Home Home > GIT Browse > SLE12-SP4-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOlaf Hering <ohering@suse.de>2019-05-15 09:33:09 +0200
committerOlaf Hering <ohering@suse.de>2019-05-15 09:33:09 +0200
commit10c0a4c2a5088f1fb8da2508297967054b56cfa1 (patch)
tree90542f3b4cb1331ccd9afb4a051dd45d74f45758
parent5cc393f52b843b3c49a18720b64b0be4904bb3eb (diff)
parentefaf05db39f2eb6582d53d0ab26255ad2b2d489a (diff)
Merge remote-tracking branch 'kerncvs/SLE12-SP4' into SLE12-SP4-AZURE
-rw-r--r--blacklist.conf17
-rw-r--r--config/arm64/default3
-rw-r--r--config/ppc64le/default3
-rw-r--r--config/s390x/default3
-rw-r--r--config/s390x/zfcpdump1
-rw-r--r--config/x86_64/default3
-rw-r--r--patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch3
-rw-r--r--patches.arch/intel_idle-add-support-for-Jacobsville.patch13
-rw-r--r--patches.arch/kvm-x86-report-stibp-on-get_supported_cpuid.patch47
-rw-r--r--patches.arch/locking-atomics-asm-generic-move-some-macros-from-linux-bitops-h-to-a-new-linux-bits-h-file.patch90
-rw-r--r--patches.arch/powercap-intel_rapl-add-support-for-Jacobsville.patch6
-rw-r--r--patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch4
-rw-r--r--patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch3
-rw-r--r--patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch91
-rw-r--r--patches.arch/s390-ism-ignore-some-errors-during-deregistration74
-rw-r--r--patches.arch/s390-sles12sp4-kmsg-update-2019-03-08.patch326
-rw-r--r--patches.arch/s390-speculation-support-mitigations-cmdline-option.patch3
-rw-r--r--patches.arch/x86-bugs-add-amd-s-variant-of-ssb_no.patch4
-rw-r--r--patches.arch/x86-cpu-Add-Atom-Tremont-Jacobsville.patch10
-rw-r--r--patches.arch/x86-cpu-sanitize-fam6_atom-naming.patch602
-rw-r--r--patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch45
-rw-r--r--patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch52
-rw-r--r--patches.arch/x86-mce-handle-varying-mca-bank-counts.patch3
-rw-r--r--patches.arch/x86-msr-index-cleanup-bit-defines.patch102
-rw-r--r--patches.arch/x86-speculation-consolidate-cpu-whitelists.patch167
-rw-r--r--patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch148
-rw-r--r--patches.arch/x86-speculation-mds-add-bug_msbds_only.patch86
-rw-r--r--patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch85
-rw-r--r--patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch216
-rw-r--r--patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch186
-rw-r--r--patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch131
-rw-r--r--patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch62
-rw-r--r--patches.arch/x86-speculation-mds-add-smt-warning-message.patch50
-rw-r--r--patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch120
-rw-r--r--patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch192
-rw-r--r--patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch224
-rw-r--r--patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch49
-rw-r--r--patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch45
-rw-r--r--patches.arch/x86-speculation-simplify-the-cpu-bug-detection-logic.patch84
-rw-r--r--patches.arch/x86-speculation-support-enhanced-ibrs-on-future-cpus.patch12
-rw-r--r--patches.arch/x86-speculation-support-mitigations-cmdline-option.patch3
-rw-r--r--patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch181
-rw-r--r--patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch50
-rw-r--r--patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch64
-rw-r--r--patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch61
-rw-r--r--patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch48
-rw-r--r--patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch3
-rw-r--r--patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch43
-rw-r--r--patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch39
-rw-r--r--patches.drivers/ALSA-line6-Avoid-polluting-led_-namespace.patch56
-rw-r--r--patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch64
-rw-r--r--patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch50
-rw-r--r--patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch40
-rw-r--r--patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch103
-rw-r--r--patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch54
-rw-r--r--patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch132
-rw-r--r--patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch277
-rw-r--r--patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch143
-rw-r--r--patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch75
-rw-r--r--patches.drivers/ALSA-timer-Coding-style-fixes.patch71
-rw-r--r--patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch148
-rw-r--r--patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch70
-rw-r--r--patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch80
-rw-r--r--patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch129
-rw-r--r--patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch125
-rw-r--r--patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch43
-rw-r--r--patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch37
-rw-r--r--patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch44
-rw-r--r--patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch66
-rw-r--r--patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch135
-rw-r--r--patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch39
-rw-r--r--patches.drivers/ASoC-fix-valid-stream-condition.patch40
-rw-r--r--patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch32
-rw-r--r--patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch175
-rw-r--r--patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch57
-rw-r--r--patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch39
-rw-r--r--patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch110
-rw-r--r--patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch49
-rw-r--r--patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch64
-rw-r--r--patches.drivers/ASoC-stm32-fix-sai-driver-name-initialisation.patch44
-rw-r--r--patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch35
-rw-r--r--patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch69
-rw-r--r--patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch58
-rw-r--r--patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch38
-rw-r--r--patches.drivers/HID-debug-fix-race-condition-with-between-rdesc_show.patch62
-rw-r--r--patches.drivers/HID-input-add-mapping-for-Assistant-key.patch35
-rw-r--r--patches.drivers/HID-logitech-check-the-return-value-of-create_single.patch49
-rw-r--r--patches.drivers/Input-introduce-KEY_ASSISTANT.patch33
-rw-r--r--patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch51
-rw-r--r--patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch69
-rw-r--r--patches.drivers/USB-cdc-acm-fix-unthrottle-races.patch136
-rw-r--r--patches.drivers/USB-core-Fix-bug-caused-by-duplicate-interface-PM-us.patch222
-rw-r--r--patches.drivers/USB-core-Fix-unterminated-string-returned-by-usb_str.patch54
-rw-r--r--patches.drivers/USB-serial-f81232-fix-interrupt-worker-not-stop.patch97
-rw-r--r--patches.drivers/USB-serial-fix-unthrottle-races.patch136
-rw-r--r--patches.drivers/USB-w1-ds2490-Fix-bug-caused-by-improper-use-of-alts.patch55
-rw-r--r--patches.drivers/USB-yurex-Fix-protection-fault-after-device-removal.patch45
-rw-r--r--patches.drivers/at76c50x-usb-Don-t-register-led_trigger-if-usb_regis.patch93
-rw-r--r--patches.drivers/b43-shut-up-clang-Wuninitialized-variable-warning.patch71
-rw-r--r--patches.drivers/brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch59
-rw-r--r--patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch85
-rw-r--r--patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch92
-rw-r--r--patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch45
-rw-r--r--patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch90
-rw-r--r--patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch39
-rw-r--r--patches.drivers/ghes-edac-fix-ghes_edac-registration.patch120
-rw-r--r--patches.drivers/gpio-aspeed-fix-a-potential-NULL-pointer-dereference.patch36
-rw-r--r--patches.drivers/hwmon-f71805f-Use-request_muxed_region-for-Super-IO-.patch93
-rw-r--r--patches.drivers/hwmon-pc87427-Use-request_muxed_region-for-Super-IO-.patch71
-rw-r--r--patches.drivers/hwmon-smsc47b397-Use-request_muxed_region-for-Super-.patch71
-rw-r--r--patches.drivers/hwmon-smsc47m1-Use-request_muxed_region-for-Super-IO.patch95
-rw-r--r--patches.drivers/hwmon-vt1211-Use-request_muxed_region-for-Super-IO-a.patch72
-rw-r--r--patches.drivers/hwmon-w83627hf-Use-request_muxed_region-for-Super-IO.patch121
-rw-r--r--patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch3
-rw-r--r--patches.drivers/intel_th-msu-Fix-single-mode-with-IOMMU.patch109
-rw-r--r--patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch38
-rw-r--r--patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock101
-rw-r--r--patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu42
-rw-r--r--patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly49
-rw-r--r--patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch55
-rw-r--r--patches.drivers/leds-avoid-races-with-workqueue.patch64
-rw-r--r--patches.drivers/libata-fix-using-DMA-buffers-on-stack.patch89
-rw-r--r--patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch37
-rw-r--r--patches.drivers/media-cx23885-check-allocation-return.patch43
-rw-r--r--patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch78
-rw-r--r--patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch37
-rw-r--r--patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch39
-rw-r--r--patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch141
-rw-r--r--patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch46
-rw-r--r--patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch41
-rw-r--r--patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch40
-rw-r--r--patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch64
-rw-r--r--patches.drivers/mmc-core-fix-possible-use-after-free-of-host.patch40
-rw-r--r--patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch38
-rw-r--r--patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch46
-rw-r--r--patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch34
-rw-r--r--patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch40
-rw-r--r--patches.drivers/mwifiex-Fix-mem-leak-in-mwifiex_tm_cmd.patch50
-rw-r--r--patches.drivers/mwifiex-prevent-an-array-overflow.patch40
-rw-r--r--patches.drivers/mwl8k-Fix-rate_idx-underflow.patch86
-rw-r--r--patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch160
-rw-r--r--patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch66
-rw-r--r--patches.drivers/net-smc-fix-byte_order-for-rx_curs_confirmed77
-rw-r--r--patches.drivers/net-smc-fix-smc_poll-in-smc_init-state37
-rw-r--r--patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch64
-rw-r--r--patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch50
-rw-r--r--patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch38
-rw-r--r--patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch45
-rw-r--r--patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch49
-rw-r--r--patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch61
-rw-r--r--patches.drivers/platform-x86-pmc_atom-Drop-__initconst-on-dmi-table.patch42
-rw-r--r--patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch57
-rw-r--r--patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch277
-rw-r--r--patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch54
-rw-r--r--patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch44
-rw-r--r--patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch144
-rw-r--r--patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch48
-rw-r--r--patches.drivers/qmi_wwan-add-Olicard-600.patch67
-rw-r--r--patches.drivers/regulator-tps65086-Fix-tps65086_ldoa1_ranges-for-sel.patch45
-rw-r--r--patches.drivers/rt2x00-do-not-increment-sequence-number-while-re-tra.patch106
-rw-r--r--patches.drivers/rtlwifi-rtl8723ae-Fix-missing-break-in-switch-statem.patch41
-rw-r--r--patches.drivers/sc16is7xx-missing-unregister-delete-driver-on-error-.patch56
-rw-r--r--patches.drivers/sc16is7xx-move-label-err_spi-to-correct-section.patch49
-rw-r--r--patches.drivers/sc16is7xx-put-err_spi-and-err_i2c-into-correct-ifdef.patch45
-rw-r--r--patches.drivers/scsi-qla2xxx-Fix-panic-in-qla_dfs_tgt_counters_show.patch37
-rw-r--r--patches.drivers/serial-8250_pxa-honor-the-port-number-from-devicetre.patch45
-rw-r--r--patches.drivers/serial-ar933x_uart-Fix-build-failure-with-disabled-c.patch104
-rw-r--r--patches.drivers/serial-uartps-console_setup-can-t-be-placed-to-init-.patch33
-rw-r--r--patches.drivers/soc-tegra-pmc-Drop-locking-from-tegra_powergate_is_p.patch66
-rw-r--r--patches.drivers/spi-a3700-Clear-DATA_OUT-when-performing-a-read.patch38
-rw-r--r--patches.drivers/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch61
-rw-r--r--patches.drivers/spi-bcm2835aux-setup-gpio-cs-to-output-and-correct-l.patch58
-rw-r--r--patches.drivers/spi-bcm2835aux-warn-in-dmesg-that-native-cs-is-not-r.patch80
-rw-r--r--patches.drivers/spi-rspi-Fix-sequencer-reset-during-initialization.patch56
-rw-r--r--patches.drivers/ssb-Fix-possible-NULL-pointer-dereference-in-ssb_hos.patch99
-rw-r--r--patches.drivers/staging-rtl8188eu-Fix-potential-NULL-pointer-derefer.patch130
-rw-r--r--patches.drivers/stm-class-Fix-an-endless-loop-in-channel-allocation.patch45
-rw-r--r--patches.drivers/stm-class-Fix-channel-free-in-stm-output-free-path.patch45
-rw-r--r--patches.drivers/stm-class-Prevent-division-by-zero.patch47
-rw-r--r--patches.drivers/thermal-int340x_thermal-Add-additional-UUIDs.patch49
-rw-r--r--patches.drivers/thermal-int340x_thermal-fix-mode-setting.patch37
-rw-r--r--patches.drivers/tty-increase-the-default-flip-buffer-limit-to-2-640K.patch53
-rw-r--r--patches.drivers/tty-pty-Fix-race-condition-between-release_one_tty-a.patch74
-rw-r--r--patches.drivers/tty-vt.c-Fix-TIOCL_BLANKSCREEN-console-blanking-if-b.patch74
-rw-r--r--patches.drivers/usb-dwc3-Fix-default-lpm_nyet_threshold-value.patch32
-rw-r--r--patches.drivers/usb-gadget-net2272-Fix-net2272_dequeue.patch43
-rw-r--r--patches.drivers/usb-gadget-net2280-Fix-net2280_dequeue.patch45
-rw-r--r--patches.drivers/usb-gadget-net2280-Fix-overrun-of-OUT-messages.patch64
-rw-r--r--patches.drivers/usb-storage-Set-virt_boundary_mask-to-avoid-SG-overf.patch92
-rw-r--r--patches.drivers/usb-u132-hcd-fix-resource-leak.patch36
-rw-r--r--patches.drivers/usb-usb251xb-fix-to-avoid-potential-NULL-pointer-der.patch36
-rw-r--r--patches.drivers/usb-usbip-fix-isoc-packet-num-validation-in-get_pipe.patch84
-rw-r--r--patches.drm/0004-drm-i915-gvt-Fix-incorrect-mask-of-mmio-0x22028-in-g.patch39
-rw-r--r--patches.drm/0005-drm-meson-add-size-and-alignment-requirements-for-du.patch53
-rw-r--r--patches.drm/drm-fb-helper-dpms_legacy-Only-set-on-connectors-in-.patch57
-rw-r--r--patches.drm/drm-i915-Fix-I915_EXEC_RING_MASK.patch42
-rw-r--r--patches.drm/drm-mediatek-fix-possible-object-reference-leak.patch48
-rw-r--r--patches.drm/drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch74
-rw-r--r--patches.fixes/0001-UAS-fix-alignment-of-scatter-gather-segments.patch80
-rw-r--r--patches.fixes/0001-btrfs-Don-t-panic-when-we-can-t-find-a-root-key.patch46
-rw-r--r--patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch43
-rw-r--r--patches.fixes/0001-btrfs-reloc-Fix-NULL-pointer-dereference-due-to-expa.patch5
-rw-r--r--patches.fixes/0001-dt-bindings-net-Fix-a-typo-in-the-phy-mode-list-for-.patch37
-rw-r--r--patches.fixes/0001-media-pvrusb2-Prevent-a-buffer-overflow.patch61
-rw-r--r--patches.fixes/0001-mtd-spi-nor-intel-spi-Avoid-crossing-4K-address-boun.patch73
-rw-r--r--patches.fixes/0001-net-dsa-legacy-don-t-unmask-port-bitmaps.patch36
-rw-r--r--patches.fixes/0001-netfilter-bridge-ebt_among-add-more-missing-match-si.patch101
-rw-r--r--patches.fixes/0002-sctp-set-frag_point-in-sctp_setsockopt_maxseg-correc.patch116
-rw-r--r--patches.fixes/0003-sctp-only-update-outstanding_bytes-for-transmitted-q.patch59
-rw-r--r--patches.fixes/0005-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch48
-rw-r--r--patches.fixes/0006-xfrm-fix-xfrm_do_migrate-with-AEAD-e.g-AES-GCM.patch42
-rw-r--r--patches.fixes/0007-xfrm-Return-error-on-unknown-encap_type-in-init_stat.patch60
-rw-r--r--patches.fixes/0008-net-avoid-skb_warn_bad_offload-on-IS_ERR.patch40
-rw-r--r--patches.fixes/0009-netfilter-bridge-ebt_among-add-missing-match-size-ch.patch75
-rw-r--r--patches.fixes/0011-netfilter-drop-template-ct-when-conntrack-is-skipped.patch109
-rw-r--r--patches.fixes/0012-netfilter-nf_socket-Fix-out-of-bounds-access-in-nf_s.patch84
-rw-r--r--patches.fixes/Revert-ide-unexport-DISK_EVENT_MEDIA_CHANGE-for-ide-.patch71
-rw-r--r--patches.fixes/audit-fix-a-memleak-caused-by-auditing-load-module.patch77
-rw-r--r--patches.fixes/block_dev-fix-crash-on-chained-bios-with-O_DIRECT.patch41
-rw-r--r--patches.fixes/ceph-ensure-d_name-stability-in-ceph_dentry_hash.patch42
-rw-r--r--patches.fixes/ceph-fix-ci-i_head_snapc-leak.patch56
-rw-r--r--patches.fixes/ceph-fix-use-after-free-on-symlink-traversal.patch38
-rw-r--r--patches.fixes/ceph-only-use-d_name-directly-when-parent-is-locked.patch163
-rw-r--r--patches.fixes/crypto-arm-aes-neonbs-don-t-access-already-freed-wal.patch46
-rw-r--r--patches.fixes/crypto-ccm-fix-incompatibility-between-ccm-and-ccm_b.patch146
-rw-r--r--patches.fixes/crypto-ccp-Do-not-free-psp_master-when-PLATFORM_INIT.patch43
-rw-r--r--patches.fixes/crypto-chacha20poly1305-set-cra_name-correctly.patch50
-rw-r--r--patches.fixes/crypto-crct10dif-generic-fix-use-via-crypto_shash_di.patch69
-rw-r--r--patches.fixes/crypto-fips-Grammar-s-options-option-s-to-the.patch36
-rw-r--r--patches.fixes/crypto-gcm-fix-incompatibility-between-gcm-and-gcm_b.patch136
-rw-r--r--patches.fixes/crypto-skcipher-don-t-WARN-on-unprocessed-data-after.patch60
-rw-r--r--patches.fixes/crypto-sun4i-ss-Fix-invalid-calculation-of-hash-end.patch37
-rw-r--r--patches.fixes/crypto-vmx-fix-copy-paste-error-in-CTR-mode.patch60
-rw-r--r--patches.fixes/crypto-x86-crct10dif-pcl-fix-use-via-crypto_shash_di.patch67
-rw-r--r--patches.fixes/kernel-sysctl.c-add-missing-range-check-in-do_proc_d.patch56
-rw-r--r--patches.fixes/kernel-sysctl.c-fix-out-of-bounds-access-when-settin.patch93
-rw-r--r--patches.fixes/linux-kernel.h-Use-parentheses-around-argument-in-u6.patch72
-rw-r--r--patches.fixes/md-batch-flush-requests.patch3
-rw-r--r--patches.fixes/net-rds-force-to-destroy-connection-if-t_sock-is-NUL.patch143
-rw-r--r--patches.fixes/net-smc-allow-16-byte-pnetids-in-netlink-policy34
-rw-r--r--patches.fixes/net-smc-call-smc_cdc_msg_send-under-send_lock35
-rw-r--r--patches.fixes/net-smc-check-connections-in-smc_lgr_free_work43
-rw-r--r--patches.fixes/net-smc-check-port_idx-of-ib-event69
-rw-r--r--patches.fixes/net-smc-correct-state-change-for-peer-closing43
-rw-r--r--patches.fixes/net-smc-delete-rkey-first-before-switching-to-unused39
-rw-r--r--patches.fixes/net-smc-do-not-wait-under-send_lock55
-rw-r--r--patches.fixes/net-smc-don-t-wait-for-send-buffer-space-when-data-was-already-sent45
-rw-r--r--patches.fixes/net-smc-fix-another-sizeof-to-int-comparison32
-rw-r--r--patches.fixes/net-smc-fix-sender_free-computation118
-rw-r--r--patches.fixes/net-smc-fix-use-of-variable-in-cleared-area39
-rw-r--r--patches.fixes/net-smc-move-code-to-clear-the-conn-lgr-field51
-rw-r--r--patches.fixes/net-smc-move-wake-up-of-close-waiter59
-rw-r--r--patches.fixes/net-smc-no-delay-for-free-tx-buffer-wait35
-rw-r--r--patches.fixes/net-smc-postpone-release-of-clcsock95
-rw-r--r--patches.fixes/net-smc-preallocated-memory-for-rdma-work-requests391
-rw-r--r--patches.fixes/net-smc-prevent-races-between-smc_lgr_terminate-and-smc_conn_free44
-rw-r--r--patches.fixes/net-smc-recvmsg-and-splice_read-should-return-0-after-shutdown49
-rw-r--r--patches.fixes/net-smc-reduce-amount-of-status-updates-to-peer59
-rw-r--r--patches.fixes/net-smc-reset-cursor-update-required-flag59
-rw-r--r--patches.fixes/net-smc-unlock-lgr-pending-lock-earlier-for-smc-d63
-rw-r--r--patches.fixes/net-smc-use-client-and-server-lgr-pending-locks-for-smc-r165
-rw-r--r--patches.fixes/net-smc-use-device-link-provided-in-qp_context46
-rw-r--r--patches.fixes/net-smc-use-smc_curs_copy-for-smc-d54
-rw-r--r--patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch14
-rw-r--r--patches.fixes/openvswitch-add-seqadj-extension-when-NAT-is-used.patch46
-rw-r--r--patches.fixes/openvswitch-fix-flow-actions-reallocation.patch70
-rw-r--r--patches.fixes/proc-kcore-don-t-bounds-check-against-address-0.patch82
-rw-r--r--patches.fixes/proc-revalidate-kernel-thread-inodes-to-root-root.patch51
-rw-r--r--patches.fixes/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch106
-rw-r--r--patches.fixes/qla2xxx-always-allocate-qla_tgt_wq.patch85
-rw-r--r--patches.fixes/scripts-override-locale-from-environment-when-runnin.patch43
-rw-r--r--patches.fixes/selinux-use-kernel-linux-socket.h-for-genheaders-and-mdp64
-rw-r--r--patches.fixes/smc-move-unhash-as-early-as-possible-in-smc_release44
-rw-r--r--patches.fixes/vfio-mdev-Avoid-release-parent-reference-during-erro.patch40
-rw-r--r--patches.fixes/vfio-mdev-Fix-aborting-mdev-child-device-removal-if-.patch77
-rw-r--r--patches.fixes/vfio-pci-use-correct-format-characters.patch83
-rw-r--r--patches.fixes/vfio_pci-Enable-memory-accesses-before-calling-pci_m.patch69
-rw-r--r--patches.fixes/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch65
-rw-r--r--patches.fixes/virtio-Honour-may_reduce_num-in-vring_create_virtque.patch66
-rw-r--r--patches.fixes/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch46
-rw-r--r--patches.fixes/virtio_pci-fix-a-NULL-pointer-reference-in-vp_del_vq.patch70
-rw-r--r--patches.fixes/vsock-virtio-fix-kernel-panic-after-device-hot-unplu.patch103
-rw-r--r--patches.fixes/vsock-virtio-fix-kernel-panic-from-virtio_transport_.patch109
-rw-r--r--patches.fixes/vsock-virtio-reset-connected-sockets-on-device-remov.patch37
-rw-r--r--patches.fixes/xfs-detect-and-fix-bad-summary-counts-at-mount.patch190
-rw-r--r--patches.fixes/xfs-kill-meaningless-variable-zero.patch49
-rw-r--r--patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch14
-rw-r--r--patches.fixes/xfs-remove-xfs_zero_range.patch170
-rw-r--r--patches.kabi/Re-export-snd_cards-for-kABI.patch26
-rw-r--r--patches.kabi/net-smc-add-pnet-table-namespace-support26
-rw-r--r--patches.kabi/net-smc-add-smcd-support-to-the-pnet-table26
-rw-r--r--patches.kabi/net-smc-preallocated-memory-for-rdma-work-requests178
-rw-r--r--patches.kabi/net-smc-rework-pnet-table33
-rw-r--r--patches.kabi/snd_seq_kernel_client_enqueue-kabi-compat.patch50
-rw-r--r--patches.kabi/usb_interface-reveive-pm_usage_cnt-for-kabi.patch24
-rw-r--r--patches.suse/0001-btrfs-Factor-out-common-delayed-refs-init-code.patch85
-rw-r--r--patches.suse/0001-btrfs-add-a-helper-to-return-a-head-ref.patch86
-rw-r--r--patches.suse/0001-btrfs-delayed-ref-Introduce-better-documented-delaye.patch187
-rw-r--r--patches.suse/0001-btrfs-track-refs-in-a-rb_tree-instead-of-a-list.patch404
-rw-r--r--patches.suse/0001-drm-ttm-Remove-warning-about-inconsistent-mapping-in.patch33
-rw-r--r--patches.suse/0002-Add-a-void-suse_kabi_padding-placeholder-to-some-USB.patch14
-rw-r--r--patches.suse/0002-btrfs-Use-init_delayed_ref_common-in-add_delayed_tre.patch75
-rw-r--r--patches.suse/0002-btrfs-extent-tree-Open-code-process_func-in-__btrfs_.patch83
-rw-r--r--patches.suse/0002-btrfs-move-extent_op-cleanup-to-a-helper.patch130
-rw-r--r--patches.suse/0003-btrfs-Use-init_delayed_ref_common-in-add_delayed_dat.patch73
-rw-r--r--patches.suse/0003-btrfs-breakout-empty-head-cleanup-to-a-helper.patch124
-rw-r--r--patches.suse/0003-x86-idle-Control-Indirect-Branch-Speculation-in-idle.patch16
-rw-r--r--patches.suse/0004-btrfs-Open-code-add_delayed_tree_ref.patch128
-rw-r--r--patches.suse/0004-btrfs-move-ref_mod-modification-into-the-if-ref-logi.patch46
-rw-r--r--patches.suse/0005-btrfs-Open-code-add_delayed_data_ref.patch125
-rw-r--r--patches.suse/0005-btrfs-move-all-ref-head-cleanup-to-the-helper-functi.patch211
-rw-r--r--patches.suse/0006-btrfs-Introduce-init_delayed_ref_head.patch102
-rw-r--r--patches.suse/0006-btrfs-remove-delayed_ref_node-from-ref_head.patch780
-rw-r--r--patches.suse/0007-btrfs-Use-init_delayed_ref_head-in-add_delayed_ref_h.patch102
-rw-r--r--patches.suse/0008-btrfs-split-delayed-ref-head-initialization-and-addi.patch159
-rw-r--r--patches.suse/0227-bcache-Move-couple-of-functions-to-sysfs.c.patch136
-rw-r--r--patches.suse/0227-bcache-Move-couple-of-string-arrays-to-sysfs.c.patch99
-rw-r--r--patches.suse/0227-bcache-Replace-bch_read_string_list-by-__sysfs_match.patch153
-rw-r--r--patches.suse/0227-bcache-don-t-clone-bio-in-bch_data_verify.patch41
-rw-r--r--patches.suse/0227-bcache-stop-bcache-device-when-backing-device-is-off.patch155
-rw-r--r--patches.suse/0230-bcache-do-not-assign-in-if-condition-register_bcache.patch41
-rw-r--r--patches.suse/0231-bcache-do-not-assign-in-if-condition-in-bcache_init.patch45
-rw-r--r--patches.suse/0231-bcache-stop-using-the-deprecated-get_seconds.patch115
-rw-r--r--patches.suse/0232-bcache-do-not-check-return-value-of-debugfs_create_d.patch10
-rw-r--r--patches.suse/0234-bcache-add-a-comment-in-super.c.patch33
-rw-r--r--patches.suse/0234-bcache-add-code-comments-for-bset.c.patch154
-rw-r--r--patches.suse/0234-bcache-fix-mistaken-code-comments-in-bcache.h.patch38
-rw-r--r--patches.suse/0234-bcache-fix-mistaken-comments-in-request.c.patch34
-rw-r--r--patches.suse/0237-bcache-trivial-remove-tailing-backslash-in-macro-BTR.patch35
-rw-r--r--patches.suse/0238-bcache-add-identifier-names-to-arguments-of-function.patch661
-rw-r--r--patches.suse/0238-bcache-fix-indent-by-replacing-blank-by-tabs.patch40
-rw-r--r--patches.suse/0238-bcache-fix-typo-succesfully-to-successfully.patch49
-rw-r--r--patches.suse/0238-bcache-replace-Symbolic-permissions-by-octal-permiss.patch60
-rw-r--r--patches.suse/0238-bcache-replace-pF-by-pS-in-seq_printf.patch44
-rw-r--r--patches.suse/0238-bcache-replace-printk-by-pr_-routines.patch149
-rw-r--r--patches.suse/0238-bcache-style-fix-to-add-a-blank-line-after-declarati.patch538
-rw-r--r--patches.suse/0238-bcache-style-fix-to-replace-unsigned-by-unsigned-int.patch2223
-rw-r--r--patches.suse/0238-bcache-style-fixes-for-lines-over-80-characters.patch291
-rw-r--r--patches.suse/0238-bcache-use-routines-from-lib-crc64.c-for-CRC64-calcu.patch222
-rw-r--r--patches.suse/0238-lib-add-crc64-calculation-routines.patch284
-rw-r--r--patches.suse/0239-bcache-prefer-help-in-Kconfig.patch51
-rw-r--r--patches.suse/0239-lib-don-t-depend-on-linux-headers-being-installed.patch42
-rw-r--r--patches.suse/0240-bcache-do-not-check-NULL-pointer-before-calling-kmem.patch38
-rw-r--r--patches.suse/0241-bcache-fix-code-comments-style.patch128
-rw-r--r--patches.suse/0242-bcache-add-static-const-prefix-to-char-array-declara.patch35
-rw-r--r--patches.suse/0243-bcache-move-open-brace-at-end-of-function-definition.patch58
-rw-r--r--patches.suse/0244-bcache-add-missing-SPDX-header.patch51
-rw-r--r--patches.suse/0245-bcache-remove-unnecessary-space-before-ioctl-functio.patch37
-rw-r--r--patches.suse/0246-bcache-add-the-missing-comments-for-smp_mb-smp_wmb.patch59
-rw-r--r--patches.suse/0249-bcache-add-separate-workqueue-for-journal_write-to-a.patch109
-rw-r--r--patches.suse/0250-bcache-account-size-of-buckets-used-in-uuid-write-to.patch60
-rw-r--r--patches.suse/0251-bcache-use-REQ_PRIO-to-indicate-bio-for-metadata.patch51
-rw-r--r--patches.suse/0252-bcache-fix-ioctl-in-flash-device.patch56
-rw-r--r--patches.suse/0253-bcache-fix-typo-in-code-comments-of-closure_return_w.patch37
-rw-r--r--patches.suse/0254-bcache-correct-dirty-data-statistics.patch43
-rw-r--r--patches.suse/0255-bcache-Populate-writeback_rate_minimum-attribute.patch51
-rw-r--r--patches.suse/0256-bcache-recal-cached_dev_sectors-on-detach.patch37
-rw-r--r--patches.suse/0257-bcache-remove-unused-bch_passthrough_cache.patch34
-rw-r--r--patches.suse/0258-bcache-remove-useless-parameter-of-bch_debug_init.patch63
-rw-r--r--patches.suse/0259-bcache-replace-hard-coded-number-with-BUCKET_GC_GEN_.patch36
-rw-r--r--patches.suse/0260-bcache-use-MAX_CACHES_PER_SET-instead-of-magic-numbe.patch43
-rw-r--r--patches.suse/0261-bcache-split-combined-if-condition-code-into-separat.patch140
-rw-r--r--patches.suse/0262-bcache-panic-fix-for-making-cache-device.patch56
-rw-r--r--patches.suse/0263-bcache-add-comment-for-cache_set-fill_iter.patch74
-rw-r--r--patches.suse/0264-bcache-do-not-check-if-debug-dentry-is-ERR-or-NULL-e.patch54
-rw-r--r--patches.suse/0265-bcache-update-comment-for-bch_data_insert.patch42
-rw-r--r--patches.suse/0266-bcache-update-comment-in-sysfs.c.patch48
-rw-r--r--patches.suse/0267-bcache-do-not-mark-writeback_running-too-early.patch96
-rw-r--r--patches.suse/0268-bcache-cannot-set-writeback_running-via-sysfs-if-no-.patch64
-rw-r--r--patches.suse/0269-bcache-introduce-force_wake_up_gc.patch87
-rw-r--r--patches.suse/0270-bcache-option-to-automatically-run-gc-thread-after-w.patch169
-rw-r--r--patches.suse/0271-bcache-add-MODULE_DESCRIPTION-information.patch40
-rw-r--r--patches.suse/0272-bcache-make-cutoff_writeback-and-cutoff_writeback_sy.patch183
-rw-r--r--patches.suse/0273-bcache-set-writeback_percent-in-a-flexible-range.patch48
-rw-r--r--patches.suse/0274-bcache-print-number-of-keys-in-trace_bcache_journal_.patch74
-rw-r--r--patches.suse/0275-bcache-never-writeback-a-discard-operation.patch136
-rw-r--r--patches.suse/0276-bcache-not-use-hard-coded-memset-size-in-bch_cache_a.patch41
-rw-r--r--patches.suse/0277-bcache-export-backing_dev_name-via-sysfs.patch58
-rw-r--r--patches.suse/0278-bcache-export-backing_dev_uuid-via-sysfs.patch64
-rw-r--r--patches.suse/0279-bcache-fix-indentation-issue-remove-tabs-on-a-hunk-o.patch63
-rw-r--r--patches.suse/0280-bcache-treat-stale-dirty-keys-as-bad-keys.patch98
-rw-r--r--patches.suse/0281-bcache-improve-sysfs_strtoul_clamp.patch65
-rw-r--r--patches.suse/0282-bcache-fix-input-integer-overflow-of-congested-thres.patch50
-rw-r--r--patches.suse/0283-bcache-fix-input-overflow-to-sequential_cutoff.patch43
-rw-r--r--patches.suse/0284-bcache-add-sysfs_strtoul_bool-for-setting-bit-field-.patch56
-rw-r--r--patches.suse/0285-bcache-use-sysfs_strtoul_bool-to-set-bit-field-varia.patch76
-rw-r--r--patches.suse/0286-bcache-fix-input-overflow-to-writeback_delay.patch41
-rw-r--r--patches.suse/0287-bcache-fix-potential-div-zero-error-of-writeback_rat.patch52
-rw-r--r--patches.suse/0288-bcache-fix-potential-div-zero-error-of-writeback_rat.patch50
-rw-r--r--patches.suse/0289-bcache-fix-input-overflow-to-writeback_rate_minimum.patch42
-rw-r--r--patches.suse/0290-bcache-fix-input-overflow-to-journal_delay_ms.patch43
-rw-r--r--patches.suse/0291-bcache-fix-input-overflow-to-cache-set-io_error_limi.patch43
-rw-r--r--patches.suse/0292-bcache-fix-input-overflow-to-cache-set-sysfs-file-io.patch52
-rw-r--r--patches.suse/0293-bcache-use-REQ_META-REQ_PRIO-to-indicate-bio-for-met.patch76
-rw-r--r--patches.suse/Revert-block-unexport-DISK_EVENT_MEDIA_CHANGE-for.patch145
-rw-r--r--patches.suse/block-check_events-don-t-bother-with-events-if-un.patch99
-rw-r--r--patches.suse/block-disk_events-introduce-event-flags.patch133
