ -0,0 +1,121 @@
+From 5ae51d67aec95f6f9386aa8dd5db424964895575 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 11 Feb 2019 14:59:07 -0800
+Subject: [PATCH] clk: clk-twl6040: Fix imprecise external abort for pdmclk
+Git-commit: 5ae51d67aec95f6f9386aa8dd5db424964895575
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+I noticed that modprobe clk-twl6040 can fail after a cold boot with:
+abe_cm:clk:0010:0: failed to enable
+...
+Unhandled fault: imprecise external abort (0x1406) at 0xbe896b20
+
+Warning: CPU: 1 PID: 29 at drivers/clk/clk.c:828 clk_core_disable_lock+0x18/0x24
+...
+(clk_core_disable_lock) from [<c0123534>] (_disable_clocks+0x18/0x90)
+(_disable_clocks) from [<c0124040>] (_idle+0x17c/0x244)
+(_idle) from [<c0125ad4>] (omap_hwmod_idle+0x24/0x44)
+(omap_hwmod_idle) from [<c053a038>] (sysc_runtime_suspend+0x48/0x108)
+(sysc_runtime_suspend) from [<c06084c4>] (__rpm_callback+0x144/0x1d8)
+(__rpm_callback) from [<c0608578>] (rpm_callback+0x20/0x80)
+(rpm_callback) from [<c0607034>] (rpm_suspend+0x120/0x694)
+(rpm_suspend) from [<c0607a78>] (__pm_runtime_idle+0x60/0x84)
+(__pm_runtime_idle) from [<c053aaf0>] (sysc_probe+0x874/0xf2c)
+(sysc_probe) from [<c05fecd4>] (platform_drv_probe+0x48/0x98)
+
+After searching around for a similar issue, I came across an earlier fix
+that never got merged upstream in the Android tree for glass-omap-xrr02.
+There is patch "MFD: twl6040-codec: Implement PDMCLK cold temp errata"
+by Misael Lopez Cruz <misael.lopez@ti.com>.
+
+Based on my observations, this fix is also needed when cold booting
+devices, and not just for deeper idle modes. Since we now have a clock
+driver for pdmclk, let's fix the issue in twl6040_pdmclk_prepare().
+
+Cc: Misael Lopez Cruz <misael.lopez@ti.com>
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/clk-twl6040.c | 53 +++++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 51 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk-twl6040.c b/drivers/clk/clk-twl6040.c
+index ea846f77750b..0cad5748bf0e 100644
+--- a/drivers/clk/clk-twl6040.c
++++ b/drivers/clk/clk-twl6040.c
+@@ -41,6 +41,43 @@ static int twl6040_pdmclk_is_prepared(struct clk_hw *hw)
+ return pdmclk->enabled;
+ }
+
++static int twl6040_pdmclk_reset_one_clock(struct twl6040_pdmclk *pdmclk,
++ unsigned int reg)
++{
++ const u8 reset_mask = TWL6040_HPLLRST; /* Same for HPPLL and LPPLL */
++ int ret;
++
++ ret = twl6040_set_bits(pdmclk->twl6040, reg, reset_mask);
++ if (ret < 0)
++ return ret;
++
++ ret = twl6040_clear_bits(pdmclk->twl6040, reg, reset_mask);
++ if (ret < 0)
++ return ret;
++
++ return 0;
++}
++
++/*
++ * TWL6040A2 Phoenix Audio IC erratum #6: "PDM Clock Generation Issue At
++ * Cold Temperature". This affects cold boot and deeper idle states it
++ * seems. The workaround consists of resetting HPPLL and LPPLL.
++ */
++static int twl6040_pdmclk_quirk_reset_clocks(struct twl6040_pdmclk *pdmclk)
++{
++ int ret;
++
++ ret = twl6040_pdmclk_reset_one_clock(pdmclk, TWL6040_REG_HPPLLCTL);
++ if (ret)
++ return ret;
++
++ ret = twl6040_pdmclk_reset_one_clock(pdmclk, TWL6040_REG_LPPLLCTL);
++ if (ret)
++ return ret;
++
++ return 0;
++}
++
+ static int twl6040_pdmclk_prepare(struct clk_hw *hw)
+ {
+ struct twl6040_pdmclk *pdmclk = container_of(hw, struct twl6040_pdmclk,
+@@ -48,8 +85,20 @@ static int twl6040_pdmclk_prepare(struct clk_hw *hw)
+ int ret;
+
+ ret = twl6040_power(pdmclk->twl6040, 1);
+- if (!ret)
+- pdmclk->enabled = 1;
++ if (ret)
++ return ret;
++
++ ret = twl6040_pdmclk_quirk_reset_clocks(pdmclk);
++ if (ret)
++ goto out_err;
++
++ pdmclk->enabled = 1;
++
++ return 0;
++
++out_err:
++ dev_err(pdmclk->dev, "%s: error %i\n", __func__, ret);
++ twl6040_power(pdmclk->twl6040, 0);
+
+ return ret;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/clk-ingenic-Fix-doc-of-ingenic_cgu_div_info.patch b/patches.drivers/clk-ingenic-Fix-doc-of-ingenic_cgu_div_info.patch
new file mode 100644
index 0000000000..11348f89ee
--- /dev/null
+++ b/patches.drivers/clk-ingenic-Fix-doc-of-ingenic_cgu_div_info.patch
@@ -0,0 +1,38 @@
+From 7ca4c922aad2e3c46767a12f80d01c6b25337b59 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sun, 27 Jan 2019 23:09:21 -0300
+Subject: [PATCH] clk: ingenic: Fix doc of ingenic_cgu_div_info
+Git-commit: 7ca4c922aad2e3c46767a12f80d01c6b25337b59
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+The 'div' field does not represent a number of bits used to divide
+(understand: right-shift) the divider, but a number itself used to
+divide the divider.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Maarten ter Huurne <maarten@treewalker.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/ingenic/cgu.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/ingenic/cgu.h b/drivers/clk/ingenic/cgu.h
+index 502bcbb61b04..e12716d8ce3c 100644
+--- a/drivers/clk/ingenic/cgu.h
++++ b/drivers/clk/ingenic/cgu.h
+@@ -80,7 +80,7 @@ struct ingenic_cgu_mux_info {
+ * @reg: offset of the divider control register within the CGU
+ * @shift: number of bits to left shift the divide value by (ie. the index of
+ * the lowest bit of the divide value within its control register)
+- * @div: number of bits to divide the divider value by (i.e. if the
++ * @div: number to divide the divider value by (i.e. if the
+ * effective divider value is the value written to the register
+ * multiplied by some constant)
+ * @bits: the size of the divide value in bits
+--
+2.16.4
+
diff --git a/patches.drivers/clk-ingenic-Fix-round_rate-misbehaving-with-non-inte.patch b/patches.drivers/clk-ingenic-Fix-round_rate-misbehaving-with-non-inte.patch
new file mode 100644
index 0000000000..8024b8dadd
--- /dev/null
+++ b/patches.drivers/clk-ingenic-Fix-round_rate-misbehaving-with-non-inte.patch
@@ -0,0 +1,67 @@
+From bc5d922c93491878c44c9216e9d227c7eeb81d7f Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sun, 27 Jan 2019 23:09:20 -0300
+Subject: [PATCH] clk: ingenic: Fix round_rate misbehaving with non-integer dividers
+Git-commit: bc5d922c93491878c44c9216e9d227c7eeb81d7f
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Take a parent rate of 180 MHz, and a requested rate of 4.285715 MHz.
+This results in a theorical divider of 41.999993 which is then rounded
+up to 42. The .round_rate function would then return (180 MHz / 42) as
+the clock, rounded down, so 4.285714 MHz.
+
+Calling clk_set_rate on 4.285714 MHz would round the rate again, and
+give a theorical divider of 42,0000028, now rounded up to 43, and the
+rate returned would be (180 MHz / 43) which is 4.186046 MHz, aka. not
+what we requested.
+
+Fix this by rounding up the divisions.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Tested-by: Maarten ter Huurne <maarten@treewalker.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/ingenic/cgu.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/ingenic/cgu.c b/drivers/clk/ingenic/cgu.c
+index 5ef7d9ba2195..b40160eb3372 100644
+--- a/drivers/clk/ingenic/cgu.c
++++ b/drivers/clk/ingenic/cgu.c
+@@ -426,16 +426,16 @@ ingenic_clk_round_rate(struct clk_hw *hw, unsigned long req_rate,
+ struct ingenic_clk *ingenic_clk = to_ingenic_clk(hw);
+ struct ingenic_cgu *cgu = ingenic_clk->cgu;
+ const struct ingenic_cgu_clk_info *clk_info;
+- long rate = *parent_rate;
++ unsigned int div = 1;
+
+ clk_info = &cgu->clock_info[ingenic_clk->idx];
+
+ if (clk_info->type & CGU_CLK_DIV)
+- rate /= ingenic_clk_calc_div(clk_info, *parent_rate, req_rate);
++ div = ingenic_clk_calc_div(clk_info, *parent_rate, req_rate);
+ else if (clk_info->type & CGU_CLK_FIXDIV)
+- rate /= clk_info->fixdiv.div;
++ div = clk_info->fixdiv.div;
+
+- return rate;
++ return DIV_ROUND_UP(*parent_rate, div);
+ }
+
+ static int
+@@ -455,7 +455,7 @@ ingenic_clk_set_rate(struct clk_hw *hw, unsigned long req_rate,
+
+ if (clk_info->type & CGU_CLK_DIV) {
+ div = ingenic_clk_calc_div(clk_info, parent_rate, req_rate);
+- rate = parent_rate / div;
++ rate = DIV_ROUND_UP(parent_rate, div);
+
+ if (rate != req_rate)
+ return -EINVAL;
+--
+2.16.4
+
diff --git a/patches.drivers/clk-sunxi-ng-v3s-Fix-TCON-reset-de-assert-bit.patch b/patches.drivers/clk-sunxi-ng-v3s-Fix-TCON-reset-de-assert-bit.patch
new file mode 100644
index 0000000000..6dcfd49309
--- /dev/null
+++ b/patches.drivers/clk-sunxi-ng-v3s-Fix-TCON-reset-de-assert-bit.patch
@@ -0,0 +1,37 @@
+From 5c59801f7018acba11b12de59017a3fcdcf7421d Mon Sep 17 00:00:00 2001
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Date: Tue, 22 Jan 2019 09:16:19 +0100
+Subject: [PATCH] clk: sunxi-ng: v3s: Fix TCON reset de-assert bit
+Git-commit: 5c59801f7018acba11b12de59017a3fcdcf7421d
+Patch-mainline: v5.0-rc8
+References: bsc#1051510
+
+According to the datasheet and the reference code from Allwinner, the
+bit used to de-assert the TCON reset is bit 4, not bit 3.
+
+Fix it in the V3s CCU driver.
+
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+index 621b1cd996db..ac12f261f8ca 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+@@ -542,7 +542,7 @@ static struct ccu_reset_map sun8i_v3s_ccu_resets[] = {
+ [RST_BUS_OHCI0] = { 0x2c0, BIT(29) },
+
+ [RST_BUS_VE] = { 0x2c4, BIT(0) },
+- [RST_BUS_TCON0] = { 0x2c4, BIT(3) },
++ [RST_BUS_TCON0] = { 0x2c4, BIT(4) },
+ [RST_BUS_CSI] = { 0x2c4, BIT(8) },
+ [RST_BUS_DE] = { 0x2c4, BIT(12) },
+ [RST_BUS_DBG] = { 0x2c4, BIT(31) },
+--
+2.16.4
+
diff --git a/patches.drivers/clk-vc5-Abort-clock-configuration-without-upstream-c.patch b/patches.drivers/clk-vc5-Abort-clock-configuration-without-upstream-c.patch
new file mode 100644
index 0000000000..4a6333157b
--- /dev/null
+++ b/patches.drivers/clk-vc5-Abort-clock-configuration-without-upstream-c.patch
@@ -0,0 +1,52 @@
+From 2137a109a5e39c2bdccfffe65230ed3fadbaac0e Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marek.vasut@gmail.com>
+Date: Sat, 15 Dec 2018 01:55:19 +0100
+Subject: [PATCH] clk: vc5: Abort clock configuration without upstream clock
+Git-commit: 2137a109a5e39c2bdccfffe65230ed3fadbaac0e
+Patch-mainline: v5.0-rc4
+References: bsc#1051510
+
+In case the upstream clock are not set, which can happen in case the
+VC5 has no valid upstream clock, the $src variable is used uninited
+by regmap_update_bits(). Check for this condition and return -EINVAL
+in such case.
+
+Note that in case the VC5 has no valid upstream clock, the VC5 can
+not operate correctly. That is a hardware property of the VC5. The
+internal oscilator present in some VC5 models is also considered
+upstream clock.
+
+Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
+Cc: Alexey Firago <alexey_firago@mentor.com>
+Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: linux-renesas-soc@vger.kernel.org
+[sboyd@kernel.org: Added comment about probe preventing this from
+happening in the first place]
+
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/clk-versaclock5.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
+index 5b393e711e94..7d16ab0784ec 100644
+--- a/drivers/clk/clk-versaclock5.c
++++ b/drivers/clk/clk-versaclock5.c
+@@ -262,8 +262,10 @@ static int vc5_mux_set_parent(struct clk_hw *hw, u8 index)
+
+ if (vc5->clk_mux_ins == VC5_MUX_IN_XIN)
+ src = VC5_PRIM_SRC_SHDN_EN_XTAL;
+- if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
++ else if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
+ src = VC5_PRIM_SRC_SHDN_EN_CLKIN;
++ else /* Invalid; should have been caught by vc5_probe() */
++ return -EINVAL;
+ }
+
+ return regmap_update_bits(vc5->regmap, VC5_PRIM_SRC_SHDN, mask, src);
+--
+2.16.4
+
diff --git a/patches.drivers/clocksource-drivers-exynos_mct-Clear-timer-interrupt.patch b/patches.drivers/clocksource-drivers-exynos_mct-Clear-timer-interrupt.patch
new file mode 100644
index 0000000000..34466325c4
--- /dev/null
+++ b/patches.drivers/clocksource-drivers-exynos_mct-Clear-timer-interrupt.patch
@@ -0,0 +1,40 @@
+From d2f276c8d3c224d5b493c42b6cf006ae4e64fb1c Mon Sep 17 00:00:00 2001
+From: Stuart Menefy <stuart.menefy@mathembedded.com>
+Date: Sun, 10 Feb 2019 22:51:14 +0000
+Subject: [PATCH] clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
+Git-commit: d2f276c8d3c224d5b493c42b6cf006ae4e64fb1c
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+When shutting down the timer, ensure that after we have stopped the
+timer any pending interrupts are cleared. This fixes a problem when
+suspending, as interrupts are disabled before the timer is stopped,
+so the timer interrupt may still be asserted, preventing the system
+entering a low power state when the wfi is executed.
+
+Signed-off-by: Stuart Menefy <stuart.menefy@mathembedded.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Cc: <stable@vger.kernel.org> # v4.3+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clocksource/exynos_mct.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index 1e325f89d408..d55c30f6981d 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -411,6 +411,7 @@ static int set_state_shutdown(struct clock_event_device *evt)
+
+ mevt = container_of(evt, struct mct_clock_event_device, evt);
+ exynos4_mct_tick_stop(mevt);
++ exynos4_mct_tick_clear(mevt);
+ return 0;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/clocksource-drivers-exynos_mct-Move-one-shot-check-f.patch b/patches.drivers/clocksource-drivers-exynos_mct-Move-one-shot-check-f.patch
new file mode 100644
index 0000000000..3774e80a36
--- /dev/null
+++ b/patches.drivers/clocksource-drivers-exynos_mct-Move-one-shot-check-f.patch
@@ -0,0 +1,77 @@
+From a5719a40aef956ba704f2aa1c7b977224d60fa96 Mon Sep 17 00:00:00 2001
+From: Stuart Menefy <stuart.menefy@mathembedded.com>
+Date: Sun, 10 Feb 2019 22:51:13 +0000
+Subject: [PATCH] clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
+Git-commit: a5719a40aef956ba704f2aa1c7b977224d60fa96
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+When a timer tick occurs and the clock is in one-shot mode, the timer
+needs to be stopped to prevent it triggering subsequent interrupts.
+Currently this code is in exynos4_mct_tick_clear(), but as it is
+only needed when an ISR occurs move it into exynos4_mct_tick_isr(),
+leaving exynos4_mct_tick_clear() just doing what its name suggests it
+should.
+
+Signed-off-by: Stuart Menefy <stuart.menefy@mathembedded.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Cc: stable@vger.kernel.org # v4.3+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clocksource/exynos_mct.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index 7a244b681876..1e325f89d408 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -388,6 +388,13 @@ static void exynos4_mct_tick_start(unsigned long cycles,
+ exynos4_mct_write(tmp, mevt->base + MCT_L_TCON_OFFSET);
+ }
+
++static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt)
++{
++ /* Clear the MCT tick interrupt */
++ if (readl_relaxed(reg_base + mevt->base + MCT_L_INT_CSTAT_OFFSET) & 1)
++ exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET);
++}
++
+ static int exynos4_tick_set_next_event(unsigned long cycles,
+ struct clock_event_device *evt)
+ {
+@@ -420,8 +427,11 @@ static int set_state_periodic(struct clock_event_device *evt)
+ return 0;
+ }
+
+-static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt)
++static irqreturn_t exynos4_mct_tick_isr(int irq, void *dev_id)
+ {
++ struct mct_clock_event_device *mevt = dev_id;
++ struct clock_event_device *evt = &mevt->evt;
++
+ /*
+ * This is for supporting oneshot mode.
+ * Mct would generate interrupt periodically
+@@ -430,16 +440,6 @@ static void exynos4_mct_tick_clear(struct mct_clock_event_device *mevt)
+ if (!clockevent_state_periodic(&mevt->evt))
+ exynos4_mct_tick_stop(mevt);
+
+- /* Clear the MCT tick interrupt */
+- if (readl_relaxed(reg_base + mevt->base + MCT_L_INT_CSTAT_OFFSET) & 1)
+- exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET);
+-}
+-
+-static irqreturn_t exynos4_mct_tick_isr(int irq, void *dev_id)
+-{
+- struct mct_clock_event_device *mevt = dev_id;
+- struct clock_event_device *evt = &mevt->evt;
+-
+ exynos4_mct_tick_clear(mevt);
+
+ evt->event_handler(evt);
+--
+2.16.4
+
diff --git a/patches.drivers/cpcap-charger-generate-events-for-userspace.patch b/patches.drivers/cpcap-charger-generate-events-for-userspace.patch
new file mode 100644
index 0000000000..55570b15cd
--- /dev/null
+++ b/patches.drivers/cpcap-charger-generate-events-for-userspace.patch
@@ -0,0 +1,41 @@
+From fd10606f93a149a9f3d37574e5385b083b4a7b32 Mon Sep 17 00:00:00 2001
+From: Pavel Machek <pavel@ucw.cz>
+Date: Thu, 27 Dec 2018 20:52:21 +0100
+Subject: [PATCH] cpcap-charger: generate events for userspace
+Git-commit: fd10606f93a149a9f3d37574e5385b083b4a7b32
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+The driver doesn't generate uevents on charger connect/disconnect.
+This leads to UPower not detecting when AC is on or off... and that is
+bad.
+
+Reported by Arthur D. on github (
+https://github.com/maemo-leste/bugtracker/issues/206 ), thanks to
+Merlijn Wajer for suggesting a fix.