-rw-r--r--patches.suse/btrfs-Take-trans-lock-before-access-running-trans-in.patch19
-rw-r--r--patches.suse/btrfs-fix-race-condition-between-delayed-refs-and-blockgroup-removal.patch82
-rw-r--r--patches.suse/ext4-dont-warn-when-enabling-DAX.patch26
-rw-r--r--patches.suse/lpfc-validate-command-in-lpfc_sli4_scmd_to_wqidx_dis.patch32
-rw-r--r--patches.suse/net-smc-add-pnet-table-namespace-support471
-rw-r--r--patches.suse/net-smc-add-smcd-support-to-the-pnet-table234
-rw-r--r--patches.suse/net-smc-allow-pci-ids-as-ib-device-names-in-the-pnet-table44
-rw-r--r--patches.suse/net-smc-allow-pnetid-less-configuration84
-rw-r--r--patches.suse/net-smc-cleanup-for-smcr_tx_sndbuf_nonempty48
-rw-r--r--patches.suse/net-smc-rework-pnet-table680
-rw-r--r--patches.suse/nfs-serialize-open-ops.patch63
-rw-r--r--patches.suse/packet-validate-msg_namelen-in-send-directly.patch95
-rw-r--r--patches.suse/qla2xxx-allow-irqbalance-control-in-non-MQ-mode.patch34
-rw-r--r--patches.suse/revert-btrfs-qgroup-move-half-of-the-qgroup-accounting-time-out-of-commit-trans.patch104
-rw-r--r--patches.suse/tty-make-R3964-line-discipline-fail.patch54
-rwxr-xr-xscripts/bugzilla-create1
-rw-r--r--scripts/git_sort/README.md13
-rwxr-xr-xscripts/git_sort/git_sort.py15
-rw-r--r--scripts/git_sort/lib.py12
-rwxr-xr-xscripts/git_sort/merge_tool.py3
-rw-r--r--scripts/git_sort/pygit2_wrapper.py30
-rwxr-xr-xscripts/git_sort/qcp.py8
-rwxr-xr-xscripts/git_sort/qdupcheck.py3
-rwxr-xr-xscripts/git_sort/series_insert.py3
-rwxr-xr-xscripts/git_sort/series_sort.py9
-rw-r--r--scripts/git_sort/tests/sle12-sp2/Dockerfile2
-rw-r--r--scripts/git_sort/tests/support.py3
-rwxr-xr-xscripts/git_sort/tests/test_git_sort.py3
-rwxr-xr-xscripts/git_sort/tests/test_quilt_mode.py3
-rwxr-xr-xscripts/git_sort/tests/test_series_insert.py3
-rwxr-xr-xscripts/git_sort/tests/test_series_sort.py3
-rwxr-xr-xscripts/git_sort/update_clone.py3
-rw-r--r--series.conf419
-rw-r--r--supported.conf3
431 files changed, 35438 insertions, 335 deletions
diff --git a/blacklist.conf b/blacklist.conf
index d4b06efdca..f3540b02d0 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -58,6 +58,7 @@ tools/testing/selftests/ # Selftests should be run from upstream
fs/f2fs/ # Not compiled, has some fatal flaws (see bsc#1109665)
security/smack # we don't enable Smack
+drivers/ide # IDE not shipped since SLE12
# Blacklisted CVE entries
# -----------------------
@@ -1099,3 +1100,19 @@ c8b1917c8987a6fa3695d479b4d60fbbbc3e537b # acpica: causes a regression (bsc#1132
379d98ddf41344273d9718556f761420f4dc80b3 # we don't use clang
9fa246256e09dc30820524401cdbeeaadee94025 # We don't have the reverted commit: Revert "drm/i915/fbdev: Actually configure untiled displays"
4a58038b9e420276157785afa0a0bbb4b9bc2265 # Reverted patch is not in SLE15
+5e6afb3832bedf420dd8e4c5b32ed85117c5087d # regulator: missing regulator_lock() API in SLE15
+978995def0f6030aa6b3b494682f673aca13881b # regulator: missing regulator_lock() API in SLE15
+1867af94cfdf37fc70fe67b3d522e78352800196 # regulator: missing regulator_lock() API in SLE15
+275513b7695a61b75b2546406ecd0f8e3d9fc8be # regulator: missing regulator_lock() API in SLE15
+119c4f5085c45b60cb23c5595e45d06135b89518 # regulator: missing regulator_lock() API in SLE15
+29d40b4a5776ec4727c9f0e00a884423dd5e3366 # regulator: missing regulator_lock() API in SLE15
+65378de3359d30ebce44762d8b8027f372b5b1c4 # regulator: missing regulator_lock() API in SLE15
+89b2758c192c35068b07766a6830433bfbdc1f44 # regulator: missing regulator_lock() API in SLE15
+f132da2534ec6599c78c4adcef15340cff2e9dd9 # regulator: missing regulator_lock() API in SLE15
+769fc8d4182c1d1875db7859852afeb436714c5c # regulator: missing regulator_lock() API in SLE15
+f58213637206e190453e3bd91f98f535566290a3 # regulator: missing regulator_lock() API in SLE15
+f7a621728a6a23bfd2c6ac4d3e42e1303aefde0f # regulator: missing regulator_lock() API in SLE15
+8be64b6d87bd47d81753b60ddafe70102ebfd76b # regulator: missing regulator_lock() API in SLE15
+401e7e88d4ef80188ffa07095ac00456f901b8c4 # base patch missing in SLE12-SP4
+98fdaaca9537b997062f1abc0aa87c61b50ce40a # Duplicate of fc89a38d99d4b1b33ca5b0e2329f5ddea02ecfb5: drm/i915/opregion: fix version check
+a0f52c3d357af218a9c1f7cd906ab70426176a1a # Duplicate of 16eb0f34cdf4cf04cd92762c7a79f98aa51e053f: drm/i915/opregion: rvda is relative from opregion base in opregion 2.1+
diff --git a/config/arm64/default b/config/arm64/default
index 82d8d3fde4..44801203c3 100644
--- a/config/arm64/default
+++ b/config/arm64/default
@@ -7016,7 +7016,7 @@ CONFIG_GFS2_FS_LOCKING_DLM=y
CONFIG_OCFS2_FS=m
CONFIG_OCFS2_FS_O2CB=m
CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
-# CONFIG_OCFS2_FS_STATS is not set
+CONFIG_OCFS2_FS_STATS=y
CONFIG_OCFS2_DEBUG_MASKLOG=y
# CONFIG_OCFS2_DEBUG_FS is not set
CONFIG_BTRFS_FS=m
@@ -7842,6 +7842,7 @@ CONFIG_CRC32_SLICEBY8=y
# CONFIG_CRC32_SLICEBY4 is not set
# CONFIG_CRC32_SARWATE is not set
# CONFIG_CRC32_BIT is not set
+CONFIG_CRC64=m
CONFIG_CRC7=m
CONFIG_LIBCRC32C=m
CONFIG_CRC8=m
diff --git a/config/ppc64le/default b/config/ppc64le/default
index 1d508fe3a4..f0e4a0204e 100644
--- a/config/ppc64le/default
+++ b/config/ppc64le/default
@@ -4495,7 +4495,7 @@ CONFIG_GFS2_FS_LOCKING_DLM=y
CONFIG_OCFS2_FS=m
CONFIG_OCFS2_FS_O2CB=m
CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
-# CONFIG_OCFS2_FS_STATS is not set
+CONFIG_OCFS2_FS_STATS=y
CONFIG_OCFS2_DEBUG_MASKLOG=y
# CONFIG_OCFS2_DEBUG_FS is not set
CONFIG_BTRFS_FS=m
@@ -4784,6 +4784,7 @@ CONFIG_CRC32_SLICEBY8=y
# CONFIG_CRC32_SLICEBY4 is not set
# CONFIG_CRC32_SARWATE is not set
# CONFIG_CRC32_BIT is not set
+CONFIG_CRC64=m
CONFIG_CRC7=m
CONFIG_LIBCRC32C=m
CONFIG_CRC8=m
diff --git a/config/s390x/default b/config/s390x/default
index b3dd1cc333..11fa9a598c 100644
--- a/config/s390x/default
+++ b/config/s390x/default
@@ -2293,7 +2293,7 @@ CONFIG_GFS2_FS_LOCKING_DLM=y
CONFIG_OCFS2_FS=m
CONFIG_OCFS2_FS_O2CB=m
CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
-# CONFIG_OCFS2_FS_STATS is not set
+CONFIG_OCFS2_FS_STATS=y
CONFIG_OCFS2_DEBUG_MASKLOG=y
# CONFIG_OCFS2_DEBUG_FS is not set
CONFIG_BTRFS_FS=m
@@ -3034,6 +3034,7 @@ CONFIG_CRC32_SLICEBY8=y
# CONFIG_CRC32_SLICEBY4 is not set
# CONFIG_CRC32_SARWATE is not set
# CONFIG_CRC32_BIT is not set
+CONFIG_CRC64=m
CONFIG_CRC7=m
CONFIG_LIBCRC32C=m
CONFIG_CRC8=m
diff --git a/config/s390x/zfcpdump b/config/s390x/zfcpdump
index 15cdc86cdf..08c108ad91 100644
--- a/config/s390x/zfcpdump
+++ b/config/s390x/zfcpdump
@@ -1182,6 +1182,7 @@ CONFIG_CRC32_SLICEBY8=y
# CONFIG_CRC32_SLICEBY4 is not set
# CONFIG_CRC32_SARWATE is not set
# CONFIG_CRC32_BIT is not set
+CONFIG_CRC64=y
# CONFIG_CRC7 is not set
# CONFIG_LIBCRC32C is not set
# CONFIG_CRC8 is not set
diff --git a/config/x86_64/default b/config/x86_64/default
index 6ec056eedd..bf17d506f7 100644
--- a/config/x86_64/default
+++ b/config/x86_64/default
@@ -6679,7 +6679,7 @@ CONFIG_GFS2_FS_LOCKING_DLM=y
CONFIG_OCFS2_FS=m
CONFIG_OCFS2_FS_O2CB=m
CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
-# CONFIG_OCFS2_FS_STATS is not set
+CONFIG_OCFS2_FS_STATS=y
CONFIG_OCFS2_DEBUG_MASKLOG=y
# CONFIG_OCFS2_DEBUG_FS is not set
CONFIG_BTRFS_FS=m
@@ -7568,6 +7568,7 @@ CONFIG_CRC32_SLICEBY8=y
# CONFIG_CRC32_SLICEBY4 is not set
# CONFIG_CRC32_SARWATE is not set
# CONFIG_CRC32_BIT is not set
+CONFIG_CRC64=m
CONFIG_CRC7=m
CONFIG_LIBCRC32C=m
CONFIG_CRC8=m
diff --git a/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch b/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch
index 58fd60fc29..ef4fcccace 100644
--- a/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch
+++ b/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:28 -0500
Subject: cpu/speculation: Add 'mitigations=' cmdline option
Git-commit: 98af8452945c55652de68536afdde3b520fec429
-Patch-mainline: queued in subsystem tree
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Keeping track of the number of mitigations for all the CPU speculation
diff --git a/patches.arch/intel_idle-add-support-for-Jacobsville.patch b/patches.arch/intel_idle-add-support-for-Jacobsville.patch
index 81b2bc5dba..9e2a8e615b 100644
--- a/patches.arch/intel_idle-add-support-for-Jacobsville.patch
+++ b/patches.arch/intel_idle-add-support-for-Jacobsville.patch
@@ -13,21 +13,16 @@ Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- drivers/idle/intel_idle.c | 1 +
+ drivers/idle/intel_idle.c | 1 +
1 file changed, 1 insertion(+)
-diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
-index 216d7ec88c0c..008eb4d58a86 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
-@@ -1099,6 +1099,7 @@ static const struct x86_cpu_id intel_idle_ids[] __initconst = {
+@@ -1099,6 +1099,7 @@ static const struct x86_cpu_id intel_idl
ICPU(INTEL_FAM6_ATOM_GOLDMONT, idle_cpu_bxt),
- ICPU(INTEL_FAM6_ATOM_GEMINI_LAKE, idle_cpu_bxt),
- ICPU(INTEL_FAM6_ATOM_DENVERTON, idle_cpu_dnv),
+ ICPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, idle_cpu_bxt),
+ ICPU(INTEL_FAM6_ATOM_GOLDMONT_X, idle_cpu_dnv),
+ ICPU(INTEL_FAM6_ATOM_TREMONT_X, idle_cpu_dnv),
{}
};
---
-2.20.1
-
diff --git a/patches.arch/kvm-x86-report-stibp-on-get_supported_cpuid.patch b/patches.arch/kvm-x86-report-stibp-on-get_supported_cpuid.patch
new file mode 100644
index 0000000000..bec39883f1
--- /dev/null
+++ b/patches.arch/kvm-x86-report-stibp-on-get_supported_cpuid.patch
@@ -0,0 +1,47 @@
+From: Eduardo Habkost <ehabkost@redhat.com>
+Date: Wed, 5 Dec 2018 17:19:56 -0200
+Subject: kvm: x86: Report STIBP on GET_SUPPORTED_CPUID
+Git-commit: d7b09c827a6cf291f66637a36f46928dd1423184
+Patch-mainline: v5.0-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+Months ago, we have added code to allow direct access to MSR_IA32_SPEC_CTRL
+to the guest, which makes STIBP available to guests. This was implemented
+by commits d28b387fb74d ("KVM/VMX: Allow direct access to
+MSR_IA32_SPEC_CTRL") and b2ac58f90540 ("KVM/SVM: Allow direct access to
+MSR_IA32_SPEC_CTRL").
+
+However, we never updated GET_SUPPORTED_CPUID to let userspace know that
+STIBP can be enabled in CPUID. Fix that by updating
+kvm_cpuid_8000_0008_ebx_x86_features and kvm_cpuid_7_0_edx_x86_features.
+
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+Reviewed-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kvm/cpuid.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -367,7 +367,8 @@ static inline int __do_cpuid_ent(struct
+
+ /* cpuid 0x80000008.ebx */
+ const u32 kvm_cpuid_8000_0008_ebx_x86_features =
+- F(AMD_IBPB) | F(AMD_IBRS) | F(AMD_SSBD) | F(VIRT_SSBD) | F(AMD_SSB_NO);
++ F(AMD_IBPB) | F(AMD_IBRS) | F(AMD_SSBD) | F(VIRT_SSBD) |
++ F(AMD_SSB_NO) | F(AMD_STIBP);
+
+ /* cpuid 0xC0000001.edx */
+ const u32 kvm_cpuid_C000_0001_edx_x86_features =
+@@ -395,7 +396,7 @@ static inline int __do_cpuid_ent(struct
+ /* cpuid 7.0.edx*/
+ const u32 kvm_cpuid_7_0_edx_x86_features =
+ F(AVX512_4VNNIW) | F(AVX512_4FMAPS) | F(SPEC_CTRL) |
+- F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES);
++ F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES) | F(INTEL_STIBP);
+
+ /* all calls to cpuid_count() should be made on the same cpu */
+ get_cpu();
diff --git a/patches.arch/locking-atomics-asm-generic-move-some-macros-from-linux-bitops-h-to-a-new-linux-bits-h-file.patch b/patches.arch/locking-atomics-asm-generic-move-some-macros-from-linux-bitops-h-to-a-new-linux-bits-h-file.patch
new file mode 100644
index 0000000000..e431bdf60d
--- /dev/null
+++ b/patches.arch/locking-atomics-asm-generic-move-some-macros-from-linux-bitops-h-to-a-new-linux-bits-h-file.patch
@@ -0,0 +1,90 @@
+From: Will Deacon <will.deacon@arm.com>
+Date: Tue, 19 Jun 2018 13:53:08 +0100
+Subject: locking/atomics, asm-generic: Move some macros from <linux/bitops.h>
+ to a new <linux/bits.h> file
+Git-commit: 8bd9cb51daac89337295b6f037b0486911e1b408
+Patch-mainline: v4.19-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+In preparation for implementing the asm-generic atomic bitops in terms
+of atomic_long_*(), we need to prevent <asm/atomic.h> implementations from
+pulling in <linux/bitops.h>. A common reason for this include is for the
+BITS_PER_BYTE definition, so move this and some other BIT() and masking
+macros into a new header file, <linux/bits.h>.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: yamada.masahiro@socionext.com
+Link: https://lore.kernel.org/lkml/1529412794-17720-4-git-send-email-will.deacon@arm.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ include/linux/bitops.h | 21 +--------------------
+ include/linux/bits.h | 26 ++++++++++++++++++++++++++
+ 2 files changed, 27 insertions(+), 20 deletions(-)
+
+--- a/include/linux/bitops.h
++++ b/include/linux/bitops.h
+@@ -1,28 +1,9 @@
+ #ifndef _LINUX_BITOPS_H
+ #define _LINUX_BITOPS_H
+ #include <asm/types.h>
++#include <linux/bits.h>
+
+-#ifdef __KERNEL__
+-#define BIT(nr) (1UL << (nr))
+-#define BIT_ULL(nr) (1ULL << (nr))
+-#define BIT_MASK(nr) (1UL << ((nr) % BITS_PER_LONG))
+-#define BIT_WORD(nr) ((nr) / BITS_PER_LONG)
+-#define BIT_ULL_MASK(nr) (1ULL << ((nr) % BITS_PER_LONG_LONG))
+-#define BIT_ULL_WORD(nr) ((nr) / BITS_PER_LONG_LONG)
+-#define BITS_PER_BYTE 8
+ #define BITS_TO_LONGS(nr) DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
+-#endif
+-
+-/*
+- * Create a contiguous bitmask starting at bit position @l and ending at
+- * position @h. For example
+- * GENMASK_ULL(39, 21) gives us the 64bit vector 0x000000ffffe00000.
+- */
+-#define GENMASK(h, l) \
+- (((~0UL) << (l)) & (~0UL >> (BITS_PER_LONG - 1 - (h))))
+-
+-#define GENMASK_ULL(h, l) \
+- (((~0ULL) << (l)) & (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h))))
+
+ extern unsigned int __sw_hweight8(unsigned int w);
+ extern unsigned int __sw_hweight16(unsigned int w);
+--- /dev/null
++++ b/include/linux/bits.h
+@@ -0,0 +1,26 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __LINUX_BITS_H
++#define __LINUX_BITS_H
++#include <asm/bitsperlong.h>
++
++#define BIT(nr) (1UL << (nr))
++#define BIT_ULL(nr) (1ULL << (nr))
++#define BIT_MASK(nr) (1UL << ((nr) % BITS_PER_LONG))
++#define BIT_WORD(nr) ((nr) / BITS_PER_LONG)
++#define BIT_ULL_MASK(nr) (1ULL << ((nr) % BITS_PER_LONG_LONG))
++#define BIT_ULL_WORD(nr) ((nr) / BITS_PER_LONG_LONG)
++#define BITS_PER_BYTE 8
++
++/*
++ * Create a contiguous bitmask starting at bit position @l and ending at
++ * position @h. For example
++ * GENMASK_ULL(39, 21) gives us the 64bit vector 0x000000ffffe00000.
++ */
++#define GENMASK(h, l) \
++ (((~0UL) - (1UL << (l)) + 1) & (~0UL >> (BITS_PER_LONG - 1 - (h))))
++
++#define GENMASK_ULL(h, l) \
++ (((~0ULL) - (1ULL << (l)) + 1) & \
++ (~0ULL >> (BITS_PER_LONG_LONG - 1 - (h))))
++
++#endif /* __LINUX_BITS_H */
diff --git a/patches.arch/powercap-intel_rapl-add-support-for-Jacobsville.patch b/patches.arch/powercap-intel_rapl-add-support-for-Jacobsville.patch
index 5a3982f1bf..5a1ed53480 100644
--- a/patches.arch/powercap-intel_rapl-add-support-for-Jacobsville.patch
+++ b/patches.arch/powercap-intel_rapl-add-support-for-Jacobsville.patch
@@ -13,15 +13,15 @@ Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- drivers/powercap/intel_rapl.c | 1 +
+ drivers/powercap/intel_rapl.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -1166,6 +1166,7 @@ static const struct x86_cpu_id rapl_ids[
RAPL_CPU(INTEL_FAM6_ATOM_GOLDMONT, rapl_defaults_core),
- RAPL_CPU(INTEL_FAM6_ATOM_GEMINI_LAKE, rapl_defaults_core),
- RAPL_CPU(INTEL_FAM6_ATOM_DENVERTON, rapl_defaults_core),
+ RAPL_CPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, rapl_defaults_core),
+ RAPL_CPU(INTEL_FAM6_ATOM_GOLDMONT_X, rapl_defaults_core),
+ RAPL_CPU(INTEL_FAM6_ATOM_TREMONT_X, rapl_defaults_core),
RAPL_CPU(INTEL_FAM6_XEON_PHI_KNL, rapl_defaults_hsw_server),
diff --git a/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch b/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
index cdab5ca429..50b4452a92 100644
--- a/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
+++ b/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
@@ -4,7 +4,8 @@ Date: Tue, 2 Oct 2018 10:35:59 -0500
Subject: [PATCH] powerpc/pseries: Track LMB nid instead of using device tree
References: bsc#1108270
-Patch-mainline: submitted https://patchwork.ozlabs.org/patch/977943/
+Patch-mainline: v5.2-rc1
+Git-commit: b2d3b5ee66f2a04a918cc043cec0c9ed3de58f40
When removing memory we need to remove the memory from the node
it was added to instead of looking up the node it should be in
@@ -49,6 +50,7 @@ it is added to the system so we can remove it from that node instead
of the node that the device tree indicates it should belong to.
Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
arch/powerpc/include/asm/drmem.h | 26 +++++++++++++++++++
diff --git a/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch b/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch
index f9072b1237..bb925ed307 100644
--- a/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch
+++ b/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:30 -0500
Subject: powerpc/speculation: Support 'mitigations=' cmdline option
Git-commit: 782e69efb3dfed6e8360bc612e8c7827a901a8f9
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: queued in subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Configure powerpc CPU runtime speculation bug mitigations in accordance
diff --git a/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch b/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
index ef765a6203..0eb3f926d5 100644
--- a/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
+++ b/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
@@ -1,59 +1,63 @@
-From patchwork Wed Jan 16 16:47:44 2019
-Subject: powerpc/tm: Avoid machine crash on rt_sigreturn
-X-Patchwork-Id: 1026032
-Date: Wed, 16 Jan 2019 14:47:44 -0200
+From e620d45065c7b5b8d6ae11217c09c09380103b83 Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao@debian.org>
+Date: Wed, 16 Jan 2019 14:47:44 -0200
+Subject: [PATCH] powerpc/tm: Avoid machine crash on rt_sigreturn()
References: bsc#1118338
-Patch-mainline: submitted https://patchwork.ozlabs.org/patch/1026032/
+Patch-mainline: v5.2-rc1
+Git-commit: e620d45065c7b5b8d6ae11217c09c09380103b83
-There is a kernel crash that happens if rt_sigreturn is called inside a
-transactional block.
+There is a kernel crash that happens if rt_sigreturn() is called inside
+a transactional block.
This crash happens if the kernel hits an in-kernel page fault when
-accessing userspace memory, usually through copy_ckvsx_to_user(). A major
-page fault calls might_sleep() function, which can cause a task reschedule.
-A task reschedule (switch_to()) reclaim and recheckpoint the TM states,
-but, in the signal return path, the checkpointed memory was already
-reclaimed, thus the exception stack has MSR that points to MSR[TS]=0.
+accessing userspace memory, usually through copy_ckvsx_to_user(). A
+major page fault calls might_sleep() function, which can cause a task
+reschedule. A task reschedule (switch_to()) reclaim and recheckpoint
+the TM states, but, in the signal return path, the checkpointed memory
+was already reclaimed, thus the exception stack has MSR that points to
+MSR[TS]=0.
-When the code returns from might_sleep() and a task reschedule happened,
-then this task is returned with the memory recheckpointed, and
-CPU MSR[TS] = suspended.
+When the code returns from might_sleep() and a task reschedule
+happened, then this task is returned with the memory recheckpointed,
+and CPU MSR[TS] = suspended.
-This means that there is a side effect at might_sleep() if it is called
-with CPU MSR[TS] = 0 and the task has regs->msr[TS] != 0.
+This means that there is a side effect at might_sleep() if it is
+called with CPU MSR[TS] = 0 and the task has regs->msr[TS] != 0.
-This side effect can cause a TM bad thing, since at the exception entrance,
-the stack saves MSR[TS]=0, and this is what will be used at RFID, but,
-the processor has MSR[TS] = Suspended, and this transition will be invalid
-and a TM Bad thing will be raised, causing the following crash:
+This side effect can cause a TM bad thing, since at the exception
+entrance, the stack saves MSR[TS]=0, and this is what will be used at
+RFID, but, the processor has MSR[TS] = Suspended, and this transition
+will be invalid and a TM Bad thing will be raised, causing the
+following crash:
- Unexpected TM Bad Thing exception at c00000000000e9ec (msr 0x8000000302a03031) tm_scratch=800000010280b033
- cpu 0xc: Vector: 700 (Program Check) at [c00000003ff1fd70]
- pc: c00000000000e9ec: fast_exception_return+0x100/0x1bc
- lr: c000000000032948: handle_rt_signal64+0xb8/0xaf0
- sp: c0000004263ebc40
- msr: 8000000302a03031
- current = 0xc000000415050300
- paca = 0xc00000003ffc4080 irqmask: 0x03 irq_happened: 0x01
- pid = 25006, comm = sigfuz
- Linux version 5.0.0-rc1-00001-g3bd6e94bec12 (breno@debian) (gcc version 8.2.0 (Debian 8.2.0-3)) #899 SMP Mon Jan 7 11:30:07 EST 2019
- WARNING: exception is not recoverable, can't continue
- enter ? for help
- [c0000004263ebc40] c000000000032948 handle_rt_signal64+0xb8/0xaf0 (unreliable)
- [c0000004263ebd30] c000000000022780 do_notify_resume+0x2f0/0x430
- [c0000004263ebe20] c00000000000e844 ret_from_except_lite+0x70/0x74
- --- Exception: c00 (System Call) at 00007fffbaac400c
- SP (7fffeca90f40) is in userspace
+ Unexpected TM Bad Thing exception at c00000000000e9ec (msr 0x8000000302a03031) tm_scratch=800000010280b033
+ cpu 0xc: Vector: 700 (Program Check) at [c00000003ff1fd70]
+ pc: c00000000000e9ec: fast_exception_return+0x100/0x1bc
+ lr: c000000000032948: handle_rt_signal64+0xb8/0xaf0
+ sp: c0000004263ebc40
+ msr: 8000000302a03031
+ current = 0xc000000415050300
+ paca = 0xc00000003ffc4080 irqmask: 0x03 irq_happened: 0x01
+ pid = 25006, comm = sigfuz
+ Linux version 5.0.0-rc1-00001-g3bd6e94bec12 (breno@debian) (gcc version 8.2.0 (Debian 8.2.0-3)) #899 SMP Mon Jan 7 11:30:07 EST 2019
+ WARNING: exception is not recoverable, can't continue
+ enter ? for help
+ [c0000004263ebc40] c000000000032948 handle_rt_signal64+0xb8/0xaf0 (unreliable)
+ [c0000004263ebd30] c000000000022780 do_notify_resume+0x2f0/0x430
+ [c0000004263ebe20] c00000000000e844 ret_from_except_lite+0x70/0x74
+ --- Exception: c00 (System Call) at 00007fffbaac400c
+ SP (7fffeca90f40) is in userspace
The solution for this problem is running the sigreturn code with
-regs->msr[TS] disabled, thus, avoiding hitting the side effect above. This
-does not seem to be a problem since regs->msr will be replaced by the
-ucontext value, so, it is being flushed already. In this case, it is
-flushed earlier.
+regs->msr[TS] disabled, thus, avoiding hitting the side effect above.
+This does not seem to be a problem since regs->msr will be replaced by
+the ucontext value, so, it is being flushed already. In this case, it
+is flushed earlier.
Signed-off-by: Breno Leitao <leitao@debian.org>
+Acked-by: Michael Neuling <mikey@neuling.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
arch/powerpc/kernel/signal_64.c | 27 ++++++++++++++++++++++++++-
@@ -104,3 +108,6 @@ index 6794466f6420..06c299ef6132 100644
if (__get_user(msr, &uc->uc_mcontext.gp_regs[PT_MSR]))
goto badframe;
if (MSR_TM_ACTIVE(msr)) {
+--
+2.20.1
+
diff --git a/patches.arch/s390-ism-ignore-some-errors-during-deregistration b/patches.arch/s390-ism-ignore-some-errors-during-deregistration
new file mode 100644
index 0000000000..00b471460d
--- /dev/null
+++ b/patches.arch/s390-ism-ignore-some-errors-during-deregistration
@@ -0,0 +1,74 @@
+From: Sebastian Ott <sebott@linux.ibm.com>
+Date: Thu, 14 Feb 2019 14:46:23 +0100
+Subject: s390/ism: ignore some errors during deregistration
+Git-commit: 0ff06c44efeede4acd068847d3bf8cf894b6c664
+Patch-mainline: v5.1-rc1
+References: bsc#1129857 LTC#176247
+
+Prior to dma unmap/free operations the ism driver tries to ensure
+that the memory is no longer accessed by the HW. When errors
+during deregistration of memory regions from the HW occur the ism
+driver will not unmap/free this memory.
+
+When we receive notification from the hypervisor that a PCI function
+has been detached we can no longer access the device and would never
+unmap/free these memory regions which led to complaints by the DMA
+debug API.
+
+Treat this kind of errors during the deregistration of memory regions
+from the HW as success since it is already ensured that the memory
+is no longer accessed by HW.
+
+Reported-by: Karsten Graul <kgraul@linux.ibm.com>
+Reported-by: Hans Wippel <hwippel@linux.ibm.com>
+Signed-off-by: Sebastian Ott <sebott@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/net/ism_drv.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
+index ed8e58f09054..3e132592c1fe 100644
+--- a/drivers/s390/net/ism_drv.c
++++ b/drivers/s390/net/ism_drv.c
+@@ -141,10 +141,13 @@ static int register_ieq(struct ism_dev *ism)
+
+ static int unregister_sba(struct ism_dev *ism)
+ {
++ int ret;
++
+ if (!ism->sba)
+ return 0;
+
+- if (ism_cmd_simple(ism, ISM_UNREG_SBA))
++ ret = ism_cmd_simple(ism, ISM_UNREG_SBA);
++ if (ret && ret != ISM_ERROR)
+ return -EIO;
+
+ dma_free_coherent(&ism->pdev->dev, PAGE_SIZE,
+@@ -158,10 +161,13 @@ static int unregister_sba(struct ism_dev *ism)
+
+ static int unregister_ieq(struct ism_dev *ism)
+ {
++ int ret;
++
+ if (!ism->ieq)
+ return 0;
+
+- if (ism_cmd_simple(ism, ISM_UNREG_IEQ))
++ ret = ism_cmd_simple(ism, ISM_UNREG_IEQ);
++ if (ret && ret != ISM_ERROR)
+ return -EIO;
+
+ dma_free_coherent(&ism->pdev->dev, PAGE_SIZE,
+@@ -287,7 +293,7 @@ static int ism_unregister_dmb(struct smcd_dev *smcd, struct smcd_dmb *dmb)
+ cmd.request.dmb_tok = dmb->dmb_tok;
+
+ ret = ism_cmd(ism, &cmd);
+- if (ret)
++ if (ret && ret != ISM_ERROR)
+ goto out;
+
+ ism_free_dmb(ism, dmb);
+
diff --git a/patches.arch/s390-sles12sp4-kmsg-update-2019-03-08.patch b/patches.arch/s390-sles12sp4-kmsg-update-2019-03-08.patch
new file mode 100644
index 0000000000..4f1a266f3d
--- /dev/null
+++ b/patches.arch/s390-sles12sp4-kmsg-update-2019-03-08.patch
@@ -0,0 +1,326 @@
+From: Michael Holzheu <holzheu@linux.ibm.com>
+Subject: kmsg: Update message catalog to latest IBM level (2019/03/08)
+Patch-mainline: never, S/390 specific
+References: bsc#1128905 LTC#176077
+
+Description: kmsg: Update message catalog to latest IBM level (2019/03/08)
+Symptom: Man pages in the "kernel-default-man" rpm are missing or are
+ not correct.
+Problem: Source for man pages is not up-to-date because added patches
+ introduced new messages or updated existing ones.
+Solution: Update messages to latest internal IBM level.
+Reproduction: 1) Build kernel with selected config, e.g.:
+ $ make defconfig && make
+ 2) Make kmsg-doc executable:
+ $ chmod a+x scripts/kmsg-doc
+ 3) Check messages:
+ $ make D=1
+ 4) Build messages:
+ $ make D=2
+ 5) Check built man pages, e.g.:
+ $ man man/cpu.643eaf.9
+ Note: To check a subdirectory use "make D=1 SUBDIR=arch/s390"
+
+
+Signed-off-by: Michael Holzheu <holzheu@linux.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ Documentation/kmsg/IPVS | 3 ++
+ Documentation/kmsg/ism | 2 +
+ Documentation/kmsg/s390/aes_s390 | 1
+ Documentation/kmsg/s390/af_iucv | 1
+ Documentation/kmsg/s390/appldata | 1
+ Documentation/kmsg/s390/bpf_jit | 1
+ Documentation/kmsg/s390/cio | 1
+ Documentation/kmsg/s390/cpcmd | 1
+ Documentation/kmsg/s390/cpu | 1
+ Documentation/kmsg/s390/crc32-vx | 1
+ Documentation/kmsg/s390/ctcm | 1
+ Documentation/kmsg/s390/dasd | 1
+ Documentation/kmsg/s390/dasd-eckd | 42 ++++++++++++++++++++++++++++++++++++
+ Documentation/kmsg/s390/diag288_wdt | 1
+ Documentation/kmsg/s390/extmem | 1
+ Documentation/kmsg/s390/hmcdrv | 1
+ Documentation/kmsg/s390/hugetlb | 1
+ Documentation/kmsg/s390/hypfs | 1
+ Documentation/kmsg/s390/lcs | 1
+ Documentation/kmsg/s390/monwriter | 1
+ Documentation/kmsg/s390/netiucv | 1
+ Documentation/kmsg/s390/paes_s390 | 3 +-
+ Documentation/kmsg/s390/perf | 1
+ Documentation/kmsg/s390/qeth | 1
+ Documentation/kmsg/s390/setup | 1
+ Documentation/kmsg/s390/vmur | 1
+ Documentation/kmsg/s390/zfcp | 2 +
+ Documentation/kmsg/s390/zpci | 1
+ Documentation/kmsg/s390/zram | 2 +
+ Documentation/kmsg/sbp_target | 3 +-
+ Documentation/kmsg/smc | 4 ++-
+ 31 files changed, 81 insertions(+), 3 deletions(-)
+
+--- a/Documentation/kmsg/IPVS
++++ b/Documentation/kmsg/IPVS
+@@ -79,3 +79,6 @@
+ /*? Text: "%s selects TX queue %d, but real number of TX queues is %d\n" */
+ /*? Text: "Unknown mcast interface: %s\n" */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
++/*? Text: "%s(): request for already hashed, called from %pS\n" */
++/*? Text: "%s(): request for unhash flagged, called from %pS\n" */
+--- /dev/null
++++ b/Documentation/kmsg/ism
+@@ -0,0 +1,2 @@
++/*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/aes_s390
++++ b/Documentation/kmsg/s390/aes_s390
+@@ -43,3 +43,4 @@
+ * None.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/af_iucv
++++ b/Documentation/kmsg/s390/af_iucv
+@@ -21,3 +21,4 @@
+ /*? Text: "flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n" */
+ /*? Text: "%s selects TX queue %d, but real number of TX queues is %d\n" */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/appldata
++++ b/Documentation/kmsg/s390/appldata
+@@ -89,3 +89,4 @@
+ /*? Text: "netif_stop_queue() cannot be called before register_netdev()\n" */
+ /*? Text: "%s selects TX queue %d, but real number of TX queues is %d\n" */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/bpf_jit
++++ b/Documentation/kmsg/s390/bpf_jit
+@@ -14,3 +14,4 @@
+ * Report this problem and the error message to your support organization.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/cio
++++ b/Documentation/kmsg/s390/cio
+@@ -245,3 +245,4 @@
+ * Report the problem to your support organization.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/cpcmd
++++ b/Documentation/kmsg/s390/cpcmd
+@@ -15,3 +15,4 @@
+ * machine.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/cpu
++++ b/Documentation/kmsg/s390/cpu
+@@ -52,3 +52,4 @@
+ * does not include all CPU information.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/crc32-vx
++++ b/Documentation/kmsg/s390/crc32-vx
+@@ -1 +1,2 @@
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/ctcm
++++ b/Documentation/kmsg/s390/ctcm
+@@ -200,3 +200,4 @@
+ /*? Text: "flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n" */
+ /*? Text: "%s selects TX queue %d, but real number of TX queues is %d\n" */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/dasd
++++ b/Documentation/kmsg/s390/dasd
+@@ -691,3 +691,4 @@
+ * or set the sysfs 'use_diag' attribute of the DASD to 0 to switch off DIAG.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/dasd-eckd
++++ b/Documentation/kmsg/s390/dasd-eckd
+@@ -2163,4 +2163,46 @@
+ * to the path_reset sysfs attribute of the device.
+ * If the problem persists, report it to your support organization.
+ */
++
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++
++/*?
++ * Text: "%s: Path %x.%02x (pathmask %02x) is operational despite excessive IFCCs\n"
++ * Severity: Error
++ * Parameter:
++ * @1: bus ID of the DASD
++ * @2: cssid
++ * @3: chpid
++ * @4: logical path mask
++ * Description:
++ * The threshold value for interface or channel control checks (IFCCs) for the
++ * channel path was exceeded.
++ * The channel path remains operational because the autodisable feature for
++ * defective channel paths is not active.