+
+Cc: stable@kernel.org
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/power/supply/cpcap-charger.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/power/supply/cpcap-charger.c b/drivers/power/supply/cpcap-charger.c
+index c843eaff8ad0..c3ed7b476676 100644
+--- a/drivers/power/supply/cpcap-charger.c
++++ b/drivers/power/supply/cpcap-charger.c
+@@ -458,6 +458,7 @@ static void cpcap_usb_detect(struct work_struct *work)
+ goto out_err;
+ }
+
++ power_supply_changed(ddata->usb);
+ return;
+
+ out_err:
+--
+2.16.4
+
diff --git a/patches.drivers/cpufreq-pxa2xx-remove-incorrect-__init-annotation.patch b/patches.drivers/cpufreq-pxa2xx-remove-incorrect-__init-annotation.patch
new file mode 100644
index 0000000000..477e26a937
--- /dev/null
+++ b/patches.drivers/cpufreq-pxa2xx-remove-incorrect-__init-annotation.patch
@@ -0,0 +1,57 @@
+From 9505b98ccddc454008ca7efff90044e3e857c827 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 7 Mar 2019 11:22:41 +0100
+Subject: [PATCH] cpufreq: pxa2xx: remove incorrect __init annotation
+Git-commit: 9505b98ccddc454008ca7efff90044e3e857c827
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+pxa_cpufreq_init_voltages() is marked __init but usually inlined into
+the non-__init pxa_cpufreq_init() function. When building with clang,
+it can stay as a standalone function in a discarded section, and produce
+this warning:
+
+Warning: vmlinux.o(.text+0x616a00): Section mismatch in reference from the function pxa_cpufreq_init() to the function .init.text:pxa_cpufreq_init_voltages()
+The function pxa_cpufreq_init() references
+the function __init pxa_cpufreq_init_voltages().
+This is often because pxa_cpufreq_init lacks a __init
+annotation or the annotation of pxa_cpufreq_init_voltages is wrong.
+
+Fixes: 50e77fcd790e ("ARM: pxa: remove __init from cpufreq_driver->init()")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cpufreq/pxa2xx-cpufreq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/pxa2xx-cpufreq.c b/drivers/cpufreq/pxa2xx-cpufreq.c
+index 46254e583982..74e0e0c20c46 100644
+--- a/drivers/cpufreq/pxa2xx-cpufreq.c
++++ b/drivers/cpufreq/pxa2xx-cpufreq.c
+@@ -143,7 +143,7 @@ static int pxa_cpufreq_change_voltage(const struct pxa_freqs *pxa_freq)
+ return ret;
+ }
+
+-static void __init pxa_cpufreq_init_voltages(void)
++static void pxa_cpufreq_init_voltages(void)
+ {
+ vcc_core = regulator_get(NULL, "vcc_core");
+ if (IS_ERR(vcc_core)) {
+@@ -159,7 +159,7 @@ static int pxa_cpufreq_change_voltage(const struct pxa_freqs *pxa_freq)
+ return 0;
+ }
+
+-static void __init pxa_cpufreq_init_voltages(void) { }
++static void pxa_cpufreq_init_voltages(void) { }
+ #endif
+
+ static void find_freq_tables(struct cpufreq_frequency_table **freq_table,
+--
+2.16.4
+
diff --git a/patches.drivers/cpufreq-tegra124-add-missing-of_node_put.patch b/patches.drivers/cpufreq-tegra124-add-missing-of_node_put.patch
new file mode 100644
index 0000000000..dac23beae3
--- /dev/null
+++ b/patches.drivers/cpufreq-tegra124-add-missing-of_node_put.patch
@@ -0,0 +1,39 @@
+From 446fae2bb5395f3028d8e3aae1508737e5a72ea1 Mon Sep 17 00:00:00 2001
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Mon, 4 Feb 2019 02:48:54 -0500
+Subject: [PATCH] cpufreq: tegra124: add missing of_node_put()
+Git-commit: 446fae2bb5395f3028d8e3aae1508737e5a72ea1
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+of_cpu_device_node_get() will increase the refcount of device_node,
+it is necessary to call of_node_put() at the end to release the
+refcount.
+
+Fixes: 9eb15dbbfa1a2 ("cpufreq: Add cpufreq driver for Tegra124")
+Cc: <stable@vger.kernel.org> # 4.4+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cpufreq/tegra124-cpufreq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/tegra124-cpufreq.c b/drivers/cpufreq/tegra124-cpufreq.c
+index 43530254201a..4bb154f6c54c 100644
+--- a/drivers/cpufreq/tegra124-cpufreq.c
++++ b/drivers/cpufreq/tegra124-cpufreq.c
+@@ -134,6 +134,8 @@ static int tegra124_cpufreq_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, priv);
+
++ of_node_put(np);
++
+ return 0;
+
+ out_switch_to_pllx:
+--
+2.16.4
+
diff --git a/patches.drivers/i2c-tegra-fix-maximum-transfer-size.patch b/patches.drivers/i2c-tegra-fix-maximum-transfer-size.patch
new file mode 100644
index 0000000000..c93bf50311
--- /dev/null
+++ b/patches.drivers/i2c-tegra-fix-maximum-transfer-size.patch
@@ -0,0 +1,36 @@
+From f4e3f4ae1d9c9330de355f432b69952e8cef650c Mon Sep 17 00:00:00 2001
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+Date: Tue, 12 Feb 2019 11:06:44 -0800
+Subject: [PATCH] i2c: tegra: fix maximum transfer size
+Git-commit: f4e3f4ae1d9c9330de355f432b69952e8cef650c
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Tegra186 and prior supports maximum 4K bytes per packet transfer
+including 12 bytes of packet header.
+
+This patch fixes max write length limit to account packet header
+size for transfers.
+
+Cc: stable@vger.kernel.org # 4.4+
+
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/i2c/busses/i2c-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -794,7 +794,7 @@ static const struct i2c_algorithm tegra_
+ /* payload size is only 12 bit */
+ static struct i2c_adapter_quirks tegra_i2c_quirks = {
+ .max_read_len = 4096,
+- .max_write_len = 4096,
++ .max_write_len = 4096 - 12,
+ };
+
+ static const struct tegra_i2c_hw_feature tegra20_i2c_hw = {
diff --git a/patches.drivers/iommu-amd-fix-null-dereference-bug-in-match_hid_uid b/patches.drivers/iommu-amd-fix-null-dereference-bug-in-match_hid_uid
new file mode 100644
index 0000000000..99d6e22fc8
--- /dev/null
+++ b/patches.drivers/iommu-amd-fix-null-dereference-bug-in-match_hid_uid
@@ -0,0 +1,39 @@
+From: Aaron Ma <aaron.ma@canonical.com>
+Date: Wed, 13 Mar 2019 21:53:24 +0800
+Subject: iommu/amd: Fix NULL dereference bug in match_hid_uid
+Git-commit: bb6bccba390c7d743c1e4427de4ef284c8cc6869
+Patch-mainline: v5.1-rc1
+References: bsc#1130336
+
+Add a non-NULL check to fix potential NULL pointer dereference
+Cleanup code to call function once.
+
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Fixes: 2bf9a0a12749b ('iommu/amd: Add iommu support for ACPI HID devices')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 6b0760dafb3e..b319e51c379b 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -140,10 +140,14 @@ static struct lock_class_key reserved_rbtree_key;
+ static inline int match_hid_uid(struct device *dev,
+ struct acpihid_map_entry *entry)
+ {
++ struct acpi_device *adev = ACPI_COMPANION(dev);
+ const char *hid, *uid;
+
+- hid = acpi_device_hid(ACPI_COMPANION(dev));
+- uid = acpi_device_uid(ACPI_COMPANION(dev));
++ if (!adev)
++ return -ENODEV;
++
++ hid = acpi_device_hid(adev);
++ uid = acpi_device_uid(adev);
+
+ if (!hid || !(*hid))
+ return -ENODEV;
+
diff --git a/patches.drivers/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size b/patches.drivers/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size
new file mode 100644
index 0000000000..6c95ab9804
--- /dev/null
+++ b/patches.drivers/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size
@@ -0,0 +1,77 @@
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 13 Mar 2019 10:03:17 +0100
+Subject: iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE
+Git-commit: 4e50ce03976fbc8ae995a000c4b10c737467beaa
+Patch-mainline: v5.1-rc2
+References: bsc#1130337
+
+Take into account that sg->offset can be bigger than PAGE_SIZE when
+setting segment sg->dma_address. Otherwise sg->dma_address will point
+at diffrent page, what makes DMA not possible with erros like this:
+
+xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa70c0 flags=0x0020]
+xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7040 flags=0x0020]
+xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7080 flags=0x0020]
+xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7100 flags=0x0020]
+xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7000 flags=0x0020]
+
+Additinally with wrong sg->dma_address unmap_sg will free wrong pages,
+what what can cause crashes like this:
+
+Feb 28 19:27:45 kernel: BUG: Bad page state in process cinnamon pfn:39e8b1
+Feb 28 19:27:45 kernel: Disabling lock debugging due to kernel taint
+Feb 28 19:27:45 kernel: flags: 0x2ffff0000000000()
+Feb 28 19:27:45 kernel: raw: 02ffff0000000000 0000000000000000 ffffffff00000301 0000000000000000
+Feb 28 19:27:45 kernel: raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
+Feb 28 19:27:45 kernel: page dumped because: nonzero _refcount
+Feb 28 19:27:45 kernel: Modules linked in: ccm fuse arc4 nct6775 hwmon_vid amdgpu nls_iso8859_1 nls_cp437 edac_mce_amd vfat fat kvm_amd ccp rng_core kvm mt76x0u mt76x0_common mt76x02_usb irqbypass mt76_usb mt76x02_lib mt76 crct10dif_pclmul crc32_pclmul chash mac80211 amd_iommu_v2 ghash_clmulni_intel gpu_sched i2c_algo_bit ttm wmi_bmof snd_hda_codec_realtek snd_hda_codec_generic drm_kms_helper snd_hda_codec_hdmi snd_hda_intel drm snd_hda_codec aesni_intel snd_hda_core snd_hwdep aes_x86_64 crypto_simd snd_pcm cfg80211 cryptd mousedev snd_timer glue_helper pcspkr r8169 input_leds realtek agpgart libphy rfkill snd syscopyarea sysfillrect sysimgblt fb_sys_fops soundcore sp5100_tco k10temp i2c_piix4 wmi evdev gpio_amdpt pinctrl_amd mac_hid pcc_cpufreq acpi_cpufreq sg ip_tables x_tables ext4(E) crc32c_generic(E) crc16(E) mbcache(E) jbd2(E) fscrypto(E) sd_mod(E) hid_generic(E) usbhid(E) hid(E) dm_mod(E) serio_raw(E) atkbd(E) libps2(E) crc32c_intel(E) ahci(E) libahci(E) libata(E) xhci_pci(E) xhci_hcd(E)
+Feb 28 19:27:45 kernel: scsi_mod(E) i8042(E) serio(E) bcache(E) crc64(E)
+Feb 28 19:27:45 kernel: CPU: 2 PID: 896 Comm: cinnamon Tainted: G B W E 4.20.12-arch1-1-custom #1
+Feb 28 19:27:45 kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./B450M Pro4, BIOS P1.20 06/26/2018
+Feb 28 19:27:45 kernel: Call Trace:
+Feb 28 19:27:45 kernel: dump_stack+0x5c/0x80
+Feb 28 19:27:45 kernel: bad_page.cold.29+0x7f/0xb2
+Feb 28 19:27:45 kernel: __free_pages_ok+0x2c0/0x2d0
+Feb 28 19:27:45 kernel: skb_release_data+0x96/0x180
+Feb 28 19:27:45 kernel: __kfree_skb+0xe/0x20
+Feb 28 19:27:45 kernel: tcp_recvmsg+0x894/0xc60
+Feb 28 19:27:45 kernel: ? reuse_swap_page+0x120/0x340
+Feb 28 19:27:45 kernel: ? ptep_set_access_flags+0x23/0x30
+Feb 28 19:27:45 kernel: inet_recvmsg+0x5b/0x100
+Feb 28 19:27:45 kernel: __sys_recvfrom+0xc3/0x180
+Feb 28 19:27:45 kernel: ? handle_mm_fault+0x10a/0x250
+Feb 28 19:27:45 kernel: ? syscall_trace_enter+0x1d3/0x2d0
+Feb 28 19:27:45 kernel: ? __audit_syscall_exit+0x22a/0x290
+Feb 28 19:27:45 kernel: __x64_sys_recvfrom+0x24/0x30
+Feb 28 19:27:45 kernel: do_syscall_64+0x5b/0x170
+Feb 28 19:27:45 kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Cc: stable@vger.kernel.org
+Reported-and-tested-by: Jan Viktorin <jan.viktorin@gmail.com>
+Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Fixes: 80187fd39dcb ('iommu/amd: Optimize map_sg and unmap_sg')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index b319e51c379b..21cb088d6687 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2608,7 +2608,12 @@ static int map_sg(struct device *dev, struct scatterlist *sglist,
+
+ /* Everything is mapped - write the right values into s->dma_address */
+ for_each_sg(sglist, s, nelems, i) {
+- s->dma_address += address + s->offset;
++ /*
++ * Add in the remaining piece of the scatter-gather offset that
++ * was masked out when we were determining the physical address
++ * via (sg_phys(s) & PAGE_MASK) earlier.
++ */
++ s->dma_address += address + (s->offset & ~PAGE_MASK);
+ s->dma_length = s->length;
+ }
+
+
diff --git a/patches.drivers/iommu-vt-d-check-capability-before-disabling-protected-memory b/patches.drivers/iommu-vt-d-check-capability-before-disabling-protected-memory
new file mode 100644
index 0000000000..36348de2e0
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-check-capability-before-disabling-protected-memory
@@ -0,0 +1,37 @@
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Wed, 20 Mar 2019 09:58:33 +0800
+Subject: iommu/vt-d: Check capability before disabling protected memory
+Git-commit: 5bb71fc790a88d063507dc5d445ab8b14e845591
+Patch-mainline: v5.1-rc2
+References: bsc#1130338
+
+The spec states in 10.4.16 that the Protected Memory Enable
+Register should be treated as read-only for implementations
+not supporting protected memory regions (PLMR and PHMR fields
+reported as Clear in the Capability register).
+
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Cc: mark gross <mgross@intel.com>
+Suggested-by: Ashok Raj <ashok.raj@intel.com>
+Fixes: f8bab73515ca5 ("intel-iommu: PMEN support")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 87274b54febd..f002d47d2f27 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1538,6 +1538,9 @@ static void iommu_disable_protect_mem_regions(struct intel_iommu *iommu)
+ u32 pmen;
+ unsigned long flags;
+
++ if (!cap_plmr(iommu->cap) && !cap_phmr(iommu->cap))
++ return;
++
+ raw_spin_lock_irqsave(&iommu->register_lock, flags);
+ pmen = readl(iommu->reg + DMAR_PMEN_REG);
+ pmen &= ~DMA_PMEN_EPM;
+
diff --git a/patches.drivers/mmc-pxamci-fix-enum-type-confusion.patch b/patches.drivers/mmc-pxamci-fix-enum-type-confusion.patch
new file mode 100644
index 0000000000..ac44e06010
--- /dev/null
+++ b/patches.drivers/mmc-pxamci-fix-enum-type-confusion.patch
@@ -0,0 +1,51 @@
+From e60a582bcde01158a64ff948fb799f21f5d31a11 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 7 Mar 2019 11:09:19 +0100
+Subject: [PATCH] mmc: pxamci: fix enum type confusion
+Git-commit: e60a582bcde01158a64ff948fb799f21f5d31a11
+Patch-mainline: v5.1-rc2
+References: bsc#1051510
+
+clang points out several instances of mismatched types in this drivers,
+all coming from a single declaration:
+
+drivers/mmc/host/pxamci.c:193:15: error: implicit conversion from enumeration type 'enum dma_transfer_direction' to
+ different enumeration type 'enum dma_data_direction' [-Werror,-Wenum-conversion]
+ direction = DMA_DEV_TO_MEM;
+ ~ ^~~~~~~~~~~~~~
+drivers/mmc/host/pxamci.c:212:62: error: implicit conversion from enumeration type 'enum dma_data_direction' to
+ different enumeration type 'enum dma_transfer_direction' [-Werror,-Wenum-conversion]
+ tx = dmaengine_prep_slave_sg(chan, data->sg, host->dma_len, direction,
+
+The behavior is correct, so this must be a simply typo from
+dma_data_direction and dma_transfer_direction being similarly named
+types with a similar purpose.
+
+Fixes: 6464b7140951 ("mmc: pxamci: switch over to dmaengine use")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/pxamci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
+index c907bf502a12..c1d3f0e38921 100644
+--- a/drivers/mmc/host/pxamci.c
++++ b/drivers/mmc/host/pxamci.c
+@@ -162,7 +162,7 @@ static void pxamci_dma_irq(void *param);
+ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
+ {
+ struct dma_async_tx_descriptor *tx;
+- enum dma_data_direction direction;
++ enum dma_transfer_direction direction;
+ struct dma_slave_config config;
+ struct dma_chan *chan;
+ unsigned int nob = data->blocks;
+--
+2.16.4
+
diff --git a/patches.drivers/regulator-max77620-Initialize-values-for-DT-properti.patch b/patches.drivers/regulator-max77620-Initialize-values-for-DT-properti.patch
new file mode 100644
index 0000000000..993cdcb48b
--- /dev/null
+++ b/patches.drivers/regulator-max77620-Initialize-values-for-DT-properti.patch
@@ -0,0 +1,54 @@
+From 0ab66b3c326ef8f77dae9f528118966365757c0c Mon Sep 17 00:00:00 2001
+From: Mark Zhang <markz@nvidia.com>
+Date: Thu, 10 Jan 2019 12:11:16 +0800
+Subject: [PATCH] regulator: max77620: Initialize values for DT properties
+Git-commit: 0ab66b3c326ef8f77dae9f528118966365757c0c
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+If regulator DT node doesn't exist, its of_parse_cb callback
+function isn't called. Then all values for DT properties are
+filled with zero. This leads to wrong register update for
+FPS and POK settings.
+
+Signed-off-by: Jinyoung Park <jinyoungp@nvidia.com>
+Signed-off-by: Mark Zhang <markz@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/regulator/max77620-regulator.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/max77620-regulator.c b/drivers/regulator/max77620-regulator.c
+index b94e3a721721..cd93cf53e23c 100644
+--- a/drivers/regulator/max77620-regulator.c
++++ b/drivers/regulator/max77620-regulator.c
+@@ -1,7 +1,7 @@
+ /*
+ * Maxim MAX77620 Regulator driver
+ *
+- * Copyright (c) 2016, NVIDIA CORPORATION. All rights reserved.
++ * Copyright (c) 2016-2018, NVIDIA CORPORATION. All rights reserved.
+ *
+ * Author: Mallikarjun Kasoju <mkasoju@nvidia.com>
+ * Laxman Dewangan <ldewangan@nvidia.com>
+@@ -803,6 +803,14 @@ static int max77620_regulator_probe(struct platform_device *pdev)
+ rdesc = &rinfo[id].desc;
+ pmic->rinfo[id] = &max77620_regs_info[id];
+ pmic->enable_power_mode[id] = MAX77620_POWER_MODE_NORMAL;
++ pmic->reg_pdata[id].active_fps_src = -1;
++ pmic->reg_pdata[id].active_fps_pd_slot = -1;
++ pmic->reg_pdata[id].active_fps_pu_slot = -1;
++ pmic->reg_pdata[id].suspend_fps_src = -1;
++ pmic->reg_pdata[id].suspend_fps_pd_slot = -1;
++ pmic->reg_pdata[id].suspend_fps_pu_slot = -1;
++ pmic->reg_pdata[id].power_ok = -1;
++ pmic->reg_pdata[id].ramp_rate_setting = -1;
+
+ ret = max77620_read_slew_rate(pmic, id);
+ if (ret < 0)
+--
+2.16.4
+
diff --git a/patches.drivers/regulator-s2mpa01-Fix-step-values-for-some-LDOs.patch b/patches.drivers/regulator-s2mpa01-Fix-step-values-for-some-LDOs.patch
new file mode 100644
index 0000000000..f6df9ee890
--- /dev/null
+++ b/patches.drivers/regulator-s2mpa01-Fix-step-values-for-some-LDOs.patch
@@ -0,0 +1,60 @@
+From 28c4f730d2a44f2591cb104091da29a38dac49fe Mon Sep 17 00:00:00 2001
+From: Stuart Menefy <stuart.menefy@mathembedded.com>
+Date: Tue, 12 Feb 2019 21:51:18 +0000
+Subject: [PATCH] regulator: s2mpa01: Fix step values for some LDOs
+Git-commit: 28c4f730d2a44f2591cb104091da29a38dac49fe
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+The step values for some of the LDOs appears to be incorrect, resulting
+in incorrect voltages (or at least, ones which are different from the
+Samsung 3.4 vendor kernel).
+
+Signed-off-by: Stuart Menefy <stuart.menefy@mathembedded.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/regulator/s2mpa01.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/regulator/s2mpa01.c b/drivers/regulator/s2mpa01.c
+index 095d25f3d2ea..58a1fe583a6c 100644
+--- a/drivers/regulator/s2mpa01.c
++++ b/drivers/regulator/s2mpa01.c
+@@ -298,13 +298,13 @@ static const struct regulator_desc regulators[] = {
+ regulator_desc_ldo(2, STEP_50_MV),
+ regulator_desc_ldo(3, STEP_50_MV),
+ regulator_desc_ldo(4, STEP_50_MV),
+- regulator_desc_ldo(5, STEP_50_MV),
++ regulator_desc_ldo(5, STEP_25_MV),
+ regulator_desc_ldo(6, STEP_25_MV),
+ regulator_desc_ldo(7, STEP_50_MV),
+ regulator_desc_ldo(8, STEP_50_MV),
+ regulator_desc_ldo(9, STEP_50_MV),
+ regulator_desc_ldo(10, STEP_50_MV),
+- regulator_desc_ldo(11, STEP_25_MV),
++ regulator_desc_ldo(11, STEP_50_MV),
+ regulator_desc_ldo(12, STEP_50_MV),
+ regulator_desc_ldo(13, STEP_50_MV),
+ regulator_desc_ldo(14, STEP_50_MV),
+@@ -315,11 +315,11 @@ static const struct regulator_desc regulators[] = {
+ regulator_desc_ldo(19, STEP_50_MV),
+ regulator_desc_ldo(20, STEP_50_MV),
+ regulator_desc_ldo(21, STEP_50_MV),
+- regulator_desc_ldo(22, STEP_25_MV),
+- regulator_desc_ldo(23, STEP_25_MV),
++ regulator_desc_ldo(22, STEP_50_MV),
++ regulator_desc_ldo(23, STEP_50_MV),
+ regulator_desc_ldo(24, STEP_50_MV),
+ regulator_desc_ldo(25, STEP_50_MV),
+- regulator_desc_ldo(26, STEP_50_MV),
++ regulator_desc_ldo(26, STEP_25_MV),
+ regulator_desc_buck1_4(1),
+ regulator_desc_buck1_4(2),
+ regulator_desc_buck1_4(3),
+--
+2.16.4
+
diff --git a/patches.drivers/rtc-88pm80x-fix-unintended-sign-extension.patch b/patches.drivers/rtc-88pm80x-fix-unintended-sign-extension.patch
new file mode 100644
index 0000000000..f7f273f941
--- /dev/null
+++ b/patches.drivers/rtc-88pm80x-fix-unintended-sign-extension.patch
@@ -0,0 +1,93 @@
+From fb0b322537a831b5b0cb948c56f8f958ce493d3a Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 6 Feb 2019 10:08:11 +0000
+Subject: [PATCH] rtc: 88pm80x: fix unintended sign extension
+Git-commit: fb0b322537a831b5b0cb948c56f8f958ce493d3a
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#714646-714649 ("Unintended sign extension")
+
+Fixes: 2985c29c1964 ("rtc: Add rtc support to 88PM80X PMIC")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/rtc/rtc-88pm80x.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c
+index cab293cb2bf0..1fc48ebd3cd0 100644
+--- a/drivers/rtc/rtc-88pm80x.c
++++ b/drivers/rtc/rtc-88pm80x.c
+@@ -114,12 +114,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ unsigned char buf[4];
+ unsigned long ticks, base, data;
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -137,7 +139,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ base = ticks - data;
+ dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -158,11 +161,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ int ret;
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -185,12 +190,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0);
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+--
+2.16.4
+
diff --git a/patches.drivers/rtc-88pm860x-fix-unintended-sign-extension.patch b/patches.drivers/rtc-88pm860x-fix-unintended-sign-extension.patch
new file mode 100644
index 0000000000..09735b2918
--- /dev/null
+++ b/patches.drivers/rtc-88pm860x-fix-unintended-sign-extension.patch
@@ -0,0 +1,90 @@
+From dc9e47160626cdb58d5c39a4f43dcfdb27a5c004 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 6 Feb 2019 09:50:53 +0000
+Subject: [PATCH] rtc: 88pm860x: fix unintended sign extension
+Git-commit: dc9e47160626cdb58d5c39a4f43dcfdb27a5c004
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#144925-144928 ("Unintended sign extension")
+
+Fixes: 008b30408c40 ("mfd: Add rtc support to 88pm860x")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/rtc/rtc-88pm860x.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
+index 01ffc0ef8033..d25282b4a7dd 100644
+--- a/drivers/rtc/rtc-88pm860x.c
++++ b/drivers/rtc/rtc-88pm860x.c
+@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ base = ticks - data;
+ dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+--
+2.16.4
+
diff --git a/patches.drivers/rtc-cmos-ignore-bogus-century-byte.patch b/patches.drivers/rtc-cmos-ignore-bogus-century-byte.patch
new file mode 100644
index 0000000000..1a0c524e47
--- /dev/null
+++ b/patches.drivers/rtc-cmos-ignore-bogus-century-byte.patch
@@ -0,0 +1,45 @@
+From 2a4daadd4d3e507138f8937926e6a4df49c6bfdc Mon Sep 17 00:00:00 2001
+From: Eric Wong <e@80x24.org>
+Date: Sun, 6 Jan 2019 08:21:03 +0000
+Subject: [PATCH] rtc: cmos: ignore bogus century byte
+Git-commit: 2a4daadd4d3e507138f8937926e6a4df49c6bfdc
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Older versions of Libreboot and Coreboot had an invalid value
+(`3' in my case) in the century byte affecting the GM45 in
+the Thinkpad X200. Not everybody's updated their firmwares,
+and Linux <= 4.2 was able to read the RTC without problems,
+so workaround this by ignoring invalid values.
+
+Fixes: 3c217e51d8a272b9 ("rtc: cmos: century support")
+
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Sylvain Chouleur <sylvain.chouleur@intel.com>
+Cc: Patrick McDermott <patrick.mcdermott@libiquity.com>
+Cc: linux-rtc@vger.kernel.org
+Signed-off-by: Eric Wong <e@80x24.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/rtc/rtc-mc146818-lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c
+index 2f1772a358ca..18a6f15e313d 100644
+--- a/drivers/rtc/rtc-mc146818-lib.c
++++ b/drivers/rtc/rtc-mc146818-lib.c
+@@ -82,7 +82,7 @@ unsigned int mc146818_get_time(struct rtc_time *time)
+ time->tm_year += real_year - 72;
+ #endif
+
+- if (century)
++ if (century > 20)
+ time->tm_year += (century - 19) * 100;
+
+ /*
+--
+2.16.4
+
diff --git a/patches.drivers/rtc-ds1672-fix-unintended-sign-extension.patch b/patches.drivers/rtc-ds1672-fix-unintended-sign-extension.patch
new file mode 100644
index 0000000000..b2d89ba17d
--- /dev/null
+++ b/patches.drivers/rtc-ds1672-fix-unintended-sign-extension.patch
@@ -0,0 +1,43 @@
+From f0c04c276739ed8acbb41b4868e942a55b128dca Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 5 Feb 2019 18:04:49 +0000
+Subject: [PATCH] rtc: ds1672: fix unintended sign extension
+Git-commit: f0c04c276739ed8acbb41b4868e942a55b128dca
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#138801 ("Unintended sign extension")
+
+Fixes: edf1aaa31fc5 ("[PATCH] RTC subsystem: DS1672 driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/rtc/rtc-ds1672.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
+index 9caaccccaa57..b1ebca099b0d 100644
+--- a/drivers/rtc/rtc-ds1672.c
++++ b/drivers/rtc/rtc-ds1672.c
+@@ -58,7 +58,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
+ "%s: raw read data - counters=%02x,%02x,%02x,%02x\n",
+ __func__, buf[0], buf[1], buf[2], buf[3]);
+
+- time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+
+ rtc_time_to_tm(time, tm);
+
+--
+2.16.4
+
diff --git a/patches.drivers/rtc-pm8xxx-fix-unintended-sign-extension.patch b/patches.drivers/rtc-pm8xxx-fix-unintended-sign-extension.patch
new file mode 100644
index 0000000000..49d1efe07c
--- /dev/null
+++ b/patches.drivers/rtc-pm8xxx-fix-unintended-sign-extension.patch
@@ -0,0 +1,53 @@
+From e42280886018c6f77f0a90190f7cba344b0df3e0 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 6 Feb 2019 10:31:02 +0000
+Subject: [PATCH] rtc: pm8xxx: fix unintended sign extension
+Git-commit: e42280886018c6f77f0a90190f7cba344b0df3e0
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#1309693 ("Unintended sign extension")
+
+Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/rtc/rtc-pm8xxx.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
+index 1074e3dbfc1d..cda020700744 100644
+--- a/drivers/rtc/rtc-pm8xxx.c
++++ b/drivers/rtc/rtc-pm8xxx.c
+@@ -213,7 +213,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ }
+ }
+
+- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++ secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++ ((unsigned long)value[3] << 24);
+
+ rtc_time_to_tm(secs, tm);
+
+@@ -284,7 +285,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
+ return rc;
+ }
+
+- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++ secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++ ((unsigned long)value[3] << 24);
+
+ rtc_time_to_tm(secs, &alarm->time);
+
+--
+2.16.4
+
diff --git a/patches.drivers/serial-8250_of-assume-reg-shift-of-2-for-mrvl-mmp-ua.patch b/patches.drivers/serial-8250_of-assume-reg-shift-of-2-for-mrvl-mmp-ua.patch
new file mode 100644
index 0000000000..f204ae90cd
--- /dev/null
+++ b/patches.drivers/serial-8250_of-assume-reg-shift-of-2-for-mrvl-mmp-ua.patch
@@ -0,0 +1,37 @@
+From f4817843e39ce78aace0195a57d4e8500a65a898 Mon Sep 17 00:00:00 2001
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Sun, 24 Feb 2019 13:00:53 +0100
+Subject: [PATCH] serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart
+Git-commit: f4817843e39ce78aace0195a57d4e8500a65a898
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+There are two other drivers that bind to mrvl,mmp-uart and both of them
+assume register shift of 2 bits. There are device trees that lack the
+property and rely on that assumption.
+
+If this driver wins the race to bind to those devices, it should behave
+the same as the older deprecated driver.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/8250/8250_of.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -97,6 +97,10 @@ static int of_platform_serial_setup(stru
+ if (of_property_read_u32(np, "reg-offset", &prop) == 0)
+ port->mapbase += prop;
+
++ /* Compatibility with the deprecated pxa driver and 8250_pxa drivers. */
++ if (of_device_is_compatible(np, "mrvl,mmp-uart"))
++ port->regshift = 2;
++
+ /* Check for registers offset within the devices address range */
+ if (of_property_read_u32(np, "reg-shift", &prop) == 0)
+ port->regshift = prop;
diff --git a/patches.drivers/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch b/patches.drivers/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch
new file mode 100644
index 0000000000..9588fa15c0
--- /dev/null
+++ b/patches.drivers/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch
@@ -0,0 +1,35 @@
+From 815d835b7ba46685c316b000013367dacb2b461b Mon Sep 17 00:00:00 2001
+From: Tomonori Sakita <tomonori.sakita@sord.co.jp>
+Date: Mon, 21 Jan 2019 17:34:16 +0900
+Subject: [PATCH] serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
+Git-commit: 815d835b7ba46685c316b000013367dacb2b461b
+Patch-mainline: v5.0-rc4
+References: bsc#1051510
+
+Using over-sampling ratio, lpuart can accept baud rate upto uartclk / 4.
+
+Signed-off-by: Tomonori Sakita <tomonori.sakita@sord.co.jp>
+Signed-off-by: Atsushi Nemoto <atsushi.nemoto@sord.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/fsl_lpuart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 241a48e5052c..debdd1b9e01a 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1697,7 +1697,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
+ }
+
+ /* ask the core to calculate the divisor */
+- baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16);
++ baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
+
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+--
+2.16.4
+
diff --git a/patches.drivers/spi-pxa2xx-Setup-maximum-supported-DMA-transfer-leng.patch b/patches.drivers/spi-pxa2xx-Setup-maximum-supported-DMA-transfer-leng.patch
new file mode 100644
index 0000000000..c243e3ceb3
--- /dev/null
+++ b/patches.drivers/spi-pxa2xx-Setup-maximum-supported-DMA-transfer-leng.patch
@@ -0,0 +1,47 @@
+From ef070b4e4aa25bb5f8632ad196644026c11903bf Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 19 Feb 2019 23:21:28 +0300
+Subject: [PATCH] spi: pxa2xx: Setup maximum supported DMA transfer length
+Git-commit: ef070b4e4aa25bb5f8632ad196644026c11903bf
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+When the commit b6ced294fb61
+
+ ("spi: pxa2xx: Switch to SPI core DMA mapping functionality")
+
+switches to SPI core provided DMA helpers, it missed to setup maximum
+supported DMA transfer length for the controller and thus users
+mistakenly try to send more data than supported with the following
+Warning:
+
+ ili9341 spi-PRP0001:01: DMA disabled for transfer length 153600 greater than 65536
+
+Setup maximum supported DMA transfer length in order to make users know
+the limit.
+
+Fixes: b6ced294fb61 ("spi: pxa2xx: Switch to SPI core DMA mapping functionality")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/spi/spi-pxa2xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index d84b893a64d7..3e82eaad0f2d 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1696,6 +1696,7 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
+ platform_info->enable_dma = false;
+ } else {
+ master->can_dma = pxa2xx_spi_can_dma;
++ master->max_dma_len = MAX_DMA_LEN;
+ }
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/spi-ti-qspi-Fix-mmap-read-when-more-than-one-CS-in-u.patch b/patches.drivers/spi-ti-qspi-Fix-mmap-read-when-more-than-one-CS-in-u.patch
new file mode 100644
index 0000000000..d222a04f9d
--- /dev/null
+++ b/patches.drivers/spi-ti-qspi-Fix-mmap-read-when-more-than-one-CS-in-u.patch
@@ -0,0 +1,52 @@
+From 673c865efbdc5fec3cc525c46d71844d42c60072 Mon Sep 17 00:00:00 2001
+From: Vignesh R <vigneshr@ti.com>
+Date: Tue, 29 Jan 2019 13:14:22 +0530
+Subject: [PATCH] spi: ti-qspi: Fix mmap read when more than one CS in use
+Git-commit: 673c865efbdc5fec3cc525c46d71844d42c60072
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Commit 4dea6c9b0b64 ("spi: spi-ti-qspi: add mmap mode read support") has
+has got order of parameter wrong when calling regmap_update_bits() to
+select CS for mmap access. Mask and value arguments are interchanged.
+Code will work on a system with single slave, but fails when more than
+one CS is in use. Fix this by correcting the order of parameters when
+calling regmap_update_bits().
+
+Fixes: 4dea6c9b0b64 ("spi: spi-ti-qspi: add mmap mode read support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/spi/spi-ti-qspi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
+index 5f19016bbf10..b9fb6493cd6b 100644
+--- a/drivers/spi/spi-ti-qspi.c
++++ b/drivers/spi/spi-ti-qspi.c
+@@ -490,8 +490,8 @@ static void ti_qspi_enable_memory_map(struct spi_device *spi)
+ ti_qspi_write(qspi, MM_SWITCH, QSPI_SPI_SWITCH_REG);
+ if (qspi->ctrl_base) {
+ regmap_update_bits(qspi->ctrl_base, qspi->ctrl_reg,
+- MEM_CS_EN(spi->chip_select),
+- MEM_CS_MASK);
++ MEM_CS_MASK,
++ MEM_CS_EN(spi->chip_select));
+ }
+ qspi->mmap_enabled = true;
+ }
+@@ -503,7 +503,7 @@ static void ti_qspi_disable_memory_map(struct spi_device *spi)
+ ti_qspi_write(qspi, 0, QSPI_SPI_SWITCH_REG);
+ if (qspi->ctrl_base)
+ regmap_update_bits(qspi->ctrl_base, qspi->ctrl_reg,
+- 0, MEM_CS_MASK);
++ MEM_CS_MASK, 0);
+ qspi->mmap_enabled = false;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/spi-topcliff_pch-Fix-potential-NULL-dereference-on-a.patch b/patches.drivers/spi-topcliff_pch-Fix-potential-NULL-dereference-on-a.patch
new file mode 100644
index 0000000000..0aeeec351a
--- /dev/null
+++ b/patches.drivers/spi-topcliff_pch-Fix-potential-NULL-dereference-on-a.patch
@@ -0,0 +1,47 @@
+From e902cdcb5112b89ee445588147964723fd69ffb4 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 23 Jan 2019 20:00:22 +0800
+Subject: [PATCH] spi/topcliff_pch: Fix potential NULL dereference on allocation error
+Git-commit: e902cdcb5112b89ee445588147964723fd69ffb4
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+In pch_spi_handle_dma, it doesn't check for NULL returns of kcalloc
+so it would result in an Oops.
+
+Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/spi/spi-topcliff-pch.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index 97d137591b18..e7e8ea1edcce 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -1008,6 +1008,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+
+ /* RX */
+ dma->sg_rx_p = kcalloc(num, sizeof(*dma->sg_rx_p), GFP_ATOMIC);
++ if (!dma->sg_rx_p)
++ return;
++
+ sg_init_table(dma->sg_rx_p, num); /* Initialize SG table */
+ /* offset, length setting */
+ sg = dma->sg_rx_p;
+@@ -1068,6 +1071,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+ }
+
+ dma->sg_tx_p = kcalloc(num, sizeof(*dma->sg_tx_p), GFP_ATOMIC);
++ if (!dma->sg_tx_p)
++ return;
++
+ sg_init_table(dma->sg_tx_p, num); /* Initialize SG table */
+ /* offset, length setting */
+ sg = dma->sg_tx_p;
+--
+2.16.4
+
diff --git a/patches.drivers/thermal-bcm2835-Fix-crash-in-bcm2835_thermal_debugfs.patch b/patches.drivers/thermal-bcm2835-Fix-crash-in-bcm2835_thermal_debugfs.patch
new file mode 100644
index 0000000000..53f488c8ec
--- /dev/null
+++ b/patches.drivers/thermal-bcm2835-Fix-crash-in-bcm2835_thermal_debugfs.patch
@@ -0,0 +1,62 @@
+From 35122495a8c6683e863acf7b05a7036b2be64c7a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 29 Jan 2019 09:55:57 +0000
+Subject: [PATCH] thermal: bcm2835: Fix crash in bcm2835_thermal_debugfs
+Git-commit: 35122495a8c6683e863acf7b05a7036b2be64c7a
+Patch-mainline: v5.1-rc2
+References: bsc#1051510
+
+"cat /sys/kernel/debug/bcm2835_thermal/regset" causes a NULL pointer
+dereference in bcm2835_thermal_debugfs. The driver makes use of the
+implementation details of the thermal framework to retrieve a pointer
+to its private data from a struct thermal_zone_device, and gets it
+wrong - leading to the crash. Instead, store its private data as the
+drvdata and retrieve the thermal_zone_device pointer from it.