++ * Defective channel paths can adversely affect performance.
++ * User action:
++ * Ensure that the cabling between the storage server and the mainframe
++ * system is securely in place.
++ * If you observe performance impacts, consider setting the channel path offline.
++ * By default, the DASD device driver disables defective channel paths for you.
++ * You can restore this default, for example, by writing '1' to the
++ * path_autodisable sysfs attribute.
++ * If the problem persists, report it to your support organization.
++ */
++
++/*?
++ * Text: "%s: Last path %x.%02x (pathmask %02x) is operational despite excessive IFCCs\n"
++ * Severity: Error
++ * Parameter:
++ * @1: bus ID of the DASD
++ * @2: cssid
++ * @3: chpid
++ * @4: logical path mask
++ * Description:
++ * The threshold value for interface or channel control checks (IFCCs) for the channel path was exceeded.
++ * The channel path was not removed from regular operations because it is the last remaining channel path for the DASD.
++ * User action:
++ * Ensure that the cabling between the storage server and the mainframe
++ * system is securely in place.
++ * If the problem persists, report it to your support organization.
++ */
+--- a/Documentation/kmsg/s390/diag288_wdt
++++ b/Documentation/kmsg/s390/diag288_wdt
+@@ -64,3 +64,4 @@
+ * contact your support organization.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/extmem
++++ b/Documentation/kmsg/s390/extmem
+@@ -292,3 +292,4 @@
+ * Ensure that the DCSS range is defined below the kernel mapping range.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/hmcdrv
++++ b/Documentation/kmsg/s390/hmcdrv
+@@ -20,3 +20,4 @@
+ * the cache size specification.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/hugetlb
++++ b/Documentation/kmsg/s390/hugetlb
+@@ -11,3 +11,4 @@
+ * Specify "2G" for 2 GB huge pages. These are supported as of zEC12
+ * and zBC12 machines.
+ */
++/*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
+--- a/Documentation/kmsg/s390/hypfs
++++ b/Documentation/kmsg/s390/hypfs
+@@ -55,3 +55,4 @@
+
+ /*? Text: "Hypervisor filesystem mounted\n" */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/lcs
++++ b/Documentation/kmsg/s390/lcs
+@@ -167,3 +167,4 @@
+ /*? Text: "flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n" */
+ /*? Text: "%s selects TX queue %d, but real number of TX queues is %d\n" */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/monwriter
++++ b/Documentation/kmsg/s390/monwriter
+@@ -15,3 +15,4 @@
+ * in "z/VM CP Programming Services".
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/netiucv
++++ b/Documentation/kmsg/s390/netiucv
+@@ -154,3 +154,4 @@
+ /*? Text: "flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n" */
+ /*? Text: "%s selects TX queue %d, but real number of TX queues is %d\n" */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/paes_s390
++++ b/Documentation/kmsg/s390/paes_s390
+@@ -1 +1,2 @@
+-/*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
+\ No newline at end of file
++/*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/perf
++++ b/Documentation/kmsg/s390/perf
+@@ -88,3 +88,4 @@
+ * process has ended.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/qeth
++++ b/Documentation/kmsg/s390/qeth
+@@ -966,3 +966,4 @@
+ * sysfs attribute of the device.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/setup
++++ b/Documentation/kmsg/s390/setup
+@@ -163,3 +163,4 @@
+ * None.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/vmur
++++ b/Documentation/kmsg/s390/vmur
+@@ -46,3 +46,4 @@
+ /*? Text: "%s loaded.\n" */
+ /*? Text: "%s unloaded.\n" */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/s390/zfcp
++++ b/Documentation/kmsg/s390/zfcp
+@@ -707,3 +707,5 @@
+ * support organization of the storage system.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
++/*? Text: "Invalid address limit on user-mode return" */
+--- a/Documentation/kmsg/s390/zpci
++++ b/Documentation/kmsg/s390/zpci
+@@ -40,3 +40,4 @@
+ * If the problem persists, contact your support organization.
+ */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- /dev/null
++++ b/Documentation/kmsg/s390/zram
+@@ -0,0 +1,2 @@
++/*? Text: "Can't setup backing device for initialized device\n" */
++/*? Text: "setup backing device %s\n" */
+--- a/Documentation/kmsg/sbp_target
++++ b/Documentation/kmsg/sbp_target
+@@ -46,4 +46,5 @@
+ /*? Text: "unlink LUN: failed to update unit directory\n" */
+ /*? Text: "flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n" */
+ /*? Text: "%s selects TX queue %d, but real number of TX queues is %d\n" */
+-/*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
+\ No newline at end of file
++/*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
+--- a/Documentation/kmsg/smc
++++ b/Documentation/kmsg/smc
+@@ -1,8 +1,10 @@
+ /*? Text: "%s: smc_cdc_init fails with %d\n" */
+-/*? Text: "%s: proto_register fails with %d\n" */
++/*? Text: "%s: proto_register(v4) fails with %d\n" */
++/*? Text: "%s: proto_register(v6) fails with %d\n" */
+ /*? Text: "%s: smc_llc_init fails with %d\n" */
+ /*? Text: "%s: %d output lines suppressed due to ratelimiting\n" */
+ /*? Text: "flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n" */
+ /*? Text: "%s selects TX queue %d, but real number of TX queues is %d\n" */
+ /*? Text: "%s: sock_register fails with %d\n" */
+ /*? Text: "%s: ib_register fails with %d\n" */
++/*? Text: "%s: SME is active, device will require DMA bounce buffers\n" */
diff --git a/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch b/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch
index 232c182f03..71c8954d67 100644
--- a/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch
+++ b/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:31 -0500
Subject: s390/speculation: Support 'mitigations=' cmdline option
Git-commit: 0336e04a6520bdaefdb0769d2a70084fa52e81ed
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: queued in subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Configure s390 runtime CPU speculation bug mitigations in accordance
diff --git a/patches.arch/x86-bugs-add-amd-s-variant-of-ssb_no.patch b/patches.arch/x86-bugs-add-amd-s-variant-of-ssb_no.patch
index 2114216f45..ea0130ee81 100644
--- a/patches.arch/x86-bugs-add-amd-s-variant-of-ssb_no.patch
+++ b/patches.arch/x86-bugs-add-amd-s-variant-of-ssb_no.patch
@@ -44,7 +44,7 @@ Acked-by: Borislav Petkov <bp@suse.de>
#define X86_FEATURE_DTHERM (14*32+ 0) /* Digital Thermal Sensor */
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
-@@ -948,7 +948,8 @@ static void __init cpu_set_bug_bits(stru
+@@ -946,7 +946,8 @@ static void __init cpu_set_bug_bits(stru
rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap);
if (!x86_match_cpu(cpu_no_spec_store_bypass) &&
@@ -53,7 +53,7 @@ Acked-by: Borislav Petkov <bp@suse.de>
+ !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
- if (x86_match_cpu(cpu_no_speculation))
+ if (x86_match_cpu(cpu_no_meltdown))
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -367,7 +367,7 @@ static inline int __do_cpuid_ent(struct
diff --git a/patches.arch/x86-cpu-Add-Atom-Tremont-Jacobsville.patch b/patches.arch/x86-cpu-Add-Atom-Tremont-Jacobsville.patch
index 5788f25bbc..243d8cc12c 100644
--- a/patches.arch/x86-cpu-Add-Atom-Tremont-Jacobsville.patch
+++ b/patches.arch/x86-cpu-Add-Atom-Tremont-Jacobsville.patch
@@ -31,7 +31,7 @@ Cc: x86-ml <x86@kernel.org>
Link: https://lkml.kernel.org/r/20190125195902.17109-4-tony.luck@intel.com
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- arch/x86/include/asm/intel-family.h | 3 ++-
+ arch/x86/include/asm/intel-family.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/intel-family.h
@@ -45,10 +45,10 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
*
* Things ending in "2" are usually because we have no better
* name for them. There's no processor called "SILVERMONT2".
-@@ -63,6 +63,7 @@
- #define INTEL_FAM6_ATOM_GOLDMONT 0x5C
- #define INTEL_FAM6_ATOM_DENVERTON 0x5F /* Goldmont Microserver */
- #define INTEL_FAM6_ATOM_GEMINI_LAKE 0x7A
+@@ -67,6 +67,7 @@
+ #define INTEL_FAM6_ATOM_GOLDMONT 0x5C /* Apollo Lake */
+ #define INTEL_FAM6_ATOM_GOLDMONT_X 0x5F /* Denverton */
+ #define INTEL_FAM6_ATOM_GOLDMONT_PLUS 0x7A /* Gemini Lake */
+#define INTEL_FAM6_ATOM_TREMONT_X 0x86 /* Jacobswille */
/* Xeon Phi */
diff --git a/patches.arch/x86-cpu-sanitize-fam6_atom-naming.patch b/patches.arch/x86-cpu-sanitize-fam6_atom-naming.patch
new file mode 100644
index 0000000000..5cdecdb444
--- /dev/null
+++ b/patches.arch/x86-cpu-sanitize-fam6_atom-naming.patch
@@ -0,0 +1,602 @@
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Tue, 7 Aug 2018 10:17:27 -0700
+Subject: x86/cpu: Sanitize FAM6_ATOM naming
+Git-commit: f2c4db1bd80720cd8cb2a5aa220d9bc9f374f04e
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+commit f2c4db1bd80720cd8cb2a5aa220d9bc9f374f04e upstream
+
+Going primarily by:
+
+ https://en.wikipedia.org/wiki/List_of_Intel_Atom_microprocessors
+
+with additional information gleaned from other related pages; notably:
+
+ - Bonnell shrink was called Saltwell
+ - Moorefield is the Merriefield refresh which makes it Airmont
+
+The general naming scheme is: FAM6_ATOM_UARCH_SOCTYPE
+
+ for i in `git grep -l FAM6_ATOM` ; do
+ sed -i -e 's/ATOM_PINEVIEW/ATOM_BONNELL/g' \
+ -e 's/ATOM_LINCROFT/ATOM_BONNELL_MID/' \
+ -e 's/ATOM_PENWELL/ATOM_SALTWELL_MID/g' \
+ -e 's/ATOM_CLOVERVIEW/ATOM_SALTWELL_TABLET/g' \
+ -e 's/ATOM_CEDARVIEW/ATOM_SALTWELL/g' \
+ -e 's/ATOM_SILVERMONT1/ATOM_SILVERMONT/g' \
+ -e 's/ATOM_SILVERMONT2/ATOM_SILVERMONT_X/g' \
+ -e 's/ATOM_MERRIFIELD/ATOM_SILVERMONT_MID/g' \
+ -e 's/ATOM_MOOREFIELD/ATOM_AIRMONT_MID/g' \
+ -e 's/ATOM_DENVERTON/ATOM_GOLDMONT_X/g' \
+ -e 's/ATOM_GEMINI_LAKE/ATOM_GOLDMONT_PLUS/g' ${i}
+ done
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Cc: dave.hansen@linux.intel.com
+Cc: len.brown@intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+[ 4.14.y speck backport, commit id there: f0fae1c931dd3a49cd42855836fc3f075960d4be ]
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/events/intel/core.c | 18 +++----
+ arch/x86/events/intel/cstate.c | 4 -
+ arch/x86/events/msr.c | 4 -
+ arch/x86/include/asm/intel-family.h | 30 ++++++-----
+ arch/x86/kernel/cpu/common.c | 28 +++++-----
+ arch/x86/kernel/tsc.c | 2
+ arch/x86/platform/atom/punit_atom_debug.c | 4 -
+ arch/x86/platform/intel-mid/device_libs/platform_bt.c | 2
+ drivers/acpi/acpi_lpss.c | 2
+ drivers/acpi/x86/utils.c | 2
+ drivers/cpufreq/intel_pstate.c | 4 -
+ drivers/edac/pnd2_edac.c | 2
+ drivers/idle/intel_idle.c | 18 +++----
+ drivers/mmc/host/sdhci-acpi.c | 2
+ drivers/pci/pci-mid.c | 4 -
+ drivers/platform/x86/intel_int0002_vgpio.c | 2
+ drivers/platform/x86/intel_mid_powerbtn.c | 4 -
+ drivers/powercap/intel_rapl.c | 10 +--
+ drivers/thermal/intel_soc_dts_thermal.c | 2
+ tools/power/x86/turbostat/turbostat.c | 46 +++++++++---------
+ 20 files changed, 98 insertions(+), 92 deletions(-)
+
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3724,11 +3724,11 @@ __init int intel_pmu_init(void)
+ pr_cont("Nehalem events, ");
+ break;
+
+- case INTEL_FAM6_ATOM_PINEVIEW:
+- case INTEL_FAM6_ATOM_LINCROFT:
+- case INTEL_FAM6_ATOM_PENWELL:
+- case INTEL_FAM6_ATOM_CLOVERVIEW:
+- case INTEL_FAM6_ATOM_CEDARVIEW:
++ case INTEL_FAM6_ATOM_BONNELL:
++ case INTEL_FAM6_ATOM_BONNELL_MID:
++ case INTEL_FAM6_ATOM_SALTWELL:
++ case INTEL_FAM6_ATOM_SALTWELL_MID:
++ case INTEL_FAM6_ATOM_SALTWELL_TABLET:
+ memcpy(hw_cache_event_ids, atom_hw_cache_event_ids,
+ sizeof(hw_cache_event_ids));
+
+@@ -3740,9 +3740,11 @@ __init int intel_pmu_init(void)
+ pr_cont("Atom events, ");
+ break;
+
+- case INTEL_FAM6_ATOM_SILVERMONT1:
+- case INTEL_FAM6_ATOM_SILVERMONT2:
++ case INTEL_FAM6_ATOM_SILVERMONT:
++ case INTEL_FAM6_ATOM_SILVERMONT_X:
++ case INTEL_FAM6_ATOM_SILVERMONT_MID:
+ case INTEL_FAM6_ATOM_AIRMONT:
++ case INTEL_FAM6_ATOM_AIRMONT_MID:
+ memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
+ sizeof(hw_cache_event_ids));
+ memcpy(hw_cache_extra_regs, slm_hw_cache_extra_regs,
+@@ -3759,7 +3761,7 @@ __init int intel_pmu_init(void)
+ break;
+
+ case INTEL_FAM6_ATOM_GOLDMONT:
+- case INTEL_FAM6_ATOM_DENVERTON:
++ case INTEL_FAM6_ATOM_GOLDMONT_X:
+ memcpy(hw_cache_event_ids, glm_hw_cache_event_ids,
+ sizeof(hw_cache_event_ids));
+ memcpy(hw_cache_extra_regs, glm_hw_cache_extra_regs,
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -531,8 +531,8 @@ static const struct x86_cpu_id intel_cst
+
+ X86_CSTATES_MODEL(INTEL_FAM6_HASWELL_ULT, hswult_cstates),
+
+- X86_CSTATES_MODEL(INTEL_FAM6_ATOM_SILVERMONT1, slm_cstates),
+- X86_CSTATES_MODEL(INTEL_FAM6_ATOM_SILVERMONT2, slm_cstates),
++ X86_CSTATES_MODEL(INTEL_FAM6_ATOM_SILVERMONT, slm_cstates),
++ X86_CSTATES_MODEL(INTEL_FAM6_ATOM_SILVERMONT_X, slm_cstates),
+ X86_CSTATES_MODEL(INTEL_FAM6_ATOM_AIRMONT, slm_cstates),
+
+ X86_CSTATES_MODEL(INTEL_FAM6_BROADWELL_CORE, snb_cstates),
+--- a/arch/x86/events/msr.c
++++ b/arch/x86/events/msr.c
+@@ -61,8 +61,8 @@ static bool test_intel(int idx)
+ case INTEL_FAM6_BROADWELL_GT3E:
+ case INTEL_FAM6_BROADWELL_X:
+
+- case INTEL_FAM6_ATOM_SILVERMONT1:
+- case INTEL_FAM6_ATOM_SILVERMONT2:
++ case INTEL_FAM6_ATOM_SILVERMONT:
++ case INTEL_FAM6_ATOM_SILVERMONT_X:
+ case INTEL_FAM6_ATOM_AIRMONT:
+ if (idx == PERF_MSR_SMI)
+ return true;
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -50,19 +50,23 @@
+
+ /* "Small Core" Processors (Atom) */
+
+-#define INTEL_FAM6_ATOM_PINEVIEW 0x1C
+-#define INTEL_FAM6_ATOM_LINCROFT 0x26
+-#define INTEL_FAM6_ATOM_PENWELL 0x27
+-#define INTEL_FAM6_ATOM_CLOVERVIEW 0x35
+-#define INTEL_FAM6_ATOM_CEDARVIEW 0x36
+-#define INTEL_FAM6_ATOM_SILVERMONT1 0x37 /* BayTrail/BYT / Valleyview */
+-#define INTEL_FAM6_ATOM_SILVERMONT2 0x4D /* Avaton/Rangely */
+-#define INTEL_FAM6_ATOM_AIRMONT 0x4C /* CherryTrail / Braswell */
+-#define INTEL_FAM6_ATOM_MERRIFIELD 0x4A /* Tangier */
+-#define INTEL_FAM6_ATOM_MOOREFIELD 0x5A /* Anniedale */
+-#define INTEL_FAM6_ATOM_GOLDMONT 0x5C
+-#define INTEL_FAM6_ATOM_DENVERTON 0x5F /* Goldmont Microserver */
+-#define INTEL_FAM6_ATOM_GEMINI_LAKE 0x7A
++#define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */
++#define INTEL_FAM6_ATOM_BONNELL_MID 0x26 /* Silverthorne, Lincroft */
++
++#define INTEL_FAM6_ATOM_SALTWELL 0x36 /* Cedarview */
++#define INTEL_FAM6_ATOM_SALTWELL_MID 0x27 /* Penwell */
++#define INTEL_FAM6_ATOM_SALTWELL_TABLET 0x35 /* Cloverview */
++
++#define INTEL_FAM6_ATOM_SILVERMONT 0x37 /* Bay Trail, Valleyview */
++#define INTEL_FAM6_ATOM_SILVERMONT_X 0x4D /* Avaton, Rangely */
++#define INTEL_FAM6_ATOM_SILVERMONT_MID 0x4A /* Merriefield */
++
++#define INTEL_FAM6_ATOM_AIRMONT 0x4C /* Cherry Trail, Braswell */
++#define INTEL_FAM6_ATOM_AIRMONT_MID 0x5A /* Moorefield */
++
++#define INTEL_FAM6_ATOM_GOLDMONT 0x5C /* Apollo Lake */
++#define INTEL_FAM6_ATOM_GOLDMONT_X 0x5F /* Denverton */
++#define INTEL_FAM6_ATOM_GOLDMONT_PLUS 0x7A /* Gemini Lake */
+
+ /* Xeon Phi */
+
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -899,11 +899,11 @@ static void identify_cpu_without_cpuid(s
+ }
+
+ static const __initconst struct x86_cpu_id cpu_no_speculation[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_CEDARVIEW, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_CLOVERVIEW, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_LINCROFT, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_PENWELL, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_PINEVIEW, X86_FEATURE_ANY },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SALTWELL, X86_FEATURE_ANY },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SALTWELL_TABLET, X86_FEATURE_ANY },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_BONNELL_MID, X86_FEATURE_ANY },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SALTWELL_MID, X86_FEATURE_ANY },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_BONNELL, X86_FEATURE_ANY },
+ { X86_VENDOR_CENTAUR, 5 },
+ { X86_VENDOR_INTEL, 5 },
+ { X86_VENDOR_NSC, 5 },
+@@ -918,10 +918,10 @@ static const __initconst struct x86_cpu_
+
+ /* Only list CPUs which speculate but are non susceptible to SSB */
+ static const __initconst struct x86_cpu_id cpu_no_spec_store_bypass[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1 },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT2 },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_MERRIFIELD },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT_X },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT_MID },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_CORE_YONAH },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNL },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNM },
+@@ -934,14 +934,14 @@ static const __initconst struct x86_cpu_
+
+ static const __initconst struct x86_cpu_id cpu_no_l1tf[] = {
+ /* in addition to cpu_no_speculation */
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1 },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT2 },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT_X },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_MERRIFIELD },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_MOOREFIELD },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT_MID },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT_MID },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_DENVERTON },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GEMINI_LAKE },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT_X },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT_PLUS },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNL },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNM },
+ {}
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -620,7 +620,7 @@ unsigned long native_calibrate_tsc(void)
+ case INTEL_FAM6_KABYLAKE_DESKTOP:
+ crystal_khz = 24000; /* 24.0 MHz */
+ break;
+- case INTEL_FAM6_ATOM_DENVERTON:
++ case INTEL_FAM6_ATOM_GOLDMONT_X:
+ crystal_khz = 25000; /* 25.0 MHz */
+ break;
+ case INTEL_FAM6_ATOM_GOLDMONT:
+--- a/arch/x86/platform/atom/punit_atom_debug.c
++++ b/arch/x86/platform/atom/punit_atom_debug.c
+@@ -154,8 +154,8 @@ static void punit_dbgfs_unregister(void)
+ (kernel_ulong_t)&drv_data }
+
+ static const struct x86_cpu_id intel_punit_cpu_ids[] = {
+- ICPU(INTEL_FAM6_ATOM_SILVERMONT1, punit_device_byt),
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD, punit_device_tng),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT, punit_device_byt),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_MID, punit_device_tng),
+ ICPU(INTEL_FAM6_ATOM_AIRMONT, punit_device_cht),
+ {}
+ };
+--- a/arch/x86/platform/intel-mid/device_libs/platform_bt.c
++++ b/arch/x86/platform/intel-mid/device_libs/platform_bt.c
+@@ -68,7 +68,7 @@ static struct bt_sfi_data tng_bt_sfi_dat
+ { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (kernel_ulong_t)&ddata }
+
+ static const struct x86_cpu_id bt_sfi_cpu_ids[] = {
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD, tng_bt_sfi_data),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_MID, tng_bt_sfi_data),
+ {}
+ };
+
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -291,7 +291,7 @@ static const struct lpss_device_desc bsw
+ #define ICPU(model) { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, }
+
+ static const struct x86_cpu_id lpss_cpu_ids[] = {
+- ICPU(INTEL_FAM6_ATOM_SILVERMONT1), /* Valleyview, Bay Trail */
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT), /* Valleyview, Bay Trail */
+ ICPU(INTEL_FAM6_ATOM_AIRMONT), /* Braswell, Cherry Trail */
+ {}
+ };
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -54,7 +54,7 @@ static const struct always_present_id al
+ * Bay / Cherry Trail PWM directly poked by GPU driver in win10,
+ * but Linux uses a separate PWM driver, harmless if not used.
+ */
+- ENTRY("80860F09", "1", ICPU(INTEL_FAM6_ATOM_SILVERMONT1), {}),
++ ENTRY("80860F09", "1", ICPU(INTEL_FAM6_ATOM_SILVERMONT), {}),
+ ENTRY("80862288", "1", ICPU(INTEL_FAM6_ATOM_AIRMONT), {}),
+ /*
+ * The INT0002 device is necessary to clear wakeup interrupt sources
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -2019,7 +2019,7 @@ static const struct pstate_funcs knl_fun
+ static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
+ ICPU(INTEL_FAM6_SANDYBRIDGE, core_funcs),
+ ICPU(INTEL_FAM6_SANDYBRIDGE_X, core_funcs),
+- ICPU(INTEL_FAM6_ATOM_SILVERMONT1, silvermont_funcs),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT, silvermont_funcs),
+ ICPU(INTEL_FAM6_IVYBRIDGE, core_funcs),
+ ICPU(INTEL_FAM6_HASWELL_CORE, core_funcs),
+ ICPU(INTEL_FAM6_BROADWELL_CORE, core_funcs),
+@@ -2036,7 +2036,7 @@ static const struct x86_cpu_id intel_pst
+ ICPU(INTEL_FAM6_XEON_PHI_KNL, knl_funcs),
+ ICPU(INTEL_FAM6_XEON_PHI_KNM, knl_funcs),
+ ICPU(INTEL_FAM6_ATOM_GOLDMONT, core_funcs),
+- ICPU(INTEL_FAM6_ATOM_GEMINI_LAKE, core_funcs),
++ ICPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, core_funcs),
+ ICPU(INTEL_FAM6_SKYLAKE_X, core_funcs),
+ {}
+ };
+--- a/drivers/edac/pnd2_edac.c
++++ b/drivers/edac/pnd2_edac.c
+@@ -1541,7 +1541,7 @@ static struct dunit_ops dnv_ops = {
+
+ static const struct x86_cpu_id pnd2_cpuids[] = {
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT, 0, (kernel_ulong_t)&apl_ops },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_DENVERTON, 0, (kernel_ulong_t)&dnv_ops },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT_X, 0, (kernel_ulong_t)&dnv_ops },
+ { }
+ };
+ MODULE_DEVICE_TABLE(x86cpu, pnd2_cpuids);
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -1069,14 +1069,14 @@ static const struct x86_cpu_id intel_idl
+ ICPU(INTEL_FAM6_WESTMERE, idle_cpu_nehalem),
+ ICPU(INTEL_FAM6_WESTMERE_EP, idle_cpu_nehalem),
+ ICPU(INTEL_FAM6_NEHALEM_EX, idle_cpu_nehalem),
+- ICPU(INTEL_FAM6_ATOM_PINEVIEW, idle_cpu_atom),
+- ICPU(INTEL_FAM6_ATOM_LINCROFT, idle_cpu_lincroft),
++ ICPU(INTEL_FAM6_ATOM_BONNELL, idle_cpu_atom),
++ ICPU(INTEL_FAM6_ATOM_BONNELL_MID, idle_cpu_lincroft),
+ ICPU(INTEL_FAM6_WESTMERE_EX, idle_cpu_nehalem),
+ ICPU(INTEL_FAM6_SANDYBRIDGE, idle_cpu_snb),
+ ICPU(INTEL_FAM6_SANDYBRIDGE_X, idle_cpu_snb),
+- ICPU(INTEL_FAM6_ATOM_CEDARVIEW, idle_cpu_atom),
+- ICPU(INTEL_FAM6_ATOM_SILVERMONT1, idle_cpu_byt),
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD, idle_cpu_tangier),
++ ICPU(INTEL_FAM6_ATOM_SALTWELL, idle_cpu_atom),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT, idle_cpu_byt),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_MID, idle_cpu_tangier),
+ ICPU(INTEL_FAM6_ATOM_AIRMONT, idle_cpu_cht),
+ ICPU(INTEL_FAM6_IVYBRIDGE, idle_cpu_ivb),
+ ICPU(INTEL_FAM6_IVYBRIDGE_X, idle_cpu_ivt),
+@@ -1084,7 +1084,7 @@ static const struct x86_cpu_id intel_idl
+ ICPU(INTEL_FAM6_HASWELL_X, idle_cpu_hsw),
+ ICPU(INTEL_FAM6_HASWELL_ULT, idle_cpu_hsw),
+ ICPU(INTEL_FAM6_HASWELL_GT3E, idle_cpu_hsw),
+- ICPU(INTEL_FAM6_ATOM_SILVERMONT2, idle_cpu_avn),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_X, idle_cpu_avn),
+ ICPU(INTEL_FAM6_BROADWELL_CORE, idle_cpu_bdw),
+ ICPU(INTEL_FAM6_BROADWELL_GT3E, idle_cpu_bdw),
+ ICPU(INTEL_FAM6_BROADWELL_X, idle_cpu_bdw),
+@@ -1097,8 +1097,8 @@ static const struct x86_cpu_id intel_idl
+ ICPU(INTEL_FAM6_XEON_PHI_KNL, idle_cpu_knl),
+ ICPU(INTEL_FAM6_XEON_PHI_KNM, idle_cpu_knl),
+ ICPU(INTEL_FAM6_ATOM_GOLDMONT, idle_cpu_bxt),
+- ICPU(INTEL_FAM6_ATOM_GEMINI_LAKE, idle_cpu_bxt),
+- ICPU(INTEL_FAM6_ATOM_DENVERTON, idle_cpu_dnv),
++ ICPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, idle_cpu_bxt),
++ ICPU(INTEL_FAM6_ATOM_GOLDMONT_X, idle_cpu_dnv),
+ {}
+ };
+
+@@ -1310,7 +1310,7 @@ static void intel_idle_state_table_updat
+ ivt_idle_state_table_update();
+ break;
+ case INTEL_FAM6_ATOM_GOLDMONT:
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ bxt_idle_state_table_update();
+ break;
+ case INTEL_FAM6_SKYLAKE_DESKTOP:
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -128,7 +128,7 @@ static const struct sdhci_acpi_chip sdhc
+ static bool sdhci_acpi_byt(void)
+ {
+ static const struct x86_cpu_id byt[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1 },
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT },
+ {}
+ };
+
+--- a/drivers/pci/pci-mid.c
++++ b/drivers/pci/pci-mid.c
+@@ -71,8 +71,8 @@ static const struct pci_platform_pm_ops
+ * arch/x86/platform/intel-mid/pwr.c.
+ */
+ static const struct x86_cpu_id lpss_cpu_ids[] = {
+- ICPU(INTEL_FAM6_ATOM_PENWELL),
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD),
++ ICPU(INTEL_FAM6_ATOM_SALTWELL_MID),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_MID),
+ {}
+ };
+
+--- a/drivers/platform/x86/intel_int0002_vgpio.c
++++ b/drivers/platform/x86/intel_int0002_vgpio.c
+@@ -60,7 +60,7 @@ static const struct x86_cpu_id int0002_c
+ /*
+ * Limit ourselves to Cherry Trail for now, until testing shows we
+ * need to handle the INT0002 device on Baytrail too.
+- * ICPU(INTEL_FAM6_ATOM_SILVERMONT1), * Valleyview, Bay Trail *
++ * ICPU(INTEL_FAM6_ATOM_SILVERMONT), * Valleyview, Bay Trail *
+ */
+ ICPU(INTEL_FAM6_ATOM_AIRMONT), /* Braswell, Cherry Trail */
+ {}
+--- a/drivers/platform/x86/intel_mid_powerbtn.c
++++ b/drivers/platform/x86/intel_mid_powerbtn.c
+@@ -125,8 +125,8 @@ static struct mid_pb_ddata mrfld_ddata =
+ { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (kernel_ulong_t)&ddata }
+
+ static const struct x86_cpu_id mid_pb_cpu_ids[] = {
+- ICPU(INTEL_FAM6_ATOM_PENWELL, mfld_ddata),
+- ICPU(INTEL_FAM6_ATOM_MERRIFIELD, mrfld_ddata),
++ ICPU(INTEL_FAM6_ATOM_SALTWELL_MID, mfld_ddata),
++ ICPU(INTEL_FAM6_ATOM_SILVERMONT_MID, mrfld_ddata),
+ {}
+ };
+
+--- a/drivers/powercap/intel_rapl.c
++++ b/drivers/powercap/intel_rapl.c
+@@ -1159,13 +1159,13 @@ static const struct x86_cpu_id rapl_ids[
+ RAPL_CPU(INTEL_FAM6_KABYLAKE_MOBILE, rapl_defaults_core),
+ RAPL_CPU(INTEL_FAM6_KABYLAKE_DESKTOP, rapl_defaults_core),
+
+- RAPL_CPU(INTEL_FAM6_ATOM_SILVERMONT1, rapl_defaults_byt),
++ RAPL_CPU(INTEL_FAM6_ATOM_SILVERMONT, rapl_defaults_byt),
+ RAPL_CPU(INTEL_FAM6_ATOM_AIRMONT, rapl_defaults_cht),
+- RAPL_CPU(INTEL_FAM6_ATOM_MERRIFIELD, rapl_defaults_tng),
+- RAPL_CPU(INTEL_FAM6_ATOM_MOOREFIELD, rapl_defaults_ann),
++ RAPL_CPU(INTEL_FAM6_ATOM_SILVERMONT_MID,rapl_defaults_tng),
++ RAPL_CPU(INTEL_FAM6_ATOM_AIRMONT_MID, rapl_defaults_ann),
+ RAPL_CPU(INTEL_FAM6_ATOM_GOLDMONT, rapl_defaults_core),
+- RAPL_CPU(INTEL_FAM6_ATOM_GEMINI_LAKE, rapl_defaults_core),
+- RAPL_CPU(INTEL_FAM6_ATOM_DENVERTON, rapl_defaults_core),
++ RAPL_CPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, rapl_defaults_core),
++ RAPL_CPU(INTEL_FAM6_ATOM_GOLDMONT_X, rapl_defaults_core),
+
+ RAPL_CPU(INTEL_FAM6_XEON_PHI_KNL, rapl_defaults_hsw_server),
+ RAPL_CPU(INTEL_FAM6_XEON_PHI_KNM, rapl_defaults_hsw_server),
+--- a/drivers/thermal/intel_soc_dts_thermal.c
++++ b/drivers/thermal/intel_soc_dts_thermal.c
+@@ -43,7 +43,7 @@ static irqreturn_t soc_irq_thread_fn(int
+ }
+
+ static const struct x86_cpu_id soc_thermal_ids[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1, 0,
++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT, 0,
+ BYT_SOC_DTS_APIC_IRQ},
+ {}
+ };
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -1839,7 +1839,7 @@ int has_turbo_ratio_group_limits(int fam
+ switch (model) {
+ case INTEL_FAM6_ATOM_GOLDMONT:
+ case INTEL_FAM6_SKYLAKE_X:
+- case INTEL_FAM6_ATOM_DENVERTON:
++ case INTEL_FAM6_ATOM_GOLDMONT_X:
+ return 1;
+ }
+ return 0;
+@@ -2701,9 +2701,9 @@ int probe_nhm_msrs(unsigned int family,
+ pkg_cstate_limits = skx_pkg_cstate_limits;
+ has_misc_feature_control = 1;
+ break;
+- case INTEL_FAM6_ATOM_SILVERMONT1: /* BYT */
++ case INTEL_FAM6_ATOM_SILVERMONT: /* BYT */
+ no_MSR_MISC_PWR_MGMT = 1;
+- case INTEL_FAM6_ATOM_SILVERMONT2: /* AVN */
++ case INTEL_FAM6_ATOM_SILVERMONT_X: /* AVN */
+ pkg_cstate_limits = slv_pkg_cstate_limits;
+ break;
+ case INTEL_FAM6_ATOM_AIRMONT: /* AMT */
+@@ -2715,8 +2715,8 @@ int probe_nhm_msrs(unsigned int family,
+ pkg_cstate_limits = phi_pkg_cstate_limits;
+ break;
+ case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
+- case INTEL_FAM6_ATOM_DENVERTON: /* DNV */
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
++ case INTEL_FAM6_ATOM_GOLDMONT_X: /* DNV */
+ pkg_cstate_limits = bxt_pkg_cstate_limits;
+ break;
+ default:
+@@ -2745,9 +2745,9 @@ int has_slv_msrs(unsigned int family, un
+ return 0;
+
+ switch (model) {
+- case INTEL_FAM6_ATOM_SILVERMONT1:
+- case INTEL_FAM6_ATOM_MERRIFIELD:
+- case INTEL_FAM6_ATOM_MOOREFIELD:
++ case INTEL_FAM6_ATOM_SILVERMONT:
++ case INTEL_FAM6_ATOM_SILVERMONT_MID:
++ case INTEL_FAM6_ATOM_AIRMONT_MID:
+ return 1;
+ }
+ return 0;
+@@ -2759,7 +2759,7 @@ int is_dnv(unsigned int family, unsigned
+ return 0;
+
+ switch (model) {
+- case INTEL_FAM6_ATOM_DENVERTON:
++ case INTEL_FAM6_ATOM_GOLDMONT_X:
+ return 1;
+ }
+ return 0;
+@@ -3275,8 +3275,8 @@ double get_tdp(unsigned int model)
+ return ((msr >> 0) & RAPL_POWER_GRANULARITY) * rapl_power_units;
+
+ switch (model) {
+- case INTEL_FAM6_ATOM_SILVERMONT1:
+- case INTEL_FAM6_ATOM_SILVERMONT2:
++ case INTEL_FAM6_ATOM_SILVERMONT:
++ case INTEL_FAM6_ATOM_SILVERMONT_X:
+ return 30.0;
+ default:
+ return 135.0;
+@@ -3342,7 +3342,7 @@ void rapl_probe(unsigned int family, uns
+ }
+ break;
+ case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ do_rapl = RAPL_PKG | RAPL_PKG_POWER_INFO;
+ if (rapl_joules)
+ BIC_PRESENT(BIC_Pkg_J);
+@@ -3400,8 +3400,8 @@ void rapl_probe(unsigned int family, uns
+ BIC_PRESENT(BIC_RAMWatt);
+ }
+ break;
+- case INTEL_FAM6_ATOM_SILVERMONT1: /* BYT */
+- case INTEL_FAM6_ATOM_SILVERMONT2: /* AVN */
++ case INTEL_FAM6_ATOM_SILVERMONT: /* BYT */
++ case INTEL_FAM6_ATOM_SILVERMONT_X: /* AVN */
+ do_rapl = RAPL_PKG | RAPL_CORES;
+ if (rapl_joules) {
+ BIC_PRESENT(BIC_Pkg_J);
+@@ -3411,7 +3411,7 @@ void rapl_probe(unsigned int family, uns
+ BIC_PRESENT(BIC_CorWatt);
+ }
+ break;
+- case INTEL_FAM6_ATOM_DENVERTON: /* DNV */
++ case INTEL_FAM6_ATOM_GOLDMONT_X: /* DNV */
+ do_rapl = RAPL_PKG | RAPL_DRAM | RAPL_DRAM_POWER_INFO | RAPL_DRAM_PERF_STATUS | RAPL_PKG_PERF_STATUS | RAPL_PKG_POWER_INFO | RAPL_CORES_ENERGY_STATUS;
+ BIC_PRESENT(BIC_PKG__);
+ BIC_PRESENT(BIC_RAM__);
+@@ -3434,7 +3434,7 @@ void rapl_probe(unsigned int family, uns
+ return;
+
+ rapl_power_units = 1.0 / (1 << (msr & 0xF));
+- if (model == INTEL_FAM6_ATOM_SILVERMONT1)
++ if (model == INTEL_FAM6_ATOM_SILVERMONT)
+ rapl_energy_units = 1.0 * (1 << (msr >> 8 & 0x1F)) / 1000000;
+ else
+ rapl_energy_units = 1.0 / (1 << (msr >> 8 & 0x1F));
+@@ -3684,8 +3684,8 @@ int has_snb_msrs(unsigned int family, un
+ case INTEL_FAM6_KABYLAKE_DESKTOP: /* KBL */
+ case INTEL_FAM6_SKYLAKE_X: /* SKX */
+ case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
+- case INTEL_FAM6_ATOM_DENVERTON: /* DNV */
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
++ case INTEL_FAM6_ATOM_GOLDMONT_X: /* DNV */
+ return 1;
+ }
+ return 0;
+@@ -3716,7 +3716,7 @@ int has_hsw_msrs(unsigned int family, un
+ case INTEL_FAM6_KABYLAKE_MOBILE: /* KBL */
+ case INTEL_FAM6_KABYLAKE_DESKTOP: /* KBL */
+ case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ return 1;
+ }
+ return 0;
+@@ -3750,8 +3750,8 @@ int is_slm(unsigned int family, unsigned
+ if (!genuine_intel)
+ return 0;
+ switch (model) {
+- case INTEL_FAM6_ATOM_SILVERMONT1: /* BYT */
+- case INTEL_FAM6_ATOM_SILVERMONT2: /* AVN */
++ case INTEL_FAM6_ATOM_SILVERMONT: /* BYT */
++ case INTEL_FAM6_ATOM_SILVERMONT_X: /* AVN */
+ return 1;
+ }
+ return 0;
+@@ -4106,11 +4106,11 @@ void process_cpuid()
+ crystal_hz = 24000000; /* 24.0 MHz */
+ break;
+ case INTEL_FAM6_SKYLAKE_X: /* SKX */
+- case INTEL_FAM6_ATOM_DENVERTON: /* DNV */
++ case INTEL_FAM6_ATOM_GOLDMONT_X: /* DNV */
+ crystal_hz = 25000000; /* 25.0 MHz */
+ break;
+ case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */
+- case INTEL_FAM6_ATOM_GEMINI_LAKE:
++ case INTEL_FAM6_ATOM_GOLDMONT_PLUS:
+ crystal_hz = 19200000; /* 19.2 MHz */
+ break;
+ default:
diff --git a/patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch b/patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch
new file mode 100644
index 0000000000..ef439ddf46
--- /dev/null
+++ b/patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch
@@ -0,0 +1,45 @@
+From: Andi Kleen <ak@linux.intel.com>
+Date: Fri, 18 Jan 2019 16:50:23 -0800
+Subject: x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
+Git-commit: 6c4dbbd14730c43f4ed808a9c42ca41625925c22
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+X86_FEATURE_MD_CLEAR is a new CPUID bit which is set when microcode
+provides the mechanism to invoke a flush of various exploitable CPU buffers
+by invoking the VERW instruction.
+
+Hand it through to guests so they can adjust their mitigations.
+
+This also requires corresponding qemu changes, which are available
+separately.
+
+[ tglx: Massaged changelog ]
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kvm/cpuid.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
+index c07958b59f50..39501e7afdb4 100644
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -410,7 +410,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
+ /* cpuid 7.0.edx*/
+ const u32 kvm_cpuid_7_0_edx_x86_features =
+ F(AVX512_4VNNIW) | F(AVX512_4FMAPS) | F(SPEC_CTRL) |
+- F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES) | F(INTEL_STIBP);
++ F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES) | F(INTEL_STIBP) |
++ F(MD_CLEAR);
+
+ /* all calls to cpuid_count() should be made on the same cpu */
+ get_cpu();
+
diff --git a/patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch b/patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch
new file mode 100644
index 0000000000..72dc41269e
--- /dev/null
+++ b/patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch
@@ -0,0 +1,52 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 27 Feb 2019 12:48:14 +0100
+Subject: x86/kvm/vmx: Add MDS protection when L1D Flush is not active
+Git-commit: 650b68a0622f933444a6d66936abb3103029413b
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+CPUs which are affected by L1TF and MDS mitigate MDS with the L1D Flush on
+VMENTER when updated microcode is installed.
+
+If a CPU is not affected by L1TF or if the L1D Flush is not in use, then
+MDS mitigation needs to be invoked explicitly.
+
+For these cases, follow the host mitigation state and invoke the MDS
+mitigation before VMENTER.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 1 +
+ arch/x86/kvm/vmx.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -62,6 +62,7 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_always
+
+ /* Control MDS CPU buffer clear before returning to user space */
+ DEFINE_STATIC_KEY_FALSE(mds_user_clear);
++EXPORT_SYMBOL_GPL(mds_user_clear);
+
+ void __init check_bugs(void)
+ {
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -9684,8 +9684,11 @@ static void __noclone vmx_vcpu_run(struc
+
+ vmx->__launched = vmx->loaded_vmcs->launched;
+
++ /* L1D Flush includes CPU buffer clear to mitigate MDS */
+ if (static_branch_unlikely(&vmx_l1d_should_flush))
+ vmx_l1d_flush(vcpu);
++ else if (static_branch_unlikely(&mds_user_clear))
++ mds_clear_cpu_buffers();
+
+ asm(
+ /* Store host registers */
diff --git a/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch b/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch
index 04a118cca2..383dd4c1c0 100644
--- a/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch
+++ b/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch
@@ -2,8 +2,7 @@ From: Yazen Ghannam <yazen.ghannam@amd.com>
Date: Fri, 27 Jul 2018 16:40:09 -0500
Subject: x86/mce: Handle varying MCA bank counts
Git-commit: 006c077041dc73b9490fffc4c6af5befe0687110
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: Queued in tip
+Patch-mainline: v5.2-rc1
References: bsc#1128415
Linux reads MCG_CAP[Count] to find the number of MCA banks visible to a
diff --git a/patches.arch/x86-msr-index-cleanup-bit-defines.patch b/patches.arch/x86-msr-index-cleanup-bit-defines.patch
new file mode 100644
index 0000000000..4fed2b84e7
--- /dev/null
+++ b/patches.arch/x86-msr-index-cleanup-bit-defines.patch
@@ -0,0 +1,102 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Thu, 21 Feb 2019 12:36:50 +0100
+Subject: x86/msr-index: Cleanup bit defines
+Git-commit: d8eabc37310a92df40d07c5a8afc53cebf996716
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+Greg pointed out that speculation related bit defines are using (1 << N)
+format instead of BIT(N). Aside of that (1 << N) is wrong as it should use
+1UL at least.
+
+Clean it up.
+
+[ Josh Poimboeuf: Fix tools build ]
+
+Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/msr-index.h | 34 ++++++++++++++++++----------------
+ tools/power/x86/turbostat/Makefile | 2 +-
+ 2 files changed, 19 insertions(+), 17 deletions(-)
+
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -1,6 +1,8 @@
+ #ifndef _ASM_X86_MSR_INDEX_H
+ #define _ASM_X86_MSR_INDEX_H
+
++#include <linux/bits.h>
++
+ /*
+ * CPU model specific register (MSR) numbers.
+ *
+@@ -39,14 +41,14 @@
+ /* Intel MSRs. Some also available on other CPUs */
+
+ #define MSR_IA32_SPEC_CTRL 0x00000048 /* Speculation Control */
+-#define SPEC_CTRL_IBRS (1 << 0) /* Indirect Branch Restricted Speculation */
++#define SPEC_CTRL_IBRS BIT(0) /* Indirect Branch Restricted Speculation */
+ #define SPEC_CTRL_STIBP_SHIFT 1 /* Single Thread Indirect Branch Predictor (STIBP) bit */
+-#define SPEC_CTRL_STIBP (1 << SPEC_CTRL_STIBP_SHIFT) /* STIBP mask */
++#define SPEC_CTRL_STIBP BIT(SPEC_CTRL_STIBP_SHIFT) /* STIBP mask */
+ #define SPEC_CTRL_SSBD_SHIFT 2 /* Speculative Store Bypass Disable bit */
+-#define SPEC_CTRL_SSBD (1 << SPEC_CTRL_SSBD_SHIFT) /* Speculative Store Bypass Disable */
++#define SPEC_CTRL_SSBD BIT(SPEC_CTRL_SSBD_SHIFT) /* Speculative Store Bypass Disable */
+
+ #define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */
+-#define PRED_CMD_IBPB (1 << 0) /* Indirect Branch Prediction Barrier */
++#define PRED_CMD_IBPB BIT(0) /* Indirect Branch Prediction Barrier */
+
+ #define MSR_PPIN_CTL 0x0000004e
+ #define MSR_PPIN 0x0000004f
+@@ -68,20 +70,20 @@
+ #define MSR_MTRRcap 0x000000fe
+
+ #define MSR_IA32_ARCH_CAPABILITIES 0x0000010a
+-#define ARCH_CAP_RDCL_NO (1 << 0) /* Not susceptible to Meltdown */
+-#define ARCH_CAP_IBRS_ALL (1 << 1) /* Enhanced IBRS support */
+-#define ARCH_CAP_SKIP_VMENTRY_L1DFLUSH (1 << 3) /* Skip L1D flush on vmentry */
+-#define ARCH_CAP_SSB_NO (1 << 4) /*
+- * Not susceptible to Speculative Store Bypass
+- * attack, so no Speculative Store Bypass
+- * control required.
+- */
++#define ARCH_CAP_RDCL_NO BIT(0) /* Not susceptible to Meltdown */
++#define ARCH_CAP_IBRS_ALL BIT(1) /* Enhanced IBRS support */
++#define ARCH_CAP_SKIP_VMENTRY_L1DFLUSH BIT(3) /* Skip L1D flush on vmentry */
++#define ARCH_CAP_SSB_NO BIT(4) /*
++ * Not susceptible to Speculative Store Bypass
++ * attack, so no Speculative Store Bypass
++ * control required.
++ */
+
+ #define MSR_IA32_FLUSH_CMD 0x0000010b
+-#define L1D_FLUSH (1 << 0) /*
+- * Writeback and invalidate the
+- * L1 data cache.
+- */
++#define L1D_FLUSH BIT(0) /*
++ * Writeback and invalidate the
++ * L1 data cache.
++ */
+
+ #define MSR_IA32_BBL_CR_CTL 0x00000119
+ #define MSR_IA32_BBL_CR_CTL3 0x0000011e
+--- a/tools/power/x86/turbostat/Makefile
++++ b/tools/power/x86/turbostat/Makefile
+@@ -8,7 +8,7 @@ ifeq ("$(origin O)", "command line")
+ endif
+
+ turbostat : turbostat.c
+-CFLAGS += -Wall
++override CFLAGS += -Wall -I../../../include
+ CFLAGS += -DMSRHEADER='"../../../../arch/x86/include/asm/msr-index.h"'
+ CFLAGS += -DINTEL_FAMILY_HEADER='"../../../../arch/x86/include/asm/intel-family.h"'
+
diff --git a/patches.arch/x86-speculation-consolidate-cpu-whitelists.patch b/patches.arch/x86-speculation-consolidate-cpu-whitelists.patch
new file mode 100644
index 0000000000..a8953a02a2
--- /dev/null
+++ b/patches.arch/x86-speculation-consolidate-cpu-whitelists.patch
@@ -0,0 +1,167 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 27 Feb 2019 10:10:23 +0100
+Subject: x86/speculation: Consolidate CPU whitelists
+Git-commit: 36ad35131adacc29b328b9c8b6277a8bf0d6fd5d
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+The CPU vulnerability whitelists have some overlap and there are more
+whitelists coming along.
+
+Use the driver_data field in the x86_cpu_id struct to denote the
+whitelisted vulnerabilities and combine all whitelists into one.
+
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/common.c | 103 ++++++++++++++++++++++---------------------
+ 1 file changed, 55 insertions(+), 48 deletions(-)
+
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -898,60 +898,68 @@ static void identify_cpu_without_cpuid(s
+ #endif
+ }
+
+-static const __initconst struct x86_cpu_id cpu_no_speculation[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SALTWELL, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SALTWELL_TABLET, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_BONNELL_MID, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SALTWELL_MID, X86_FEATURE_ANY },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_BONNELL, X86_FEATURE_ANY },
+- { X86_VENDOR_CENTAUR, 5 },
+- { X86_VENDOR_INTEL, 5 },
+- { X86_VENDOR_NSC, 5 },
+- { X86_VENDOR_ANY, 4 },
+- {}
+-};
++#define NO_SPECULATION BIT(0)
++#define NO_MELTDOWN BIT(1)
++#define NO_SSB BIT(2)
++#define NO_L1TF BIT(3)
++
++#define VULNWL(_vendor, _family, _model, _whitelist) \
++ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist }
++
++#define VULNWL_INTEL(model, whitelist) \
++ VULNWL(INTEL, 6, INTEL_FAM6_##model, whitelist)
++
++#define VULNWL_AMD(family, whitelist) \
++ VULNWL(AMD, family, X86_MODEL_ANY, whitelist)
++
++static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = {
++ VULNWL(ANY, 4, X86_MODEL_ANY, NO_SPECULATION),
++ VULNWL(CENTAUR, 5, X86_MODEL_ANY, NO_SPECULATION),
++ VULNWL(INTEL, 5, X86_MODEL_ANY, NO_SPECULATION),
++ VULNWL(NSC, 5, X86_MODEL_ANY, NO_SPECULATION),
++
++ VULNWL_INTEL(ATOM_SALTWELL, NO_SPECULATION),
++ VULNWL_INTEL(ATOM_SALTWELL_TABLET, NO_SPECULATION),
++ VULNWL_INTEL(ATOM_SALTWELL_MID, NO_SPECULATION),
++ VULNWL_INTEL(ATOM_BONNELL, NO_SPECULATION),
++ VULNWL_INTEL(ATOM_BONNELL_MID, NO_SPECULATION),
++
++ VULNWL_INTEL(ATOM_SILVERMONT, NO_SSB | NO_L1TF),
++ VULNWL_INTEL(ATOM_SILVERMONT_X, NO_SSB | NO_L1TF),
++ VULNWL_INTEL(ATOM_SILVERMONT_MID, NO_SSB | NO_L1TF),
++ VULNWL_INTEL(ATOM_AIRMONT, NO_SSB | NO_L1TF),
++ VULNWL_INTEL(XEON_PHI_KNL, NO_SSB | NO_L1TF),
++ VULNWL_INTEL(XEON_PHI_KNM, NO_SSB | NO_L1TF),
++
++ VULNWL_INTEL(CORE_YONAH, NO_SSB),
++
++ VULNWL_INTEL(ATOM_AIRMONT_MID, NO_L1TF),
++ VULNWL_INTEL(ATOM_GOLDMONT, NO_L1TF),
++ VULNWL_INTEL(ATOM_GOLDMONT_X, NO_L1TF),
++ VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_L1TF),
++
++ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF),
++ VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF),
++ VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF),
++ VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF),
+
+-static const __initconst struct x86_cpu_id cpu_no_meltdown[] = {
+- { X86_VENDOR_AMD },
++ /* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */
++ VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF),
+ {}
+ };
+
+-/* Only list CPUs which speculate but are non susceptible to SSB */
+-static const __initconst struct x86_cpu_id cpu_no_spec_store_bypass[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT_X },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT_MID },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_CORE_YONAH },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNL },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNM },
+- { X86_VENDOR_AMD, 0x12, },
+- { X86_VENDOR_AMD, 0x11, },
+- { X86_VENDOR_AMD, 0x10, },
+- { X86_VENDOR_AMD, 0xf, },
+- {}
+-};
++static bool __init cpu_matches(unsigned long which)
++{
++ const struct x86_cpu_id *m = x86_match_cpu(cpu_vuln_whitelist);
+
+-static const __initconst struct x86_cpu_id cpu_no_l1tf[] = {
+- /* in addition to cpu_no_speculation */
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT_X },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT_MID },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT_MID },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT_X },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT_PLUS },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNL },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNM },
+- {}
+-};
++ return m && !!(m->driver_data & which);
++}
+
+ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ {
+ u64 ia32_cap = 0;
+
+- if (x86_match_cpu(cpu_no_speculation))
++ if (cpu_matches(NO_SPECULATION))
+ return;
+
+ setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
+@@ -960,15 +968,14 @@ static void __init cpu_set_bug_bits(stru
+ if (cpu_has(c, X86_FEATURE_ARCH_CAPABILITIES))
+ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap);
+
+- if (!x86_match_cpu(cpu_no_spec_store_bypass) &&
+- !(ia32_cap & ARCH_CAP_SSB_NO) &&
++ if (!cpu_matches(NO_SSB) && !(ia32_cap & ARCH_CAP_SSB_NO) &&
+ !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
+ setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
+
+ if (ia32_cap & ARCH_CAP_IBRS_ALL)
+ setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
+
+- if (x86_match_cpu(cpu_no_meltdown))
++ if (cpu_matches(NO_MELTDOWN))
+ return;
+
+ /* Rogue Data Cache Load? No! */
+@@ -977,7 +984,7 @@ static void __init cpu_set_bug_bits(stru
+
+ setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
+
+- if (x86_match_cpu(cpu_no_l1tf))
++ if (cpu_matches(NO_L1TF))
+ return;
+
+ setup_force_cpu_bug(X86_BUG_L1TF);
diff --git a/patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch b/patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch
new file mode 100644
index 0000000000..3b673bacec
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch
@@ -0,0 +1,148 @@
+From: Andi Kleen <ak@linux.intel.com>
+Date: Fri, 18 Jan 2019 16:50:16 -0800
+Subject: x86/speculation/mds: Add basic bug infrastructure for MDS
+Git-commit: ed5194c2732c8084af9fd159c146ea92bf137128
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+Microarchitectural Data Sampling (MDS), is a class of side channel attacks
+on internal buffers in Intel CPUs. The variants are:
+
+ - Microarchitectural Store Buffer Data Sampling (MSBDS) (CVE-2018-12126)
+ - Microarchitectural Fill Buffer Data Sampling (MFBDS) (CVE-2018-12130)
+ - Microarchitectural Load Port Data Sampling (MLPDS) (CVE-2018-12127)
+
+MSBDS leaks Store Buffer Entries which can be speculatively forwarded to a
+dependent load (store-to-load forwarding) as an optimization. The forward
+can also happen to a faulting or assisting load operation for a different
+memory address, which can be exploited under certain conditions. Store
+buffers are partitioned between Hyper-Threads so cross thread forwarding is
+not possible. But if a thread enters or exits a sleep state the store
+buffer is repartitioned which can expose data from one thread to the other.
+
+MFBDS leaks Fill Buffer Entries. Fill buffers are used internally to manage
+L1 miss situations and to hold data which is returned or sent in response
+to a memory or I/O operation. Fill buffers can forward data to a load
+operation and also write data to the cache. When the fill buffer is
+deallocated it can retain the stale data of the preceding operations which
+can then be forwarded to a faulting or assisting load operation, which can
+be exploited under certain conditions. Fill buffers are shared between
+Hyper-Threads so cross thread leakage is possible.
+
+MLDPS leaks Load Port Data. Load ports are used to perform load operations
+from memory or I/O. The received data is then forwarded to the register
+file or a subsequent operation. In some implementations the Load Port can
+contain stale data from a previous operation which can be forwarded to
+faulting or assisting loads under certain conditions, which again can be
+exploited eventually. Load ports are shared between Hyper-Threads so cross
+thread leakage is possible.
+
+All variants have the same mitigation for single CPU thread case (SMT off),
+so the kernel can treat them as one MDS issue.
+
+Add the basic infrastructure to detect if the current CPU is affected by
+MDS.
+
+[ tglx: Rewrote changelog ]
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/cpufeatures.h | 2 ++
+ arch/x86/include/asm/msr-index.h | 5 +++++
+ arch/x86/kernel/cpu/common.c | 25 ++++++++++++++++---------
+ 3 files changed, 23 insertions(+), 9 deletions(-)
+
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -341,6 +341,7 @@
+ #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */
+ #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
+ #define X86_FEATURE_TSX_FORCE_ABORT (18*32+13) /* "" TSX_FORCE_ABORT */
++#define X86_FEATURE_MD_CLEAR (18*32+10) /* VERW clears CPU buffers */
+ #define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */
+ #define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */
+ #define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */
+@@ -378,4 +379,5 @@
+ #define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */
+ #define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */
+ #define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */
++#define X86_BUG_MDS X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */
+ #endif /* _ASM_X86_CPUFEATURES_H */
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -78,6 +78,11 @@
+ * attack, so no Speculative Store Bypass
+ * control required.
+ */
++#define ARCH_CAP_MDS_NO BIT(5) /*
++ * Not susceptible to
++ * Microarchitectural Data
++ * Sampling (MDS) vulnerabilities.
++ */
+
+ #define MSR_IA32_FLUSH_CMD 0x0000010b
+ #define L1D_FLUSH BIT(0) /*
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -902,6 +902,7 @@ static void identify_cpu_without_cpuid(s
+ #define NO_MELTDOWN BIT(1)
+ #define NO_SSB BIT(2)
+ #define NO_L1TF BIT(3)
++#define NO_MDS BIT(4)
+
+ #define VULNWL(_vendor, _family, _model, _whitelist) \
+ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist }
+@@ -918,6 +919,7 @@ static const __initconst struct x86_cpu_
+ VULNWL(INTEL, 5, X86_MODEL_ANY, NO_SPECULATION),
+ VULNWL(NSC, 5, X86_MODEL_ANY, NO_SPECULATION),
+
++ /* Intel Family 6 */
+ VULNWL_INTEL(ATOM_SALTWELL, NO_SPECULATION),
+ VULNWL_INTEL(ATOM_SALTWELL_TABLET, NO_SPECULATION),
+ VULNWL_INTEL(ATOM_SALTWELL_MID, NO_SPECULATION),
+@@ -934,17 +936,19 @@ static const __initconst struct x86_cpu_
+ VULNWL_INTEL(CORE_YONAH, NO_SSB),
+
+ VULNWL_INTEL(ATOM_AIRMONT_MID, NO_L1TF),
+- VULNWL_INTEL(ATOM_GOLDMONT, NO_L1TF),
+- VULNWL_INTEL(ATOM_GOLDMONT_X, NO_L1TF),
+- VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_L1TF),
+-
+- VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF),
+- VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF),
+- VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF),
+- VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF),
++
++ VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF),
++ VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF),
++ VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF),
++
++ /* AMD Family 0xf - 0x12 */
++ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
++ VULNWL_AMD(0x10, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
++ VULNWL_AMD(0x11, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
++ VULNWL_AMD(0x12, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS),
+
+ /* FAMILY_ANY must be last, otherwise 0x0f - 0x12 matches won't work */
+- VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF),
++ VULNWL_AMD(X86_FAMILY_ANY, NO_MELTDOWN | NO_L1TF | NO_MDS),
+ {}
+ };
+
+@@ -975,6 +979,9 @@ static void __init cpu_set_bug_bits(stru
+ if (ia32_cap & ARCH_CAP_IBRS_ALL)
+ setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
+
++ if (!cpu_matches(NO_MDS) && !(ia32_cap & ARCH_CAP_MDS_NO))
++ setup_force_cpu_bug(X86_BUG_MDS);
++
+ if (cpu_matches(NO_MELTDOWN))
+ return;
+
diff --git a/patches.arch/x86-speculation-mds-add-bug_msbds_only.patch b/patches.arch/x86-speculation-mds-add-bug_msbds_only.patch
new file mode 100644
index 0000000000..b6ebab3b9e
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-add-bug_msbds_only.patch
@@ -0,0 +1,86 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Fri, 1 Mar 2019 20:21:08 +0100
+Subject: x86/speculation/mds: Add BUG_MSBDS_ONLY
+Git-commit: e261f209c3666e842fd645a1e31f001c3a26def9
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+This bug bit is set on CPUs which are only affected by Microarchitectural
+Store Buffer Data Sampling (MSBDS) and not by any other MDS variant.
+
+This is important because the Store Buffers are partitioned between
+Hyper-Threads so cross thread forwarding is not possible. But if a thread
+enters or exits a sleep state the store buffer is repartitioned which can
+expose data from one thread to the other. This transition can be mitigated.
+
+That means that for CPUs which are only affected by MSBDS SMT can be
+enabled, if the CPU is not affected by other SMT sensitive vulnerabilities,
+e.g. L1TF. The XEON PHI variants fall into that category. Also the
+Silvermont/Airmont ATOMs, but for them it's not really relevant as they do
+not support SMT, but mark them for completeness sake.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/cpufeatures.h | 1 +
+ arch/x86/kernel/cpu/common.c | 20 ++++++++++++--------
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -379,4 +379,5 @@
+ #define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */
+ #define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */
+ #define X86_BUG_MDS X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */
++#define X86_BUG_MSBDS_ONLY X86_BUG(20) /* CPU is only affected by the MSDBS variant of BUG_MDS */
+ #endif /* _ASM_X86_CPUFEATURES_H */
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -903,6 +903,7 @@ static void identify_cpu_without_cpuid(s
+ #define NO_SSB BIT(2)
+ #define NO_L1TF BIT(3)
+ #define NO_MDS BIT(4)
++#define MSBDS_ONLY BIT(5)
+
+ #define VULNWL(_vendor, _family, _model, _whitelist) \
+ { X86_VENDOR_##_vendor, _family, _model, X86_FEATURE_ANY, _whitelist }
+@@ -926,16 +927,16 @@ static const __initconst struct x86_cpu_
+ VULNWL_INTEL(ATOM_BONNELL, NO_SPECULATION),
+ VULNWL_INTEL(ATOM_BONNELL_MID, NO_SPECULATION),
+
+- VULNWL_INTEL(ATOM_SILVERMONT, NO_SSB | NO_L1TF),
+- VULNWL_INTEL(ATOM_SILVERMONT_X, NO_SSB | NO_L1TF),
+- VULNWL_INTEL(ATOM_SILVERMONT_MID, NO_SSB | NO_L1TF),
+- VULNWL_INTEL(ATOM_AIRMONT, NO_SSB | NO_L1TF),
+- VULNWL_INTEL(XEON_PHI_KNL, NO_SSB | NO_L1TF),
+- VULNWL_INTEL(XEON_PHI_KNM, NO_SSB | NO_L1TF),
++ VULNWL_INTEL(ATOM_SILVERMONT, NO_SSB | NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(ATOM_SILVERMONT_X, NO_SSB | NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(ATOM_SILVERMONT_MID, NO_SSB | NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(ATOM_AIRMONT, NO_SSB | NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(XEON_PHI_KNL, NO_SSB | NO_L1TF | MSBDS_ONLY),
++ VULNWL_INTEL(XEON_PHI_KNM, NO_SSB | NO_L1TF | MSBDS_ONLY),
+
+ VULNWL_INTEL(CORE_YONAH, NO_SSB),
+
+- VULNWL_INTEL(ATOM_AIRMONT_MID, NO_L1TF),
++ VULNWL_INTEL(ATOM_AIRMONT_MID, NO_L1TF | MSBDS_ONLY),
+
+ VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF),
+ VULNWL_INTEL(ATOM_GOLDMONT_X, NO_MDS | NO_L1TF),
+@@ -979,8 +980,11 @@ static void __init cpu_set_bug_bits(stru
+ if (ia32_cap & ARCH_CAP_IBRS_ALL)
+ setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
+
+- if (!cpu_matches(NO_MDS) && !(ia32_cap & ARCH_CAP_MDS_NO))
++ if (!cpu_matches(NO_MDS) && !(ia32_cap & ARCH_CAP_MDS_NO)) {
+ setup_force_cpu_bug(X86_BUG_MDS);
++ if (cpu_matches(MSBDS_ONLY))
++ setup_force_cpu_bug(X86_BUG_MSBDS_ONLY);
++ }
+
+ if (cpu_matches(NO_MELTDOWN))
+ return;
diff --git a/patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch b/patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch
new file mode 100644
index 0000000000..d3303c9f25
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch
@@ -0,0 +1,85 @@
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Tue, 2 Apr 2019 09:59:33 -0500
+Subject: x86/speculation/mds: Add mds=full,nosmt cmdline option
+Git-repo: tip/tip
+Git-commit: d71eb0ce109a124b0fa714832823b9452f2762cf
+Patch-mainline: Queued in a subsystem tree
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+Add the mds=full,nosmt cmdline option. This is like mds=full, but with
+SMT disabled if the CPU is vulnerable.
+
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
+Acked-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/admin-guide/kernel-parameters.txt | 6 ++++--
+ Documentation/x86/mds.rst | 4 ++++
+ arch/x86/kernel/cpu/bugs.c | 10 ++++++++++
+ 3 files changed, 18 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -342,6 +342,7 @@ early_param("l1tf", l1tf_cmdline);
+
+ /* Default mitigation for L1TF-affected CPUs */
+ static enum mds_mitigations mds_mitigation __ro_after_init = MDS_MITIGATION_FULL;
++static bool mds_nosmt __ro_after_init = false;
+
+ static const char * const mds_strings[] = {
+ [MDS_MITIGATION_OFF] = "Vulnerable",
+@@ -359,8 +360,13 @@ static void __init mds_select_mitigation
+ if (mds_mitigation == MDS_MITIGATION_FULL) {
+ if (!boot_cpu_has(X86_FEATURE_MD_CLEAR))
+ mds_mitigation = MDS_MITIGATION_VMWERV;
++
+ static_branch_enable(&mds_user_clear);
++
++ if (mds_nosmt && !boot_cpu_has(X86_BUG_MSBDS_ONLY))
++ cpu_smt_disable(false);
+ }
++
+ pr_info("%s\n", mds_strings[mds_mitigation]);
+ }
+
+@@ -376,6 +382,10 @@ static int __init mds_cmdline(char *str)
+ mds_mitigation = MDS_MITIGATION_OFF;
+ else if (!strcmp(str, "full"))
+ mds_mitigation = MDS_MITIGATION_FULL;
++ else if (!strcmp(str, "full,nosmt")) {
++ mds_mitigation = MDS_MITIGATION_FULL;
++ mds_nosmt = true;
++ }
+
+ return 0;
+ }
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2221,8 +2221,10 @@
+ This parameter controls the MDS mitigation. The
+ options are:
+
+- full - Enable MDS mitigation on vulnerable CPUs
+- off - Unconditionally disable MDS mitigation
++ full - Enable MDS mitigation on vulnerable CPUs
++ full,nosmt - Enable MDS mitigation and disable
++ SMT on vulnerable CPUs
++ off - Unconditionally disable MDS mitigation
+
+ Not specifying this option is equivalent to
+ mds=full.
+--- a/Documentation/x86/mds.rst
++++ b/Documentation/x86/mds.rst
+@@ -119,6 +119,10 @@ Kernel internal mitigation modes
+ scenarios where the host has the updated microcode but the
+ hypervisor does not expose MD_CLEAR in CPUID. It's a best
+ effort approach without guarantee.
++
++ full,nosmt The same as mds=full, with SMT disabled on vulnerable
++ CPUs. This is the complete mitigation.
++
+ ======= ============================================================
+
+ If the CPU is affected and mds=off is not supplied on the kernel command
diff --git a/patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch b/patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch
new file mode 100644
index 0000000000..3d563bb801
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch
@@ -0,0 +1,216 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 18 Feb 2019 23:13:06 +0100
+Subject: x86/speculation/mds: Add mds_clear_cpu_buffers()
+Git-commit: 6a9e529272517755904b7afa639f6db59ddb793e
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+The Microarchitectural Data Sampling (MDS) vulernabilities are mitigated by
+clearing the affected CPU buffers. The mechanism for clearing the buffers
+uses the unused and obsolete VERW instruction in combination with a
+microcode update which triggers a CPU buffer clear when VERW is executed.
+
+Provide a inline function with the assembly magic. The argument of the VERW
+instruction must be a memory operand as documented:
+
+ "MD_CLEAR enumerates that the memory-operand variant of VERW (for
+ example, VERW m16) has been extended to also overwrite buffers affected
+ by MDS. This buffer overwriting functionality is not guaranteed for the
+ register operand variant of VERW."
+
+Documentation also recommends to use a writable data segment selector:
+
+ "The buffer overwriting occurs regardless of the result of the VERW
+ permission check, as well as when the selector is null or causes a
+ descriptor load segment violation. However, for lowest latency we
+ recommend using a selector that indicates a valid writable data
+ segment."
+
+Add x86 specific documentation about MDS and the internal workings of the
+mitigation.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/index.rst | 1
+ Documentation/x86/conf.py | 10 +++
+ Documentation/x86/index.rst | 8 ++
+ Documentation/x86/mds.rst | 99 +++++++++++++++++++++++++++++++++++
+ arch/x86/include/asm/nospec-branch.h | 25 ++++++++
+ 5 files changed, 143 insertions(+)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -318,6 +318,31 @@ DECLARE_STATIC_KEY_FALSE(switch_to_cond_
+ DECLARE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
+ DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
++#include <asm/segment.h>
++
++/**
++ * mds_clear_cpu_buffers - Mitigation for MDS vulnerability
++ *
++ * This uses the otherwise unused and obsolete VERW instruction in
++ * combination with microcode which triggers a CPU buffer flush when the
++ * instruction is executed.
++ */
++static inline void mds_clear_cpu_buffers(void)
++{
++ static const u16 ds = __KERNEL_DS;
++
++ /*
++ * Has to be the memory-operand variant because only that
++ * guarantees the CPU buffer flush functionality according to
++ * documentation. The register-operand variant does not.
++ * Works with any segment selector, but a valid writable
++ * data segment is the fastest variant.
++ *
++ * "cc" clobber is required because VERW modifies ZF.
++ */
++ asm volatile("verw %[ds]" : : [ds] "m" (ds) : "cc");
++}
++
+ #endif /* __ASSEMBLY__ */
+
+ /*
+--- a/Documentation/index.rst
++++ b/Documentation/index.rst
+@@ -34,6 +34,7 @@ the kernel interface as seen by applicat
+ :maxdepth: 2
+
+ userspace-api/index
++ x86/index
+
+
+ Introduction to kernel development
+--- /dev/null
++++ b/Documentation/x86/conf.py
+@@ -0,0 +1,10 @@
++# -*- coding: utf-8; mode: python -*-
++
++project = "X86 architecture specific documentation"
++
++tags.add("subproject")
++
++latex_documents = [
++ ('index', 'x86.tex', project,
++ 'The kernel development community', 'manual'),
++]
+--- /dev/null
++++ b/Documentation/x86/index.rst
+@@ -0,0 +1,8 @@
++==========================
++x86 architecture specifics
++==========================
++
++.. toctree::
++ :maxdepth: 1
++
++ mds
+--- /dev/null
++++ b/Documentation/x86/mds.rst
+@@ -0,0 +1,99 @@
++Microarchitectural Data Sampling (MDS) mitigation
++=================================================
++
++.. _mds:
++
++Overview
++--------
++
++Microarchitectural Data Sampling (MDS) is a family of side channel attacks
++on internal buffers in Intel CPUs. The variants are:
++
++ - Microarchitectural Store Buffer Data Sampling (MSBDS) (CVE-2018-12126)
++ - Microarchitectural Fill Buffer Data Sampling (MFBDS) (CVE-2018-12130)
++ - Microarchitectural Load Port Data Sampling (MLPDS) (CVE-2018-12127)
++
++MSBDS leaks Store Buffer Entries which can be speculatively forwarded to a
++dependent load (store-to-load forwarding) as an optimization. The forward
++can also happen to a faulting or assisting load operation for a different
++memory address, which can be exploited under certain conditions. Store
++buffers are partitioned between Hyper-Threads so cross thread forwarding is
++not possible. But if a thread enters or exits a sleep state the store
++buffer is repartitioned which can expose data from one thread to the other.