+
+Fixes: bcb7dd9ef206 ("thermal: bcm2835: add thermal driver for bcm2835 SoC")
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/thermal/broadcom/bcm2835_thermal.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c
+index 720760cd493f..ba39647a690c 100644
+--- a/drivers/thermal/broadcom/bcm2835_thermal.c
++++ b/drivers/thermal/broadcom/bcm2835_thermal.c
+@@ -119,8 +119,7 @@ static const struct debugfs_reg32 bcm2835_thermal_regs[] = {
+
+ static void bcm2835_thermal_debugfs(struct platform_device *pdev)
+ {
+- struct thermal_zone_device *tz = platform_get_drvdata(pdev);
+- struct bcm2835_thermal_data *data = tz->devdata;
++ struct bcm2835_thermal_data *data = platform_get_drvdata(pdev);
+ struct debugfs_regset32 *regset;
+
+ data->debugfsdir = debugfs_create_dir("bcm2835_thermal", NULL);
+@@ -266,7 +265,7 @@ static int bcm2835_thermal_probe(struct platform_device *pdev)
+
+ data->tz = tz;
+
+- platform_set_drvdata(pdev, tz);
++ platform_set_drvdata(pdev, data);
+
+ /*
+ * Thermal_zone doesn't enable hwmon as default,
+@@ -290,8 +289,8 @@ static int bcm2835_thermal_probe(struct platform_device *pdev)
+
+ static int bcm2835_thermal_remove(struct platform_device *pdev)
+ {
+- struct thermal_zone_device *tz = platform_get_drvdata(pdev);
+- struct bcm2835_thermal_data *data = tz->devdata;
++ struct bcm2835_thermal_data *data = platform_get_drvdata(pdev);
++ struct thermal_zone_device *tz = data->tz;
+
+ debugfs_remove_recursive(data->debugfsdir);
+ thermal_zone_of_sensor_unregister(&pdev->dev, tz);
+--
+2.16.4
+
diff --git a/patches.drivers/usb-dwc3-gadget-Fix-the-uninitialized-link_state-whe.patch b/patches.drivers/usb-dwc3-gadget-Fix-the-uninitialized-link_state-whe.patch
new file mode 100644
index 0000000000..e748432500
--- /dev/null
+++ b/patches.drivers/usb-dwc3-gadget-Fix-the-uninitialized-link_state-whe.patch
@@ -0,0 +1,59 @@
+From 88b1bb1f3b88e0bf20b05d543a53a5b99bd7ceb6 Mon Sep 17 00:00:00 2001
+From: Zeng Tao <prime.zeng@hisilicon.com>
+Date: Wed, 26 Dec 2018 19:22:00 +0800
+Subject: [PATCH] usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
+Git-commit: 88b1bb1f3b88e0bf20b05d543a53a5b99bd7ceb6
+Patch-mainline: v5.0-rc4
+References: bsc#1051510
+
+Currently the link_state is uninitialized and the default value is 0(U0)
+before the first time we start the udc, and after we start the udc then
+ stop the udc, the link_state will be undefined.
+We may have the following warnings if we start the udc again with
+an undefined link_state:
+
+Warning: CPU: 0 PID: 327 at drivers/usb/dwc3/gadget.c:294 dwc3_send_gadget_ep_cmd+0x304/0x308
+dwc3 100e0000.hidwc3_0: wakeup failed --> -22
+[...]
+Call Trace:
+[<c010f270>] (unwind_backtrace) from [<c010b3d8>] (show_stack+0x10/0x14)
+[<c010b3d8>] (show_stack) from [<c034a4dc>] (dump_stack+0x84/0x98)
+[<c034a4dc>] (dump_stack) from [<c0118000>] (__warn+0xe8/0x100)
+[<c0118000>] (__warn) from [<c0118050>](warn_slowpath_fmt+0x38/0x48)
+[<c0118050>] (warn_slowpath_fmt) from [<c0442ec0>](dwc3_send_gadget_ep_cmd+0x304/0x308)
+[<c0442ec0>] (dwc3_send_gadget_ep_cmd) from [<c0445e68>](dwc3_ep0_start_trans+0x48/0xf4)
+[<c0445e68>] (dwc3_ep0_start_trans) from [<c0446750>](dwc3_ep0_out_start+0x64/0x80)
+[<c0446750>] (dwc3_ep0_out_start) from [<c04451c0>](__dwc3_gadget_start+0x1e0/0x278)
+[<c04451c0>] (__dwc3_gadget_start) from [<c04452e0>](dwc3_gadget_start+0x88/0x10c)
+[<c04452e0>] (dwc3_gadget_start) from [<c045ee54>](udc_bind_to_driver+0x88/0xbc)
+[<c045ee54>] (udc_bind_to_driver) from [<c045f29c>](usb_gadget_probe_driver+0xf8/0x140)
+[<c045f29c>] (usb_gadget_probe_driver) from [<bf005424>](gadget_dev_desc_UDC_store+0xac/0xc4 [libcomposite])
+[<bf005424>] (gadget_dev_desc_UDC_store [libcomposite]) from[<c023d8e0>] (configfs_write_file+0xd4/0x160)
+[<c023d8e0>] (configfs_write_file) from [<c01d51e8>] (__vfs_write+0x1c/0x114)
+[<c01d51e8>] (__vfs_write) from [<c01d5ff4>] (vfs_write+0xa4/0x168)
+[<c01d5ff4>] (vfs_write) from [<c01d6d40>] (SyS_write+0x3c/0x90)
+[<c01d6d40>] (SyS_write) from [<c0107400>] (ret_fast_syscall+0x0/0x3c)
+
+Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/dwc3/gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 6e2b6d6369aa..bed2ff42780b 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1985,6 +1985,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc)
+
+ /* begin to receive SETUP packets */
+ dwc->ep0state = EP0_SETUP_PHASE;
++ dwc->link_state = DWC3_LINK_STATE_SS_DIS;
+ dwc3_ep0_out_start(dwc);
+
+ dwc3_gadget_enable_irq(dwc);
+--
+2.16.4
+
diff --git a/patches.drivers/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch b/patches.drivers/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch
new file mode 100644
index 0000000000..49027fa3c0
--- /dev/null
+++ b/patches.drivers/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch
@@ -0,0 +1,40 @@
+From 01c10880d24291a96a4ab0da773e3c5ce4d12da8 Mon Sep 17 00:00:00 2001
+From: Bo He <bo.he@intel.com>
+Date: Mon, 14 Jan 2019 09:48:32 +0200
+Subject: [PATCH] usb: dwc3: gadget: synchronize_irq dwc irq in suspend
+Git-commit: 01c10880d24291a96a4ab0da773e3c5ce4d12da8
+Patch-mainline: v5.0-rc4
+References: bsc#1051510
+
+We see dwc3 endpoint stopped by unwanted irq during
+suspend resume test, which is caused dwc3 ep can't be started
+with error "No Resource".
+
+Here, add synchronize_irq before suspend to sync the
+pending IRQ handlers complete.
+
+Signed-off-by: Bo He <bo.he@intel.com>
+Signed-off-by: Yu Wang <yu.y.wang@intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/dwc3/gadget.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 07bd31bb2f8a..851fd44d56ad 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3379,6 +3379,8 @@ int dwc3_gadget_suspend(struct dwc3 *dwc)
+ dwc3_disconnect_gadget(dwc);
+ __dwc3_gadget_stop(dwc);
+
++ synchronize_irq(dwc->irq_gadget);
++
+ return 0;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/usb-gadget-Potential-NULL-dereference-on-allocation-.patch b/patches.drivers/usb-gadget-Potential-NULL-dereference-on-allocation-.patch
new file mode 100644
index 0000000000..7906de919f
--- /dev/null
+++ b/patches.drivers/usb-gadget-Potential-NULL-dereference-on-allocation-.patch
@@ -0,0 +1,39 @@
+From df28169e1538e4a8bcd8b779b043e5aa6524545c Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 21 Dec 2018 23:42:52 +0300
+Subject: [PATCH] usb: gadget: Potential NULL dereference on allocation error
+Git-commit: df28169e1538e4a8bcd8b779b043e5aa6524545c
+Patch-mainline: v5.0-rc4
+References: bsc#1051510
+
+The source_sink_alloc_func() function is supposed to return error
+pointers on error. The function is called from usb_get_function() which
+doesn't check for NULL returns so it would result in an Oops.
+
+Of course, in the current kernel, small allocations always succeed so
+this doesn't affect runtime.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/gadget/function/f_sourcesink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
+index 9cdef108fb1b..ed68a4860b7d 100644
+--- a/drivers/usb/gadget/function/f_sourcesink.c
++++ b/drivers/usb/gadget/function/f_sourcesink.c
+@@ -838,7 +838,7 @@ static struct usb_function *source_sink_alloc_func(
+
+ ss = kzalloc(sizeof(*ss), GFP_KERNEL);
+ if (!ss)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ ss_opts = container_of(fi, struct f_ss_opts, func_inst);
+
+--
+2.16.4
+
diff --git a/patches.drivers/usb-phy-fix-link-errors.patch b/patches.drivers/usb-phy-fix-link-errors.patch
new file mode 100644
index 0000000000..39c7ed7a43
--- /dev/null
+++ b/patches.drivers/usb-phy-fix-link-errors.patch
@@ -0,0 +1,60 @@
+From f2105d42597f4d10e431b195d69e96dccaf9b012 Mon Sep 17 00:00:00 2001
+From: Anders Roxell <anders.roxell@linaro.org>
+Date: Tue, 22 Jan 2019 11:36:02 +0100
+Subject: [PATCH] usb: phy: fix link errors
+Git-commit: f2105d42597f4d10e431b195d69e96dccaf9b012
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+Fix link errors when CONFIG_FSL_USB2_OTG is enabled and USB_OTG_FSM is
+set to module then the following link error occurs.
+
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_ioctl':
+drivers/usb/phy/phy-fsl-usb.c:1083: undefined reference to `otg_statemachine'
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:1083:(.text+0x574): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_start_srp':
+drivers/usb/phy/phy-fsl-usb.c:674: undefined reference to `otg_statemachine'
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:674:(.text+0x61c): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_set_host':
+drivers/usb/phy/phy-fsl-usb.c:593: undefined reference to `otg_statemachine'
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:593:(.text+0x7a4): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_start_hnp':
+drivers/usb/phy/phy-fsl-usb.c:695: undefined reference to `otg_statemachine'
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:695:(.text+0x858): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `a_wait_enum':
+drivers/usb/phy/phy-fsl-usb.c:274: undefined reference to `otg_statemachine'
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:274:(.text+0x16f0): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o:drivers/usb/phy/phy-fsl-usb.c:619: more undefined references to `otg_statemachine' follow
+Aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_set_peripheral':
+drivers/usb/phy/phy-fsl-usb.c:619:(.text+0x1fa0): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine'
+Make[1]: *** [Makefile:1020: vmlinux] Error 1
+Make[1]: Target 'Image' not remade because of errors.
+Make: *** [Makefile:152: sub-make] Error 2
+Make: Target 'Image' not remade because of errors.
+
+Rework so that FSL_USB2_OTG depends on that the USB_OTG_FSM is builtin.
+
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/phy/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
+index d7312eed6088..91ea3083e7ad 100644
+--- a/drivers/usb/phy/Kconfig
++++ b/drivers/usb/phy/Kconfig
+@@ -21,7 +21,7 @@ config AB8500_USB
+
+ config FSL_USB2_OTG
+ bool "Freescale USB OTG Transceiver Driver"
+- depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM && PM
++ depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
+ depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
+ select USB_PHY
+ help
+--
+2.16.4
+
diff --git a/patches.drivers/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch b/patches.drivers/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
new file mode 100644
index 0000000000..0df67b7692
--- /dev/null
+++ b/patches.drivers/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
@@ -0,0 +1,41 @@
+From 5895d311d28f2605e2f71c1a3e043ed38f3ac9d2 Mon Sep 17 00:00:00 2001
+From: Sven Van Asbroeck <thesven73@gmail.com>
+Date: Mon, 11 Feb 2019 10:04:26 -0500
+Subject: [PATCH] usb: phy: twl6030-usb: fix possible use-after-free on remove
+Git-commit: 5895d311d28f2605e2f71c1a3e043ed38f3ac9d2
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+In remove(), use cancel_delayed_work_sync() to cancel the
+delayed work. Otherwise there's a chance that this work
+will continue to run until after the device has been removed.
+
+This issue was detected with the help of Coccinelle.
+
+Cc: Tony Lindgren <tony@atomide.com>
+Cc: Bin Liu <b-liu@ti.com>
+Fixes: b6a619a883c3 ("usb: phy: Check initial state for twl6030")
+Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index 183550b63faa..dade34d70419 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -400,7 +400,7 @@ static int twl6030_usb_remove(struct platform_device *pdev)
+ {
+ struct twl6030_usb *twl = platform_get_drvdata(pdev);
+
+- cancel_delayed_work(&twl->get_status_work);
++ cancel_delayed_work_sync(&twl->get_status_work);
+ twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
+ REG_INT_MSK_LINE_C);
+ twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
+--
+2.16.4
+
diff --git a/patches.drm/drm-i915-Relax-mmap-VMA-check.patch b/patches.drm/drm-i915-Relax-mmap-VMA-check.patch
new file mode 100644
index 0000000000..bbcb27667b
--- /dev/null
+++ b/patches.drm/drm-i915-Relax-mmap-VMA-check.patch
@@ -0,0 +1,54 @@
+From ca22f32a6296cbfa29de56328c8505560a18cfa8 Mon Sep 17 00:00:00 2001
+From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Date: Tue, 5 Mar 2019 11:04:08 +0000
+Subject: [PATCH] drm/i915: Relax mmap VMA check
+Git-commit: ca22f32a6296cbfa29de56328c8505560a18cfa8
+Patch-mainline: v5.1-rc1
+No-fix: a90e1948efb648f567444f87f3c19b2a0787affd
+References: bsc#1051510
+
+Legacy behaviour was to allow non-page-aligned mmap requests, as does the
+linux mmap(2) implementation by virtue of automatically rounding up for
+the caller.
+
+To avoid breaking legacy userspace relax the newly introduced fix.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Fixes: 5c4604e757ba ("drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set")
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Cc: Adam Zabrocki <adamza@microsoft.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v4.0+
+Cc: Akash Goel <akash.goel@intel.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: intel-gfx@lists.freedesktop.org
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190305110409.28633-1-tvrtko.ursulin@linux.intel.com
+(cherry picked from commit a90e1948efb648f567444f87f3c19b2a0787affd)
+
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 6728ea5c71d4..30d516e975c6 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1688,7 +1688,8 @@ __vma_matches(struct vm_area_struct *vma, struct file *filp,
+ if (vma->vm_file != filp)
+ return false;
+
+- return vma->vm_start == addr && (vma->vm_end - vma->vm_start) == size;
++ return vma->vm_start == addr &&
++ (vma->vm_end - vma->vm_start) == PAGE_ALIGN(size);
+ }
+
+ /**
+--
+2.16.4
+
diff --git a/patches.drm/drm-imx-ignore-plane-updates-on-disabled-crtcs.patch b/patches.drm/drm-imx-ignore-plane-updates-on-disabled-crtcs.patch
new file mode 100644
index 0000000000..f01652e560
--- /dev/null
+++ b/patches.drm/drm-imx-ignore-plane-updates-on-disabled-crtcs.patch
@@ -0,0 +1,43 @@
+From 4fb873c9648e383206e0a91cef9b03aa54066aca Mon Sep 17 00:00:00 2001
+From: Philipp Zabel <p.zabel@pengutronix.de>
+Date: Mon, 5 Nov 2018 16:36:07 +0100
+Subject: [PATCH] drm/imx: ignore plane updates on disabled crtcs
+Git-commit: 4fb873c9648e383206e0a91cef9b03aa54066aca
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+This patch fixes backtraces like the following when sending SIGKILL to a
+process with a currently pending plane update:
+
+ [drm:ipu_plane_atomic_check] CRTC should be enabled
+ [drm:drm_framebuffer_remove] *ERROR* failed to commit
+ ------------[ cut here ]------------
+ WARNING: CPU: 3 PID: 63 at drivers/gpu/drm/drm_framebuffer.c:926 drm_framebuffer_remove+0x47c/0x498
+ atomic remove_fb failed with -22
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/imx/ipuv3-plane.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
+index c390924de93d..21e964f6ab5c 100644
+--- a/drivers/gpu/drm/imx/ipuv3-plane.c
++++ b/drivers/gpu/drm/imx/ipuv3-plane.c
+@@ -370,9 +370,9 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
+ if (ret)
+ return ret;
+
+- /* CRTC should be enabled */
++ /* nothing to check when disabling or disabled */
+ if (!crtc_state->enable)
+- return -EINVAL;
++ return 0;
+
+ switch (plane->type) {
+ case DRM_PLANE_TYPE_PRIMARY:
+--
+2.16.4
+
diff --git a/patches.drm/drm-imx-imx-ldb-add-missing-of_node_puts.patch b/patches.drm/drm-imx-imx-ldb-add-missing-of_node_puts.patch
new file mode 100644
index 0000000000..b75379744c
--- /dev/null
+++ b/patches.drm/drm-imx-imx-ldb-add-missing-of_node_puts.patch
@@ -0,0 +1,120 @@
+From aa3312012f103f91f123600bbf768b11c8f431bc Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Sun, 13 Jan 2019 09:47:42 +0100
+Subject: [PATCH] drm/imx: imx-ldb: add missing of_node_puts
+Git-commit: aa3312012f103f91f123600bbf768b11c8f431bc
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+The device node iterators perform an of_node_get on each
+iteration, so a jump out of the loop requires an of_node_put.
+
+Move the initialization channel->child = child; down to just
+before the call to imx_ldb_register so that intervening failures
+don't need to clear it. Add a label at the end of the function to
+do all the of_node_puts.
+
+The semantic patch that finds part of this problem is as follows
+(http://coccinelle.lip6.fr):
+
+// <smpl>
+@@
+expression root,e;
+local idexpression child;
+iterator name for_each_child_of_node;
+@@
+
+ for_each_child_of_node(root, child) {
+ ... when != of_node_put(child)
+ when != e = child
+(
+ return child;
+|
+* return ...;
+)
+ ...
+ }
+// </smpl>
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/imx/imx-ldb.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
+index 2c5bbe317353..e31e263cf86b 100644
+--- a/drivers/gpu/drm/imx/imx-ldb.c
++++ b/drivers/gpu/drm/imx/imx-ldb.c
+@@ -643,8 +643,10 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
+ int bus_format;
+
+ ret = of_property_read_u32(child, "reg", &i);
+- if (ret || i < 0 || i > 1)
+- return -EINVAL;
++ if (ret || i < 0 || i > 1) {
++ ret = -EINVAL;
++ goto free_child;
++ }
+
+ if (!of_device_is_available(child))
+ continue;
+@@ -657,7 +659,6 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
+ channel = &imx_ldb->channel[i];
+ channel->ldb = imx_ldb;
+ channel->chno = i;
+- channel->child = child;
+
+ /*
+ * The output port is port@4 with an external 4-port mux or
+@@ -667,13 +668,13 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
+ imx_ldb->lvds_mux ? 4 : 2, 0,
+ &channel->panel, &channel->bridge);
+ if (ret && ret != -ENODEV)
+- return ret;
++ goto free_child;
+
+ /* panel ddc only if there is no bridge */
+ if (!channel->bridge) {
+ ret = imx_ldb_panel_ddc(dev, channel, child);
+ if (ret)
+- return ret;
++ goto free_child;
+ }
+
+ bus_format = of_get_bus_format(dev, child);
+@@ -689,18 +690,26 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
+ if (bus_format < 0) {
+ dev_err(dev, "could not determine data mapping: %d\n",
+ bus_format);
+- return bus_format;
++ ret = bus_format;
++ goto free_child;
+ }
+ channel->bus_format = bus_format;
++ channel->child = child;
+
+ ret = imx_ldb_register(drm, channel);
+- if (ret)
+- return ret;
++ if (ret) {
++ channel->child = NULL;
++ goto free_child;
++ }
+ }
+
+ dev_set_drvdata(dev, imx_ldb);
+
+ return 0;
++
++free_child:
++ of_node_put(child);
++ return ret;
+ }
+
+ static void imx_ldb_unbind(struct device *dev, struct device *master,
+--
+2.16.4
+
diff --git a/patches.fixes/0001-Revert-ipv4-keep-skb-dst-around-in-presence-of-IP-op.patch b/patches.fixes/0001-Revert-ipv4-keep-skb-dst-around-in-presence-of-IP-op.patch
new file mode 100644
index 0000000000..a26fecd564
--- /dev/null
+++ b/patches.fixes/0001-Revert-ipv4-keep-skb-dst-around-in-presence-of-IP-op.patch
@@ -0,0 +1,40 @@
+From: Paolo Abeni <pabeni@redhat.com>
+Subject: Revert "ipv4: keep skb->dst around in presence of IP options"
+Patch-mainline: v4.14-rc1
+Git-commit: 61a1030bad628f7264cd5e5d0f4d71b5488eb4a4
+References: git-fixes
+
+ip_options_echo() does not use anymore the skb->dst and don't
+need to keep the dst around for options's sake only.
+This reverts commit 34b2cef20f19c87999fff3da4071e66937db9644.