++
++MFBDS leaks Fill Buffer Entries. Fill buffers are used internally to manage
++L1 miss situations and to hold data which is returned or sent in response
++to a memory or I/O operation. Fill buffers can forward data to a load
++operation and also write data to the cache. When the fill buffer is
++deallocated it can retain the stale data of the preceding operations which
++can then be forwarded to a faulting or assisting load operation, which can
++be exploited under certain conditions. Fill buffers are shared between
++Hyper-Threads so cross thread leakage is possible.
++
++MLPDS leaks Load Port Data. Load ports are used to perform load operations
++from memory or I/O. The received data is then forwarded to the register
++file or a subsequent operation. In some implementations the Load Port can
++contain stale data from a previous operation which can be forwarded to
++faulting or assisting loads under certain conditions, which again can be
++exploited eventually. Load ports are shared between Hyper-Threads so cross
++thread leakage is possible.
++
++
++Exposure assumptions
++--------------------
++
++It is assumed that attack code resides in user space or in a guest with one
++exception. The rationale behind this assumption is that the code construct
++needed for exploiting MDS requires:
++
++ - to control the load to trigger a fault or assist
++
++ - to have a disclosure gadget which exposes the speculatively accessed
++ data for consumption through a side channel.
++
++ - to control the pointer through which the disclosure gadget exposes the
++ data
++
++The existence of such a construct in the kernel cannot be excluded with
++100% certainty, but the complexity involved makes it extremly unlikely.
++
++There is one exception, which is untrusted BPF. The functionality of
++untrusted BPF is limited, but it needs to be thoroughly investigated
++whether it can be used to create such a construct.
++
++
++Mitigation strategy
++-------------------
++
++All variants have the same mitigation strategy at least for the single CPU
++thread case (SMT off): Force the CPU to clear the affected buffers.
++
++This is achieved by using the otherwise unused and obsolete VERW
++instruction in combination with a microcode update. The microcode clears
++the affected CPU buffers when the VERW instruction is executed.
++
++For virtualization there are two ways to achieve CPU buffer
++clearing. Either the modified VERW instruction or via the L1D Flush
++command. The latter is issued when L1TF mitigation is enabled so the extra
++VERW can be avoided. If the CPU is not affected by L1TF then VERW needs to
++be issued.
++
++If the VERW instruction with the supplied segment selector argument is
++executed on a CPU without the microcode update there is no side effect
++other than a small number of pointlessly wasted CPU cycles.
++
++This does not protect against cross Hyper-Thread attacks except for MSBDS
++which is only exploitable cross Hyper-thread when one of the Hyper-Threads
++enters a C-state.
++
++The kernel provides a function to invoke the buffer clearing:
++
++ mds_clear_cpu_buffers()
++
++The mitigation is invoked on kernel/userspace, hypervisor/guest and C-state
++(idle) transitions.
++
++According to current knowledge additional mitigations inside the kernel
++itself are not required because the necessary gadgets to expose the leaked
++data cannot be controlled in a way which allows exploitation from malicious
++user space or VM guests.
diff --git a/patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch b/patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch
new file mode 100644
index 0000000000..0cc8bfbf56
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch
@@ -0,0 +1,186 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 18 Feb 2019 22:04:08 +0100
+Subject: x86/speculation/mds: Add mitigation control for MDS
+Git-commit: bc1241700acd82ec69fde98c5763ce51086269f8
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+Now that the mitigations are in place, add a command line parameter to
+control the mitigation, a mitigation selector function and a SMT update
+mechanism.
+
+This is the minimal straight forward initial implementation which just
+provides an always on/off mode. The command line parameter is:
+
+ mds=[full|off]
+
+This is consistent with the existing mitigations for other speculative
+hardware vulnerabilities.
+
+The idle invocation is dynamically updated according to the SMT state of
+the system similar to the dynamic update of the STIBP mitigation. The idle
+mitigation is limited to CPUs which are only affected by MSBDS and not any
+other variant, because the other variants cannot be mitigated on SMT
+enabled systems.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/admin-guide/kernel-parameters.txt | 22 +++++++
+ arch/x86/include/asm/processor.h | 5 +
+ arch/x86/kernel/cpu/bugs.c | 70 ++++++++++++++++++++++++
+ 3 files changed, 97 insertions(+)
+
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -982,4 +982,9 @@ enum l1tf_mitigations {
+
+ extern enum l1tf_mitigations l1tf_mitigation;
+
++enum mds_mitigations {
++ MDS_MITIGATION_OFF,
++ MDS_MITIGATION_FULL,
++};
++
+ #endif /* _ASM_X86_PROCESSOR_H */
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -34,6 +34,7 @@
+ static void __init spectre_v2_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
++static void __init mds_select_mitigation(void);
+
+ /* The base value of the SPEC_CTRL MSR that always has to be preserved. */
+ u64 x86_spec_ctrl_base;
+@@ -105,6 +106,8 @@ void __init check_bugs(void)
+
+ l1tf_select_mitigation();
+
++ mds_select_mitigation();
++
+ #ifdef CONFIG_X86_32
+ /*
+ * Check whether we are able to run this kernel safely on SMP.
+@@ -330,6 +333,50 @@ early_param("l1tf", l1tf_cmdline);
+
+
+ #undef pr_fmt
++#define pr_fmt(fmt) "MDS: " fmt
++
++/* Default mitigation for L1TF-affected CPUs */
++static enum mds_mitigations mds_mitigation __ro_after_init = MDS_MITIGATION_FULL;
++
++static const char * const mds_strings[] = {
++ [MDS_MITIGATION_OFF] = "Vulnerable",
++ [MDS_MITIGATION_FULL] = "Mitigation: Clear CPU buffers"
++};
++
++static void __init mds_select_mitigation(void)
++{
++ if (!boot_cpu_has_bug(X86_BUG_MDS)) {
++ mds_mitigation = MDS_MITIGATION_OFF;
++ return;
++ }
++
++ if (mds_mitigation == MDS_MITIGATION_FULL) {
++ if (boot_cpu_has(X86_FEATURE_MD_CLEAR))
++ static_branch_enable(&mds_user_clear);
++ else
++ mds_mitigation = MDS_MITIGATION_OFF;
++ }
++ pr_info("%s\n", mds_strings[mds_mitigation]);
++}
++
++static int __init mds_cmdline(char *str)
++{
++ if (!boot_cpu_has_bug(X86_BUG_MDS))
++ return 0;
++
++ if (!str)
++ return -EINVAL;
++
++ if (!strcmp(str, "off"))
++ mds_mitigation = MDS_MITIGATION_OFF;
++ else if (!strcmp(str, "full"))
++ mds_mitigation = MDS_MITIGATION_FULL;
++
++ return 0;
++}
++early_param("mds", mds_cmdline);
++
++#undef pr_fmt
+ #define pr_fmt(fmt) "Spectre V2 : " fmt
+
+ static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+@@ -738,6 +785,26 @@ static void update_indir_branch_cond(voi
+ static_branch_disable(&switch_to_cond_stibp);
+ }
+
++/* Update the static key controlling the MDS CPU buffer clear in idle */
++static void update_mds_branch_idle(void)
++{
++ /*
++ * Enable the idle clearing if SMT is active on CPUs which are
++ * affected only by MSBDS and not any other MDS variant.
++ *
++ * The other variants cannot be mitigated when SMT is enabled, so
++ * clearing the buffers on idle just to prevent the Store Buffer
++ * repartitioning leak would be a window dressing exercise.
++ */
++ if (!boot_cpu_has_bug(X86_BUG_MSBDS_ONLY))
++ return;
++
++ if (sched_smt_active())
++ static_branch_enable(&mds_idle_clear);
++ else
++ static_branch_disable(&mds_idle_clear);
++}
++
+ void arch_smt_update(void)
+ {
+ /* Enhanced IBRS implies STIBP. No update required. */
+@@ -758,6 +825,9 @@ void arch_smt_update(void)
+ break;
+ }
+
++ if (mds_mitigation == MDS_MITIGATION_FULL)
++ update_mds_branch_idle();
++
+ mutex_unlock(&spec_ctrl_mutex);
+ }
+
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2205,6 +2205,28 @@
+ Format: <first>,<last>
+ Specifies range of consoles to be captured by the MDA.
+
++ mds= [X86,INTEL]
++ Control mitigation for the Micro-architectural Data
++ Sampling (MDS) vulnerability.
++
++ Certain CPUs are vulnerable to an exploit against CPU
++ internal buffers which can forward information to a
++ disclosure gadget under certain conditions.
++
++ In vulnerable processors, the speculatively
++ forwarded data can be used in a cache side channel
++ attack, to access data to which the attacker does
++ not have direct access.
++
++ This parameter controls the MDS mitigation. The
++ options are:
++
++ full - Enable MDS mitigation on vulnerable CPUs
++ off - Unconditionally disable MDS mitigation
++
++ Not specifying this option is equivalent to
++ mds=full.
++
+ mem=nn[KMG] [KNL,BOOT] Force usage of a specific amount of memory
+ Amount of memory to be used when the kernel is not able
+ to see the whole system memory or for test.
diff --git a/patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch b/patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch
new file mode 100644
index 0000000000..4f0e1f0f07
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch
@@ -0,0 +1,131 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 20 Feb 2019 09:40:40 +0100
+Subject: x86/speculation/mds: Add mitigation mode VMWERV
+Git-commit: 22dd8365088b6403630b82423cf906491859b65e
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+In virtualized environments it can happen that the host has the microcode
+update which utilizes the VERW instruction to clear CPU buffers, but the
+hypervisor is not yet updated to expose the X86_FEATURE_MD_CLEAR CPUID bit
+to guests.
+
+Introduce an internal mitigation mode VMWERV which enables the invocation
+of the CPU buffer clearing even if X86_FEATURE_MD_CLEAR is not set. If the
+system has no updated microcode this results in a pointless execution of
+the VERW instruction wasting a few CPU cycles. If the microcode is updated,
+but not exposed to a guest then the CPU buffers will be cleared.
+
+That said: Virtual Machines Will Eventually Receive Vaccine
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/x86/mds.rst | 27 +++++++++++++++++++++++++++
+ arch/x86/include/asm/processor.h | 1 +
+ arch/x86/kernel/cpu/bugs.c | 18 ++++++++++++------
+ 3 files changed, 40 insertions(+), 6 deletions(-)
+
+diff --git a/Documentation/x86/mds.rst b/Documentation/x86/mds.rst
+index 87ce8ac9f36e..3d6f943f1afb 100644
+--- a/Documentation/x86/mds.rst
++++ b/Documentation/x86/mds.rst
+@@ -93,11 +93,38 @@ The kernel provides a function to invoke the buffer clearing:
+ The mitigation is invoked on kernel/userspace, hypervisor/guest and C-state
+ (idle) transitions.
+
++As a special quirk to address virtualization scenarios where the host has
++the microcode updated, but the hypervisor does not (yet) expose the
++MD_CLEAR CPUID bit to guests, the kernel issues the VERW instruction in the
++hope that it might actually clear the buffers. The state is reflected
++accordingly.
++
+ According to current knowledge additional mitigations inside the kernel
+ itself are not required because the necessary gadgets to expose the leaked
+ data cannot be controlled in a way which allows exploitation from malicious
+ user space or VM guests.
+
++Kernel internal mitigation modes
++--------------------------------
++
++ ======= ============================================================
++ off Mitigation is disabled. Either the CPU is not affected or
++ mds=off is supplied on the kernel command line
++
++ full Mitigation is eanbled. CPU is affected and MD_CLEAR is
++ advertised in CPUID.
++
++ vmwerv Mitigation is enabled. CPU is affected and MD_CLEAR is not
++ advertised in CPUID. That is mainly for virtualization
++ scenarios where the host has the updated microcode but the
++ hypervisor does not expose MD_CLEAR in CPUID. It's a best
++ effort approach without guarantee.
++ ======= ============================================================
++
++If the CPU is affected and mds=off is not supplied on the kernel command
++line then the kernel selects the appropriate mitigation mode depending on
++the availability of the MD_CLEAR CPUID bit.
++
+ Mitigation points
+ -----------------
+
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index 1f0295783325..aca1ef8cc79f 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -995,6 +995,7 @@ extern enum l1tf_mitigations l1tf_mitigation;
+ enum mds_mitigations {
+ MDS_MITIGATION_OFF,
+ MDS_MITIGATION_FULL,
++ MDS_MITIGATION_VMWERV,
+ };
+
+ #endif /* _ASM_X86_PROCESSOR_H */
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 7ab16a6ed064..95cda38c8785 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -224,7 +224,8 @@ static enum mds_mitigations mds_mitigation __ro_after_init = MDS_MITIGATION_FULL
+
+ static const char * const mds_strings[] = {
+ [MDS_MITIGATION_OFF] = "Vulnerable",
+- [MDS_MITIGATION_FULL] = "Mitigation: Clear CPU buffers"
++ [MDS_MITIGATION_FULL] = "Mitigation: Clear CPU buffers",
++ [MDS_MITIGATION_VMWERV] = "Vulnerable: Clear CPU buffers attempted, no microcode",
+ };
+
+ static void __init mds_select_mitigation(void)
+@@ -235,10 +236,9 @@ static void __init mds_select_mitigation(void)
+ }
+
+ if (mds_mitigation == MDS_MITIGATION_FULL) {
+- if (boot_cpu_has(X86_FEATURE_MD_CLEAR))
+- static_branch_enable(&mds_user_clear);
+- else
+- mds_mitigation = MDS_MITIGATION_OFF;
++ if (!boot_cpu_has(X86_FEATURE_MD_CLEAR))
++ mds_mitigation = MDS_MITIGATION_VMWERV;
++ static_branch_enable(&mds_user_clear);
+ }
+ pr_info("%s\n", mds_strings[mds_mitigation]);
+ }
+@@ -705,8 +705,14 @@ void arch_smt_update(void)
+ break;
+ }
+
+- if (mds_mitigation == MDS_MITIGATION_FULL)
++ switch (mds_mitigation) {
++ case MDS_MITIGATION_FULL:
++ case MDS_MITIGATION_VMWERV:
+ update_mds_branch_idle();
++ break;
++ case MDS_MITIGATION_OFF:
++ break;
++ }
+
+ mutex_unlock(&spec_ctrl_mutex);
+ }
+
diff --git a/patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch b/patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch
new file mode 100644
index 0000000000..4405b7c895
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch
@@ -0,0 +1,62 @@
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Wed, 17 Apr 2019 16:39:02 -0500
+Subject: x86/speculation/mds: Add 'mitigations=' support for MDS
+Git-repo: tip/tip
+Git-commit: 5c14068f87d04adc73ba3f41c2a303d3c3d1fa12
+Patch-mainline: Queued in a subsystem tree
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+Add MDS to the new 'mitigations=' cmdline option.
+
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/admin-guide/kernel-parameters.txt | 2 ++
+ arch/x86/kernel/cpu/bugs.c | 5 +++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 9aa3543a8723..18cad2b0392a 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2556,6 +2556,7 @@
+ spectre_v2_user=off [X86]
+ spec_store_bypass_disable=off [X86,PPC]
+ l1tf=off [X86]
++ mds=off [X86]
+
+ auto (default)
+ Mitigate all CPU vulnerabilities, but leave SMT
+@@ -2570,6 +2571,7 @@
+ if needed. This is for users who always want to
+ be fully mitigated, even if it means losing SMT.
+ Equivalent to: l1tf=flush,nosmt [X86]
++ mds=full,nosmt [X86]
+
+ mminit_loglevel=
+ [KNL] When CONFIG_DEBUG_MEMORY_INIT is set, this
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 3c5c3c3ba734..667c273a66d7 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -233,7 +233,7 @@ static const char * const mds_strings[] = {
+
+ static void __init mds_select_mitigation(void)
+ {
+- if (!boot_cpu_has_bug(X86_BUG_MDS)) {
++ if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off()) {
+ mds_mitigation = MDS_MITIGATION_OFF;
+ return;
+ }
+@@ -244,7 +244,8 @@ static void __init mds_select_mitigation(void)
+
+ static_branch_enable(&mds_user_clear);
+
+- if (mds_nosmt && !boot_cpu_has(X86_BUG_MSBDS_ONLY))
++ if (!boot_cpu_has(X86_BUG_MSBDS_ONLY) &&
++ (mds_nosmt || cpu_mitigations_auto_nosmt()))
+ cpu_smt_disable(false);
+ }
+
+
diff --git a/patches.arch/x86-speculation-mds-add-smt-warning-message.patch b/patches.arch/x86-speculation-mds-add-smt-warning-message.patch
new file mode 100644
index 0000000000..0ba3c2f544
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-add-smt-warning-message.patch
@@ -0,0 +1,50 @@
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Tue, 2 Apr 2019 10:00:51 -0500
+Subject: x86/speculation/mds: Add SMT warning message
+Git-commit: 39226ef02bfb43248b7db12a4fdccb39d95318e3
+Git-repo: tip/tip
+Patch-mainline: Queued in a subsystem tree
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+MDS is vulnerable with SMT. Make that clear with a one-time printk
+whenever SMT first gets enabled.
+
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
+Acked-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -800,6 +800,9 @@ static void update_indir_branch_cond(voi
+ static_branch_disable(&switch_to_cond_stibp);
+ }
+
++#undef pr_fmt
++#define pr_fmt(fmt) fmt
++
+ /* Update the static key controlling the MDS CPU buffer clear in idle */
+ static void update_mds_branch_idle(void)
+ {
+@@ -820,6 +823,8 @@ static void update_mds_branch_idle(void)
+ static_branch_disable(&mds_idle_clear);
+ }
+
++#define MDS_MSG_SMT "MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.\n"
++
+ void arch_smt_update(void)
+ {
+ /* Enhanced IBRS implies STIBP. No update required. */
+@@ -843,6 +848,8 @@ void arch_smt_update(void)
+ switch (mds_mitigation) {
+ case MDS_MITIGATION_FULL:
+ case MDS_MITIGATION_VMWERV:
++ if (sched_smt_active() && !boot_cpu_has(X86_BUG_MSBDS_ONLY))
++ pr_warn_once(MDS_MSG_SMT);
+ update_mds_branch_idle();
+ break;
+ case MDS_MITIGATION_OFF:
diff --git a/patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch b/patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch
new file mode 100644
index 0000000000..2a1c7ad669
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch
@@ -0,0 +1,120 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 18 Feb 2019 22:51:43 +0100
+Subject: x86/speculation/mds: Add sysfs reporting for MDS
+Git-commit: 8a4b06d391b0a42a373808979b5028f5c84d9c6a
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+Add the sysfs reporting file for MDS. It exposes the vulnerability and
+mitigation state similar to the existing files for the other speculative
+hardware vulnerabilities.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/ABI/testing/sysfs-devices-system-cpu | 1
+ arch/x86/kernel/cpu/bugs.c | 25 +++++++++++++++++++++
+ drivers/base/cpu.c | 8 ++++++
+ include/linux/cpu.h | 2 +
+ 4 files changed, 36 insertions(+)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -1170,6 +1170,22 @@ static ssize_t l1tf_show_state(char *buf
+ }
+ #endif
+
++static ssize_t mds_show_state(char *buf)
++{
++ if (!hypervisor_is_type(X86_HYPER_NATIVE)) {
++ return sprintf(buf, "%s; SMT Host state unknown\n",
++ mds_strings[mds_mitigation]);
++ }
++
++ if (boot_cpu_has(X86_BUG_MSBDS_ONLY)) {
++ return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
++ sched_smt_active() ? "mitigated" : "disabled");
++ }
++
++ return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
++ sched_smt_active() ? "vulnerable" : "disabled");
++}
++
+ static char *stibp_state(void)
+ {
+ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+@@ -1236,6 +1252,10 @@ static ssize_t cpu_show_common(struct de
+ return l1tf_show_state(buf);
+ break;
+
++
++ case X86_BUG_MDS:
++ return mds_show_state(buf);
++
+ default:
+ break;
+ }
+@@ -1267,4 +1287,9 @@ ssize_t cpu_show_l1tf(struct device *dev
+ {
+ return cpu_show_common(dev, attr, buf, X86_BUG_L1TF);
+ }
++
++ssize_t cpu_show_mds(struct device *dev, struct device_attribute *attr, char *buf)
++{
++ return cpu_show_common(dev, attr, buf, X86_BUG_MDS);
++}
+ #endif
+--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
++++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
+@@ -380,6 +380,7 @@ What: /sys/devices/system/cpu/vulnerabi
+ /sys/devices/system/cpu/vulnerabilities/spectre_v2
+ /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
+ /sys/devices/system/cpu/vulnerabilities/l1tf
++ /sys/devices/system/cpu/vulnerabilities/mds
+ Date: January 2018
+ Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>
+ Description: Information about CPU vulnerabilities
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -533,11 +533,18 @@ ssize_t __weak cpu_show_l1tf(struct devi
+ return sprintf(buf, "Not affected\n");
+ }
+
++ssize_t __weak cpu_show_mds(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ return sprintf(buf, "Not affected\n");
++}
++
+ static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
+ static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
+ static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
+ static DEVICE_ATTR(spec_store_bypass, 0444, cpu_show_spec_store_bypass, NULL);
+ static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL);
++static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL);
+
+ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
+ &dev_attr_meltdown.attr,
+@@ -545,6 +552,7 @@ static struct attribute *cpu_root_vulner
+ &dev_attr_spectre_v2.attr,
+ &dev_attr_spec_store_bypass.attr,
+ &dev_attr_l1tf.attr,
++ &dev_attr_mds.attr,
+ NULL
+ };
+
+--- a/include/linux/cpu.h
++++ b/include/linux/cpu.h
+@@ -56,6 +56,8 @@ extern ssize_t cpu_show_spec_store_bypas
+ struct device_attribute *attr, char *buf);
+ extern ssize_t cpu_show_l1tf(struct device *dev,
+ struct device_attribute *attr, char *buf);
++extern ssize_t cpu_show_mds(struct device *dev,
++ struct device_attribute *attr, char *buf);
+
+ extern __printf(4, 5)
+ struct device *cpu_device_create(struct device *parent, void *drvdata,
diff --git a/patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch b/patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch
new file mode 100644
index 0000000000..8501ae91ae
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch
@@ -0,0 +1,192 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 18 Feb 2019 23:42:51 +0100
+Subject: x86/speculation/mds: Clear CPU buffers on exit to user
+Git-commit: 04dcbdb8057827b043b3c71aa397c4c63e67d086
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+Add a static key which controls the invocation of the CPU buffer clear
+mechanism on exit to user space and add the call into
+prepare_exit_to_usermode() and do_nmi() right before actually returning.
+
+Add documentation which kernel to user space transition this covers and
+explain why some corner cases are not mitigated.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/x86/mds.rst | 52 +++++++++++++++++++++++++++++++++++
+ arch/x86/entry/common.c | 3 ++
+ arch/x86/include/asm/nospec-branch.h | 13 ++++++++
+ arch/x86/kernel/cpu/bugs.c | 3 ++
+ arch/x86/kernel/nmi.c | 4 ++
+ arch/x86/kernel/traps.c | 8 +++++
+ 6 files changed, 83 insertions(+)
+
+--- a/arch/x86/entry/common.c
++++ b/arch/x86/entry/common.c
+@@ -30,6 +30,7 @@
+ #include <asm/vdso.h>
+ #include <linux/uaccess.h>
+ #include <asm/cpufeature.h>
++#include <asm/nospec-branch.h>
+
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/syscalls.h>
+@@ -208,6 +209,8 @@ __visible inline void prepare_exit_to_us
+ #endif
+
+ user_enter_irqoff();
++
++ mds_user_clear_cpu_buffers();
+ }
+
+ #define SYSCALL_EXIT_WORK_FLAGS \
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -318,6 +318,8 @@ DECLARE_STATIC_KEY_FALSE(switch_to_cond_
+ DECLARE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
+ DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
++DECLARE_STATIC_KEY_FALSE(mds_user_clear);
++
+ #include <asm/segment.h>
+
+ /**
+@@ -343,6 +345,17 @@ static inline void mds_clear_cpu_buffers
+ asm volatile("verw %[ds]" : : [ds] "m" (ds) : "cc");
+ }
+
++/**
++ * mds_user_clear_cpu_buffers - Mitigation for MDS vulnerability
++ *
++ * Clear CPU buffers if the corresponding static key is enabled
++ */
++static inline void mds_user_clear_cpu_buffers(void)
++{
++ if (static_branch_likely(&mds_user_clear))
++ mds_clear_cpu_buffers();
++}
++
+ #endif /* __ASSEMBLY__ */
+
+ /*
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -60,6 +60,9 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_cond_i
+ /* Control unconditional IBPB in switch_mm() */
+ DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
++/* Control MDS CPU buffer clear before returning to user space */
++DEFINE_STATIC_KEY_FALSE(mds_user_clear);
++
+ void __init check_bugs(void)
+ {
+ identify_boot_cpu();
+--- a/arch/x86/kernel/nmi.c
++++ b/arch/x86/kernel/nmi.c
+@@ -34,6 +34,7 @@
+ #include <asm/x86_init.h>
+ #include <asm/reboot.h>
+ #include <asm/cache.h>
++#include <asm/nospec-branch.h>
+
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/nmi.h>
+@@ -533,6 +534,9 @@ nmi_restart:
+ write_cr2(this_cpu_read(nmi_cr2));
+ if (this_cpu_dec_return(nmi_state))
+ goto nmi_restart;
++
++ if (user_mode(regs))
++ mds_user_clear_cpu_buffers();
+ }
+ NOKPROBE_SYMBOL(do_nmi);
+
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -59,6 +59,7 @@
+ #include <asm/alternative.h>
+ #include <asm/fpu/xstate.h>
+ #include <asm/trace/mpx.h>
++#include <asm/nospec-branch.h>
+ #include <asm/mpx.h>
+ #include <asm/vm86.h>
+
+@@ -393,6 +394,13 @@ dotraplinkage void do_double_fault(struc
+ regs->ip = (unsigned long)general_protection;
+ regs->sp = (unsigned long)&gpregs->orig_ax;
+
++ /*
++ * This situation can be triggered by userspace via
++ * modify_ldt(2) and the return does not take the regular
++ * user space exit, so a CPU buffer clear is required when
++ * MDS mitigation is enabled.
++ */
++ mds_user_clear_cpu_buffers();
+ return;
+ }
+ #endif
+--- a/Documentation/x86/mds.rst
++++ b/Documentation/x86/mds.rst
+@@ -97,3 +97,55 @@ According to current knowledge additiona
+ itself are not required because the necessary gadgets to expose the leaked
+ data cannot be controlled in a way which allows exploitation from malicious
+ user space or VM guests.
++
++Mitigation points
++-----------------
++
++1. Return to user space
++^^^^^^^^^^^^^^^^^^^^^^^
++
++ When transitioning from kernel to user space the CPU buffers are flushed
++ on affected CPUs when the mitigation is not disabled on the kernel
++ command line. The migitation is enabled through the static key
++ mds_user_clear.
++
++ The mitigation is invoked in prepare_exit_to_usermode() which covers
++ most of the kernel to user space transitions. There are a few exceptions
++ which are not invoking prepare_exit_to_usermode() on return to user
++ space. These exceptions use the paranoid exit code.
++
++ - Non Maskable Interrupt (NMI):
++
++ Access to sensible data like keys, credentials in the NMI context is
++ mostly theoretical: The CPU can do prefetching or execute a
++ misspeculated code path and thereby fetching data which might end up
++ leaking through a buffer.
++
++ But for mounting other attacks the kernel stack address of the task is
++ already valuable information. So in full mitigation mode, the NMI is
++ mitigated on the return from do_nmi() to provide almost complete
++ coverage.
++
++ - Double fault (#DF):
++
++ A double fault is usually fatal, but the ESPFIX workaround, which can
++ be triggered from user space through modify_ldt(2) is a recoverable
++ double fault. #DF uses the paranoid exit path, so explicit mitigation
++ in the double fault handler is required.
++
++ - Machine Check Exception (#MC):
++
++ Another corner case is a #MC which hits between the CPU buffer clear
++ invocation and the actual return to user. As this still is in kernel
++ space it takes the paranoid exit path which does not clear the CPU
++ buffers. So the #MC handler repopulates the buffers to some
++ extent. Machine checks are not reliably controllable and the window is
++ extremly small so mitigation would just tick a checkbox that this
++ theoretical corner case is covered. To keep the amount of special
++ cases small, ignore #MC.
++
++ - Debug Exception (#DB):
++
++ This takes the paranoid exit path only when the INT1 breakpoint is in
++ kernel space. #DB on a user space address takes the regular exit path,
++ so no extra mitigation required.
diff --git a/patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch b/patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch
new file mode 100644
index 0000000000..e55065d925
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch
@@ -0,0 +1,224 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 18 Feb 2019 23:04:01 +0100
+Subject: x86/speculation/mds: Conditionally clear CPU buffers on idle entry
+Git-commit: 07f07f55a29cb705e221eda7894dd67ab81ef343
+Patch-mainline: v5.1-rc1
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+Add a static key which controls the invocation of the CPU buffer clear
+mechanism on idle entry. This is independent of other MDS mitigations
+because the idle entry invocation to mitigate the potential leakage due to
+store buffer repartitioning is only necessary on SMT systems.
+
+Add the actual invocations to the different halt/mwait variants which
+covers all usage sites. mwaitx is not patched as it's not available on
+Intel CPUs.
+
+The buffer clear is only invoked before entering the C-State to prevent
+that stale data from the idling CPU is spilled to the Hyper-Thread sibling
+after the Store buffer got repartitioned and all entries are available to
+the non idle sibling.
+
+When coming out of idle the store buffer is partitioned again so each
+sibling has half of it available. Now CPU which returned from idle could be
+speculatively exposed to contents of the sibling, but the buffers are
+flushed either on exit to user space or on VMENTER.
+
+When later on conditional buffer clearing is implemented on top of this,
+then there is no action required either because before returning to user
+space the context switch will set the condition flag which causes a flush
+on the return to user path.
+
+Note, that the buffer clearing on idle is only sensible on CPUs which are
+solely affected by MSBDS and not any other variant of MDS because the other
+MDS variants cannot be mitigated when SMT is enabled, so the buffer
+clearing on idle would be a window dressing exercise.
+
+This intentionally does not handle the case in the acpi/processor_idle
+driver which uses the legacy IO port interface for C-State transitions for
+two reasons:
+
+ - The acpi/processor_idle driver was replaced by the intel_idle driver
+ almost a decade ago. Anything Nehalem upwards supports it and defaults
+ to that new driver.
+
+ - The legacy IO port interface is likely to be used on older and therefore
+ unaffected CPUs or on systems which do not receive microcode updates
+ anymore, so there is no point in adding that.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Reviewed-by: Jon Masters <jcm@redhat.com>
+Tested-by: Jon Masters <jcm@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/x86/mds.rst | 42 ++++++++++++++++++++++++++++++++++++
+ arch/x86/include/asm/irqflags.h | 4 ++++
+ arch/x86/include/asm/mwait.h | 7 ++++++
+ arch/x86/include/asm/nospec-branch.h | 12 +++++++++++
+ arch/x86/kernel/cpu/bugs.c | 3 +++
+ 5 files changed, 68 insertions(+)
+
+diff --git a/Documentation/x86/mds.rst b/Documentation/x86/mds.rst
+index 54d935bf283b..87ce8ac9f36e 100644
+--- a/Documentation/x86/mds.rst
++++ b/Documentation/x86/mds.rst
+@@ -149,3 +149,45 @@ Mitigation points
+ This takes the paranoid exit path only when the INT1 breakpoint is in
+ kernel space. #DB on a user space address takes the regular exit path,
+ so no extra mitigation required.
++
++
++2. C-State transition
++^^^^^^^^^^^^^^^^^^^^^
++
++ When a CPU goes idle and enters a C-State the CPU buffers need to be
++ cleared on affected CPUs when SMT is active. This addresses the
++ repartitioning of the store buffer when one of the Hyper-Threads enters
++ a C-State.
++
++ When SMT is inactive, i.e. either the CPU does not support it or all
++ sibling threads are offline CPU buffer clearing is not required.
++
++ The idle clearing is enabled on CPUs which are only affected by MSBDS
++ and not by any other MDS variant. The other MDS variants cannot be
++ protected against cross Hyper-Thread attacks because the Fill Buffer and
++ the Load Ports are shared. So on CPUs affected by other variants, the
++ idle clearing would be a window dressing exercise and is therefore not
++ activated.
++
++ The invocation is controlled by the static key mds_idle_clear which is
++ switched depending on the chosen mitigation mode and the SMT state of
++ the system.
++
++ The buffer clear is only invoked before entering the C-State to prevent
++ that stale data from the idling CPU from spilling to the Hyper-Thread
++ sibling after the store buffer got repartitioned and all entries are
++ available to the non idle sibling.
++
++ When coming out of idle the store buffer is partitioned again so each
++ sibling has half of it available. The back from idle CPU could be then
++ speculatively exposed to contents of the sibling. The buffers are
++ flushed either on exit to user space or on VMENTER so malicious code
++ in user space or the guest cannot speculatively access them.
++
++ The mitigation is hooked into all variants of halt()/mwait(), but does
++ not cover the legacy ACPI IO-Port mechanism because the ACPI idle driver
++ has been superseded by the intel_idle driver around 2010 and is
++ preferred on all affected CPUs which are expected to gain the MD_CLEAR
++ functionality in microcode. Aside of that the IO-Port mechanism is a
++ legacy interface which is only used on older systems which are either
++ not affected or do not receive microcode updates anymore.
+diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
+index 058e40fed167..8a0e56e1dcc9 100644
+--- a/arch/x86/include/asm/irqflags.h
++++ b/arch/x86/include/asm/irqflags.h
+@@ -6,6 +6,8 @@
+
+ #ifndef __ASSEMBLY__
+
++#include <asm/nospec-branch.h>
++
+ /* Provide __cpuidle; we can't safely include <linux/cpu.h> */
+ #define __cpuidle __attribute__((__section__(".cpuidle.text")))
+
+@@ -54,11 +56,13 @@ static inline void native_irq_enable(void)
+
+ static inline __cpuidle void native_safe_halt(void)
+ {
++ mds_idle_clear_cpu_buffers();
+ asm volatile("sti; hlt": : :"memory");
+ }
+
+ static inline __cpuidle void native_halt(void)
+ {
++ mds_idle_clear_cpu_buffers();
+ asm volatile("hlt": : :"memory");
+ }
+
+diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h
+index 39a2fb29378a..eb0f80ce8524 100644
+--- a/arch/x86/include/asm/mwait.h
++++ b/arch/x86/include/asm/mwait.h
+@@ -6,6 +6,7 @@
+ #include <linux/sched/idle.h>
+
+ #include <asm/cpufeature.h>
++#include <asm/nospec-branch.h>
+
+ #define MWAIT_SUBSTATE_MASK 0xf
+ #define MWAIT_CSTATE_MASK 0xf
+@@ -40,6 +41,8 @@ static inline void __monitorx(const void *eax, unsigned long ecx,
+
+ static inline void __mwait(unsigned long eax, unsigned long ecx)
+ {
++ mds_idle_clear_cpu_buffers();
++
+ /* "mwait %eax, %ecx;" */
+ asm volatile(".byte 0x0f, 0x01, 0xc9;"
+ :: "a" (eax), "c" (ecx));
+@@ -74,6 +77,8 @@ static inline void __mwait(unsigned long eax, unsigned long ecx)
+ static inline void __mwaitx(unsigned long eax, unsigned long ebx,
+ unsigned long ecx)
+ {
++ /* No MDS buffer clear as this is AMD/HYGON only */
++
+ /* "mwaitx %eax, %ebx, %ecx;" */
+ asm volatile(".byte 0x0f, 0x01, 0xfb;"
+ :: "a" (eax), "b" (ebx), "c" (ecx));
+@@ -81,6 +86,8 @@ static inline void __mwaitx(unsigned long eax, unsigned long ebx,
+
+ static inline void __sti_mwait(unsigned long eax, unsigned long ecx)
+ {
++ mds_idle_clear_cpu_buffers();
++
+ trace_hardirqs_on();
+ /* "mwait %eax, %ecx;" */
+ asm volatile("sti; .byte 0x0f, 0x01, 0xc9;"
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 65b747286d96..4e970390110f 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -319,6 +319,7 @@ DECLARE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
+ DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
+ DECLARE_STATIC_KEY_FALSE(mds_user_clear);
++DECLARE_STATIC_KEY_FALSE(mds_idle_clear);
+
+ #include <asm/segment.h>
+
+@@ -356,6 +357,17 @@ static inline void mds_user_clear_cpu_buffers(void)
+ mds_clear_cpu_buffers();
+ }
+
++/**
++ * mds_idle_clear_cpu_buffers - Mitigation for MDS vulnerability
++ *
++ * Clear CPU buffers if the corresponding static key is enabled
++ */
++static inline void mds_idle_clear_cpu_buffers(void)
++{
++ if (static_branch_likely(&mds_idle_clear))
++ mds_clear_cpu_buffers();
++}
++
+ #endif /* __ASSEMBLY__ */
+
+ /*
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 29ed8e8dfee2..916995167301 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -66,6 +66,9 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+ /* Control MDS CPU buffer clear before returning to user space */
+ DEFINE_STATIC_KEY_FALSE(mds_user_clear);
+ EXPORT_SYMBOL_GPL(mds_user_clear);
++/* Control MDS CPU buffer clear before idling (halt, mwait) */
++DEFINE_STATIC_KEY_FALSE(mds_idle_clear);
++EXPORT_SYMBOL_GPL(mds_idle_clear);
+
+ void __init check_bugs(void)
+ {
+
diff --git a/patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch b/patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch
new file mode 100644
index 0000000000..c9762dddd2
--- /dev/null
+++ b/patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch
@@ -0,0 +1,49 @@
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Fri, 12 Apr 2019 17:50:58 -0400
+Subject: x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
+Git-repo: tip/tip
+Git-commit: e2c3c94788b08891dcf3dbe608f9880523ecd71b
+Patch-mainline: Queued in a subsystem tree
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+This code is only for CPUs which are affected by MSBDS, but are *not*
+affected by the other two MDS issues.
+
+For such CPUs, enabling the mds_idle_clear mitigation is enough to
+mitigate SMT.
+
+However if user boots with 'mds=off' and still has SMT enabled, we should
+not report that SMT is mitigated:
+
+$cat /sys//devices/system/cpu/vulnerabilities/mds
+Vulnerable; SMT mitigated
+
+But rather:
+Vulnerable; SMT vulnerable
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
+Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lkml.kernel.org/r/20190412215118.294906495@localhost.localdomain
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 0642505dda69..6b8a55c7cebc 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -1204,7 +1204,8 @@ static ssize_t mds_show_state(char *buf)
+
+ if (boot_cpu_has(X86_BUG_MSBDS_ONLY)) {
+ return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
+- sched_smt_active() ? "mitigated" : "disabled");
++ (mds_mitigation == MDS_MITIGATION_OFF ? "vulnerable" :
++ sched_smt_active() ? "mitigated" : "disabled"));
+ }
+
+ return sprintf(buf, "%s; SMT %s\n", mds_strings[mds_mitigation],
+
diff --git a/patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch b/patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch
new file mode 100644
index 0000000000..cfcda3d0e4
--- /dev/null
+++ b/patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch
@@ -0,0 +1,45 @@
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Tue, 2 Apr 2019 10:00:14 -0500
+Subject: x86/speculation: Move arch_smt_update() call to after mitigation decisions
+Git-repo: tip/tip
+Git-commit: 7c3658b20194a5b3209a143f63bc9c643c6a3ae2
+Patch-mainline: Queued in a subsystem tree
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+arch_smt_update() now has a dependency on both Spectre v2 and MDS
+mitigations. Move its initial call to after all the mitigation decisions
+have been made.
+
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
+Acked-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 9f252082a83b..3f934ffef8cf 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -111,6 +111,8 @@ void __init check_bugs(void)
+
+ mds_select_mitigation();
+
++ arch_smt_update();
++
+ #ifdef CONFIG_X86_32
+ /*
+ * Check whether we are able to run this kernel safely on SMP.
+@@ -638,9 +640,6 @@ static void __init spectre_v2_select_mitigation(void)
+
+ /* Set up IBPB and STIBP depending on the general spectre V2 command */
+ spectre_v2_user_select_mitigation(cmd);
+-
+- /* Enable STIBP if appropriate */
+- arch_smt_update();
+ }
+
+ static void update_stibp_msr(void * __unused)
+
diff --git a/patches.arch/x86-speculation-simplify-the-cpu-bug-detection-logic.patch b/patches.arch/x86-speculation-simplify-the-cpu-bug-detection-logic.patch
new file mode 100644
index 0000000000..2ca003db81
--- /dev/null
+++ b/patches.arch/x86-speculation-simplify-the-cpu-bug-detection-logic.patch
@@ -0,0 +1,84 @@
+From: Dominik Brodowski <linux@dominikbrodowski.net>
+Date: Tue, 22 May 2018 11:05:39 +0200
+Subject: x86/speculation: Simplify the CPU bug detection logic
+Git-commit: 8ecc4979b1bd9c94168e6fc92960033b7a951336
+Patch-mainline: v4.17-rc7
+References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
+
+Only CPUs which speculate can speculate. Therefore, it seems prudent
+to test for cpu_no_speculation first and only then determine whether
+a specific speculating CPU is susceptible to store bypass speculation.
+This is underlined by all CPUs currently listed in cpu_no_speculation
+were present in cpu_no_spec_store_bypass as well.
+
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: bp@suse.de
+Cc: konrad.wilk@oracle.com
+Link: https://lkml.kernel.org/r/20180522090539.GA24668@light.dominikbrodowski.net
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/common.c | 22 +++++++---------------
+ 1 file changed, 7 insertions(+), 15 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 78decc3e3067..38276f58d3bf 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -942,12 +942,8 @@ static const __initconst struct x86_cpu_id cpu_no_meltdown[] = {
+ {}
+ };
+
++/* Only list CPUs which speculate but are non susceptible to SSB */
+ static const __initconst struct x86_cpu_id cpu_no_spec_store_bypass[] = {
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_PINEVIEW },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_LINCROFT },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_PENWELL },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_CLOVERVIEW },
+- { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_CEDARVIEW },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1 },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT2 },
+@@ -955,14 +951,10 @@ static const __initconst struct x86_cpu_id cpu_no_spec_store_bypass[] = {
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_CORE_YONAH },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNL },
+ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNM },
+- { X86_VENDOR_CENTAUR, 5, },
+- { X86_VENDOR_INTEL, 5, },
+- { X86_VENDOR_NSC, 5, },
+ { X86_VENDOR_AMD, 0x12, },
+ { X86_VENDOR_AMD, 0x11, },
+ { X86_VENDOR_AMD, 0x10, },
+ { X86_VENDOR_AMD, 0xf, },
+- { X86_VENDOR_ANY, 4, },
+ {}
+ };
+
+@@ -970,6 +962,12 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ {
+ u64 ia32_cap = 0;
+
++ if (x86_match_cpu(cpu_no_speculation))
++ return;
++
++ setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
++ setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
++
+ if (cpu_has(c, X86_FEATURE_ARCH_CAPABILITIES))
+ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap);
+
+@@ -977,12 +975,6 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ !(ia32_cap & ARCH_CAP_SSB_NO))
+ setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
+
+- if (x86_match_cpu(cpu_no_speculation))
+- return;
+-
+- setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
+- setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
+-
+ if (x86_match_cpu(cpu_no_meltdown))
+ return;
+
+
diff --git a/patches.arch/x86-speculation-support-enhanced-ibrs-on-future-cpus.patch b/patches.arch/x86-speculation-support-enhanced-ibrs-on-future-cpus.patch
index e0333fec19..6a78531142 100644
--- a/patches.arch/x86-speculation-support-enhanced-ibrs-on-future-cpus.patch
+++ b/patches.arch/x86-speculation-support-enhanced-ibrs-on-future-cpus.patch
@@ -95,7 +95,7 @@ Acked-by: Borislav Petkov <bp@suse.de>
};
#undef pr_fmt
-@@ -347,6 +348,13 @@ static void __init spectre_v2_select_mit
+@@ -348,6 +349,13 @@ static void __init spectre_v2_select_mit
case SPECTRE_V2_CMD_FORCE:
case SPECTRE_V2_CMD_AUTO:
@@ -109,7 +109,7 @@ Acked-by: Borislav Petkov <bp@suse.de>
if (IS_ENABLED(CONFIG_RETPOLINE))
goto retpoline_auto;
break;
-@@ -384,6 +392,7 @@ retpoline_auto:
+@@ -385,6 +393,7 @@ retpoline_auto:
setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
}
@@ -117,7 +117,7 @@ Acked-by: Borislav Petkov <bp@suse.de>
spectre_v2_enabled = mode;
pr_info("%s\n", spectre_v2_strings[mode]);
-@@ -406,9 +415,16 @@ retpoline_auto:
+@@ -407,9 +416,16 @@ retpoline_auto:
/*
* Retpoline means the kernel is safe because it has no indirect
@@ -138,9 +138,9 @@ Acked-by: Borislav Petkov <bp@suse.de>
}
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
-@@ -957,6 +957,9 @@ static void __init cpu_set_bug_bits(stru
- setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
- setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
+@@ -956,6 +956,9 @@ static void __init cpu_set_bug_bits(stru
+ !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
+ setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
+ if (ia32_cap & ARCH_CAP_IBRS_ALL)
+ setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
diff --git a/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch b/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch
index 8fda421f64..a7c8d4052b 100644
--- a/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch
+++ b/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:29 -0500
Subject: x86/speculation: Support 'mitigations=' cmdline option
Git-commit: d68be4c4d31295ff6ae34a8ddfaa4c1a8ff42812
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: queued in subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Configure x86 runtime CPU speculation bug mitigations in accordance with
diff --git a/patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch b/patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch
new file mode 100644
index 0000000000..46a76ed964
--- /dev/null
+++ b/patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch
@@ -0,0 +1,181 @@
+From f4fa968950aef7efb98a0899bb0132405e2edaf1 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Apr 2019 18:18:47 +0200
+Subject: [PATCH] ALSA: core: Don't refer to snd_cards array directly
+Git-commit: f4fa968950aef7efb98a0899bb0132405e2edaf1
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The snd_cards[] array holds the card pointers that have been currently
+registered, and it's exported for the external modules that may need
+to refer a card object. But accessing to this array can be racy
+against the driver probe or removal, as the card registration or free
+may happen concurrently.
+
+This patch gets rid of the direct access to snd_cards[] array and
+provides a helper function to give the card object from the index
+number with a refcount management. Then the caller can access to the
+given card object safely, and releases it via snd_card_unref().
+
+While we're at it, add a proper comment to snd_card_unref() and make
+it an inlined function for type-safety, too.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/core.h | 16 ++++++++++++++--
+ sound/core/init.c | 23 +++++++++++++++++++++--
+ sound/core/oss/mixer_oss.c | 16 ++++++++++++----
+ sound/core/sound.c | 5 ++++-
+ sound/last.c | 10 +++++++---
+ 5 files changed, 58 insertions(+), 12 deletions(-)
+
+--- a/include/sound/core.h
++++ b/include/sound/core.h
+@@ -241,7 +241,6 @@ int copy_from_user_toio(volatile void __
+
+ /* init.c */
+
+-extern struct snd_card *snd_cards[SNDRV_CARDS];
+ int snd_card_locked(int card);
+ #if defined(CONFIG_SND_MIXER_OSS) || defined(CONFIG_SND_MIXER_OSS_MODULE)
+ #define SND_MIXER_OSS_NOTIFY_REGISTER 0
+@@ -265,7 +264,20 @@ int snd_card_add_dev_attr(struct snd_car
+ int snd_component_add(struct snd_card *card, const char *component);
+ int snd_card_file_add(struct snd_card *card, struct file *file);
+ int snd_card_file_remove(struct snd_card *card, struct file *file);
+-#define snd_card_unref(card) put_device(&(card)->card_dev)
++
++struct snd_card *snd_card_ref(int card);
++
++/**
++ * snd_card_unref - Unreference the card object
++ * @card: the card object to unreference
++ *
++ * Call this function for the card object that was obtained via snd_card_ref()
++ * or snd_lookup_minor_data().
++ */
++static inline void snd_card_unref(struct snd_card *card)
++{
++ put_device(&card->card_dev);
++}
+
+ #define snd_card_set_dev(card, devptr) ((card)->dev = (devptr))
+
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -49,8 +49,7 @@ static const struct file_operations snd_
+
+ /* locked for registering/using */
+ static DECLARE_BITMAP(snd_cards_lock, SNDRV_CARDS);
+-struct snd_card *snd_cards[SNDRV_CARDS];
+-EXPORT_SYMBOL(snd_cards);
++static struct snd_card *snd_cards[SNDRV_CARDS];
+
+ static DEFINE_MUTEX(snd_card_mutex);
+
+@@ -294,6 +293,26 @@ int snd_card_new(struct device *parent,
+ }
+ EXPORT_SYMBOL(snd_card_new);
+
++/**
++ * snd_card_ref - Get the card object from the index
++ * @idx: the card index
++ *
++ * Returns a card object corresponding to the given index or NULL if not found.
++ * Release the object via snd_card_unref().
++ */
++struct snd_card *snd_card_ref(int idx)
++{
++ struct snd_card *card;
++
++ mutex_lock(&snd_card_mutex);
++ card = snd_cards[idx];
++ if (card)
++ get_device(&card->card_dev);
++ mutex_unlock(&snd_card_mutex);
++ return card;
++}
++EXPORT_SYMBOL_GPL(snd_card_ref);
++
+ /* return non-zero if a card is already locked */
+ int snd_card_locked(int card)
+ {
+--- a/sound/core/oss/mixer_oss.c
++++ b/sound/core/oss/mixer_oss.c
+@@ -1402,24 +1402,32 @@ static int snd_mixer_oss_notify_handler(
+
+ static int __init alsa_mixer_oss_init(void)
+ {
++ struct snd_card *card;
+ int idx;
+
+ snd_mixer_oss_notify_callback = snd_mixer_oss_notify_handler;
+ for (idx = 0; idx < SNDRV_CARDS; idx++) {
+- if (snd_cards[idx])
+- snd_mixer_oss_notify_handler(snd_cards[idx], SND_MIXER_OSS_NOTIFY_REGISTER);
++ card = snd_card_ref(idx);
++ if (card) {
++ snd_mixer_oss_notify_handler(card, SND_MIXER_OSS_NOTIFY_REGISTER);
++ snd_card_unref(card);
++ }
+ }
+ return 0;
+ }
+
+ static void __exit alsa_mixer_oss_exit(void)
+ {
++ struct snd_card *card;
+ int idx;
+
+ snd_mixer_oss_notify_callback = NULL;
+ for (idx = 0; idx < SNDRV_CARDS; idx++) {
+- if (snd_cards[idx])
+- snd_mixer_oss_notify_handler(snd_cards[idx], SND_MIXER_OSS_NOTIFY_FREE);
++ card = snd_card_ref(idx);
++ if (card) {
++ snd_mixer_oss_notify_handler(card, SND_MIXER_OSS_NOTIFY_FREE);
++ snd_card_unref(card);
++ }
+ }
+ }
+
+--- a/sound/core/sound.c
++++ b/sound/core/sound.c
+@@ -136,8 +136,11 @@ static struct snd_minor *autoload_device
+ if (dev == SNDRV_MINOR_CONTROL) {
+ /* /dev/aloadC? */
+ int card = SNDRV_MINOR_CARD(minor);
+- if (snd_cards[card] == NULL)
++ struct snd_card *ref = snd_card_ref(card);
++ if (!ref)
+ snd_request_card(card);
++ else
++ snd_card_unref(ref);
+ } else if (dev == SNDRV_MINOR_GLOBAL) {
+ /* /dev/aloadSEQ */
+ snd_request_other(minor);
+--- a/sound/last.c
++++ b/sound/last.c
+@@ -24,14 +24,18 @@
+
+ static int __init alsa_sound_last_init(void)
+ {
++ struct snd_card *card;
+ int idx, ok = 0;
+
+ printk(KERN_INFO "ALSA device list:\n");
+- for (idx = 0; idx < SNDRV_CARDS; idx++)
+- if (snd_cards[idx] != NULL) {
+- printk(KERN_INFO " #%i: %s\n", idx, snd_cards[idx]->longname);
++ for (idx = 0; idx < SNDRV_CARDS; idx++) {
++ card = snd_card_ref(idx);
++ if (card) {
++ printk(KERN_INFO " #%i: %s\n", idx, card->longname);
++ snd_card_unref(card);
+ ok++;
+ }
++ }
+ if (ok == 0)
+ printk(KERN_INFO " No soundcards found.\n");
+ return 0;
diff --git a/patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch b/patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch
new file mode 100644
index 0000000000..506e41c6fc
--- /dev/null
+++ b/patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch
@@ -0,0 +1,50 @@
+From c989954938761a2939a21fcbc768af182de6be58 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Apr 2019 18:01:46 +0200
+Subject: [PATCH] ALSA: emu10k1: Drop superfluous id-uniquification behavior
+Git-commit: c989954938761a2939a21fcbc768af182de6be58
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The emu10k1 driver tries to create a unique id string by itself when
+it's copied from the card list, but it's rather superfluous, as the
+same thing will be done in ALSA core side at the card registration.
+Let's drop the code. This allows us removing snd_cards export.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/emu10k1/emu10k1_main.c | 16 +---------------
+ 1 file changed, 1 insertion(+), 15 deletions(-)
+
+diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
+index 61f85ff91cd9..0419c75bdf5a 100644
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -1882,22 +1882,8 @@ int snd_emu10k1_create(struct snd_card *card,
+ c->name, pci->vendor, pci->device,
+ emu->serial);
+
+- if (!*card->id && c->id) {
+- int i, n = 0;
++ if (!*card->id && c->id)
+ strlcpy(card->id, c->id, sizeof(card->id));
+- for (;;) {
+- for (i = 0; i < snd_ecards_limit; i++) {
+- if (snd_cards[i] && !strcmp(snd_cards[i]->id, card->id))
+- break;
+- }
+- if (i >= snd_ecards_limit)
+- break;
+- n++;
+- if (n >= SNDRV_CARDS)
+- break;
+- snprintf(card->id, sizeof(card->id), "%s_%d", c->id, n);
+- }
+- }
+
+ is_audigy = emu->audigy = c->emu10k2_chip;
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch b/patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch
new file mode 100644
index 0000000000..73e136f881
--- /dev/null
+++ b/patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch
@@ -0,0 +1,64 @@
+From f495222e28275222ab6fd93813bd3d462e16d340 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 30 Apr 2019 12:18:28 +0200
+Subject: [PATCH] ALSA: hda - Register irq handler after the chip initialization
+Git-commit: f495222e28275222ab6fd93813bd3d462e16d340
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Currently the IRQ handler in HD-audio controller driver is registered
+before the chip initialization. That is, we have some window opened
+between the azx_acquire_irq() call and the CORB/RIRB setup. If an
+interrupt is triggered in this small window, the IRQ handler may
+access to the uninitialized RIRB buffer, which leads to a NULL
+dereference Oops.
+
+This is usually no big problem since most of Intel chips do register
+the IRQ via MSI, and we've already fixed the order of the IRQ
+enablement and the CORB/RIRB setup in the former commit b61749a89f82
+("sound: enable interrupt after dma buffer initialization"), hence the
+IRQ won't be triggered in that room. However, some platforms use a
+shared IRQ, and this may allow the IRQ trigger by another source.
+
+Another possibility is the kdump environment: a stale interrupt might
+be present in there, the IRQ handler can be falsely triggered as well.
+
+For covering this small race, let's move the azx_acquire_irq() call
+after hda_intel_init_chip() call. Although this is a bit radical
+change, it can cover more widely than checking the CORB/RIRB setup
+locally in the callee side.
+
+Reported-by: Liwei Song <liwei.song@windriver.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 2ec91085fa3e..789308f54785 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1788,9 +1788,6 @@ static int azx_first_init(struct azx *chip)
+ chip->msi = 0;
+ }
+
+- if (azx_acquire_irq(chip, 0) < 0)
+- return -EBUSY;
+-
+ pci_set_master(pci);
+ synchronize_irq(bus->irq);
+
+@@ -1904,6 +1901,9 @@ static int azx_first_init(struct azx *chip)
+ return -ENODEV;
+ }
+
++ if (azx_acquire_irq(chip, 0) < 0)
++ return -EBUSY;
++
+ strcpy(card->driver, "HDA-Intel");
+ strlcpy(card->shortname, driver_short_names[chip->driver_type],
+ sizeof(card->shortname));
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch b/patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch
new file mode 100644
index 0000000000..53a39fc7f4
--- /dev/null
+++ b/patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch
@@ -0,0 +1,61 @@
+From 7f641e26a6df9269cb25dd7a4b0a91d6586ed441 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 6 May 2019 22:09:32 +0800
+Subject: [PATCH] ALSA: hda/hdmi - Consider eld_valid when reporting jack event
+Git-commit: 7f641e26a6df9269cb25dd7a4b0a91d6586ed441
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+On the machines with AMD GPU or Nvidia GPU, we often meet this issue:
+after s3, there are 4 HDMI/DP audio devices in the gnome-sound-setting
+even there is no any monitors plugged.
+
+When this problem happens, we check the /proc/asound/cardX/eld#N.M, we
+will find the monitor_present=1, eld_valid=0.
+
+The root cause is BIOS or GPU driver makes the PRESENCE valid even no
+monitor plugged, and of course the driver will not get the valid
+eld_data subsequently.
+
+In this situation, we should not report the jack_plugged event, to do
+so, let us change the function hdmi_present_sense_via_verbs(). In this
+function, it reads the pin_sense via snd_hda_pin_sense(), after
+calling this function, the jack_dirty is 0, and before exiting
+via_verbs(), we change the shadow pin_sense according to both
+monitor_present and eld_valid, then in the snd_hda_jack_report_sync(),
+since the jack_dirty is still 0, it will report jack event according
+to this modified shadow pin_sense.
+
+After this change, the driver will not report Jack_is_plugged event
+through hdmi_present_sense_via_verbs() if monitor_present is 1 and
+eld_valid is 0.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_hdmi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 380001d6e797..0c61c05503f5 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1551,9 +1551,11 @@ static bool hdmi_present_sense_via_verbs(struct hdmi_spec_per_pin *per_pin,
+ ret = !repoll || !eld->monitor_present || eld->eld_valid;
+
+ jack = snd_hda_jack_tbl_get(codec, pin_nid);
+- if (jack)
++ if (jack) {
+ jack->block_report = !ret;
+-
++ jack->pin_sense = (eld->monitor_present && eld->eld_valid) ?
++ AC_PINSENSE_PRESENCE : 0;
++ }
+ mutex_unlock(&per_pin->lock);
+ return ret;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch b/patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch
new file mode 100644
index 0000000000..76fad87bac
--- /dev/null
+++ b/patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch
@@ -0,0 +1,48 @@
+From 8c2e6728c2bf95765b724e07d0278ae97cd1ee0d Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 6 May 2019 22:09:31 +0800
+Subject: [PATCH] ALSA: hda/hdmi - Read the pin sense from register when repolling
+Git-commit: 8c2e6728c2bf95765b724e07d0278ae97cd1ee0d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The driver will check the monitor presence when resuming from suspend,
+starting poll or interrupt triggers. In these 3 situations, the
+jack_dirty will be set to 1 first, then the hda_jack.c reads the
+pin_sense from register, after reading the register, the jack_dirty
+will be set to 0. But hdmi_repoll_work() is enabled in these 3
+situations, It will read the pin_sense a couple of times subsequently,
+since the jack_dirty is 0 now, It does not read the register anymore,
+instead it uses the shadow pin_sense which is read at the first time.
+
+It is meaningless to check the shadow pin_sense a couple of times,
+we need to read the register to check the real plugging state, so
+we set the jack_dirty to 1 in the hdmi_repoll_work().
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_hdmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 8b3ac690efa3..380001d6e797 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1663,6 +1663,11 @@ static void hdmi_repoll_eld(struct work_struct *work)
+ container_of(to_delayed_work(work), struct hdmi_spec_per_pin, work);
+ struct hda_codec *codec = per_pin->codec;
+ struct hdmi_spec *spec = codec->spec;
++ struct hda_jack_tbl *jack;
++
++ jack = snd_hda_jack_tbl_get(codec, per_pin->pin_nid);
++ if (jack)
++ jack->jack_dirty = 1;
+
+ if (per_pin->repoll_count++ > 6)
+ per_pin->repoll_count = 0;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch b/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch
index 5cab8e57c9..605e0fc1fe 100644
--- a/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch
+++ b/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch
@@ -4,8 +4,7 @@ Date: Tue, 2 Apr 2019 15:52:04 +0200
Subject: [PATCH] ALSA: hda/realtek - Add quirk for Tuxedo XC 1509
References: bsc#1131442
Git-commit: 80690a276f444a68a332136d98bfea1c338bc263
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v5.1-rc5
This adds a SND_PCI_QUIRK(...) line for the Tuxedo XC 1509.
diff --git a/patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch b/patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch
new file mode 100644
index 0000000000..6d185debc3
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch
@@ -0,0 +1,43 @@
+From 607ca3bd220f4022e6f5356026b19dafc363863a Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Fri, 26 Apr 2019 16:35:41 +0800
+Subject: [PATCH] ALSA: hda/realtek - EAPD turn on later
+Git-commit: 607ca3bd220f4022e6f5356026b19dafc363863a
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Let EAPD turn on after set pin output.
+
+[ NOTE: This change is supposed to reduce the possible click noises at
+ (runtime) PM resume. The functionality should be same (i.e. the
+ verbs are executed correctly) no matter which order is, so this
+ should be safe to apply for all codecs -- tiwai ]
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 810479766090..674ddff65bef 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -803,11 +803,10 @@ static int alc_init(struct hda_codec *codec)
+ if (spec->init_hook)
+ spec->init_hook(codec);
+
++ snd_hda_gen_init(codec);
+ alc_fix_pll(codec);
+ alc_auto_init_amp(codec, spec->init_amp);
+
+- snd_hda_gen_init(codec);
+-
+ snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT);
+
+ return 0;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch b/patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch
new file mode 100644
index 0000000000..ba0da7343e
--- /dev/null
+++ b/patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch
@@ -0,0 +1,39 @@
+From 80a5052db75131423b67f38b21958555d7d970e4 Mon Sep 17 00:00:00 2001
+From: Jeremy Soller <jeremy@system76.com>
+Date: Tue, 7 May 2019 17:11:08 -0400
+Subject: [PATCH] ALSA: hdea/realtek - Headset fixup for System76 Gazelle (gaze14)
+Git-commit: 80a5052db75131423b67f38b21958555d7d970e4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+On the System76 Gazelle (gaze14), there is a headset microphone input
+attached to 0x1a that does not have a jack detect. In order to get it
+working, the pin configuration needs to be set correctly, and the
+ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC fixup needs to be applied. This is
+identical to the patch already applied for the System76 Darter Pro
+(darp5).
+
+Signed-off-by: Jeremy Soller <jeremy@system76.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index e733d323f1a7..dacccacb5fe0 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6948,6 +6948,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8550, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8560, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-line6-Avoid-polluting-led_-namespace.patch b/patches.drivers/ALSA-line6-Avoid-polluting-led_-namespace.patch
new file mode 100644
index 0000000000..d43a6ec94d
--- /dev/null
+++ b/patches.drivers/ALSA-line6-Avoid-polluting-led_-namespace.patch
@@ -0,0 +1,56 @@
+From 05b8ccfba5d4621072e541603b0f0a14c2203ca8 Mon Sep 17 00:00:00 2001
+From: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Date: Sat, 6 Apr 2019 19:04:44 +0200
+Subject: [PATCH] ALSA: line6: Avoid polluting led_* namespace
+Git-commit: 05b8ccfba5d4621072e541603b0f0a14c2203ca8
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+led_colors clashes with the array of the same name being added
+to the LED class. Do the following amendments to fix this issue
+and the other prospective one.
+
+led_colors -> toneport_led_colors
+led_init_vals -> toneport_led_init_vals
+
+Fixes: f44edd7b2bbed ("ALSA: line6/toneport: Implement LED controls via LED class")
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/line6/toneport.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c
+index f47ba94e6f4a..56875526b182 100644
+--- a/sound/usb/line6/toneport.c
++++ b/sound/usb/line6/toneport.c
+@@ -291,8 +291,8 @@ static bool toneport_has_led(struct usb_line6_toneport *toneport)
+ }
+ }
+
+-static const char * const led_colors[2] = { "red", "green" };
+-static const int led_init_vals[2] = { 0x00, 0x26 };
++static const char * const toneport_led_colors[2] = { "red", "green" };
++static const int toneport_led_init_vals[2] = { 0x00, 0x26 };
+
+ static void toneport_update_led(struct usb_line6_toneport *toneport)
+ {
+@@ -320,9 +320,9 @@ static int toneport_init_leds(struct usb_line6_toneport *toneport)
+
+ led->toneport = toneport;
+ snprintf(led->name, sizeof(led->name), "%s::%s",
+- dev_name(dev), led_colors[i]);
++ dev_name(dev), toneport_led_colors[i]);
+ leddev->name = led->name;
+- leddev->brightness = led_init_vals[i];
++ leddev->brightness = toneport_led_init_vals[i];
+ leddev->max_brightness = 0x26;
+ leddev->brightness_set = toneport_led_brightness_set;
+ err = led_classdev_register(dev, leddev);
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch b/patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch
new file mode 100644
index 0000000000..50c6da90b1
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch
@@ -0,0 +1,64 @@
+From 4b24b960b10b6a4e30beba3ce097fa867b4a085f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 15:55:08 +0100
+Subject: [PATCH] ALSA: seq: Align temporary re-locking with irqsave version
+Git-commit: 4b24b960b10b6a4e30beba3ce097fa867b4a085f
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In a few places in sequencer core, we temporarily unlock / re-lock the
+pool spin lock while waiting for the allocation in the blocking mode.
+There spin_unlock_irq() / spin_lock_irq() pairs are called while
+initially spin_lock_irqsave() is used (and spin_lock_irqrestore() at
+the end of the function again). This is likely OK for now, but it's a
+bit confusing and error-prone.
+
+This patch replaces these temporary relocking lines with the irqsave
+variant to make the lock/unlock sequence more consistently.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_fifo.c | 4 ++--
+ sound/core/seq/seq_memory.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index 72c0302a55d2..613ae10d33b8 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -195,9 +195,9 @@ int snd_seq_fifo_cell_out(struct snd_seq_fifo *f,
+ }
+ set_current_state(TASK_INTERRUPTIBLE);
+ add_wait_queue(&f->input_sleep, &wait);
+- spin_unlock_irq(&f->lock);
++ spin_unlock_irqrestore(&f->lock, flags);
+ schedule();
+- spin_lock_irq(&f->lock);
++ spin_lock_irqsave(&f->lock, flags);
+ remove_wait_queue(&f->input_sleep, &wait);
+ if (signal_pending(current)) {
+ spin_unlock_irqrestore(&f->lock, flags);
+diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
+index 6ea4d8a5a71e..ae0b8971f6ce 100644
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -244,13 +244,13 @@ static int snd_seq_cell_alloc(struct snd_seq_pool *pool,
+
+ set_current_state(TASK_INTERRUPTIBLE);
+ add_wait_queue(&pool->output_sleep, &wait);
+- spin_unlock_irq(&pool->lock);
++ spin_unlock_irqrestore(&pool->lock, flags);
+ if (mutexp)
+ mutex_unlock(mutexp);
+ schedule();
+ if (mutexp)
+ mutex_lock(mutexp);
+- spin_lock_irq(&pool->lock);
++ spin_lock_irqsave(&pool->lock, flags);
+ remove_wait_queue(&pool->output_sleep, &wait);
+ /* interrupted? */
+ if (signal_pending(current)) {
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch b/patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch
new file mode 100644
index 0000000000..308af2814c
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch
@@ -0,0 +1,50 @@
+From b5fd12d6c0fc64c2c2b5ae095e63824083d27151 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 15 Apr 2019 09:03:01 +0200
+Subject: [PATCH] ALSA: seq: Correct unlock sequence at snd_seq_client_ioctl_unlock()
+Git-commit: b5fd12d6c0fc64c2c2b5ae095e63824083d27151
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The doubly unlock sequence at snd_seq_client_ioctl_unlock() is tricky.
+I took a direct unref call since I thought it would avoid
+misunderstanding, but rather this seems more confusing. Let's use
+snd_seq_client_unlock() consistently even if they look strange to be
+called twice, and add more comments for avoiding reader's confusion.
+
+Fixes: 6b580f523172 ("ALSA: seq: Protect racy pool manipulation from OSS sequencer")
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 3acd80e718f2..c0227a672442 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -191,6 +191,7 @@ bool snd_seq_client_ioctl_lock(int clientid)
+ if (!client)
+ return false;
+ mutex_lock(&client->ioctl_mutex);
++ /* The client isn't unrefed here; see snd_seq_client_ioctl_unlock() */
+ return true;
+ }
+ EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_lock);
+@@ -204,7 +205,11 @@ void snd_seq_client_ioctl_unlock(int clientid)
+ if (WARN_ON(!client))
+ return;
+ mutex_unlock(&client->ioctl_mutex);
+- snd_use_lock_free(&client->use_lock);
++ /* The doubly unrefs below are intentional; the first one releases the
++ * leftover from snd_seq_client_ioctl_lock() above, and the second one
++ * is for releasing snd_seq_client_use_ptr() in this function
++ */
++ snd_seq_client_unlock(client);
+ snd_seq_client_unlock(client);
+ }
+ EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_unlock);
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch b/patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch
new file mode 100644
index 0000000000..19f83f1555
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch
@@ -0,0 +1,40 @@
+From 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 12 Apr 2019 11:37:19 +0200
+Subject: [PATCH] ALSA: seq: Cover unsubscribe_port() in list_mutex
+Git-commit: 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The call of unsubscribe_port() which manages the group count and
+module refcount from delete_and_unsubscribe_port() looks racy; it's
+not covered by the group list lock, and it's likely a cause of the
+reported unbalance at port deletion. Let's move the call inside the
+group list_mutex to plug the hole.
+
+Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_ports.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index d964d728681e..ac7556ab531c 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -547,10 +547,10 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
+ list_del_init(list);
+ grp->exclusive = 0;
+ write_unlock_irq(&grp->list_lock);
+- up_write(&grp->list_mutex);
+
+ if (!empty)
+ unsubscribe_port(client, port, grp, &subs->info, ack);
++ up_write(&grp->list_mutex);
+ }
+
+ /* connect two ports */
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch b/patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch
new file mode 100644
index 0000000000..9c7cc9bf17
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch
@@ -0,0 +1,103 @@
+From 2eabc5ec8ab4d4748a82050dfcb994119b983750 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 9 Apr 2019 18:04:17 +0200
+Subject: [PATCH] ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
+Git-commit: 2eabc5ec8ab4d4748a82050dfcb994119b983750
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The snd_seq_ioctl_get_subscription() retrieves the port subscriber
+information as a pointer, while the object isn't protected, hence it
+may be deleted before the actual reference. This race was spotted by
+syzkaller and may lead to a UAF.
+
+The fix is simply copying the data in the lookup function that
+performs in the rwsem to protect against the deletion.
+
+Reported-by: syzbot+9437020c82413d00222d@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 10 ++--------
+ sound/core/seq/seq_ports.c | 13 ++++++++-----
+ sound/core/seq/seq_ports.h | 5 +++--
+ 3 files changed, 13 insertions(+), 15 deletions(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 976404691261..f256704dc401 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1897,20 +1897,14 @@ static int snd_seq_ioctl_get_subscription(struct snd_seq_client *client,
+ int result;
+ struct snd_seq_client *sender = NULL;
+ struct snd_seq_client_port *sport = NULL;
+- struct snd_seq_subscribers *p;
+
+ result = -EINVAL;
+ if ((sender = snd_seq_client_use_ptr(subs->sender.client)) == NULL)
+ goto __end;
+ if ((sport = snd_seq_port_use_ptr(sender, subs->sender.port)) == NULL)
+ goto __end;
+- p = snd_seq_port_get_subscription(&sport->c_src, &subs->dest);
+- if (p) {
+- result = 0;
+- *subs = p->info;
+- } else
+- result = -ENOENT;
+-
++ result = snd_seq_port_get_subscription(&sport->c_src, &subs->dest,
++ subs);
+ __end:
+ if (sport)
+ snd_seq_port_unlock(sport);
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index 1e2239240f21..d964d728681e 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -632,20 +632,23 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector,
+
+
+ /* get matched subscriber */
+-struct snd_seq_subscribers *snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
+- struct snd_seq_addr *dest_addr)
++int snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
++ struct snd_seq_addr *dest_addr,
++ struct snd_seq_port_subscribe *subs)
+ {
+- struct snd_seq_subscribers *s, *found = NULL;
++ struct snd_seq_subscribers *s;
++ int err = -ENOENT;
+
+ down_read(&src_grp->list_mutex);
+ list_for_each_entry(s, &src_grp->list_head, src_list) {
+ if (addr_match(dest_addr, &s->info.dest)) {
+- found = s;
++ *subs = s->info;
++ err = 0;
+ break;
+ }
+ }
+ up_read(&src_grp->list_mutex);
+- return found;
++ return err;
+ }
+
+ /*
+diff --git a/sound/core/seq/seq_ports.h b/sound/core/seq/seq_ports.h
+index 26bd71f36c41..06003b36652e 100644
+--- a/sound/core/seq/seq_ports.h
++++ b/sound/core/seq/seq_ports.h
+@@ -135,7 +135,8 @@ int snd_seq_port_subscribe(struct snd_seq_client_port *port,
+ struct snd_seq_port_subscribe *info);
+
+ /* get matched subscriber */
+-struct snd_seq_subscribers *snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
+- struct snd_seq_addr *dest_addr);
++int snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
++ struct snd_seq_addr *dest_addr,
++ struct snd_seq_port_subscribe *subs);
+
+ #endif
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch b/patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch
new file mode 100644
index 0000000000..47ed8949b1
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch
@@ -0,0 +1,54 @@
+From feb689025fbb6f0aa6297d3ddf97de945ea4ad32 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 9 Apr 2019 17:35:22 +0200
+Subject: [PATCH] ALSA: seq: Protect in-kernel ioctl calls with mutex
+Git-commit: feb689025fbb6f0aa6297d3ddf97de945ea4ad32
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+ALSA OSS sequencer calls the ioctl function indirectly via
+snd_seq_kernel_client_ctl(). While we already applied the protection
+against races between the normal ioctls and writes via the client's
+ioctl_mutex, this code path was left untouched. And this seems to be
+the cause of still remaining some rare UAF as spontaneously triggered
+by syzkaller.