+
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/ipv4/ip_sockglue.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 1c3354d028a4..dd68a9ed5e40 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -1228,14 +1228,7 @@ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
+ pktinfo->ipi_ifindex = 0;
+ pktinfo->ipi_spec_dst.s_addr = 0;
+ }
+- /* We need to keep the dst for __ip_options_echo()
+- * We could restrict the test to opt.ts_needtime || opt.srr,
+- * but the following is good enough as IP options are not often used.
+- */
+- if (unlikely(IPCB(skb)->opt.optlen))
+- skb_dst_force(skb);
+- else
+- skb_dst_drop(skb);
++ skb_dst_drop(skb);
+ }
+
+ int ip_setsockopt(struct sock *sk, int level,
+--
+2.12.3
+
diff --git a/patches.fixes/0001-USB-serial-cp210x-add-ID-for-Ingenico-3070.patch b/patches.fixes/0001-USB-serial-cp210x-add-ID-for-Ingenico-3070.patch
new file mode 100644
index 0000000000..bbff92878d
--- /dev/null
+++ b/patches.fixes/0001-USB-serial-cp210x-add-ID-for-Ingenico-3070.patch
@@ -0,0 +1,42 @@
+From dd9d3d86b08d6a106830364879c42c78db85389c Mon Sep 17 00:00:00 2001
+From: Ivan Mironov <mironov.ivan@gmail.com>
+Date: Wed, 6 Feb 2019 21:14:13 +0500
+Subject: [PATCH] USB: serial: cp210x: add ID for Ingenico 3070
+Git-commit: dd9d3d86b08d6a106830364879c42c78db85389c
+Patch-mainline: v5.1-rc1
+References: bsc#1129770
+
+Here is how this device appears in kernel log:
+
+ usb 3-1: new full-speed USB device number 18 using xhci_hcd
+ usb 3-1: New USB device found, idVendor=0b00, idProduct=3070
+ usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+ usb 3-1: Product: Ingenico 3070
+ usb 3-1: Manufacturer: Silicon Labs
+ usb 3-1: SerialNumber: 0001
+
+Apparently this is a POS terminal with embedded USB-to-Serial converter.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ivan Mironov <mironov.ivan@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index c0777a374a88..3286ed462fc5 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -61,6 +61,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
+ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
++ { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */
+ { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
+ { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */
+ { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
+--
+2.16.4
+
diff --git a/patches.fixes/0001-USB-serial-ftdi_sio-add-ID-for-Hjelmslund-Electronic.patch b/patches.fixes/0001-USB-serial-ftdi_sio-add-ID-for-Hjelmslund-Electronic.patch
new file mode 100644
index 0000000000..a7f36ea320
--- /dev/null
+++ b/patches.fixes/0001-USB-serial-ftdi_sio-add-ID-for-Hjelmslund-Electronic.patch
@@ -0,0 +1,53 @@
+From 8d7fa3d4ea3f0ca69554215e87411494e6346fdc Mon Sep 17 00:00:00 2001
+From: Mans Rullgard <mans@mansr.com>
+Date: Thu, 14 Feb 2019 19:45:33 +0000
+Subject: [PATCH] USB: serial: ftdi_sio: add ID for Hjelmslund Electronics
+ USB485
+Git-commit: 8d7fa3d4ea3f0ca69554215e87411494e6346fdc
+Patch-mainline: v5.1-rc1
+References: bsc#1129770
+
+This adds the USB ID of the Hjelmslund Electronics USB485 Iso stick.
+
+Signed-off-by: Mans Rullgard <mans@mansr.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 77ef4c481f3c..8f5b17471759 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1025,6 +1025,8 @@ static const struct usb_device_id id_table_combined[] = {
+ { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) },
+ { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) },
+ { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) },
++ /* EZPrototypes devices */
++ { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 975d02666c5a..b863bedb55a1 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1308,6 +1308,12 @@
+ #define IONICS_VID 0x1c0c
+ #define IONICS_PLUGCOMPUTER_PID 0x0102
+
++/*
++ * EZPrototypes (PID reseller)
++ */
++#define EZPROTOTYPES_VID 0x1c40
++#define HJELMSLUND_USB485_ISO_PID 0x0477
++
+ /*
+ * Dresden Elektronik Sensor Terminal Board
+ */
+--
+2.16.4
+
diff --git a/patches.fixes/0001-USB-serial-option-add-Telit-ME910-ECM-composition.patch b/patches.fixes/0001-USB-serial-option-add-Telit-ME910-ECM-composition.patch
new file mode 100644
index 0000000000..6c1f4f2b15
--- /dev/null
+++ b/patches.fixes/0001-USB-serial-option-add-Telit-ME910-ECM-composition.patch
@@ -0,0 +1,34 @@
+From 6431866b6707d27151be381252d6eef13025cfce Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Wed, 20 Feb 2019 11:43:17 +0100
+Subject: [PATCH] USB: serial: option: add Telit ME910 ECM composition
+Git-commit: 6431866b6707d27151be381252d6eef13025cfce
+Patch-mainline: v5.1-rc1
+References: bsc#1129770
+
+This patch adds Telit ME910 family ECM composition 0x1102.
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index aef15497ff31..11b21d9410f3 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1148,6 +1148,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+ .driver_info = NCTRL(0) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff), /* Telit ME910 (ECM) */
++ .driver_info = NCTRL(0) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
+--
+2.16.4
+
diff --git a/patches.fixes/0001-ip6-fix-PMTU-discovery-when-using-127-subnets.patch b/patches.fixes/0001-ip6-fix-PMTU-discovery-when-using-127-subnets.patch
new file mode 100644
index 0000000000..c440aee3d2
--- /dev/null
+++ b/patches.fixes/0001-ip6-fix-PMTU-discovery-when-using-127-subnets.patch
@@ -0,0 +1,75 @@
+From: Vincent Bernat <vincent@bernat.im>
+Subject: ip6: fix PMTU discovery when using /127 subnets
+Patch-mainline: v4.14-rc1
+Git-commit: ccdb2d17df9f07c291d43b0aeea7c90e4c020489
+References: git-fixes
+
+The definition of an "anycast destination address" has been tweaked as a
+side-effect of commit 2647a9b07032 ("ipv6: Remove external dependency on
+rt6i_gateway and RTF_ANYCAST"). The first address of a point-to-point
+/127 subnet is now considered as an anycast address. This prevents
+ICMPv6 errors to be returned to a sender of such a subnet and breaks
+PMTU discovery.
+
+This can be reproduced with:
+
+ ip link add name out6 type veth peer name in6
+ ip link add name out7 type veth peer name in7
+ ip link set mtu 1400 dev out7
+ ip link set mtu 1400 dev in7
+ ip netns add next-hop
+ ip netns add next-next-hop
+ ip link set netns next-hop dev in6
+ ip link set netns next-hop dev out7
+ ip link set netns next-next-hop dev in7
+ ip link set up dev out6
+ ip addr add 2001:db8:1::12/127 dev out6
+ ip netns exec next-hop ip link set up dev in6
+ ip netns exec next-hop ip link set up dev out7
+ ip netns exec next-hop ip addr add 2001:db8:1::13/127 dev in6
+ ip netns exec next-hop ip addr add 2001:db8:1::14/127 dev out7
+ ip netns exec next-hop ip route add default via 2001:db8:1::15
+ ip netns exec next-hop sysctl -qw net.ipv6.conf.all.forwarding=1
+ ip netns exec next-next-hop ip link set up dev in7
+ ip netns exec next-next-hop ip addr add 2001:db8:1::15/127 dev in7
+ ip netns exec next-next-hop ip addr add 2001:db8:1::50/128 dev in7
+ ip netns exec next-next-hop ip route add default via 2001:db8:1::14
+ ip netns exec next-next-hop sysctl -qw net.ipv6.conf.all.forwarding=1
+ ip route add 2001:db8:1::48/123 via 2001:db8:1::13
+ sleep 4
+ ping -M do -s 1452 -c 3 2001:db8:1::50 || true
+ ip route get 2001:db8:1::50
+
+Before the patch, we get:
+
+ 2001:db8:1::50 from :: via 2001:db8:1::13 dev out6 src 2001:db8:1::12 metric 1024 pref medium
+
+After the patch, we get:
+
+ 2001:db8:1::50 via 2001:db8:1::13 dev out6 src 2001:db8:1::12 metric 0
+ cache expires 578sec mtu 1400 pref medium
+
+Fixes: 2647a9b07032 ("ipv6: Remove external dependency on rt6i_gateway and RTF_ANYCAST")
+Signed-off-by: Vincent Bernat <vincent@bernat.im>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ include/net/ip6_route.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 199056933dcb..907d39a42f6b 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -194,7 +194,7 @@ static inline bool ipv6_anycast_destination(const struct dst_entry *dst,
+ struct rt6_info *rt = (struct rt6_info *)dst;
+
+ return rt->rt6i_flags & RTF_ANYCAST ||
+- (rt->rt6i_dst.plen != 128 &&
++ (rt->rt6i_dst.plen < 127 &&
+ ipv6_addr_equal(&rt->rt6i_dst.addr, daddr));
+ }
+
+--
+2.12.3
+
diff --git a/patches.fixes/0001-ip6mr-Do-not-call-__IP6_INC_STATS-from-preemptible-c.patch b/patches.fixes/0001-ip6mr-Do-not-call-__IP6_INC_STATS-from-preemptible-c.patch
new file mode 100644
index 0000000000..10cad61828
--- /dev/null
+++ b/patches.fixes/0001-ip6mr-Do-not-call-__IP6_INC_STATS-from-preemptible-c.patch
@@ -0,0 +1,69 @@
+From: Ido Schimmel <idosch@mellanox.com>
+Subject: ip6mr: Do not call __IP6_INC_STATS() from preemptible context
+Patch-mainline: v5.1-rc1
+Git-commit: 87c11f1ddbbad38ad8bad47af133a8208985fbdf
+References: git-fixes
+
+Similar to commit 44f49dd8b5a6 ("ipmr: fix possible race resulting from
+improper usage of IP_INC_STATS_BH() in preemptible context."), we cannot
+assume preemption is disabled when incrementing the counter and
+accessing a per-CPU variable.
+
+Preemption can be enabled when we add a route in process context that
+corresponds to packets stored in the unresolved queue, which are then
+forwarded using this route [1].
+
+Fix this by using IP6_INC_STATS() which takes care of disabling
+preemption on architectures where it is needed.
+
+[1]
+[ 157.451447] BUG: using __this_cpu_add() in preemptible [00000000] code: smcrouted/2314
+[ 157.460409] caller is ip6mr_forward2+0x73e/0x10e0
+[ 157.460434] CPU: 3 PID: 2314 Comm: smcrouted Not tainted 5.0.0-rc7-custom-03635-g22f2712113f1 #1336
+[ 157.460449] Hardware name: Mellanox Technologies Ltd. MSN2100-CB2FO/SA001017, BIOS 5.6.5 06/07/2016
+[ 157.460461] Call Trace:
+[ 157.460486] dump_stack+0xf9/0x1be
+[ 157.460553] check_preemption_disabled+0x1d6/0x200
+[ 157.460576] ip6mr_forward2+0x73e/0x10e0
+[ 157.460705] ip6_mr_forward+0x9a0/0x1510
+[ 157.460771] ip6mr_mfc_add+0x16b3/0x1e00
+[ 157.461155] ip6_mroute_setsockopt+0x3cb/0x13c0
+[ 157.461384] do_ipv6_setsockopt.isra.8+0x348/0x4060
+[ 157.462013] ipv6_setsockopt+0x90/0x110
+[ 157.462036] rawv6_setsockopt+0x4a/0x120
+[ 157.462058] __sys_setsockopt+0x16b/0x340
+[ 157.462198] __x64_sys_setsockopt+0xbf/0x160
+[ 157.462220] do_syscall_64+0x14d/0x610
+[ 157.462349] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fixes: 0912ea38de61 ("[IPV6] MROUTE: Add stats in multicast routing module method ip6_mr_forward().")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: Amit Cohen <amitc@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/ipv6/ip6mr.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 3594f1d9c68c..e4dd57976737 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -1988,10 +1988,10 @@ int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+
+ static inline int ip6mr_forward2_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+- __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+- IPSTATS_MIB_OUTFORWDATAGRAMS);
+- __IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)),
+- IPSTATS_MIB_OUTOCTETS, skb->len);
++ IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
++ IPSTATS_MIB_OUTFORWDATAGRAMS);
++ IP6_ADD_STATS(net, ip6_dst_idev(skb_dst(skb)),
++ IPSTATS_MIB_OUTOCTETS, skb->len);
+ return dst_output(net, sk, skb);
+ }
+
+--
+2.12.3
+
diff --git a/patches.fixes/0001-ipv4-route-fail-early-when-inet-dev-is-missing.patch b/patches.fixes/0001-ipv4-route-fail-early-when-inet-dev-is-missing.patch
new file mode 100644
index 0000000000..8298ef3260
--- /dev/null
+++ b/patches.fixes/0001-ipv4-route-fail-early-when-inet-dev-is-missing.patch
@@ -0,0 +1,52 @@
+From: Paolo Abeni <pabeni@redhat.com>
+Subject: ipv4/route: fail early when inet dev is missing
+Patch-mainline: v5.1-rc1
+Git-commit: 22c74764aa2943ecdf9f07c900d8a9c8ba6c9265
+References: git-fixes
+
+
+If a non local multicast packet reaches ip_route_input_rcu() while
+the ingress device IPv4 private data (in_dev) is NULL, we end up
+doing a NULL pointer dereference in IN_DEV_MFORWARD().
+
+Since the later call to ip_route_input_mc() is going to fail if
+!in_dev, we can fail early in such scenario and avoid the dangerous
+code path.
+
+v1 -> v2:
+ - clarified the commit message, no code changes
+
+Reported-by: Tianhao Zhao <tizhao@redhat.com>
+Fixes: e58e41596811 ("net: Enable support for VRF with ipv4 multicast")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/ipv4/route.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 0e0c40d54e34..291c1b13c583 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2105,12 +2105,13 @@ int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ struct in_device *in_dev = __in_dev_get_rcu(dev);
+ int our = 0;
+
+- if (in_dev)
+- our = ip_check_mc_rcu(in_dev, daddr, saddr,
++ if (!in_dev)
++ return -EINVAL;
++ our = ip_check_mc_rcu(in_dev, daddr, saddr,
+ ip_hdr(skb)->protocol);
+
+ /* check l3 master if no match yet */
+- if ((!in_dev || !our) && netif_is_l3_slave(dev)) {
++ if (!our && netif_is_l3_slave(dev)) {
+ struct in_device *l3_in_dev;
+
+ l3_in_dev = __in_dev_get_rcu(skb->dev);
+--
+2.12.3
+
diff --git a/patches.fixes/0001-iwlwifi-mvm-fix-firmware-statistics-usage.patch b/patches.fixes/0001-iwlwifi-mvm-fix-firmware-statistics-usage.patch
new file mode 100644
index 0000000000..ab6d11beba
--- /dev/null
+++ b/patches.fixes/0001-iwlwifi-mvm-fix-firmware-statistics-usage.patch
@@ -0,0 +1,112 @@
+From 606b9ab67784b02572269d0c76f28bbef9328c6b Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Thu, 4 Oct 2018 10:41:45 +0300
+Subject: [PATCH] iwlwifi: mvm: fix firmware statistics usage
+Git-commit: 606b9ab67784b02572269d0c76f28bbef9328c6b
+Patch-mainline: v5.1-rc1
+References: bsc#1129770
+
+The new (CDB) statistics API is used by non-CDB devices
+as well. Look at the right TLV flag to know which version
+of the statistics notification to use.
+To avoid confusion, remove the _cdb suffix from the
+structure name.
+While at it, remove a structure that was never used.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Fixes: 678d9b6dddea ("iwlwifi: mvm: update rx statistics cmd api")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/api/stats.h | 15 +++++----------
+ drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 10 +++++-----
+ 2 files changed, 10 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/stats.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/stats.h
+@@ -8,6 +8,7 @@
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
++ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -29,6 +30,7 @@
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
++ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -363,14 +365,7 @@ struct mvm_statistics_general_v8 {
+ u8 reserved[4 - (NUM_MAC_INDEX % 4)];
+ } __packed; /* STATISTICS_GENERAL_API_S_VER_8 */
+
+-struct mvm_statistics_general_cdb_v9 {
+- struct mvm_statistics_general_common_v19 common;
+- __le32 beacon_counter[NUM_MAC_INDEX_CDB];
+- u8 beacon_average_energy[NUM_MAC_INDEX_CDB];
+- u8 reserved[4 - (NUM_MAC_INDEX_CDB % 4)];
+-} __packed; /* STATISTICS_GENERAL_API_S_VER_9 */
+-
+-struct mvm_statistics_general_cdb {
++struct mvm_statistics_general {
+ struct mvm_statistics_general_common common;
+ __le32 beacon_counter[MAC_INDEX_AUX];
+ u8 beacon_average_energy[MAC_INDEX_AUX];
+@@ -435,11 +430,11 @@ struct iwl_notif_statistics_v11 {
+ struct mvm_statistics_load_v1 load_stats;
+ } __packed; /* STATISTICS_NTFY_API_S_VER_11 */
+
+-struct iwl_notif_statistics_cdb {
++struct iwl_notif_statistics {
+ __le32 flag;
+ struct mvm_statistics_rx rx;
+ struct mvm_statistics_tx tx;
+- struct mvm_statistics_general_cdb general;
++ struct mvm_statistics_general general;
+ struct mvm_statistics_load load_stats;
+ } __packed; /* STATISTICS_NTFY_API_S_VER_13 */
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+@@ -532,8 +532,8 @@ static void iwl_mvm_stat_iterator(void *
+ if (data->general) {
+ u16 vif_id = mvmvif->id;
+
+- if (iwl_mvm_is_cdb_supported(mvm)) {
+- struct mvm_statistics_general_cdb *general =
++ if (iwl_mvm_has_new_rx_stats_api(mvm)) {
++ struct mvm_statistics_general *general =
+ data->general;
+
+ mvmvif->beacon_stats.num_beacons =
+@@ -659,7 +659,7 @@ void iwl_mvm_handle_rx_statistics(struct
+ else
+ expected_size = sizeof(struct iwl_notif_statistics_v10);
+ } else {
+- expected_size = sizeof(struct iwl_notif_statistics_cdb);
++ expected_size = sizeof(struct iwl_notif_statistics);
+ }
+
+ if (iwl_rx_packet_payload_len(pkt) != expected_size) {
+@@ -690,7 +690,7 @@ void iwl_mvm_handle_rx_statistics(struct
+
+ flags = stats->flag;
+ } else {
+- struct iwl_notif_statistics_cdb *stats = (void *)&pkt->data;
++ struct iwl_notif_statistics *stats = (void *)&pkt->data;
+
+ data.mac_id = stats->rx.general.mac_id;
+ data.beacon_filter_average_energy =
+@@ -729,7 +729,7 @@ void iwl_mvm_handle_rx_statistics(struct
+ bytes = (void *)&v11->load_stats.byte_count;
+ air_time = (void *)&v11->load_stats.air_time;
+ } else {
+- struct iwl_notif_statistics_cdb *stats = (void *)&pkt->data;
++ struct iwl_notif_statistics *stats = (void *)&pkt->data;
+
+ energy = (void *)&stats->load_stats.avg_energy;
+ bytes = (void *)&stats->load_stats.byte_count;
diff --git a/patches.fixes/0001-net-ncsi-Fix-AEN-HNCDSC-packet-length.patch b/patches.fixes/0001-net-ncsi-Fix-AEN-HNCDSC-packet-length.patch
new file mode 100644
index 0000000000..72f2faf0ed
--- /dev/null
+++ b/patches.fixes/0001-net-ncsi-Fix-AEN-HNCDSC-packet-length.patch
@@ -0,0 +1,32 @@
+From: Samuel Mendoza-Jonas <sam@mendozajonas.com>
+Subject: net/ncsi: Fix AEN HNCDSC packet length
+Patch-mainline: v4.14-rc6
+Git-commit: 6850d0f8b2542112629061808ed950b35eb982e4
+References: git-fixes
+
+Correct the value of the HNCDSC AEN packet.