+
+For the sake of robustness, wrap the ioctl_mutex also for the call via
+snd_seq_kernel_client_ctl(), too.
+
+Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 933bde3843d9..976404691261 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2340,14 +2340,19 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
+ {
+ const struct ioctl_handler *handler;
+ struct snd_seq_client *client;
++ int err;
+
+ client = clientptr(clientid);
+ if (client == NULL)
+ return -ENXIO;
+
+ for (handler = ioctl_handlers; handler->cmd > 0; ++handler) {
+- if (handler->cmd == cmd)
+- return handler->func(client, arg);
++ if (handler->cmd == cmd) {
++ mutex_lock(&client->ioctl_mutex);
++ err = handler->func(client, arg);
++ mutex_unlock(&client->ioctl_mutex);
++ return err;
++ }
+ }
+
+ pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n",
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch b/patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch
new file mode 100644
index 0000000000..2c9eaf349b
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch
@@ -0,0 +1,132 @@
+From 6b580f523172f2c738b661069a57c23c74a75f88 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 12 Apr 2019 12:44:39 +0200
+Subject: [PATCH] ALSA: seq: Protect racy pool manipulation from OSS sequencer
+Git-commit: 6b580f523172f2c738b661069a57c23c74a75f88
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+OSS sequencer emulation still allows to queue and issue the events
+that manipulate the client pool concurrently in a racy way. This
+patch serializes the access like the normal sequencer write / ioctl
+via taking the client ioctl_mutex. Since the access to the sequencer
+client is done indirectly via a client id number, a new helper to
+take/release the mutex is introduced.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/oss/seq_oss_device.h | 10 ++++++++--
+ sound/core/seq/seq_clientmgr.c | 40 ++++++++++++++++++++++++++++++++++---
+ sound/core/seq/seq_clientmgr.h | 4 ++++
+ 3 files changed, 49 insertions(+), 5 deletions(-)
+
+diff --git a/sound/core/seq/oss/seq_oss_device.h b/sound/core/seq/oss/seq_oss_device.h
+index 2d0e9eaf13aa..77eb1fe1155c 100644
+--- a/sound/core/seq/oss/seq_oss_device.h
++++ b/sound/core/seq/oss/seq_oss_device.h
+@@ -30,6 +30,7 @@
+ #include <sound/rawmidi.h>
+ #include <sound/seq_kernel.h>
+ #include <sound/info.h>
++#include "../seq_clientmgr.h"
+
+ /* max. applications */
+ #define SNDRV_SEQ_OSS_MAX_CLIENTS 16
+@@ -150,11 +151,16 @@ snd_seq_oss_dispatch(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, int a
+ return snd_seq_kernel_client_dispatch(dp->cseq, ev, atomic, hop);
+ }
+
+-/* ioctl */
++/* ioctl for writeq */
+ static inline int
+ snd_seq_oss_control(struct seq_oss_devinfo *dp, unsigned int type, void *arg)
+ {
+- return snd_seq_kernel_client_ctl(dp->cseq, type, arg);
++ int err;
++
++ snd_seq_client_ioctl_lock(dp->cseq);
++ err = snd_seq_kernel_client_ctl(dp->cseq, type, arg);
++ snd_seq_client_ioctl_unlock(dp->cseq);
++ return err;
+ }
+
+ /* fill the addresses in header */
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 0af5b1440b33..a5c9d59eb5b8 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -179,6 +179,36 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid)
+ return client;
+ }
+
++/* Take refcount and perform ioctl_mutex lock on the given client;
++ * used only for OSS sequencer
++ * Unlock via snd_seq_client_ioctl_unlock() below
++ */
++bool snd_seq_client_ioctl_lock(int clientid)
++{
++ struct snd_seq_client *client;
++
++ client = snd_seq_client_use_ptr(clientid);
++ if (!client)
++ return false;
++ mutex_lock(&client->ioctl_mutex);
++ return true;
++}
++EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_lock);
++
++/* Unlock and unref the given client; for OSS sequencer use only */
++void snd_seq_client_ioctl_unlock(int clientid)
++{
++ struct snd_seq_client *client;
++
++ client = snd_seq_client_use_ptr(clientid);
++ if (WARN_ON(!client))
++ return;
++ mutex_unlock(&client->ioctl_mutex);
++ snd_use_lock_free(&client->use_lock);
++ snd_seq_client_unlock(client);
++}
++EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_unlock);
++
+ static void usage_alloc(struct snd_seq_usage *res, int num)
+ {
+ res->cur += num;
+@@ -2247,11 +2277,15 @@ int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
+ if (cptr == NULL)
+ return -EINVAL;
+
+- if (! cptr->accept_output)
++ if (!cptr->accept_output) {
+ result = -EPERM;
+- else /* send it */
++ } else { /* send it */
++ mutex_lock(&cptr->ioctl_mutex);
+ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking,
+- false, 0, NULL);
++ false, 0,
++ &cptr->ioctl_mutex);
++ mutex_unlock(&cptr->ioctl_mutex);
++ }
+
+ snd_seq_client_unlock(cptr);
+ return result;
+diff --git a/sound/core/seq/seq_clientmgr.h b/sound/core/seq/seq_clientmgr.h
+index 66ad3d547916..28a51dcc0190 100644
+--- a/sound/core/seq/seq_clientmgr.h
++++ b/sound/core/seq/seq_clientmgr.h
+@@ -97,6 +97,10 @@ int snd_seq_kernel_client_write_poll(int clientid, struct file *file, poll_table
+ int snd_seq_client_notify_subscription(int client, int port,
+ struct snd_seq_port_subscribe *info, int evtype);
+
++/* only for OSS sequencer */
++bool snd_seq_client_ioctl_lock(int clientid);
++void snd_seq_client_ioctl_unlock(int clientid);
++
+ extern int seq_client_load[15];
+
+ #endif
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch b/patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch
new file mode 100644
index 0000000000..f0ff02fb78
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch
@@ -0,0 +1,277 @@
+From f823b8a75527dca0b93cf577bbabbe47fd79b2a8 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 16:21:01 +0100
+Subject: [PATCH] ALSA: seq: Remove superfluous irqsave flags
+Git-commit: f823b8a75527dca0b93cf577bbabbe47fd79b2a8
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+spin_lock_irqsave() is used unnecessarily in various places in
+sequencer core code although it's pretty obvious that the context is
+sleepable. Remove irqsave and use the plain spin_lock_irq() in such
+places for simplicity.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 19 ++++++++-----------
+ sound/core/seq/seq_fifo.c | 10 ++++------
+ sound/core/seq/seq_memory.c | 16 +++++++---------
+ sound/core/seq/seq_ports.c | 15 ++++++---------
+ 4 files changed, 25 insertions(+), 35 deletions(-)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -203,7 +203,6 @@ int __init client_init_data(void)
+
+ static struct snd_seq_client *seq_create_client1(int client_index, int poolsize)
+ {
+- unsigned long flags;
+ int c;
+ struct snd_seq_client *client;
+
+@@ -224,7 +223,7 @@ static struct snd_seq_client *seq_create
+ mutex_init(&client->ioctl_mutex);
+
+ /* find free slot in the client table */
+- spin_lock_irqsave(&clients_lock, flags);
++ spin_lock_irq(&clients_lock);
+ if (client_index < 0) {
+ for (c = SNDRV_SEQ_DYNAMIC_CLIENTS_BEGIN;
+ c < SNDRV_SEQ_MAX_CLIENTS;
+@@ -232,17 +231,17 @@ static struct snd_seq_client *seq_create
+ if (clienttab[c] || clienttablock[c])
+ continue;
+ clienttab[client->number = c] = client;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ return client;
+ }
+ } else {
+ if (clienttab[client_index] == NULL && !clienttablock[client_index]) {
+ clienttab[client->number = client_index] = client;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ return client;
+ }
+ }
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ snd_seq_pool_delete(&client->pool);
+ kfree(client);
+ return NULL; /* no free slot found or busy, return failure code */
+@@ -251,23 +250,21 @@ static struct snd_seq_client *seq_create
+
+ static int seq_free_client1(struct snd_seq_client *client)
+ {
+- unsigned long flags;
+-
+ if (!client)
+ return 0;
+- spin_lock_irqsave(&clients_lock, flags);
++ spin_lock_irq(&clients_lock);
+ clienttablock[client->number] = 1;
+ clienttab[client->number] = NULL;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ snd_seq_delete_all_ports(client);
+ snd_seq_queue_client_leave(client->number);
+ snd_use_lock_sync(&client->use_lock);
+ snd_seq_queue_client_termination(client->number);
+ if (client->pool)
+ snd_seq_pool_delete(&client->pool);
+- spin_lock_irqsave(&clients_lock, flags);
++ spin_lock_irq(&clients_lock);
+ clienttablock[client->number] = 0;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ return 0;
+ }
+
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -98,18 +98,17 @@ static struct snd_seq_event_cell *fifo_c
+ void snd_seq_fifo_clear(struct snd_seq_fifo *f)
+ {
+ struct snd_seq_event_cell *cell;
+- unsigned long flags;
+
+ /* clear overflow flag */
+ atomic_set(&f->overflow, 0);
+
+ snd_use_lock_sync(&f->use_lock);
+- spin_lock_irqsave(&f->lock, flags);
++ spin_lock_irq(&f->lock);
+ /* drain the fifo */
+ while ((cell = fifo_cell_out(f)) != NULL) {
+ snd_seq_cell_free(cell);
+ }
+- spin_unlock_irqrestore(&f->lock, flags);
++ spin_unlock_irq(&f->lock);
+ }
+
+
+@@ -239,7 +238,6 @@ int snd_seq_fifo_poll_wait(struct snd_se
+ /* change the size of pool; all old events are removed */
+ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize)
+ {
+- unsigned long flags;
+ struct snd_seq_pool *newpool, *oldpool;
+ struct snd_seq_event_cell *cell, *next, *oldhead;
+
+@@ -255,7 +253,7 @@ int snd_seq_fifo_resize(struct snd_seq_f
+ return -ENOMEM;
+ }
+
+- spin_lock_irqsave(&f->lock, flags);
++ spin_lock_irq(&f->lock);
+ /* remember old pool */
+ oldpool = f->pool;
+ oldhead = f->head;
+@@ -265,7 +263,7 @@ int snd_seq_fifo_resize(struct snd_seq_f
+ f->tail = NULL;
+ f->cells = 0;
+ /* NOTE: overflow flag is not cleared */
+- spin_unlock_irqrestore(&f->lock, flags);
++ spin_unlock_irq(&f->lock);
+
+ /* close the old pool and wait until all users are gone */
+ snd_seq_pool_mark_closing(oldpool);
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -386,7 +386,6 @@ int snd_seq_pool_init(struct snd_seq_poo
+ {
+ int cell;
+ struct snd_seq_event_cell *cellptr;
+- unsigned long flags;
+
+ if (snd_BUG_ON(!pool))
+ return -EINVAL;
+@@ -396,9 +395,9 @@ int snd_seq_pool_init(struct snd_seq_poo
+ return -ENOMEM;
+
+ /* add new cells to the free cell list */
+- spin_lock_irqsave(&pool->lock, flags);
++ spin_lock_irq(&pool->lock);
+ if (pool->ptr) {
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+ vfree(cellptr);
+ return 0;
+ }
+@@ -417,7 +416,7 @@ int snd_seq_pool_init(struct snd_seq_poo
+ /* init statistics */
+ pool->max_used = 0;
+ pool->total_elements = pool->size;
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+ return 0;
+ }
+
+@@ -436,7 +435,6 @@ void snd_seq_pool_mark_closing(struct sn
+ /* remove events */
+ int snd_seq_pool_done(struct snd_seq_pool *pool)
+ {
+- unsigned long flags;
+ struct snd_seq_event_cell *ptr;
+
+ if (snd_BUG_ON(!pool))
+@@ -450,18 +448,18 @@ int snd_seq_pool_done(struct snd_seq_poo
+ schedule_timeout_uninterruptible(1);
+
+ /* release all resources */
+- spin_lock_irqsave(&pool->lock, flags);
++ spin_lock_irq(&pool->lock);
+ ptr = pool->ptr;
+ pool->ptr = NULL;
+ pool->free = NULL;
+ pool->total_elements = 0;
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+
+ vfree(ptr);
+
+- spin_lock_irqsave(&pool->lock, flags);
++ spin_lock_irq(&pool->lock);
+ pool->closing = 0;
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+
+ return 0;
+ }
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -128,7 +128,6 @@ static void port_subs_info_init(struct s
+ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
+ int port)
+ {
+- unsigned long flags;
+ struct snd_seq_client_port *new_port, *p;
+ int num = -1;
+
+@@ -157,7 +156,7 @@ struct snd_seq_client_port *snd_seq_crea
+
+ num = port >= 0 ? port : 0;
+ mutex_lock(&client->ports_mutex);
+- write_lock_irqsave(&client->ports_lock, flags);
++ write_lock_irq(&client->ports_lock);
+ list_for_each_entry(p, &client->ports_list_head, list) {
+ if (p->addr.port > num)
+ break;
+@@ -169,7 +168,7 @@ struct snd_seq_client_port *snd_seq_crea
+ client->num_ports++;
+ new_port->addr.port = num; /* store the port number in the port */
+ sprintf(new_port->name, "port-%d", num);
+- write_unlock_irqrestore(&client->ports_lock, flags);
++ write_unlock_irq(&client->ports_lock);
+ mutex_unlock(&client->ports_mutex);
+
+ return new_port;
+@@ -283,11 +282,10 @@ static int port_delete(struct snd_seq_cl
+ /* delete a port with the given port id */
+ int snd_seq_delete_port(struct snd_seq_client *client, int port)
+ {
+- unsigned long flags;
+ struct snd_seq_client_port *found = NULL, *p;
+
+ mutex_lock(&client->ports_mutex);
+- write_lock_irqsave(&client->ports_lock, flags);
++ write_lock_irq(&client->ports_lock);
+ list_for_each_entry(p, &client->ports_list_head, list) {
+ if (p->addr.port == port) {
+ /* ok found. delete from the list at first */
+@@ -297,7 +295,7 @@ int snd_seq_delete_port(struct snd_seq_c
+ break;
+ }
+ }
+- write_unlock_irqrestore(&client->ports_lock, flags);
++ write_unlock_irq(&client->ports_lock);
+ mutex_unlock(&client->ports_mutex);
+ if (found)
+ return port_delete(client, found);
+@@ -308,7 +306,6 @@ int snd_seq_delete_port(struct snd_seq_c
+ /* delete the all ports belonging to the given client */
+ int snd_seq_delete_all_ports(struct snd_seq_client *client)
+ {
+- unsigned long flags;
+ struct list_head deleted_list;
+ struct snd_seq_client_port *port, *tmp;
+
+@@ -316,7 +313,7 @@ int snd_seq_delete_all_ports(struct snd_
+ * clear the port list in the client data.
+ */
+ mutex_lock(&client->ports_mutex);
+- write_lock_irqsave(&client->ports_lock, flags);
++ write_lock_irq(&client->ports_lock);
+ if (! list_empty(&client->ports_list_head)) {
+ list_add(&deleted_list, &client->ports_list_head);
+ list_del_init(&client->ports_list_head);
+@@ -324,7 +321,7 @@ int snd_seq_delete_all_ports(struct snd_
+ INIT_LIST_HEAD(&deleted_list);
+ }
+ client->num_ports = 0;
+- write_unlock_irqrestore(&client->ports_lock, flags);
++ write_unlock_irq(&client->ports_lock);
+
+ /* remove each port in deleted_list */
+ list_for_each_entry_safe(port, tmp, &deleted_list, list) {
diff --git a/patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch b/patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch
new file mode 100644
index 0000000000..3d3c8e5cb0
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch
@@ -0,0 +1,143 @@
+From 6740ea6776e97274627e3c261469d1c4ba0a0cb5 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 12 Apr 2019 12:10:14 +0200
+Subject: [PATCH] ALSA: seq: Simplify snd_seq_kernel_client_enqueue() helper
+Git-commit: 6740ea6776e97274627e3c261469d1c4ba0a0cb5
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We have two helpers for queuing a sequencer event from the kernel
+client, and both are used only from OSS sequencer layer without any
+hop and atomic set. Let's simplify and unify two helpers into one.
+
+No functional change, just a call pattern change.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/seq_kernel.h | 3 +-
+ sound/core/seq/oss/seq_oss_rw.c | 11 +++-------
+ sound/core/seq/oss/seq_oss_writeq.c | 2 -
+ sound/core/seq/seq_clientmgr.c | 39 ++++++------------------------------
+ sound/core/seq/seq_clientmgr.h | 4 ---
+ 5 files changed, 14 insertions(+), 45 deletions(-)
+
+--- a/include/sound/seq_kernel.h
++++ b/include/sound/seq_kernel.h
+@@ -73,7 +73,8 @@ __printf(3, 4)
+ int snd_seq_create_kernel_client(struct snd_card *card, int client_index,
+ const char *name_fmt, ...);
+ int snd_seq_delete_kernel_client(int client);
+-int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev, int atomic, int hop);
++int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
++ struct file *file, bool blocking);
+ int snd_seq_kernel_client_dispatch(int client, struct snd_seq_event *ev, int atomic, int hop);
+ int snd_seq_kernel_client_ctl(int client, unsigned int cmd, void *arg);
+
+--- a/sound/core/seq/oss/seq_oss_rw.c
++++ b/sound/core/seq/oss/seq_oss_rw.c
+@@ -180,14 +180,11 @@ insert_queue(struct seq_oss_devinfo *dp,
+ return 0; /* invalid event - no need to insert queue */
+
+ event.time.tick = snd_seq_oss_timer_cur_tick(dp->timer);
+- if (dp->timer->realtime || !dp->timer->running) {
++ if (dp->timer->realtime || !dp->timer->running)
+ snd_seq_oss_dispatch(dp, &event, 0, 0);
+- } else {
+- if (is_nonblock_mode(dp->file_mode))
+- rc = snd_seq_kernel_client_enqueue(dp->cseq, &event, 0, 0);
+- else
+- rc = snd_seq_kernel_client_enqueue_blocking(dp->cseq, &event, opt, 0, 0);
+- }
++ else
++ rc = snd_seq_kernel_client_enqueue(dp->cseq, &event, opt,
++ !is_nonblock_mode(dp->file_mode));
+ return rc;
+ }
+
+--- a/sound/core/seq/oss/seq_oss_writeq.c
++++ b/sound/core/seq/oss/seq_oss_writeq.c
+@@ -116,7 +116,7 @@ snd_seq_oss_writeq_sync(struct seq_oss_w
+ rec->t.code = SEQ_SYNCTIMER;
+ rec->t.time = time;
+ q->sync_event_put = 1;
+- snd_seq_kernel_client_enqueue_blocking(dp->cseq, &ev, NULL, 0, 0);
++ snd_seq_kernel_client_enqueue(dp->cseq, &ev, NULL, true);
+ }
+
+ wait_event_interruptible_timeout(q->sync_sleep, ! q->sync_event_put, HZ);
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2225,12 +2225,13 @@ int snd_seq_delete_kernel_client(int cli
+
+ EXPORT_SYMBOL(snd_seq_delete_kernel_client);
+
+-/* skeleton to enqueue event, called from snd_seq_kernel_client_enqueue
+- * and snd_seq_kernel_client_enqueue_blocking
++/*
++ * exported, called by kernel clients to enqueue events (w/o blocking)
++ *
++ * RETURN VALUE: zero if succeed, negative if error
+ */
+-static int kernel_client_enqueue(int client, struct snd_seq_event *ev,
+- struct file *file, int blocking,
+- int atomic, int hop)
++int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
++ struct file *file, bool blocking)
+ {
+ struct snd_seq_client *cptr;
+ int result;
+@@ -2257,39 +2258,13 @@ static int kernel_client_enqueue(int cli
+ result = -EPERM;
+ else /* send it */
+ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking,
+- atomic, hop, NULL);
++ false, 0, NULL);
+
+ snd_seq_client_unlock(cptr);
+ return result;
+ }
+-
+-/*
+- * exported, called by kernel clients to enqueue events (w/o blocking)
+- *
+- * RETURN VALUE: zero if succeed, negative if error
+- */
+-int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event * ev,
+- int atomic, int hop)
+-{
+- return kernel_client_enqueue(client, ev, NULL, 0, atomic, hop);
+-}
+-
+ EXPORT_SYMBOL(snd_seq_kernel_client_enqueue);
+
+-/*
+- * exported, called by kernel clients to enqueue events (with blocking)
+- *
+- * RETURN VALUE: zero if succeed, negative if error
+- */
+-int snd_seq_kernel_client_enqueue_blocking(int client, struct snd_seq_event * ev,
+- struct file *file,
+- int atomic, int hop)
+-{
+- return kernel_client_enqueue(client, ev, file, 1, atomic, hop);
+-}
+-
+-EXPORT_SYMBOL(snd_seq_kernel_client_enqueue_blocking);
+-
+ /*
+ * exported, called by kernel clients to dispatch events directly to other
+ * clients, bypassing the queues. Event time-stamp will be updated.
+--- a/sound/core/seq/seq_clientmgr.h
++++ b/sound/core/seq/seq_clientmgr.h
+@@ -93,10 +93,6 @@ struct snd_seq_client *snd_seq_client_us
+ /* dispatch event to client(s) */
+ int snd_seq_dispatch_event(struct snd_seq_event_cell *cell, int atomic, int hop);
+
+-/* exported to other modules */
+-int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev, int atomic, int hop);
+-int snd_seq_kernel_client_enqueue_blocking(int client, struct snd_seq_event * ev,
+- struct file *file, int atomic, int hop);
+ int snd_seq_kernel_client_write_poll(int clientid, struct file *file, poll_table *wait);
+ int snd_seq_client_notify_subscription(int client, int port,
+ struct snd_seq_port_subscribe *info, int evtype);
diff --git a/patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch b/patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch
new file mode 100644
index 0000000000..1f10ef4c39
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch
@@ -0,0 +1,75 @@
+From a7588c896b05444929ecb3d0115481988720abf6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 16:56:08 +0100
+Subject: [PATCH] ALSA: timer: Check ack_list emptiness instead of bit flag
+Git-commit: a7588c896b05444929ecb3d0115481988720abf6
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+For checking the pending timer instance that is still left on the
+timer object that is being closed, we set/clear a bit flag
+SNDRV_TIMER_IFLG_CALLBACK around the call of callbacks. This can be
+simplified by replace with the list_empty() call for ti->ack_list.
+This covers the existence more comprehensively and safely.
+
+A gratis bonus is that we can get rid of SNDRV_TIMER_IFLG_CALLBACK bit
+flag definition as well.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/timer.h | 1 -
+ sound/core/timer.c | 10 ++++------
+ 2 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/include/sound/timer.h b/include/sound/timer.h
+index 7ae226ab6990..bcfee20ea226 100644
+--- a/include/sound/timer.h
++++ b/include/sound/timer.h
+@@ -43,7 +43,6 @@
+ #define SNDRV_TIMER_IFLG_START 0x00000004
+ #define SNDRV_TIMER_IFLG_AUTO 0x00000008 /* auto restart */
+ #define SNDRV_TIMER_IFLG_FAST 0x00000010 /* fast callback (do not use tasklet) */
+-#define SNDRV_TIMER_IFLG_CALLBACK 0x00000020 /* timer callback is active */
+ #define SNDRV_TIMER_IFLG_EXCLUSIVE 0x00000040 /* exclusive owner - no more instances */
+ #define SNDRV_TIMER_IFLG_EARLY_EVENT 0x00000080 /* write early event to the poll queue */
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 107d8ebeeb2e..e343de0e4f9e 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -366,7 +366,7 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+ timer->num_instances--;
+ /* wait, until the active callback is finished */
+ spin_lock_irq(&timer->lock);
+- while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) {
++ while (!list_empty(&timeri->ack_list)) {
+ spin_unlock_irq(&timer->lock);
+ udelay(10);
+ spin_lock_irq(&timer->lock);
+@@ -731,19 +731,17 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ ti = list_first_entry(head, struct snd_timer_instance,
+ ack_list);
+
+- /* remove from ack_list and make empty */
+- list_del_init(&ti->ack_list);
+-
+ ticks = ti->pticks;
+ ti->pticks = 0;
+ resolution = ti->resolution;
+
+- ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
+ spin_unlock(&timer->lock);
+ if (ti->callback)
+ ti->callback(ti, resolution, ticks);
+ spin_lock(&timer->lock);
+- ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
++
++ /* remove from ack_list and make empty */
++ list_del_init(&ti->ack_list);
+ }
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Coding-style-fixes.patch b/patches.drivers/ALSA-timer-Coding-style-fixes.patch
new file mode 100644
index 0000000000..8d5ed3d0f3
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Coding-style-fixes.patch
@@ -0,0 +1,71 @@
+From 5d704b0d3b4855734f029337e516b829c473801c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 17:44:53 +0100
+Subject: [PATCH] ALSA: timer: Coding style fixes
+Git-commit: 5d704b0d3b4855734f029337e516b829c473801c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Avoid old school C style but do plain and clear way.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 0eed4fe0da21..d23efec35660 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1909,7 +1909,10 @@ static int snd_timer_user_start(struct file *file)
+ snd_timer_stop(tu->timeri);
+ tu->timeri->lost = 0;
+ tu->last_resolution = 0;
+- return (err = snd_timer_start(tu->timeri, tu->ticks)) < 0 ? err : 0;
++ err = snd_timer_start(tu->timeri, tu->ticks);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ static int snd_timer_user_stop(struct file *file)
+@@ -1920,7 +1923,10 @@ static int snd_timer_user_stop(struct file *file)
+ tu = file->private_data;
+ if (!tu->timeri)
+ return -EBADFD;
+- return (err = snd_timer_stop(tu->timeri)) < 0 ? err : 0;
++ err = snd_timer_stop(tu->timeri);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ static int snd_timer_user_continue(struct file *file)
+@@ -1935,7 +1941,10 @@ static int snd_timer_user_continue(struct file *file)
+ if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
+ return snd_timer_user_start(file);
+ tu->timeri->lost = 0;
+- return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0;
++ err = snd_timer_continue(tu->timeri);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ static int snd_timer_user_pause(struct file *file)
+@@ -1946,7 +1955,10 @@ static int snd_timer_user_pause(struct file *file)
+ tu = file->private_data;
+ if (!tu->timeri)
+ return -EBADFD;
+- return (err = snd_timer_pause(tu->timeri)) < 0 ? err : 0;
++ err = snd_timer_pause(tu->timeri);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ enum {
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch b/patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch
new file mode 100644
index 0000000000..b0431af7c3
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch
@@ -0,0 +1,148 @@
+From fe1b26c93d430400ac37d820425e2468218ae8b2 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 17:02:40 +0100
+Subject: [PATCH] ALSA: timer: Make snd_timer_close() really kill pending actions
+Git-commit: fe1b26c93d430400ac37d820425e2468218ae8b2
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+snd_timer_close() is supposed to close the timer instance and sync
+with the deactivation of pending actions. However, there are still
+some overlooked cases:
+
+- It calls snd_timer_stop() at the beginning, but some other might
+ re-trigger the timer right after that.
+
+- snd_timer_stop() calls del_timer_sync() only when all belonging
+ instances are closed. If multiple instances were assigned to a
+ timer object and one is closed, the timer is still running. Then
+ the pending action assigned to this timer might be left.
+
+Actually either of the above is the likely cause of the reported
+syzkaller UAF.
+
+This patch plug these holes by introducing SNDRV_TIMER_IFLG_DEAD
+flag. This is set at the beginning of snd_timer_close(), and the flag
+is checked at snd_timer_start*() and else, so that no longer new
+action is left after snd_timer_close().
+
+Reported-by: syzbot+d5136d4d3240cbe45a2a@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 45 +++++++++++++++++++++++++++++++++------------
+ 1 file changed, 33 insertions(+), 12 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index e343de0e4f9e..bb7e90ab90f8 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -38,6 +38,7 @@
+
+ /* internal flags */
+ #define SNDRV_TIMER_IFLG_PAUSED 0x00010000
++#define SNDRV_TIMER_IFLG_DEAD 0x00020000
+
+ #if IS_ENABLED(CONFIG_SND_HRTIMER)
+ #define DEFAULT_TIMER_LIMIT 4
+@@ -353,15 +354,20 @@ EXPORT_SYMBOL(snd_timer_open);
+ */
+ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+ {
+- struct snd_timer *timer = NULL;
++ struct snd_timer *timer = timeri->timer;
+ struct snd_timer_instance *slave, *tmp;
+
++ if (timer) {
++ spin_lock_irq(&timer->lock);
++ timeri->flags |= SNDRV_TIMER_IFLG_DEAD;
++ spin_unlock_irq(&timer->lock);
++ }
++
+ list_del(&timeri->open_list);
+
+ /* force to stop the timer */
+ snd_timer_stop(timeri);
+
+- timer = timeri->timer;
+ if (timer) {
+ timer->num_instances--;
+ /* wait, until the active callback is finished */
+@@ -497,6 +503,10 @@ static int snd_timer_start1(struct snd_timer_instance *timeri,
+ return -EINVAL;
+
+ spin_lock_irqsave(&timer->lock, flags);
++ if (timeri->flags & SNDRV_TIMER_IFLG_DEAD) {
++ result = -EINVAL;
++ goto unlock;
++ }
+ if (timer->card && timer->card->shutdown) {
+ result = -ENODEV;
+ goto unlock;
+@@ -541,11 +551,16 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri,
+ bool start)
+ {
+ unsigned long flags;
++ int err;
+
+ spin_lock_irqsave(&slave_active_lock, flags);
++ if (timeri->flags & SNDRV_TIMER_IFLG_DEAD) {
++ err = -EINVAL;
++ goto unlock;
++ }
+ if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) {
+- spin_unlock_irqrestore(&slave_active_lock, flags);
+- return -EBUSY;
++ err = -EBUSY;
++ goto unlock;
+ }
+ timeri->flags |= SNDRV_TIMER_IFLG_RUNNING;
+ if (timeri->master && timeri->timer) {
+@@ -556,8 +571,10 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri,
+ SNDRV_TIMER_EVENT_CONTINUE);
+ spin_unlock(&timeri->timer->lock);
+ }
++ err = 1; /* delayed start */
++ unlock:
+ spin_unlock_irqrestore(&slave_active_lock, flags);
+- return 1; /* delayed start */
++ return err;
+ }
+
+ /* stop/pause a master timer */
+@@ -731,14 +748,16 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ ti = list_first_entry(head, struct snd_timer_instance,
+ ack_list);
+
+- ticks = ti->pticks;
+- ti->pticks = 0;
+- resolution = ti->resolution;
++ if (!(ti->flags & SNDRV_TIMER_IFLG_DEAD)) {
++ ticks = ti->pticks;
++ ti->pticks = 0;
++ resolution = ti->resolution;
+
+- spin_unlock(&timer->lock);
+- if (ti->callback)
+- ti->callback(ti, resolution, ticks);
+- spin_lock(&timer->lock);
++ spin_unlock(&timer->lock);
++ if (ti->callback)
++ ti->callback(ti, resolution, ticks);
++ spin_lock(&timer->lock);
++ }
+
+ /* remove from ack_list and make empty */
+ list_del_init(&ti->ack_list);
+@@ -810,6 +829,8 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ */
+ list_for_each_entry_safe(ti, tmp, &timer->active_list_head,
+ active_list) {
++ if (ti->flags & SNDRV_TIMER_IFLG_DEAD)
++ continue;
+ if (!(ti->flags & SNDRV_TIMER_IFLG_RUNNING))
+ continue;
+ ti->pticks += ticks_left;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch b/patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch
new file mode 100644
index 0000000000..4b25eac9fb
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch
@@ -0,0 +1,70 @@
+From 7bb4a8a2cc9382da720b46988bc976ebccaa49fd Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 16:51:58 +0100
+Subject: [PATCH] ALSA: timer: Make sure to clear pending ack list
+Git-commit: 7bb4a8a2cc9382da720b46988bc976ebccaa49fd
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+When a card is under disconnection, we bail out immediately at each
+timer interrupt or tasklet. This might leave some items left in ack
+list. For a better integration of the upcoming change to check
+ack_list emptiness, clear out the whole list upon the emergency exit
+route.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index fdcddfb756b4..107d8ebeeb2e 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -747,6 +747,18 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ }
+ }
+
++/* clear pending instances from ack list */
++static void snd_timer_clear_callbacks(struct snd_timer *timer,
++ struct list_head *head)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&timer->lock, flags);
++ while (!list_empty(head))
++ list_del_init(head->next);
++ spin_unlock_irqrestore(&timer->lock, flags);
++}
++
+ /*
+ * timer tasklet
+ *
+@@ -756,8 +768,10 @@ static void snd_timer_tasklet(unsigned long arg)
+ struct snd_timer *timer = (struct snd_timer *) arg;
+ unsigned long flags;
+
+- if (timer->card && timer->card->shutdown)
++ if (timer->card && timer->card->shutdown) {
++ snd_timer_clear_callbacks(timer, &timer->sack_list_head);
+ return;
++ }
+
+ spin_lock_irqsave(&timer->lock, flags);
+ snd_timer_process_callbacks(timer, &timer->sack_list_head);
+@@ -781,8 +795,10 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ if (timer == NULL)
+ return;
+
+- if (timer->card && timer->card->shutdown)
++ if (timer->card && timer->card->shutdown) {
++ snd_timer_clear_callbacks(timer, &timer->ack_list_head);
+ return;
++ }
+
+ spin_lock_irqsave(&timer->lock, flags);
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch b/patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch
new file mode 100644
index 0000000000..e777a63511
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch
@@ -0,0 +1,80 @@
+From df55531b8b0eea9d2473f5697ae4f38d0df6bec7 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 9 Apr 2019 12:25:32 +0200
+Subject: [PATCH] ALSA: timer: Revert active callback sync check at close
+Git-commit: df55531b8b0eea9d2473f5697ae4f38d0df6bec7
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This is essentially a revert of the commit a7588c896b05 ("ALSA: timer:
+Check ack_list emptiness instead of bit flag"). The intended change
+by the commit turns out to be insufficient, as snd_timer_close*()
+always calls snd_timer_stop() that deletes the ack_list beforehand.
+
+In theory, we can change the behavior of snd_timer_stop() to sync the
+pending ack_list, but this will become a deadlock for the callback
+like sequencer that calls again snd_timer_stop() from itself. So,
+reverting the change is a more straightforward solution.