+Fixes: 7a82ecf4cfb85 "net/ncsi: NCSI AEN packet handler"
+
+Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/ncsi/ncsi-aen.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c
+index 6898e7229285..f135938bf781 100644
+--- a/net/ncsi/ncsi-aen.c
++++ b/net/ncsi/ncsi-aen.c
+@@ -187,7 +187,7 @@ static struct ncsi_aen_handler {
+ } ncsi_aen_handlers[] = {
+ { NCSI_PKT_AEN_LSC, 12, ncsi_aen_handler_lsc },
+ { NCSI_PKT_AEN_CR, 4, ncsi_aen_handler_cr },
+- { NCSI_PKT_AEN_HNCDSC, 4, ncsi_aen_handler_hncdsc }
++ { NCSI_PKT_AEN_HNCDSC, 8, ncsi_aen_handler_hncdsc }
+ };
+
+ int ncsi_aen_handler(struct ncsi_dev_priv *ndp, struct sk_buff *skb)
+--
+2.12.3
+
diff --git a/patches.fixes/0001-net-ncsi-Stop-monitor-if-channel-times-out-or-is-ina.patch b/patches.fixes/0001-net-ncsi-Stop-monitor-if-channel-times-out-or-is-ina.patch
new file mode 100644
index 0000000000..75aeda75ac
--- /dev/null
+++ b/patches.fixes/0001-net-ncsi-Stop-monitor-if-channel-times-out-or-is-ina.patch
@@ -0,0 +1,87 @@
+From: Samuel Mendoza-Jonas <sam@mendozajonas.com>
+Subject: net/ncsi: Stop monitor if channel times out or is inactive
+Patch-mainline: v4.14-rc6
+Git-commit: 0795fb2021f07969949f523ea33c39785bfae9d6
+References: git-fixes
+
+ncsi_channel_monitor() misses stopping the channel monitor in several
+places that it should, causing a WARN_ON_ONCE() to trigger when the
+monitor is re-started later, eg:
+
+[ 459.040000] WARNING: CPU: 0 PID: 1093 at net/ncsi/ncsi-manage.c:269 ncsi_start_channel_monitor+0x7c/0x90
+[ 459.040000] CPU: 0 PID: 1093 Comm: kworker/0:3 Not tainted 4.10.17-gaca2fdd #140
+[ 459.040000] Hardware name: ASpeed SoC
+[ 459.040000] Workqueue: events ncsi_dev_work
+[ 459.040000] [<80010094>] (unwind_backtrace) from [<8000d950>] (show_stack+0x20/0x24)
+[ 459.040000] [<8000d950>] (show_stack) from [<801dbf70>] (dump_stack+0x20/0x28)
+[ 459.040000] [<801dbf70>] (dump_stack) from [<80018d7c>] (__warn+0xe0/0x108)
+[ 459.040000] [<80018d7c>] (__warn) from [<80018e70>] (warn_slowpath_null+0x30/0x38)
+[ 459.040000] [<80018e70>] (warn_slowpath_null) from [<803f6a08>] (ncsi_start_channel_monitor+0x7c/0x90)
+[ 459.040000] [<803f6a08>] (ncsi_start_channel_monitor) from [<803f7664>] (ncsi_configure_channel+0xdc/0x5fc)
+[ 459.040000] [<803f7664>] (ncsi_configure_channel) from [<803f8160>] (ncsi_dev_work+0xac/0x474)
+[ 459.040000] [<803f8160>] (ncsi_dev_work) from [<8002d244>] (process_one_work+0x1e0/0x450)
+[ 459.040000] [<8002d244>] (process_one_work) from [<8002d510>] (worker_thread+0x5c/0x570)
+[ 459.040000] [<8002d510>] (worker_thread) from [<80033614>] (kthread+0x124/0x164)
+[ 459.040000] [<80033614>] (kthread) from [<8000a5e8>] (ret_from_fork+0x14/0x2c)
+
+This also updates the monitor instead of just returning if
+ncsi_xmit_cmd() fails to send the get-link-status command so that the
+monitor properly times out.
+
+Fixes: e6f44ed6d04d3 "net/ncsi: Package and channel management"
+
+Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/ncsi/ncsi-manage.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
+index b6a449aa9d4b..b022deb39d31 100644
+--- a/net/ncsi/ncsi-manage.c
++++ b/net/ncsi/ncsi-manage.c
+@@ -202,11 +202,15 @@ static void ncsi_channel_monitor(unsigned long data)
+ monitor_state = nc->monitor.state;
+ spin_unlock_irqrestore(&nc->lock, flags);
+
+- if (!enabled || chained)
++ if (!enabled || chained) {
++ ncsi_stop_channel_monitor(nc);
+ return;
++ }
+ if (state != NCSI_CHANNEL_INACTIVE &&
+- state != NCSI_CHANNEL_ACTIVE)
++ state != NCSI_CHANNEL_ACTIVE) {
++ ncsi_stop_channel_monitor(nc);
+ return;
++ }
+
+ switch (monitor_state) {
+ case NCSI_CHANNEL_MONITOR_START:
+@@ -217,12 +221,9 @@ static void ncsi_channel_monitor(unsigned long data)
+ nca.type = NCSI_PKT_CMD_GLS;
+ nca.req_flags = 0;
+ ret = ncsi_xmit_cmd(&nca);
+- if (ret) {
++ if (ret)
+ netdev_err(ndp->ndev.dev, "Error %d sending GLS\n",
+ ret);
+- return;
+- }
+-
+ break;
+ case NCSI_CHANNEL_MONITOR_WAIT ... NCSI_CHANNEL_MONITOR_WAIT_MAX:
+ break;
+@@ -233,6 +234,8 @@ static void ncsi_channel_monitor(unsigned long data)
+ ndp->flags |= NCSI_DEV_RESHUFFLE;
+ }
+
++ ncsi_stop_channel_monitor(nc);
++
+ spin_lock_irqsave(&nc->lock, flags);
+ nc->state = NCSI_CHANNEL_INVISIBLE;
+ spin_unlock_irqrestore(&nc->lock, flags);
+--
+2.12.3
+
diff --git a/patches.fixes/0001-net-sysfs-Fix-mem-leak-in-netdev_register_kobject.patch b/patches.fixes/0001-net-sysfs-Fix-mem-leak-in-netdev_register_kobject.patch
new file mode 100644
index 0000000000..51a8479885
--- /dev/null
+++ b/patches.fixes/0001-net-sysfs-Fix-mem-leak-in-netdev_register_kobject.patch
@@ -0,0 +1,57 @@
+From: YueHaibing <yuehaibing@huawei.com>
+Subject: net-sysfs: Fix mem leak in netdev_register_kobject
+Patch-mainline: v5.1-rc1
+Git-commit: 895a5e96dbd6386c8e78e5b78e067dcc67b7f0ab
+References: git-fixes
+
+syzkaller report this:
+BUG: memory leak
+unreferenced object 0xffff88837a71a500 (size 256):
+ comm "syz-executor.2", pid 9770, jiffies 4297825125 (age 17.843s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
+ ff ff ff ff ff ff ff ff 20 c0 ef 86 ff ff ff ff ........ .......
+ backtrace:
+ [<00000000db12624b>] netdev_register_kobject+0x124/0x2e0 net/core/net-sysfs.c:1751
+ [<00000000dc49a994>] register_netdevice+0xcc1/0x1270 net/core/dev.c:8516
+ [<00000000e5f3fea0>] tun_set_iff drivers/net/tun.c:2649 [inline]
+ [<00000000e5f3fea0>] __tun_chr_ioctl+0x2218/0x3d20 drivers/net/tun.c:2883
+ [<000000001b8ac127>] vfs_ioctl fs/ioctl.c:46 [inline]
+ [<000000001b8ac127>] do_vfs_ioctl+0x1a5/0x10e0 fs/ioctl.c:690
+ [<0000000079b269f8>] ksys_ioctl+0x89/0xa0 fs/ioctl.c:705
+ [<00000000de649beb>] __do_sys_ioctl fs/ioctl.c:712 [inline]
+ [<00000000de649beb>] __se_sys_ioctl fs/ioctl.c:710 [inline]
+ [<00000000de649beb>] __x64_sys_ioctl+0x74/0xb0 fs/ioctl.c:710
+ [<000000007ebded1e>] do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290
+ [<00000000db315d36>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [<00000000115be9bb>] 0xffffffffffffffff
+
+It should call kset_unregister to free 'dev->queues_kset'
+in error path of register_queue_kobjects, otherwise will cause a mem leak.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 1d24eb4815d1 ("xps: Transmit Packet Steering")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/core/net-sysfs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index 74c7cb731672..2beefc2f4222 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1415,6 +1415,9 @@ static int register_queue_kobjects(struct net_device *dev)
+ error:
+ netdev_queue_update_kobjects(dev, txq, 0);
+ net_rx_queue_update_kobjects(dev, rxq, 0);
++#ifdef CONFIG_SYSFS
++ kset_unregister(dev->queues_kset);
++#endif
+ return error;
+ }
+
+--
+2.12.3
+
diff --git a/patches.fixes/0001-netfilter-check-for-seqadj-ext-existence-before-addi.patch b/patches.fixes/0001-netfilter-check-for-seqadj-ext-existence-before-addi.patch
new file mode 100644
index 0000000000..c34e087a8d
--- /dev/null
+++ b/patches.fixes/0001-netfilter-check-for-seqadj-ext-existence-before-addi.patch
@@ -0,0 +1,64 @@
+From: Xin Long <lucien.xin@gmail.com>
+Subject: netfilter: check for seqadj ext existence before adding it in
+ nf_nat_setup_info
+Patch-mainline: v4.13
+Git-commit: ab6dd1beac7be3c17f8bf3d38bdf29ecb7293f1e
+References: git-fixes
+
+Commit 4440a2ab3b9f ("netfilter: synproxy: Check oom when adding synproxy
+and seqadj ct extensions") wanted to drop the packet when it fails to add
+seqadj ext due to no memory by checking if nfct_seqadj_ext_add returns
+NULL.
+
+But that nfct_seqadj_ext_add returns NULL can also happen when seqadj ext
+already exists in a nf_conn. It will cause that userspace protocol doesn't
+work when both dnat and snat are configured.
+
+Li Shuang found this issue in the case:
+
+Topo:
+ ftp client router ftp server
+ 10.167.131.2 <-> 10.167.131.254 10.167.141.254 <-> 10.167.141.1
+
+Rules:
+ # iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 21 -j \
+ DNAT --to-destination 10.167.141.1
+ # iptables -t nat -A POSTROUTING -o eth2 -p tcp -m tcp --dport 21 -j \
+ SNAT --to-source 10.167.141.254
+
+In router, when both dnat and snat are added, nf_nat_setup_info will be
+called twice. The packet can be dropped at the 2nd time for DNAT due to
+seqadj ext is already added at the 1st time for SNAT.
+
+This patch is to fix it by checking for seqadj ext existence before adding
+it, so that the packet will not be dropped if seqadj ext already exists.
+
+Note that as Florian mentioned, as a long term, we should review ext_add()
+behaviour, it's better to return a pointer to the existing ext instead.
+
+Fixes: 4440a2ab3b9f ("netfilter: synproxy: Check oom when adding synproxy and seqadj ct extensions")
+Reported-by: Li Shuang <shuali@redhat.com>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/netfilter/nf_nat_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
+index eb541786ccb7..b1d3740ae36a 100644
+--- a/net/netfilter/nf_nat_core.c
++++ b/net/netfilter/nf_nat_core.c
+@@ -441,7 +441,7 @@ nf_nat_setup_info(struct nf_conn *ct,
+ else
+ ct->status |= IPS_DST_NAT;
+
+- if (nfct_help(ct))
++ if (nfct_help(ct) && !nfct_seqadj(ct))
+ if (!nfct_seqadj_ext_add(ct))
+ return NF_DROP;
+ }
+--
+2.12.3
+
diff --git a/patches.fixes/0001-rtnetlink-bring-NETDEV_CHANGEUPPER-event-process-bac.patch b/patches.fixes/0001-rtnetlink-bring-NETDEV_CHANGEUPPER-event-process-bac.patch
new file mode 100644
index 0000000000..e8b95b990a
--- /dev/null
+++ b/patches.fixes/0001-rtnetlink-bring-NETDEV_CHANGEUPPER-event-process-bac.patch
@@ -0,0 +1,36 @@
+From: Xin Long <lucien.xin@gmail.com>
+Subject: rtnetlink: bring NETDEV_CHANGEUPPER event process back in
+ rtnetlink_event
+Patch-mainline: v4.14-rc6
+Git-commit: dc709f375743ebf5c9326cc9b946f6f09a34ac44
+References: git-fixes
+
+libteam needs this event notification in userspace when dev's master
+dev has been changed. After this, the redundant notifications issue
+would be fixed in the later patch 'rtnetlink: check DO_SETLINK_NOTIFY
+correctly in do_setlink'.
+
+Fixes: b6b36eb23a46 ("rtnetlink: Do not generate notifications for NETDEV_CHANGEUPPER event")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/core/rtnetlink.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 8e44fd597f46..ab98c1c8b6f3 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -4286,6 +4286,7 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
+ case NETDEV_BONDING_FAILOVER:
+ case NETDEV_POST_TYPE_CHANGE:
+ case NETDEV_NOTIFY_PEERS:
++ case NETDEV_CHANGEUPPER:
+ case NETDEV_RESEND_IGMP:
+ case NETDEV_CHANGEINFODATA:
+ case NETDEV_CHANGE_TX_QUEUE_LEN:
+--
+2.12.3
+
diff --git a/patches.fixes/0001-rtnetlink-bring-NETDEV_CHANGE_TX_QUEUE_LEN-event-pro.patch b/patches.fixes/0001-rtnetlink-bring-NETDEV_CHANGE_TX_QUEUE_LEN-event-pro.patch
new file mode 100644
index 0000000000..a4d6dc836d
--- /dev/null
+++ b/patches.fixes/0001-rtnetlink-bring-NETDEV_CHANGE_TX_QUEUE_LEN-event-pro.patch
@@ -0,0 +1,39 @@
+From: Xin Long <lucien.xin@gmail.com>
+Subject: rtnetlink: bring NETDEV_CHANGE_TX_QUEUE_LEN event process
+ back in rtnetlink_event
+Patch-mainline: v4.14-rc6
+Git-commit: ebdcf0450b020748c2dab6bfe44a5ac3c5159fb0
+References: git-fixes
+
+The same fix for changing mtu in the patch 'rtnetlink: bring
+NETDEV_CHANGEMTU event process back in rtnetlink_event' is
+needed for changing tx_queue_len.
+
+Note that the redundant notifications issue for tx_queue_len
+will be fixed in the later patch 'rtnetlink: do not send
+notification for tx_queue_len in do_setlink'.
+
+Fixes: 27b3b551d8a7 ("rtnetlink: Do not generate notifications for NETDEV_CHANGE_TX_QUEUE_LEN event")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/core/rtnetlink.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 72053ed7c891..bf473604f33d 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -4287,6 +4287,7 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
+ case NETDEV_NOTIFY_PEERS:
+ case NETDEV_RESEND_IGMP:
+ case NETDEV_CHANGEINFODATA:
++ case NETDEV_CHANGE_TX_QUEUE_LEN:
+ rtmsg_ifinfo_event(RTM_NEWLINK, dev, 0, rtnl_get_event(event),
+ GFP_KERNEL);
+ break;
+--
+2.12.3
+
diff --git a/patches.fixes/0001-rtnetlink-bring-NETDEV_POST_TYPE_CHANGE-event-proces.patch b/patches.fixes/0001-rtnetlink-bring-NETDEV_POST_TYPE_CHANGE-event-proces.patch
new file mode 100644
index 0000000000..b5bc0f0be9
--- /dev/null
+++ b/patches.fixes/0001-rtnetlink-bring-NETDEV_POST_TYPE_CHANGE-event-proces.patch
@@ -0,0 +1,39 @@
+From: Xin Long <lucien.xin@gmail.com>
+Subject: rtnetlink: bring NETDEV_POST_TYPE_CHANGE event process back
+ in rtnetlink_event
+Patch-mainline: v4.14-rc6
+Git-commit: e6e6659446c87057aede26a39d9f16b19001716f
+References: git-fixes
+
+As I said in patch 'rtnetlink: bring NETDEV_CHANGEMTU event process back
+in rtnetlink_event', removing NETDEV_POST_TYPE_CHANGE event was not the
+right fix for the redundant notifications issue.
+
+So bring this event process back to rtnetlink_event and the old redundant
+notifications issue would be fixed in the later patch 'rtnetlink: check
+DO_SETLINK_NOTIFY correctly in do_setlink'.
+
+Fixes: aef091ae58aa ("rtnetlink: Do not generate notifications for POST_TYPE_CHANGE event")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/core/rtnetlink.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index bf473604f33d..8e44fd597f46 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -4284,6 +4284,7 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
+ case NETDEV_CHANGENAME:
+ case NETDEV_FEAT_CHANGE:
+ case NETDEV_BONDING_FAILOVER:
++ case NETDEV_POST_TYPE_CHANGE:
+ case NETDEV_NOTIFY_PEERS:
+ case NETDEV_RESEND_IGMP:
+ case NETDEV_CHANGEINFODATA:
+--
+2.12.3
+
diff --git a/patches.fixes/0001-rtnetlink-check-DO_SETLINK_NOTIFY-correctly-in-do_se.patch b/patches.fixes/0001-rtnetlink-check-DO_SETLINK_NOTIFY-correctly-in-do_se.patch
new file mode 100644
index 0000000000..416f553052
--- /dev/null
+++ b/patches.fixes/0001-rtnetlink-check-DO_SETLINK_NOTIFY-correctly-in-do_se.patch
@@ -0,0 +1,46 @@
+From: Xin Long <lucien.xin@gmail.com>
+Subject: rtnetlink: check DO_SETLINK_NOTIFY correctly in do_setlink
+Patch-mainline: v4.14-rc6
+Git-commit: 64ff90cc2e6f42596d7a0c37e41dc95292bb63b1
+References: git-fixes
+
+The check 'status & DO_SETLINK_NOTIFY' in do_setlink doesn't really
+work after status & DO_SETLINK_MODIFIED, as:
+
+ DO_SETLINK_MODIFIED 0x1
+ DO_SETLINK_NOTIFY 0x3
+
+Considering that notifications are suppposed to be sent only when
+status have the flag DO_SETLINK_NOTIFY, the right check would be:
+
+ (status & DO_SETLINK_NOTIFY) == DO_SETLINK_NOTIFY
+
+This would avoid lots of duplicated notifications when setting some
+properties of a link.
+
+Fixes: ba9989069f4e ("rtnl/do_setlink(): notify when a netdev is modified")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: David Ahern <dsahern@gmail.com>
+Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/core/rtnetlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index ab98c1c8b6f3..3e98fb557598 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2248,7 +2248,7 @@ static int do_setlink(const struct sk_buff *skb,
+
+ errout:
+ if (status & DO_SETLINK_MODIFIED) {
+- if (status & DO_SETLINK_NOTIFY)
++ if ((status & DO_SETLINK_NOTIFY) == DO_SETLINK_NOTIFY)
+ netdev_state_change(dev);
+
+ if (err < 0)
+--
+2.12.3
+
diff --git a/patches.fixes/PM-wakeup-Rework-wakeup-source-timer-cancellation.patch b/patches.fixes/PM-wakeup-Rework-wakeup-source-timer-cancellation.patch
new file mode 100644
index 0000000000..b9a19ea6f6
--- /dev/null
+++ b/patches.fixes/PM-wakeup-Rework-wakeup-source-timer-cancellation.patch
@@ -0,0 +1,55 @@
+From 1fad17fb1bbcd73159c2b992668a6957ecc5af8a Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Fri, 8 Mar 2019 15:23:11 +0530
+Subject: [PATCH] PM / wakeup: Rework wakeup source timer cancellation
+Git-commit: 1fad17fb1bbcd73159c2b992668a6957ecc5af8a
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+If wakeup_source_add() is called right after wakeup_source_remove()
+for the same wakeup source, timer_setup() may be called for a
+potentially scheduled timer which is incorrect.
+
+To avoid that, move the wakeup source timer cancellation from
+wakeup_source_drop() to wakeup_source_remove().
+
+Moreover, make wakeup_source_remove() clear the timer function after
+canceling the timer to let wakeup_source_not_registered() treat
+unregistered wakeup sources in the same way as the ones that have
+never been registered.
+
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: 4.4+ <stable@vger.kernel.org> # 4.4+
+[ rjw: Subject, changelog, merged two patches together ]
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/base/power/wakeup.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/base/power/wakeup.c
++++ b/drivers/base/power/wakeup.c
+@@ -113,7 +113,6 @@ void wakeup_source_drop(struct wakeup_so
+ if (!ws)
+ return;
+
+- del_timer_sync(&ws->timer);
+ __pm_relax(ws);
+ }
+ EXPORT_SYMBOL_GPL(wakeup_source_drop);
+@@ -200,6 +199,13 @@ void wakeup_source_remove(struct wakeup_
+ list_del_rcu(&ws->entry);
+ spin_unlock_irqrestore(&events_lock, flags);
+ synchronize_srcu(&wakeup_srcu);
++
++ del_timer_sync(&ws->timer);
++ /*
++ * Clear timer.function to make wakeup_source_not_registered() treat
++ * this wakeup source as not registered.
++ */
++ ws->timer.function = NULL;
+ }
+ EXPORT_SYMBOL_GPL(wakeup_source_remove);
+
diff --git a/patches.fixes/SMB3-Fix-SMB3.1.1-guest-mounts-to-Samba.patch b/patches.fixes/SMB3-Fix-SMB3.1.1-guest-mounts-to-Samba.patch
new file mode 100644
index 0000000000..5968a06ada
--- /dev/null
+++ b/patches.fixes/SMB3-Fix-SMB3.1.1-guest-mounts-to-Samba.patch
@@ -0,0 +1,54 @@
+From 8c11a607d1d9cd6e7f01fd6b03923597fb0ef95a Mon Sep 17 00:00:00 2001
+From: Steve French <stfrench@microsoft.com>
+Date: Fri, 22 Mar 2019 22:31:17 -0500
+Subject: [PATCH] SMB3: Fix SMB3.1.1 guest mounts to Samba
+Git-commit: 8c11a607d1d9cd6e7f01fd6b03923597fb0ef95a
+Patch-mainline: v5.1-rc2
+References: bsc#1051510
+
+Workaround problem with Samba responses to SMB3.1.1
+null user (guest) mounts. The server doesn't set the
+expected flag in the session setup response so we have
+to do a similar check to what is done in smb3_validate_negotiate
+where we also check if the user is a null user (but not sec=krb5
+since username might not be passed in on mount for Kerberos case).
+
+Note that the commit below tightened the conditions and forced signing
+for the SMB2-TreeConnect commands as per MS-SMB2.
+However, this should only apply to normal user sessions and not for
+cases where there is no user (even if server forgets to set the flag
+in the response) since we don't have anything useful to sign with.
+This is especially important now that the more secure SMB3.1.1 protocol
+is in the default dialect list.
+
+An earlier patch ("cifs: allow guest mounts to work for smb3.11") fixed
+the guest mounts to Windows.
+
+ Fixes: 6188f28bf608 ("Tree connect for SMB3.1.1 must be signed for non-encrypted shares")
+
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Paulo Alcantara <palcantara@suse.de>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Acked-by: Paulo Alcantara <palcantar@suse.de>
+---
+ fs/cifs/smb2pdu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -1421,10 +1421,13 @@ SMB2_tcon(const unsigned int xid, struct
+ /*
+ * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1
+ * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1
++ * (Samba servers don't always set the flag so also check if null user)
+ */
+ if ((ses->server->dialect == SMB311_PROT_ID) &&
+ !encryption_required(tcon) &&
+- !(ses->session_flags & (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)))
++ !(ses->session_flags &
++ (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) &&
++ ((ses->user_name != NULL) || (ses->sectype == Kerberos)))
+ req->hdr.sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
+
+ inc_rfc1001_len(req, unc_path_len - 1 /* pad */);
diff --git a/patches.fixes/cifs-allow-guest-mounts-to-work-for-smb3.11.patch b/patches.fixes/cifs-allow-guest-mounts-to-work-for-smb3.11.patch
new file mode 100644
index 0000000000..b1c72447a7
--- /dev/null
+++ b/patches.fixes/cifs-allow-guest-mounts-to-work-for-smb3.11.patch
@@ -0,0 +1,43 @@
+From e71ab2aa06f731a944993120b0eef1556c63b81c Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+Date: Thu, 21 Mar 2019 14:59:02 +1000
+Subject: [PATCH] cifs: allow guest mounts to work for smb3.11
+Git-commit: e71ab2aa06f731a944993120b0eef1556c63b81c
+Patch-mainline: v5.1-rc2
+References: bsc#1051510
+
+Fix Guest/Anonymous sessions so that they work with SMB 3.11.
+
+The commit noted below tightened the conditions and forced signing for
+the SMB2-TreeConnect commands as per MS-SMB2.
+However, this should only apply to normal user sessions and not for
+Guest/Anonumous sessions.
+
+Fixes: 6188f28bf608 ("Tree connect for SMB3.1.1 must be signed for non-encrypted shares")
+
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Acked-by: Paulo Alcantara <palcantara@suse.de>
+---
+ fs/cifs/smb2pdu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -1418,9 +1418,13 @@ SMB2_tcon(const unsigned int xid, struct
+ iov[1].iov_base = unc_path;
+ iov[1].iov_len = unc_path_len;
+
+- /* 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 */
++ /*
++ * 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1
++ * unless it is guest or anonymous user. See MS-SMB2 3.2.5.3.1
++ */
+ if ((ses->server->dialect == SMB311_PROT_ID) &&
+- !encryption_required(tcon))
++ !encryption_required(tcon) &&
++ !(ses->session_flags & (SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)))
+ req->hdr.sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
+
+ inc_rfc1001_len(req, unc_path_len - 1 /* pad */);
diff --git a/patches.fixes/device-property-Fix-the-length-used-in-PROPERTY_ENTR.patch b/patches.fixes/device-property-Fix-the-length-used-in-PROPERTY_ENTR.patch
new file mode 100644
index 0000000000..eef6e2d93f
--- /dev/null
+++ b/patches.fixes/device-property-Fix-the-length-used-in-PROPERTY_ENTR.patch
@@ -0,0 +1,40 @@
+From 2b6e492467c78183bb629bb0a100ea3509b615a5 Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Wed, 23 Jan 2019 17:44:16 +0300
+Subject: [PATCH] device property: Fix the length used in PROPERTY_ENTRY_STRING()
+Git-commit: 2b6e492467c78183bb629bb0a100ea3509b615a5
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+With string type property entries we need to use
+sizeof(const char *) instead of the number of characters as
+the length of the entry.
+
+If the string was shorter then sizeof(const char *),
+attempts to read it would have failed with -EOVERFLOW. The
+problem has been hidden because all build-in string
+properties have had a string longer then 8 characters until
+now.
+
+Fixes: a85f42047533 ("device property: helper macros for property entry creation")
+Cc: 4.5+ <stable@vger.kernel.org> # 4.5+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/linux/property.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/property.h
++++ b/include/linux/property.h
+@@ -254,7 +254,7 @@ struct property_entry {
+ #define PROPERTY_ENTRY_STRING(_name_, _val_) \
+ (struct property_entry) { \
+ .name = _name_, \
+- .length = sizeof(_val_), \
++ .length = sizeof(const char *), \
+ .is_string = true, \
+ { .value = { .str = _val_ } }, \
+ }
diff --git a/patches.fixes/ext4-Avoid-panic-during-forced-reboot.patch b/patches.fixes/ext4-Avoid-panic-during-forced-reboot.patch
new file mode 100644
index 0000000000..ec8021da4c
--- /dev/null
+++ b/patches.fixes/ext4-Avoid-panic-during-forced-reboot.patch
@@ -0,0 +1,61 @@
+From 15b830d4e877ed908c733ab3219801d1026af256 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Tue, 12 Mar 2019 10:38:19 +0100
+Subject: [PATCH] ext4: Avoid panic during forced reboot
+Patch-mainline: Not yet, submitted March 2019
+References: bsc#1126356
+
+When admin calls "reboot -f" - i.e., does a hard system reboot by
+directly calling reboot(2) - ext4 filesystem mounted with errors=panic
+can panic the system. This happens because the underlying device gets
+disabled without unmounting the filesystem and thus some syscall running
+in parallel to reboot(2) can result in the filesystem getting IO errors.
+
+This is somewhat surprising to the users so try improve the behavior by
+switching to errors=remount-ro behavior when the system is running
+reboot(2).
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+---
+ fs/ext4/super.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -388,6 +388,12 @@ static void ext4_journal_commit_callback
+ spin_unlock(&sbi->s_md_lock);
+ }
+
++static bool system_going_down(void)
++{
++ return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF
++ || system_state == SYSTEM_RESTART;
++}
++
+ /* Deal with the reporting of failure conditions on a filesystem such as
+ * inconsistencies detected or read IO failures.
+ *
+@@ -415,7 +421,12 @@ static void ext4_handle_error(struct sup
+ if (journal)
+ jbd2_journal_abort(journal, -EIO);
+ }
+- if (test_opt(sb, ERRORS_RO)) {
++ /*
++ * We force ERRORS_RO behavior when system is rebooting. Otherwise we
++ * could panic during 'reboot -f' as the underlying device got already
++ * disabled.
++ */
++ if (test_opt(sb, ERRORS_RO) || system_going_down()) {
+ ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only");
+ /*
+ * Make sure updated value of ->s_mount_flags will be visible
+@@ -423,8 +434,7 @@ static void ext4_handle_error(struct sup
+ */
+ smp_wmb();
+ sb->s_flags |= MS_RDONLY;
+- }
+- if (test_opt(sb, ERRORS_PANIC)) {
++ } else if (test_opt(sb, ERRORS_PANIC)) {
+ if (EXT4_SB(sb)->s_journal &&
+ !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
+ return;
diff --git a/patches.fixes/mac80211-Fix-Tx-aggregation-session-tear-down-with-I.patch b/patches.fixes/mac80211-Fix-Tx-aggregation-session-tear-down-with-I.patch
new file mode 100644
index 0000000000..51d95dc1b3
--- /dev/null
+++ b/patches.fixes/mac80211-Fix-Tx-aggregation-session-tear-down-with-I.patch
@@ -0,0 +1,58 @@
+From 6157ca0d6bfe437691b1e98a62e2efe12b6714da Mon Sep 17 00:00:00 2001
+From: Ilan Peer <ilan.peer@intel.com>
+Date: Wed, 6 Feb 2019 13:17:21 +0200
+Subject: [PATCH] mac80211: Fix Tx aggregation session tear down with ITXQs
+Git-commit: 6157ca0d6bfe437691b1e98a62e2efe12b6714da
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+When mac80211 requests the low level driver to stop an ongoing
+Tx aggregation, the low level driver is expected to call
+ieee80211_stop_tx_ba_cb_irqsafe() to indicate that it is ready
+to stop the session. The callback in turn schedules a worker
+to complete the session tear down, which in turn also handles
+the relevant state for the intermediate Tx queue.
+
+However, as this flow in asynchronous, the intermediate queue
+should be stopped and not continue servicing frames, as in
+such a case frames that are dequeued would be marked as part
+of an aggregation, although the aggregation is already been
+stopped.
+
+Fix this by stopping the intermediate Tx queue, before
+calling the low level driver to stop the Tx aggregation.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/agg-tx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+index 69e831bc317b..54821fb1a960 100644
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -8,7 +8,7 @@
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007-2010, Intel Corporation
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
+- * Copyright (C) 2018 Intel Corporation
++ * Copyright (C) 2018 - 2019 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -366,6 +366,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+
+ set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
+
++ ieee80211_agg_stop_txq(sta, tid);
++
+ spin_unlock_bh(&sta->lock);
+
+ ht_dbg(sta->sdata, "Tx BA session stop requested for %pM tid %u\n",
+--
+2.16.4
+
diff --git a/patches.fixes/mac80211_hwsim-propagate-genlmsg_reply-return-code.patch b/patches.fixes/mac80211_hwsim-propagate-genlmsg_reply-return-code.patch
new file mode 100644
index 0000000000..6a10eb79f4
--- /dev/null
+++ b/patches.fixes/mac80211_hwsim-propagate-genlmsg_reply-return-code.patch
@@ -0,0 +1,34 @@
+From 17407715240456448e4989bee46ffc93991add83 Mon Sep 17 00:00:00 2001
+From: Li RongQing <lirongqing@baidu.com>
+Date: Tue, 19 Feb 2019 13:12:40 +0800
+Subject: [PATCH] mac80211_hwsim: propagate genlmsg_reply return code
+Git-commit: 17407715240456448e4989bee46ffc93991add83
+Patch-mainline: v5.0-rc8
+References: bsc#1051510
+
+genlmsg_reply can fail, so propagate its return code
+
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/mac80211_hwsim.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 320edcac4699..6359053bd0c7 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3554,7 +3554,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ goto out_err;
+ }
+
+- genlmsg_reply(skb, info);
++ res = genlmsg_reply(skb, info);
+ break;
+ }
+
+--
+2.16.4
+
diff --git a/patches.suse/ACPI-acpi_pad-Do-not-launch-acpi_pad-threads-on-idle-cpus.patch b/patches.suse/ACPI-acpi_pad-Do-not-launch-acpi_pad-threads-on-idle-cpus.patch
new file mode 100644
index 0000000000..37144a801a
--- /dev/null
+++ b/patches.suse/ACPI-acpi_pad-Do-not-launch-acpi_pad-threads-on-idle-cpus.patch
@@ -0,0 +1,105 @@
+From: Chen Yu <yu.c.chen@intel.com>
+Date: Sat, 5 May 2018 19:53:22 +0800
+Subject: ACPI: acpi_pad: Do not launch acpi_pad threads on idle cpus
+Patch-mainline: never, mainline wants to replace acpi_pad with the idle-inject framework
+References: bsc#1113399
+
+According to current implementation of acpi_pad driver,
+it does not make sense to spawn any power saving threads
+on the cpus which are already idle - it might bring
+unnecessary overhead on these idle cpus and causes power
+waste. So verify the condition that if the number of 'busy'
+cpus exceeds the amount of the 'forced idle' cpus is met.
+This is applicable due to round-robin attribute of the
+power saving threads, otherwise ignore the setting/ACPI
+notification.
+
+Suggested-by: Lenny Szubowicz <lszubowi@redhat.com>
+Suggested-by: Len Brown <lenb@kernel.org>
+Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
+Cc: Lenny Szubowicz <lszubowi@redhat.com>
+Cc: Len Brown <lenb@kernel.org>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Cc: Rui Zhang <rui.zhang@intel.com>
+Cc: linux-acpi@vger.kernel.org
+Signed-off-by: Chen Yu <yu.c.chen@intel.com>
+Acked-by: Giovanni Gherdovich <ggherdovich@suse.cz>
+---
+ drivers/acpi/acpi_pad.c | 54 +++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 53 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/acpi_pad.c
++++ b/drivers/acpi/acpi_pad.c
+@@ -26,6 +26,8 @@
+ #include <linux/tick.h>
+ #include <linux/slab.h>
+ #include <linux/acpi.h>
++#include <linux/kernel_stat.h>
++#include <linux/jiffies.h>
+ #include <asm/mwait.h>
+ #include <xen/xen.h>
+
+@@ -254,12 +256,62 @@ static void set_power_saving_task_num(un
+ }
+ }
+
++/*
++ * Extra acpi_pad threads should not be created until
++ * the requested idle count is less than/equals to the
++ * number of the busy cpus - it does not make sense to
++ * throttle the idle cpus.
++ */
++#define SAMPLE_INTERVAL_JIF 20
++
++static u64 get_idle_time(int cpu)
++{
++ u64 idle, idle_usecs = -1ULL;
++
++ idle_usecs = get_cpu_idle_time_us(cpu, NULL);
++
++ if (idle_usecs == -1ULL)
++ idle = kcpustat_cpu(cpu).cpustat[CPUTIME_IDLE];
++ else
++ idle = idle_usecs * NSEC_PER_USEC;
++
++ return idle;
++}
++
++static bool idle_nr_valid(unsigned int num_cpus)
++{
++ int busy_nr = 0, i = 0, load_thresh = 100 - idle_pct;
++
++ if (!num_cpus)
++ return true;
++
++ for_each_online_cpu(i) {
++ u64 wall_time, idle_time;
++ unsigned int elapsed_delta, idle_delta, load;
++
++ wall_time = jiffies64_to_nsecs(get_jiffies_64());
++ idle_time = get_idle_time(i);
++ /* Wait and see... */
++ schedule_timeout_uninterruptible(SAMPLE_INTERVAL_JIF);
++
++ idle_delta = get_idle_time(i) - idle_time;
++ elapsed_delta = jiffies64_to_nsecs(get_jiffies_64()) - wall_time;
++ idle_delta = (idle_delta > elapsed_delta) ? elapsed_delta : idle_delta;
++ load = 100 * (elapsed_delta - idle_delta) / elapsed_delta;
++ if (load >= load_thresh)
++ busy_nr++;
++ }
++
++ return (busy_nr >= num_cpus) ? true : false;
++}
++
+ static void acpi_pad_idle_cpus(unsigned int num_cpus)
+ {
+ get_online_cpus();
+
+ num_cpus = min_t(unsigned int, num_cpus, num_online_cpus());
+- set_power_saving_task_num(num_cpus);
++ if (idle_nr_valid(num_cpus))
++ set_power_saving_task_num(num_cpus);
+
+ put_online_cpus();
+ }
diff --git a/series.conf b/series.conf
index 9de7cfe33f..774b84f328 100644
--- a/series.conf
+++ b/series.conf
@@ -4432,6 +4432,7 @@
patches.drivers/bnxt_en-Free-MSIX-vectors-when-unregistering-the-dev.patch
patches.drivers/bnxt_en-Do-not-setup-MAC-address-in-bnxt_hwrm_func_q.patch
patches.fixes/netfilter-ipt_CLUSTERIP-fix-use-after-free-of-proc-e.patch
+ patches.fixes/0001-netfilter-check-for-seqadj-ext-existence-before-addi.patch
patches.fixes/netfilter-nf_tables-Fix-nft-limit-burst-handling.patch
patches.fixes/tipc-reassign-pointers-after-skb-reallocation-linear.patch
patches.drivers/r8169-Do-not-increment-tx_dropped-in-TX-ring-cleanin
@@ -5580,6 +5581,7 @@
patches.fixes/0003-errseq-rename-__errseq_set-to-errseq_set.patch
patches.fixes/Documentation-add-some-docs-for-errseq_t.patch
patches.suse/msft-hv-1405-tools-hv-ignore-a-NIC-if-it-has-been-configured.patch
+ patches.fixes/0001-ip6-fix-PMTU-discovery-when-using-127-subnets.patch
patches.fixes/inetpeer-remove-AVL-implementation-in-favor-of-RB-tr.patch
patches.drivers/ixgbe-NULL-xdp_tx-rings-on-resource-cleanup.patch
patches.fixes/s2io-Remove-UFO-support.patch
@@ -5724,6 +5726,7 @@
patches.drivers/net-hns-Fix-for-__udivdi3-compiler-error.patch
patches.drivers/net-sched-change-names-of-action-number-helpers-to-b.patch
patches.fixes/ip-options-explicitly-provide-net-ns-to-__ip_options.patch
+ patches.fixes/0001-Revert-ipv4-keep-skb-dst-around-in-presence-of-IP-op.patch
patches.drivers/liquidio-add-missing-strings-in-oct_dev_state_str-ar.patch
patches.drivers/liquidio-moved-console_bitmask-module-param-to-lio_m.patch
patches.suse/msft-hv-1446-netvsc-fix-rtnl-deadlock-on-unregister-of-vf.patch
@@ -7622,6 +7625,10 @@
patches.drivers/bnxt_en-Fix-possible-corrupted-NVRAM-parameters-from.patch
patches.drivers/bnxt_en-Fix-possible-corruption-in-DCB-parameters-fr.patch
patches.drivers/rtnetlink-bring-NETDEV_CHANGEMTU-event-process-back-.patch
+ patches.fixes/0001-rtnetlink-bring-NETDEV_CHANGE_TX_QUEUE_LEN-event-pro.patch
+ patches.fixes/0001-rtnetlink-bring-NETDEV_POST_TYPE_CHANGE-event-proces.patch
+ patches.fixes/0001-rtnetlink-bring-NETDEV_CHANGEUPPER-event-process-bac.patch
+ patches.fixes/0001-rtnetlink-check-DO_SETLINK_NOTIFY-correctly-in-do_se.patch
patches.drivers/net-enable-interface-alias-removal-via-rtnl.patch
patches.suse/tun-call-dev_get_valid_name-before-register_netdevic.patch
patches.drivers/net-sched-cls_flower-Set-egress_dev-mark-when-callin.patch
@@ -7638,6 +7645,8 @@
patches.fixes/sctp-add-the-missing-sock_owned_by_user-check-in-sct.patch
patches.fixes/tcp-dccp-fix-ireq-opt-races.patch
patches.fixes/packet-avoid-panic-in-packet_getsockopt.patch
+ patches.fixes/0001-net-ncsi-Fix-AEN-HNCDSC-packet-length.patch
+ patches.fixes/0001-net-ncsi-Stop-monitor-if-channel-times-out-or-is-ina.patch
patches.drivers/can-flexcan-fix-state-transition-regression
patches.drivers/can-flexcan-rename-legacy-error-state-quirk
patches.drivers/can-flexcan-implement-error-passive-state-quirk
@@ -20542,6 +20551,7 @@
patches.drivers/isdn-avm-Fix-string-plus-integer-warning-from-Clang.patch
patches.fixes/bpf-fix-inner-map-masking-to-prevent-oob-under-specu.patch
patches.fixes/pstore-ram-Avoid-allocation-and-leak-of-platform-dat.patch
+ patches.drivers/clk-vc5-Abort-clock-configuration-without-upstream-c.patch
patches.drivers/thermal-int340x_thermal-Fix-a-NULL-vs-IS_ERR-check.patch
patches.arch/s390-early-improve-machine-detection
patches.arch/s390-mm-always-force-a-load-of-the-primary-asce-on-context-switch
@@ -20560,13 +20570,17 @@
patches.fixes/libceph-avoid-keepalive_pending-races-in-ceph_con_keepalive.patch
patches.drm/drm-i915-gvt-release-shadow-batch-buffer-and-wa_ctx-.patch
patches.drm/drm-msm-Unblock-writer-if-reader-closes-file.patch
+ patches.drivers/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch
patches.fixes/0001-usb-dwc3-gadget-Clear-req-needs_extra_trb-flag-on-cl.patch
+ patches.drivers/usb-dwc3-gadget-Fix-the-uninitialized-link_state-whe.patch
+ patches.drivers/usb-gadget-Potential-NULL-dereference-on-allocation-.patch
patches.drivers/USB-serial-simple-add-Motorola-Tetra-TPG2200-device-.patch
patches.drivers/USB-serial-pl2303-add-new-PID-to-support-PL2303TB.patch
patches.drivers/uart-Fix-crash-in-uart_write-and-uart_put_char.patch
patches.drivers/tty-n_hdlc-fix-__might_sleep-warning.patch
patches.drivers/vt-invoke-notifier-on-screen-size-change.patch
patches.drivers/tty-Handle-problem-if-line-discipline-does-not-have-.patch
+ patches.drivers/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch
patches.drivers/staging-rtl8188eu-Add-device-code-for-D-Link-DWA-121.patch
patches.drivers/staging-rtl8723bs-Fix-build-error-with-Clang-when-in.patch
patches.suse/msft-hv-1831-Drivers-hv-vmbus-Check-for-ring-when-getting-debug-i.patch
@@ -20649,6 +20663,7 @@
patches.drivers/usb-gadget-musb-fix-short-isoc-packets-with-inventra.patch
patches.drivers/usb-dwc3-gadget-Handle-0-xfer-length-for-OUT-EP.patch
patches.drivers/usb-gadget-udc-net2272-Fix-bitwise-and-boolean-opera.patch
+ patches.drivers/usb-phy-fix-link-errors.patch
patches.drivers/usb-phy-am335x-fix-race-condition-in-_probe.patch
patches.drivers/serial-fix-race-between-flush_to_ldisc-and-tty_open.patch
patches.drivers/iio-chemical-atlas-ph-sensor-correct-IIO_TEMP-values.patch
@@ -20693,19 +20708,25 @@
patches.drivers/ALSA-usb-audio-Fix-implicit-fb-endpoint-setup-by-qui.patch
patches.drivers/ASoC-rsnd-fixup-rsnd_ssi_master_clk_start-user-count.patch
patches.fixes/vsock-cope-with-memory-allocation-failure-at-socket-.patch
+ patches.fixes/mac80211-Fix-Tx-aggregation-session-tear-down-with-I.patch
patches.fixes/batman-adv-fix-uninit-value-in-batadv_interface_tx.patch
patches.drivers/net-ena-fix-race-between-link-up-and-device-initaliz.patch
patches.fixes/team-avoid-complex-list-operations-in-team_nl_cmd_op.patch
+ patches.drm/drm-imx-ignore-plane-updates-on-disabled-crtcs.patch
patches.drm/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch
+ patches.drm/drm-imx-imx-ldb-add-missing-of_node_puts.patch
patches.drm/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch
patches.drm/0003-drm-i915-Block-fbdev-HPD-processing-during-suspend.patch
patches.drm/0004-drm-i915-Prevent-a-race-during-I915_GEM_MMAP-ioctl-w.patch
patches.drm/0005-drm-i915-opregion-fix-version-check.patch
patches.drm/0006-drm-i915-opregion-rvda-is-relative-from-opregion-bas.patch
patches.drivers/floppy-check_events-callback-should-not-return-a-neg.patch
+ patches.drivers/auxdisplay-ht16k33-fix-potential-user-after-free-on-.patch
patches.drivers/Input-bma150-register-input-device-after-setting-pri.patch
patches.drivers/Input-elantech-enable-3rd-button-support-on-Fujitsu-.patch
+ patches.drivers/Input-matrix_keypad-use-flush_delayed_work.patch
patches.drivers/Revert-Input-elan_i2c-add-ACPI-ID-for-touchpad-in-AS.patch
+ patches.drivers/Input-st-keyscan-fix-potential-zalloc-NULL-dereferen.patch
patches.drivers/Input-elan_i2c-add-ACPI-ID-for-touchpad-in-Lenovo-V3.patch
patches.drivers/i2c-cadence-Fix-the-hold-bit-setting.patch
patches.drivers/i2c-bcm2835-Clear-current-buffer-pointers-and-counts.patch
@@ -20728,11 +20749,13 @@
patches.drivers/ALSA-hda-realtek-Disable-PC-beep-in-passthrough-on-a.patch
patches.fixes/libceph-handle-an-empty-authorize-reply.patch
patches.fixes/ceph-avoid-repeatedly-adding-inode-to-mdsc-snap_flush_list.patch
+ patches.drivers/clk-sunxi-ng-v3s-Fix-TCON-reset-de-assert-bit.patch
patches.drivers/clk-sunxi-A31-Fix-wrong-AHB-gate-number.patch
patches.drm/0001-drm-i915-fbdev-Actually-configure-untiled-displays.patch
patches.suse/kallsyms-handle-too-long-symbols-in-kallsyms-c.patch
patches.drivers/scsi-libiscsi-fix-race-between-iscsi_xmit_task-and-iscsi_complete_task
patches.fixes/scsi-core-reset-host-byte-in-DID_NEXUS_FAILURE-case.patch
+ patches.fixes/mac80211_hwsim-propagate-genlmsg_reply-return-code.patch
patches.drivers/bnxt_en-Fix-typo-in-firmware-message-timeout-logic.patch
patches.drivers/bnxt_en-Wait-longer-for-the-firmware-message-respons.patch
patches.fixes/mdio_bus-Fix-use-after-free-on-device_register-fails.patch
@@ -20753,15 +20776,21 @@
patches.drivers/mmc-sdhci-esdhc-imx-fix-HS400-timing-issue.patch
patches.drivers/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch
patches.drivers/mmc-omap-fix-the-maximum-timeout-setting.patch
+ patches.drivers/regulator-max77620-Initialize-values-for-DT-properti.patch
patches.drivers/regulator-s2mps11-Fix-steps-for-buck7-buck8-and-LDO3.patch
+ patches.drivers/regulator-s2mpa01-Fix-step-values-for-some-LDOs.patch
patches.drivers/regulator-pv88060-Fix-array-out-of-bounds-access.patch
patches.drivers/regulator-pv88080-Fix-array-out-of-bounds-access.patch
patches.drivers/regulator-pv88090-Fix-array-out-of-bounds-access.patch
patches.drivers/regulator-wm831x-dcdc-Fix-list-of-wm831x_dcdc_ilim-f.patch
patches.drivers/regulator-act8865-Fix-act8600_sudcdc_voltage_ranges-.patch
+ patches.drivers/spi-topcliff_pch-Fix-potential-NULL-dereference-on-a.patch
+ patches.drivers/spi-ti-qspi-Fix-mmap-read-when-more-than-one-CS-in-u.patch
+ patches.drivers/spi-pxa2xx-Setup-maximum-supported-DMA-transfer-leng.patch
patches.drivers/leds-lp55xx-fix-null-deref-on-firmware-load-failure.patch
patches.drivers/cw1200-fix-missing-unlock-on-error-in-cw1200_hw_scan.patch
patches.drivers/cw1200-drop-useless-LIST_HEAD.patch
+ patches.fixes/0001-iwlwifi-mvm-fix-firmware-statistics-usage.patch
patches.drivers/iwlwifi-mvm-avoid-possible-access-out-of-array.patch
patches.drivers/iwlwifi-mvm-fix-A-MPDU-reference-assignment.patch
patches.drivers/iwlwifi-mvm-fix-RSS-config-command.patch
@@ -20773,9 +20802,11 @@
patches.fixes/Bluetooth-Verify-that-l2cap_get_conf_opt-provides-la.patch
patches.fixes/0001-net-aquantia-fixed-instack-structure-overflow.patch
patches.suse/netfilter-nf_tables-check-the-result-of-dereferencin.patch
+ patches.fixes/0001-ip6mr-Do-not-call-__IP6_INC_STATS-from-preemptible-c.patch
patches.drivers/team-Free-BPF-filter-when-unregistering-netdev.patch
patches.drivers/sky2-Disable-MSI-on-Dell-Inspiron-1545-and-Gateway-P.patch
patches.fixes/0001-net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracef.patch
+ patches.fixes/0001-net-sysfs-Fix-mem-leak-in-netdev_register_kobject.patch
patches.fixes/crypto-hash-set-CRYPTO_TFM_NEED_KEY-if-setkey-fails.patch
patches.fixes/crypto-brcm-Fix-some-set-but-not-used-warning.patch
patches.fixes/crypto-tgr192-fix-unaligned-memory-access.patch
@@ -20788,9 +20819,13 @@
patches.fixes/crypto-cavium-zip-fix-collision-with-generic-cra_dri.patch
patches.fixes/crypto-crypto4xx-add-missing-of_node_put-after-of_de.patch
patches.drivers/clocksource-drivers-sun5i-Fail-gracefully-when-clock.patch
+ patches.drivers/clocksource-drivers-exynos_mct-Move-one-shot-check-f.patch
+ patches.drivers/clocksource-drivers-exynos_mct-Clear-timer-interrupt.patch
patches.drivers/clocksource-drivers-exynos_mct-Fix-error-path-in-tim.patch
+ patches.drivers/cpufreq-tegra124-add-missing-of_node_put.patch
patches.drivers/ACPI-video-Refactor-and-fix-dmi_is_desktop.patch
patches.drivers/ACPI-video-Extend-chassis-type-detection-with-a-Lunc.patch
+ patches.fixes/device-property-Fix-the-length-used-in-PROPERTY_ENTR.patch
patches.drivers/ALSA-hda-Use-standard-device-registration-for-beep.patch
patches.drivers/ASoC-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch
patches.drivers/ALSA-hda-realtek-Reduce-click-noise-on-Dell-Precisio.patch
@@ -20820,9 +20855,14 @@
patches.drivers/serial-8250_pci-Fix-number-of-ports-for-ACCES-serial.patch
patches.drivers/serial-8250_pci-Have-ACCES-cards-that-use-the-four-p.patch
patches.drivers/serial-uartps-Fix-stuck-ISR-if-RX-disabled-with-non-.patch
+ patches.drivers/serial-8250_of-assume-reg-shift-of-2-for-mrvl-mmp-ua.patch
patches.fixes/0001-USB-Add-new-USB-LPM-helpers.patch
patches.fixes/0001-USB-Consolidate-LPM-checks-to-avoid-enabling-LPM-twi.patch
+ patches.drivers/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
patches.drivers/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch
+ patches.fixes/0001-USB-serial-option-add-Telit-ME910-ECM-composition.patch
+ patches.fixes/0001-USB-serial-cp210x-add-ID-for-Ingenico-3070.patch
+ patches.fixes/0001-USB-serial-ftdi_sio-add-ID-for-Hjelmslund-Electronic.patch
patches.suse/0001-btrfs-relocation-Delay-reloc-tree-deletion-after-mer.patch
patches.suse/0002-btrfs-qgroup-Refactor-btrfs_qgroup_trace_subtree_swa.patch
patches.suse/0003-btrfs-qgroup-Introduce-per-root-swapped-blocks-infra.patch
@@ -20864,7 +20904,14 @@
patches.suse/livepatch-return-enomem-on-ptr_id-allocation-failure.patch
patches.suse/livepatch-proper-error-handling-in-the-shadow-variables-selftest.patch
patches.suse/livepatch-module-coming-and-going-callbacks-can-proceed-with-all-listed-patches.patch
+ patches.drivers/cpcap-charger-generate-events-for-userspace.patch
+ patches.drivers/i2c-tegra-fix-maximum-transfer-size.patch
patches.drivers/thermal-mediatek-fix-register-index-error.patch
+ patches.drivers/rtc-cmos-ignore-bogus-century-byte.patch
+ patches.drivers/rtc-ds1672-fix-unintended-sign-extension.patch
+ patches.drivers/rtc-88pm860x-fix-unintended-sign-extension.patch
+ patches.drivers/rtc-88pm80x-fix-unintended-sign-extension.patch
+ patches.drivers/rtc-pm8xxx-fix-unintended-sign-extension.patch
patches.fixes/0001-backlight-pwm_bl-Use-gpiod_get_value_cansleep-to-get.patch
patches.fixes/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-number.patch
patches.fixes/doc-rcu-Suspicious-RCU-usage-is-a-warning.patch
@@ -20898,6 +20945,7 @@
patches.arch/0004-virtio-introduce-virtio_max_dma_size
patches.arch/0005-virtio-blk-consider-virtio_max_dma_size-for-maximum-segment-size
patches.fixes/tipc-fix-RDM-DGRAM-connect-regression.patch
+ patches.fixes/0001-ipv4-route-fail-early-when-inet-dev-is-missing.patch
patches.drivers/enic-fix-build-warning-without-CONFIG_CPUMASK_OFFSTA.patch
patches.fixes/0001-vxlan-Fix-GRO-cells-race-condition-between-receive-a.patch
patches.fixes/0001-tcp-handle-inet_csk_reqsk_queue_add-failures.patch
@@ -20924,6 +20972,7 @@
patches.fixes/fsdevpts-always-delete-dcache-dentry-s-in-dput.patch
patches.fixes/splice-dont-merge-into-linked-buffers.patch
patches.suse/Btrfs-fix-corruption-reading-shared-and-compressed-e.patch
+ patches.fixes/ext4-Fix-crash-during-online-resizing.patch
patches.fixes/acpi-nfit-Fix-bus-command-validation.patch
patches.fixes/libnvdimm-label-clear-updating-flag-after-label-set-update.patch
patches.fixes/nfit-acpi_nfit_ctl-check-out_obj-type-in-the-right-place.patch
@@ -20945,7 +20994,10 @@
patches.drivers/clk-mv98dx3236-fix-refcount-leak-in-mv98dx3236_clk_i.patch
patches.drivers/clk-dove-fix-refcount-leak-in-dove_clk_init.patch
patches.drivers/clk-sunxi-ng-sun8i-a23-Enable-PLL-MIPI-LDOs-when-ung.patch
+ patches.drivers/clk-clk-twl6040-Fix-imprecise-external-abort-for-pdm.patch
patches.drivers/clk-uniphier-Fix-update-register-for-CPU-gear.patch
+ patches.drivers/clk-ingenic-Fix-round_rate-misbehaving-with-non-inte.patch
+ patches.drivers/clk-ingenic-Fix-doc-of-ingenic_cgu_div_info.patch
patches.drivers/dmaengine-at_hdmac-drop-useless-LIST_HEAD.patch
patches.drivers/dmaengine-dw-drop-useless-LIST_HEAD.patch
patches.drivers/dmaengine-st_fdma-drop-useless-LIST_HEAD.patch
@@ -20958,10 +21010,15 @@
patches.fixes/0001-net-mlx4_core-Fix-qp-mtt-size-calculation.patch
patches.fixes/0001-l2tp-fix-infoleak-in-l2tp_ip6_recvmsg.patch
patches.fixes/0001-pptp-dst_release-sk_dst_cache-in-pptp_sock_destruct.patch
+ patches.fixes/PM-wakeup-Rework-wakeup-source-timer-cancellation.patch
+ patches.drivers/cpufreq-pxa2xx-remove-incorrect-__init-annotation.patch
patches.fixes/ACPI-device_sysfs-Avoid-OF-modalias-creation-for-rem.patch
patches.drm/0001-drm-etnaviv-NULL-vs-IS_ERR-buf-in-etnaviv_core_dump.patch
patches.drm/0002-drm-etnaviv-potential-NULL-dereference.patch
+ patches.drm/drm-i915-Relax-mmap-VMA-check.patch
patches.fixes/0001-fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
+ patches.drivers/iommu-amd-fix-null-dereference-bug-in-match_hid_uid
+ patches.arch/svm-fix-improper-check-when-deactivate-avic
patches.fixes/nvme-fc-reject-reconnect-if-io-queue-count-is-reduce.patch
patches.fixes/9p-use-inode-i_lock-to-protect-i_size_write-under-32.patch
patches.fixes/9p-net-fix-memory-leak-in-p9_client_create.patch
@@ -20969,11 +21026,18 @@
patches.drm/drm-nouveau-debugfs-Fix-check-of-pm_runtime_get_sync.patch
patches.drm/drm-i915-bios-assume-eDP-is-present-on-port-A-when-t.patch
patches.drm/0001-drm-vmwgfx-Don-t-double-free-the-mode-stored-in-par-.patch
+ patches.drivers/mmc-pxamci-fix-enum-type-confusion.patch
patches.drivers/ALSA-echoaudio-add-a-check-for-ioremap_nocache.patch
patches.drivers/ALSA-sb8-add-a-check-for-request_region.patch
patches.drivers/ALSA-firewire-motu-use-version-field-of-unit-directo.patch
patches.drivers/ALSA-hda-add-Lenovo-IdeaCentre-B550-to-the-power_sav.patch
patches.drivers/ALSA-opl3-fix-mismatch-between-snd_opl3_drum_switch-.patch
+ patches.drivers/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size
+ patches.drivers/iommu-vt-d-check-capability-before-disabling-protected-memory
+ patches.drivers/auxdisplay-hd44780-Fix-memory-leak-on-remove.patch
+ patches.fixes/cifs-allow-guest-mounts-to-work-for-smb3.11.patch
+ patches.fixes/SMB3-Fix-SMB3.1.1-guest-mounts-to-Samba.patch
+ patches.drivers/thermal-bcm2835-Fix-crash-in-bcm2835_thermal_debugfs.patch
# davem/net-next
patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch
@@ -21226,6 +21290,7 @@
########################################################
patches.arch/acpi_thinkpad_introduce_acpi_root_table_boot_param.patch
patches.arch/acpi_thermal_passive_blacklist.patch
+ patches.suse/ACPI-acpi_pad-Do-not-launch-acpi_pad-threads-on-idle-cpus.patch
########################################################
# Driver core
@@ -21281,8 +21346,8 @@
patches.suse/reiserfs-don-t-panic-on-bad-directory-entries.patch
patches.suse/xfs-properly-detect-when-DAX-wont-be-used-on-any-device.patch
- patches.fixes/ext4-Fix-crash-during-online-resizing.patch
patches.suse/xfs-add-option-to-mount-with-barrier-0-or-barrier-1.patch
+ patches.fixes/ext4-Avoid-panic-during-forced-reboot.patch
########################################################
# NFS