+
+Fixes: a7588c896b05 ("ALSA: timer: Check ack_list emptiness instead of bit flag")
+Reported-by: syzbot+58813d77154713f4de15@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/timer.h | 1 +
+ sound/core/timer.c | 11 ++++++-----
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/include/sound/timer.h b/include/sound/timer.h
+index bcfee20ea226..7ae226ab6990 100644
+--- a/include/sound/timer.h
++++ b/include/sound/timer.h
+@@ -43,6 +43,7 @@
+ #define SNDRV_TIMER_IFLG_START 0x00000004
+ #define SNDRV_TIMER_IFLG_AUTO 0x00000008 /* auto restart */
+ #define SNDRV_TIMER_IFLG_FAST 0x00000010 /* fast callback (do not use tasklet) */
++#define SNDRV_TIMER_IFLG_CALLBACK 0x00000020 /* timer callback is active */
+ #define SNDRV_TIMER_IFLG_EXCLUSIVE 0x00000040 /* exclusive owner - no more instances */
+ #define SNDRV_TIMER_IFLG_EARLY_EVENT 0x00000080 /* write early event to the poll queue */
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index bb7e90ab90f8..df52d2960179 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -372,7 +372,7 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+ timer->num_instances--;
+ /* wait, until the active callback is finished */
+ spin_lock_irq(&timer->lock);
+- while (!list_empty(&timeri->ack_list)) {
++ while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) {
+ spin_unlock_irq(&timer->lock);
+ udelay(10);
+ spin_lock_irq(&timer->lock);
+@@ -748,19 +748,20 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ ti = list_first_entry(head, struct snd_timer_instance,
+ ack_list);
+
++ /* remove from ack_list and make empty */
++ list_del_init(&ti->ack_list);
++
+ if (!(ti->flags & SNDRV_TIMER_IFLG_DEAD)) {
+ ticks = ti->pticks;
+ ti->pticks = 0;
+ resolution = ti->resolution;
+-
++ ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
+ spin_unlock(&timer->lock);
+ if (ti->callback)
+ ti->callback(ti, resolution, ticks);
+ spin_lock(&timer->lock);
++ ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
+ }
+-
+- /* remove from ack_list and make empty */
+- list_del_init(&ti->ack_list);
+ }
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch b/patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch
new file mode 100644
index 0000000000..cb39b66622
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch
@@ -0,0 +1,129 @@
+From 41672c0c24a62699d20aab53b98d843b16483053 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 17:11:10 +0100
+Subject: [PATCH] ALSA: timer: Simplify error path in snd_timer_open()
+Git-commit: 41672c0c24a62699d20aab53b98d843b16483053
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Just a minor refactoring to use the standard goto for error paths in
+snd_timer_open() instead of open code. The first mutex_lock() is
+moved to the beginning of the function to make the code clearer.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 39 ++++++++++++++++++++-------------------
+ 1 file changed, 20 insertions(+), 19 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index df52d2960179..0eed4fe0da21 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -255,19 +255,20 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ struct snd_timer_instance *timeri = NULL;
+ int err;
+
++ mutex_lock(&register_mutex);
+ if (tid->dev_class == SNDRV_TIMER_CLASS_SLAVE) {
+ /* open a slave instance */
+ if (tid->dev_sclass <= SNDRV_TIMER_SCLASS_NONE ||
+ tid->dev_sclass > SNDRV_TIMER_SCLASS_OSS_SEQUENCER) {
+ pr_debug("ALSA: timer: invalid slave class %i\n",
+ tid->dev_sclass);
+- return -EINVAL;
++ err = -EINVAL;
++ goto unlock;
+ }
+- mutex_lock(&register_mutex);
+ timeri = snd_timer_instance_new(owner, NULL);
+ if (!timeri) {
+- mutex_unlock(&register_mutex);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto unlock;
+ }
+ timeri->slave_class = tid->dev_sclass;
+ timeri->slave_id = tid->device;
+@@ -278,13 +279,10 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ snd_timer_close_locked(timeri);
+ timeri = NULL;
+ }
+- mutex_unlock(&register_mutex);
+- *ti = timeri;
+- return err;
++ goto unlock;
+ }
+
+ /* open a master instance */
+- mutex_lock(&register_mutex);
+ timer = snd_timer_find(tid);
+ #ifdef CONFIG_MODULES
+ if (!timer) {
+@@ -295,25 +293,26 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ }
+ #endif
+ if (!timer) {
+- mutex_unlock(&register_mutex);
+- return -ENODEV;
++ err = -ENODEV;
++ goto unlock;
+ }
+ if (!list_empty(&timer->open_list_head)) {
+ timeri = list_entry(timer->open_list_head.next,
+ struct snd_timer_instance, open_list);
+ if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
+- mutex_unlock(&register_mutex);
+- return -EBUSY;
++ err = -EBUSY;
++ timeri = NULL;
++ goto unlock;
+ }
+ }
+ if (timer->num_instances >= timer->max_instances) {
+- mutex_unlock(&register_mutex);
+- return -EBUSY;
++ err = -EBUSY;
++ goto unlock;
+ }
+ timeri = snd_timer_instance_new(owner, timer);
+ if (!timeri) {
+- mutex_unlock(&register_mutex);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto unlock;
+ }
+ /* take a card refcount for safe disconnection */
+ if (timer->card)
+@@ -322,16 +321,16 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ timeri->slave_id = slave_id;
+
+ if (list_empty(&timer->open_list_head) && timer->hw.open) {
+- int err = timer->hw.open(timer);
++ err = timer->hw.open(timer);
+ if (err) {
+ kfree(timeri->owner);
+ kfree(timeri);
++ timeri = NULL;
+
+ if (timer->card)
+ put_device(&timer->card->card_dev);
+ module_put(timer->module);
+- mutex_unlock(&register_mutex);
+- return err;
++ goto unlock;
+ }
+ }
+
+@@ -342,6 +341,8 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ snd_timer_close_locked(timeri);
+ timeri = NULL;
+ }
++
++ unlock:
+ mutex_unlock(&register_mutex);
+ *ti = timeri;
+ return err;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch b/patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch
new file mode 100644
index 0000000000..4520626121
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch
@@ -0,0 +1,125 @@
+From 8748b850beccdbc87aa8776d63abd6b5628720c8 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 16:42:51 +0100
+Subject: [PATCH] ALSA: timer: Unify timer callback process code
+Git-commit: 8748b850beccdbc87aa8776d63abd6b5628720c8
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The timer core has two almost identical code for processing callbacks:
+once in snd_timer_interrupt() for fast callbacks and another in
+snd_timer_tasklet() for delayed callbacks. Let's unify them.
+
+In the new version, the resolution is read from ti->resolution at each
+call, and this must be fine; ti->resolution is set in the preparation
+step in snd_timer_interrupt().
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 62 +++++++++++++++++++++++-------------------------------
+ 1 file changed, 26 insertions(+), 36 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 61a0cec6e1f6..fdcddfb756b4 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -720,29 +720,19 @@ static void snd_timer_reschedule(struct snd_timer * timer, unsigned long ticks_l
+ timer->sticks = ticks;
+ }
+
+-/*
+- * timer tasklet
+- *
+- */
+-static void snd_timer_tasklet(unsigned long arg)
++/* call callbacks in timer ack list */
++static void snd_timer_process_callbacks(struct snd_timer *timer,
++ struct list_head *head)
+ {
+- struct snd_timer *timer = (struct snd_timer *) arg;
+ struct snd_timer_instance *ti;
+- struct list_head *p;
+ unsigned long resolution, ticks;
+- unsigned long flags;
+
+- if (timer->card && timer->card->shutdown)
+- return;
+-
+- spin_lock_irqsave(&timer->lock, flags);
+- /* now process all callbacks */
+- while (!list_empty(&timer->sack_list_head)) {
+- p = timer->sack_list_head.next; /* get first item */
+- ti = list_entry(p, struct snd_timer_instance, ack_list);
++ while (!list_empty(head)) {
++ ti = list_first_entry(head, struct snd_timer_instance,
++ ack_list);
+
+ /* remove from ack_list and make empty */
+- list_del_init(p);
++ list_del_init(&ti->ack_list);
+
+ ticks = ti->pticks;
+ ti->pticks = 0;
+@@ -755,6 +745,22 @@ static void snd_timer_tasklet(unsigned long arg)
+ spin_lock(&timer->lock);
+ ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
+ }
++}
++
++/*
++ * timer tasklet
++ *
++ */
++static void snd_timer_tasklet(unsigned long arg)
++{
++ struct snd_timer *timer = (struct snd_timer *) arg;
++ unsigned long flags;
++
++ if (timer->card && timer->card->shutdown)
++ return;
++
++ spin_lock_irqsave(&timer->lock, flags);
++ snd_timer_process_callbacks(timer, &timer->sack_list_head);
+ spin_unlock_irqrestore(&timer->lock, flags);
+ }
+
+@@ -767,8 +773,8 @@ static void snd_timer_tasklet(unsigned long arg)
+ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ {
+ struct snd_timer_instance *ti, *ts, *tmp;
+- unsigned long resolution, ticks;
+- struct list_head *p, *ack_list_head;
++ unsigned long resolution;
++ struct list_head *ack_list_head;
+ unsigned long flags;
+ int use_tasklet = 0;
+
+@@ -839,23 +845,7 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ }
+
+ /* now process all fast callbacks */
+- while (!list_empty(&timer->ack_list_head)) {
+- p = timer->ack_list_head.next; /* get first item */
+- ti = list_entry(p, struct snd_timer_instance, ack_list);
+-
+- /* remove from ack_list and make empty */
+- list_del_init(p);
+-
+- ticks = ti->pticks;
+- ti->pticks = 0;
+-
+- ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
+- spin_unlock(&timer->lock);
+- if (ti->callback)
+- ti->callback(ti, resolution, ticks);
+- spin_lock(&timer->lock);
+- ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
+- }
++ snd_timer_process_callbacks(timer, &timer->ack_list_head);
+
+ /* do we have any slow callbacks? */
+ use_tasklet = !list_empty(&timer->sack_list_head);
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch b/patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch
new file mode 100644
index 0000000000..fc07a4c050
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch
@@ -0,0 +1,43 @@
+From cb5173594d50c72b7bfa14113dfc5084b4d2f726 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Sat, 27 Apr 2019 01:06:46 -0500
+Subject: [PATCH] ALSA: usb-audio: Fix a memory leak bug
+Git-commit: cb5173594d50c72b7bfa14113dfc5084b4d2f726
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In parse_audio_selector_unit(), the string array 'namelist' is allocated
+through kmalloc_array(), and each string pointer in this array, i.e.,
+'namelist[]', is allocated through kmalloc() in the following for loop.
+Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
+an error occurs during the creation process, the string array 'namelist',
+including all string pointers in the array 'namelist[]', should be freed,
+before the error code ENOMEM is returned. However, the current code does
+not free 'namelist[]', resulting in memory leaks.
+
+To fix the above issue, free all string pointers 'namelist[]' in a loop.
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/mixer.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index c095d9751924..e003b5e7b01a 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2675,6 +2675,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
+ kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
+ if (! kctl) {
+ usb_audio_err(state->chip, "cannot malloc kcontrol\n");
++ for (i = 0; i < desc->bNrInPins; i++)
++ kfree(namelist[i]);
+ kfree(namelist);
+ kfree(cval);
+ return -ENOMEM;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch b/patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch
new file mode 100644
index 0000000000..4c98cb5ba8
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch
@@ -0,0 +1,37 @@
+From 328e9f6973be2ee67862cb17bf6c0c5c5918cd72 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 24 Apr 2019 13:00:03 +0200
+Subject: [PATCH] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()
+Git-commit: 328e9f6973be2ee67862cb17bf6c0c5c5918cd72
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The error from snd_usb_mixer_apply_create_quirk() is ignored in the
+current usb-audio driver code, which will continue the probing even
+after the error. Let's take it more serious.
+
+Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/mixer.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 73d7dff425c1..c095d9751924 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -3490,7 +3490,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
+ if (err < 0)
+ goto _error;
+
+- snd_usb_mixer_apply_create_quirk(mixer);
++ err = snd_usb_mixer_apply_create_quirk(mixer);
++ if (err < 0)
++ goto _error;
+
+ err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
+ if (err < 0)
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch b/patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch
new file mode 100644
index 0000000000..314b39fb2f
--- /dev/null
+++ b/patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch
@@ -0,0 +1,44 @@
+From cbb88db76a1536e02e93e5bd37ebbfbb6c4043a9 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Mon, 29 Apr 2019 12:45:40 -0500
+Subject: [PATCH] ALSA: usx2y: fix a double free bug
+Git-commit: cbb88db76a1536e02e93e5bd37ebbfbb6c4043a9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In usX2Y_In04_init(), a new urb is firstly created through usb_alloc_urb()
+and saved to 'usX2Y->In04urb'. Then, a buffer is allocated through
+kmalloc() and saved to 'usX2Y->In04Buf'. If the allocation of the buffer
+fails, the error code ENOMEM is returned after usb_free_urb(), which frees
+the created urb. However, the urb is actually freed at card->private_free
+callback, i.e., snd_usX2Y_card_private_free(). So the free operation here
+leads to a double free bug.
+
+To fix the above issue, simply remove usb_free_urb().
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/usx2y/usbusx2y.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
+index 9f7bbed2c0f0..e8687b3bd3c8 100644
+--- a/sound/usb/usx2y/usbusx2y.c
++++ b/sound/usb/usx2y/usbusx2y.c
+@@ -293,10 +293,8 @@ int usX2Y_In04_init(struct usX2Ydev *usX2Y)
+ if (! (usX2Y->In04urb = usb_alloc_urb(0, GFP_KERNEL)))
+ return -ENOMEM;
+
+- if (! (usX2Y->In04Buf = kmalloc(21, GFP_KERNEL))) {
+- usb_free_urb(usX2Y->In04urb);
++ if (! (usX2Y->In04Buf = kmalloc(21, GFP_KERNEL)))
+ return -ENOMEM;
+- }
+
+ init_waitqueue_head(&usX2Y->In04WaitQueue);
+ usb_fill_int_urb(usX2Y->In04urb, usX2Y->dev, usb_rcvintpipe(usX2Y->dev, 0x4),
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch b/patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch
new file mode 100644
index 0000000000..c16be9fb1c
--- /dev/null
+++ b/patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch
@@ -0,0 +1,66 @@
+From 0efa3334d65b7f421ba12382dfa58f6ff5bf83c4 Mon Sep 17 00:00:00 2001
+From: Ross Zwisler <zwisler@chromium.org>
+Date: Mon, 29 Apr 2019 12:25:17 -0600
+Subject: [PATCH] ASoC: Intel: avoid Oops if DMA setup fails
+Git-commit: 0efa3334d65b7f421ba12382dfa58f6ff5bf83c4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Currently in sst_dsp_new() if we get an error return from sst_dma_new()
+we just print an error message and then still complete the function
+successfully. This means that we are trying to run without sst->dma
+properly set up, which will result in NULL pointer dereference when
+sst->dma is later used. This was happening for me in
+Sst_dsp_dma_get_channel():
+
+ struct sst_dma *dma = dsp->dma;
+ ...
+ dma->ch = dma_request_channel(mask, dma_chan_filter, dsp);
+
+This resulted in:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
+ IP: sst_dsp_dma_get_channel+0x4f/0x125 [snd_soc_sst_firmware]
+
+Fix this by adding proper error handling for the case where we fail to
+set up DMA.
+
+This change only affects Haswell and Broadwell systems. Baytrail
+systems explicilty opt-out of DMA via sst->pdata->resindex_dma_base
+being set to -1.
+
+Signed-off-by: Ross Zwisler <zwisler@google.com>
+Cc: stable@vger.kernel.org
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/intel/common/sst-firmware.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/common/sst-firmware.c b/sound/soc/intel/common/sst-firmware.c
+index 1e067504b604..f830e59f93ea 100644
+--- a/sound/soc/intel/common/sst-firmware.c
++++ b/sound/soc/intel/common/sst-firmware.c
+@@ -1251,11 +1251,15 @@ struct sst_dsp *sst_dsp_new(struct device *dev,
+ goto irq_err;
+
+ err = sst_dma_new(sst);
+- if (err)
+- dev_warn(dev, "sst_dma_new failed %d\n", err);
++ if (err) {
++ dev_err(dev, "sst_dma_new failed %d\n", err);
++ goto dma_err;
++ }
+
+ return sst;
+
++dma_err:
++ free_irq(sst->irq, sst);
+ irq_err:
+ if (sst->ops->free)
+ sst->ops->free(sst);
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch b/patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch
new file mode 100644
index 0000000000..7a5d6c171c
--- /dev/null
+++ b/patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch
@@ -0,0 +1,135 @@
+From a46eb523220e242affb9a6bc9bb8efc05f4f7459 Mon Sep 17 00:00:00 2001
+From: Curtis Malainey <cujomalainey@chromium.org>
+Date: Fri, 3 May 2019 12:32:14 -0700
+Subject: [PATCH] ASoC: RT5677-SPI: Disable 16Bit SPI Transfers
+Git-commit: a46eb523220e242affb9a6bc9bb8efc05f4f7459
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The current algorithm allows 3 types of transfers, 16bit, 32bit and
+burst. According to Realtek, 16bit transfers have a special restriction
+in that it is restricted to the memory region of
+0x18020000 ~ 0x18021000. This region is the memory location of the I2C
+registers. The current algorithm does not uphold this restriction and
+therefore fails to complete writes.
+
+Since this has been broken for some time it likely no one is using it.
+Better to simply disable the 16 bit writes. This will allow users to
+properly load firmware over SPI without data corruption.
+
+Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
+Reviewed-by: Ben Zhang <benzh@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/rt5677-spi.c | 35 ++++++++++++++++-------------------
+ 1 file changed, 16 insertions(+), 19 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5677-spi.c b/sound/soc/codecs/rt5677-spi.c
+index 167a02773a0b..84b6bd8b50e1 100644
+--- a/sound/soc/codecs/rt5677-spi.c
++++ b/sound/soc/codecs/rt5677-spi.c
+@@ -58,13 +58,15 @@ static DEFINE_MUTEX(spi_mutex);
+ * RT5677_SPI_READ/WRITE_32: Transfer 4 bytes
+ * RT5677_SPI_READ/WRITE_BURST: Transfer any multiples of 8 bytes
+ *
+- * For example, reading 260 bytes at 0x60030002 uses the following commands:
+- * 0x60030002 RT5677_SPI_READ_16 2 bytes
++ * Note:
++ * 16 Bit writes and reads are restricted to the address range
++ * 0x18020000 ~ 0x18021000
++ *
++ * For example, reading 256 bytes at 0x60030004 uses the following commands:
+ * 0x60030004 RT5677_SPI_READ_32 4 bytes
+ * 0x60030008 RT5677_SPI_READ_BURST 240 bytes
+ * 0x600300F8 RT5677_SPI_READ_BURST 8 bytes
+ * 0x60030100 RT5677_SPI_READ_32 4 bytes
+- * 0x60030104 RT5677_SPI_READ_16 2 bytes
+ *
+ * Input:
+ * @read: true for read commands; false for write commands
+@@ -79,15 +81,13 @@ static u8 rt5677_spi_select_cmd(bool read, u32 align, u32 remain, u32 *len)
+ {
+ u8 cmd;
+
+- if (align == 2 || align == 6 || remain == 2) {
+- cmd = RT5677_SPI_READ_16;
+- *len = 2;
+- } else if (align == 4 || remain <= 6) {
++ if (align == 4 || remain <= 4) {
+ cmd = RT5677_SPI_READ_32;
+ *len = 4;
+ } else {
+ cmd = RT5677_SPI_READ_BURST;
+- *len = min_t(u32, remain & ~7, RT5677_SPI_BURST_LEN);
++ *len = (((remain - 1) >> 3) + 1) << 3;
++ *len = min_t(u32, *len, RT5677_SPI_BURST_LEN);
+ }
+ return read ? cmd : cmd + 1;
+ }
+@@ -108,7 +108,7 @@ static void rt5677_spi_reverse(u8 *dst, u32 dstlen, const u8 *src, u32 srclen)
+ }
+ }
+
+-/* Read DSP address space using SPI. addr and len have to be 2-byte aligned. */
++/* Read DSP address space using SPI. addr and len have to be 4-byte aligned. */
+ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ {
+ u32 offset;
+@@ -124,7 +124,7 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ if (!g_spi)
+ return -ENODEV;
+
+- if ((addr & 1) || (len & 1)) {
++ if ((addr & 3) || (len & 3)) {
+ dev_err(&g_spi->dev, "Bad read align 0x%x(%zu)\n", addr, len);
+ return -EACCES;
+ }
+@@ -159,13 +159,13 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ }
+ EXPORT_SYMBOL_GPL(rt5677_spi_read);
+
+-/* Write DSP address space using SPI. addr has to be 2-byte aligned.
+- * If len is not 2-byte aligned, an extra byte of zero is written at the end
++/* Write DSP address space using SPI. addr has to be 4-byte aligned.
++ * If len is not 4-byte aligned, then extra zeros are written at the end
+ * as padding.
+ */
+ int rt5677_spi_write(u32 addr, const void *txbuf, size_t len)
+ {
+- u32 offset, len_with_pad = len;
++ u32 offset;
+ int status = 0;
+ struct spi_transfer t;
+ struct spi_message m;
+@@ -178,22 +178,19 @@ int rt5677_spi_write(u32 addr, const void *txbuf, size_t len)
+ if (!g_spi)
+ return -ENODEV;
+
+- if (addr & 1) {
++ if (addr & 3) {
+ dev_err(&g_spi->dev, "Bad write align 0x%x(%zu)\n", addr, len);
+ return -EACCES;
+ }
+
+- if (len & 1)
+- len_with_pad = len + 1;
+-
+ memset(&t, 0, sizeof(t));
+ t.tx_buf = buf;
+ t.speed_hz = RT5677_SPI_FREQ;
+ spi_message_init_with_transfers(&m, &t, 1);
+
+- for (offset = 0; offset < len_with_pad;) {
++ for (offset = 0; offset < len;) {
+ spi_cmd = rt5677_spi_select_cmd(false, (addr + offset) & 7,
+- len_with_pad - offset, &t.len);
++ len - offset, &t.len);
+
+ /* Construct SPI message header */
+ buf[0] = spi_cmd;
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch b/patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch
new file mode 100644
index 0000000000..ce8a28c0b2
--- /dev/null
+++ b/patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch
@@ -0,0 +1,39 @@
+From f0f2338a9cfaf71db895fa989ea7234e8a9b471d Mon Sep 17 00:00:00 2001
+From: Daniel Mack <daniel@zonque.org>
+Date: Wed, 20 Mar 2019 22:41:56 +0100
+Subject: [PATCH] ASoC: cs4270: Set auto-increment bit for register writes
+Git-commit: f0f2338a9cfaf71db895fa989ea7234e8a9b471d
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The CS4270 does not by default increment the register address on
+consecutive writes. During normal operation it doesn't matter as all
+register accesses are done individually. At resume time after suspend,
+however, the regcache code gathers the biggest possible block of
+registers to sync and sends them one on one go.
+
+To fix this, set the INCR bit in all cases.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/cs4270.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
+index 33d74f163bd7..793a14d58667 100644
+--- a/sound/soc/codecs/cs4270.c
++++ b/sound/soc/codecs/cs4270.c
+@@ -642,6 +642,7 @@ static const struct regmap_config cs4270_regmap = {
+ .reg_defaults = cs4270_reg_defaults,
+ .num_reg_defaults = ARRAY_SIZE(cs4270_reg_defaults),
+ .cache_type = REGCACHE_RBTREE,
++ .write_flag_mask = CS4270_I2C_INCR,
+
+ .readable_reg = cs4270_reg_is_readable,
+ .volatile_reg = cs4270_reg_is_volatile,
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-fix-valid-stream-condition.patch b/patches.drivers/ASoC-fix-valid-stream-condition.patch
new file mode 100644
index 0000000000..9894d2938c
--- /dev/null
+++ b/patches.drivers/ASoC-fix-valid-stream-condition.patch
@@ -0,0 +1,40 @@
+From 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Mon, 29 Apr 2019 11:47:49 +0200
+Subject: [PATCH] ASoC: fix valid stream condition
+Git-commit: 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+A stream may specify a rate range using 'rate_min' and 'rate_max', so a
+stream may be valid and not specify any rates. However, as stream cannot
+be valid and not have any channel. Let's use this condition instead to
+determine if a stream is valid or not.
+
+Fixes: cde79035c6cf ("ASoC: Handle multiple codecs with split playback / capture")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/soc-pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index d21247546f7f..57088bd69e5d 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -43,8 +43,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
+ else
+ codec_stream = &dai->driver->capture;
+
+- /* If the codec specifies any rate at all, it supports the stream. */
+- return codec_stream->rates;
++ /* If the codec specifies any channels at all, it supports the stream */
++ return codec_stream->channels_min;
+ }
+
+ /**
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch b/patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch
new file mode 100644
index 0000000000..7cb42d7524
--- /dev/null
+++ b/patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch
@@ -0,0 +1,32 @@
+From 903c220b1ece12f17c868e43f2243b8f81ff2d4c Mon Sep 17 00:00:00 2001
+From: "S.j. Wang" <shengjiu.wang@nxp.com>
+Date: Sun, 28 Apr 2019 02:24:27 +0000
+Subject: [PATCH] ASoC: fsl_esai: Fix missing break in switch statement
+Git-commit: 903c220b1ece12f17c868e43f2243b8f81ff2d4c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+case ESAI_HCKT_EXTAL and case ESAI_HCKR_EXTAL should be
+independent of each other, so replace fall-through with break.
+
+Fixes: 43d24e76b698 ("ASoC: fsl_esai: Add ESAI CPU DAI driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/fsl/fsl_esai.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/fsl/fsl_esai.c
++++ b/sound/soc/fsl/fsl_esai.c
+@@ -249,6 +249,7 @@ static int fsl_esai_set_dai_sysclk(struc
+ break;
+ case ESAI_HCKT_EXTAL:
+ ecr |= ESAI_ECR_ETI;
++ break;
+ case ESAI_HCKR_EXTAL:
+ ecr |= ESAI_ECR_ERI;
+ break;
diff --git a/patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch b/patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch
new file mode 100644
index 0000000000..8980b2d8bb
--- /dev/null
+++ b/patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch
@@ -0,0 +1,175 @@
+From 2e95f984aae4cf0608d0ba2189c756f2bd50b44a Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 28 Feb 2019 15:30:34 +0000
+Subject: [PATCH] ASoC: hdmi-codec: fix S/PDIF DAI
+Git-commit: 2e95f984aae4cf0608d0ba2189c756f2bd50b44a
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+When using the S/PDIF DAI, there is no requirement to call
+snd_soc_dai_set_fmt() as there is no DAI format definition that defines
+S/PDIF. In any case, S/PDIF does not have separate clocks, this is
+embedded into the data stream.
+
+Consequently, when attempting to use TDA998x in S/PDIF mode, the attempt
+to configure TDA998x via the hw_params callback fails as the
+hdmi_codec_daifmt is left initialised to zero.
+
+Since the S/PDIF DAI will only be used by S/PDIF, prepare the
+hdmi_codec_daifmt structure for this format.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Jyri Sarha <jsarha@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/hdmi-codec.c | 122 +++++++++++++++++++++---------------------
+ 1 file changed, 61 insertions(+), 61 deletions(-)
+
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -549,73 +549,71 @@ static int hdmi_codec_set_fmt(struct snd
+ {
+ struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai);
+ struct hdmi_codec_daifmt cf = { 0 };
+- int ret = 0;
+
+ dev_dbg(dai->dev, "%s()\n", __func__);
+
+- if (dai->id == DAI_ID_SPDIF) {
+- cf.fmt = HDMI_SPDIF;
+- } else {
+- switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+- case SND_SOC_DAIFMT_CBM_CFM:
+- cf.bit_clk_master = 1;
+- cf.frame_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBS_CFM:
+- cf.frame_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBM_CFS:
+- cf.bit_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBS_CFS:
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+- case SND_SOC_DAIFMT_NB_NF:
+- break;
+- case SND_SOC_DAIFMT_NB_IF:
+- cf.frame_clk_inv = 1;
+- break;
+- case SND_SOC_DAIFMT_IB_NF:
+- cf.bit_clk_inv = 1;
+- break;
+- case SND_SOC_DAIFMT_IB_IF:
+- cf.frame_clk_inv = 1;
+- cf.bit_clk_inv = 1;
+- break;
+- }
+-
+- switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+- case SND_SOC_DAIFMT_I2S:
+- cf.fmt = HDMI_I2S;
+- break;
+- case SND_SOC_DAIFMT_DSP_A:
+- cf.fmt = HDMI_DSP_A;
+- break;
+- case SND_SOC_DAIFMT_DSP_B:
+- cf.fmt = HDMI_DSP_B;
+- break;
+- case SND_SOC_DAIFMT_RIGHT_J:
+- cf.fmt = HDMI_RIGHT_J;
+- break;
+- case SND_SOC_DAIFMT_LEFT_J:
+- cf.fmt = HDMI_LEFT_J;
+- break;
+- case SND_SOC_DAIFMT_AC97:
+- cf.fmt = HDMI_AC97;
+- break;
+- default:
+- dev_err(dai->dev, "Invalid DAI interface format\n");
+- return -EINVAL;
+- }
++ if (dai->id == DAI_ID_SPDIF)
++ return 0;
++
++ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++ case SND_SOC_DAIFMT_CBM_CFM:
++ cf.bit_clk_master = 1;
++ cf.frame_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBS_CFM:
++ cf.frame_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBM_CFS:
++ cf.bit_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBS_CFS:
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
++ case SND_SOC_DAIFMT_NB_NF:
++ break;
++ case SND_SOC_DAIFMT_NB_IF:
++ cf.frame_clk_inv = 1;
++ break;
++ case SND_SOC_DAIFMT_IB_NF:
++ cf.bit_clk_inv = 1;
++ break;
++ case SND_SOC_DAIFMT_IB_IF:
++ cf.frame_clk_inv = 1;
++ cf.bit_clk_inv = 1;
++ break;
++ }
++
++ switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
++ case SND_SOC_DAIFMT_I2S:
++ cf.fmt = HDMI_I2S;
++ break;
++ case SND_SOC_DAIFMT_DSP_A:
++ cf.fmt = HDMI_DSP_A;
++ break;
++ case SND_SOC_DAIFMT_DSP_B:
++ cf.fmt = HDMI_DSP_B;
++ break;
++ case SND_SOC_DAIFMT_RIGHT_J:
++ cf.fmt = HDMI_RIGHT_J;
++ break;
++ case SND_SOC_DAIFMT_LEFT_J:
++ cf.fmt = HDMI_LEFT_J;
++ break;
++ case SND_SOC_DAIFMT_AC97:
++ cf.fmt = HDMI_AC97;
++ break;
++ default:
++ dev_err(dai->dev, "Invalid DAI interface format\n");
++ return -EINVAL;
+ }
+
+ hcp->daifmt[dai->id] = cf;
+
+- return ret;
++ return 0;
+ }
+
+ static int hdmi_codec_digital_mute(struct snd_soc_dai *dai, int mute)
+@@ -771,8 +769,10 @@ static int hdmi_codec_probe(struct platf
+ i++;
+ }
+
+- if (hcd->spdif)
++ if (hcd->spdif) {
+ hcp->daidrv[i] = hdmi_spdif_dai;
++ hcp->daifmt[DAI_ID_SPDIF].fmt = HDMI_SPDIF;
++ }
+
+ ret = snd_soc_register_codec(dev, &hdmi_codec, hcp->daidrv,
+ dai_count);
diff --git a/patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch b/patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch
new file mode 100644
index 0000000000..96463a8eb6
--- /dev/null
+++ b/patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch
@@ -0,0 +1,57 @@
+From ecb2795c08bc825ebd604997e5be440b060c5b18 Mon Sep 17 00:00:00 2001
+From: Jon Hunter <jonathanh@nvidia.com>
+Date: Wed, 1 May 2019 15:29:38 +0100
+Subject: [PATCH] ASoC: max98090: Fix restore of DAPM Muxes
+Git-commit: ecb2795c08bc825ebd604997e5be440b060c5b18
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The max98090 driver defines 3 DAPM muxes; one for the right line output
+(LINMOD Mux), one for the left headphone mixer source (MIXHPLSEL Mux)
+and one for the right headphone mixer source (MIXHPRSEL Mux). The same
+bit is used for the mux as well as the DAPM enable, and although the mux
+can be correctly configured, after playback has completed, the mux will
+be reset during the disable phase. This is preventing the state of these
+muxes from being saved and restored correctly on system reboot. Fix this
+by marking these muxes as SND_SOC_NOPM.
+
+Note this has been verified this on the Tegra124 Nyan Big which features
+the MAX98090 codec.
+
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/max98090.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 30c242c38d99..7619ea31ab50 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1194,14 +1194,14 @@ static const struct snd_soc_dapm_widget max98090_dapm_widgets[] = {
+ &max98090_right_rcv_mixer_controls[0],
+ ARRAY_SIZE(max98090_right_rcv_mixer_controls)),
+
+- SND_SOC_DAPM_MUX("LINMOD Mux", M98090_REG_LOUTR_MIXER,
+- M98090_LINMOD_SHIFT, 0, &max98090_linmod_mux),
++ SND_SOC_DAPM_MUX("LINMOD Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_linmod_mux),
+
+- SND_SOC_DAPM_MUX("MIXHPLSEL Mux", M98090_REG_HP_CONTROL,
+- M98090_MIXHPLSEL_SHIFT, 0, &max98090_mixhplsel_mux),
++ SND_SOC_DAPM_MUX("MIXHPLSEL Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_mixhplsel_mux),
+
+- SND_SOC_DAPM_MUX("MIXHPRSEL Mux", M98090_REG_HP_CONTROL,
+- M98090_MIXHPRSEL_SHIFT, 0, &max98090_mixhprsel_mux),
++ SND_SOC_DAPM_MUX("MIXHPRSEL Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_mixhprsel_mux),
+
+ SND_SOC_DAPM_PGA("HP Left Out", M98090_REG_OUTPUT_ENABLE,
+ M98090_HPLEN_SHIFT, 0, NULL, 0),
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch b/patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch
new file mode 100644
index 0000000000..a990c633ed
--- /dev/null
+++ b/patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch
@@ -0,0 +1,39 @@
+From 54d1cf78b0f4ba348a7c7fb8b7d0708d71b6cc8a Mon Sep 17 00:00:00 2001
+From: John Hsu <KCHSU0@nuvoton.com>
+Date: Wed, 13 Mar 2019 16:23:44 +0800
+Subject: [PATCH] ASoC: nau8810: fix the issue of widget with prefixed name
+Git-commit: 54d1cf78b0f4ba348a7c7fb8b7d0708d71b6cc8a
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The driver changes the stream name of DAC and ADC to avoid the issue of
+widget with prefixed name. When the machine adds prefixed name for codec,
+the stream name of DAI may not find the widgets.
+
+Signed-off-by: John Hsu <KCHSU0@nuvoton.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/nau8810.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8810.c b/sound/soc/codecs/nau8810.c
+index bfd74b86c9d2..645aa0794123 100644
+--- a/sound/soc/codecs/nau8810.c
++++ b/sound/soc/codecs/nau8810.c
+@@ -411,9 +411,9 @@ static const struct snd_soc_dapm_widget nau8810_dapm_widgets[] = {
+ SND_SOC_DAPM_MIXER("Mono Mixer", NAU8810_REG_POWER3,
+ NAU8810_MOUTMX_EN_SFT, 0, &nau8810_mono_mixer_controls[0],
+ ARRAY_SIZE(nau8810_mono_mixer_controls)),
+- SND_SOC_DAPM_DAC("DAC", "HiFi Playback", NAU8810_REG_POWER3,
++ SND_SOC_DAPM_DAC("DAC", "Playback", NAU8810_REG_POWER3,
+ NAU8810_DAC_EN_SFT, 0),
+- SND_SOC_DAPM_ADC("ADC", "HiFi Capture", NAU8810_REG_POWER2,
++ SND_SOC_DAPM_ADC("ADC", "Capture", NAU8810_REG_POWER2,
+ NAU8810_ADC_EN_SFT, 0),
+ SND_SOC_DAPM_PGA("SpkN Out", NAU8810_REG_POWER3,
+ NAU8810_NSPK_EN_SFT, 0, NULL, 0),
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch b/patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch
new file mode 100644
index 0000000000..cdcf1c8efa
--- /dev/null
+++ b/patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch
@@ -0,0 +1,110 @@
+From 844a4a362dbec166b44d6b9b3dd45b08cb273703 Mon Sep 17 00:00:00 2001
+From: John Hsu <KCHSU0@nuvoton.com>
+Date: Mon, 11 Mar 2019 09:36:45 +0800
+Subject: [PATCH] ASoC: nau8824: fix the issue of the widget with prefix name
+Git-commit: 844a4a362dbec166b44d6b9b3dd45b08cb273703
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The driver has two issues when machine add prefix name for codec.
+(1)The stream name of DAI can't find the AIF widgets.
+(2)The drivr can enable/disalbe the MICBIAS and SAR widgets.
+
+The patch will fix these issues caused by prefixed name added.
+
+Signed-off-by: John Hsu <KCHSU0@nuvoton.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/nau8824.c | 46 ++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 38 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
+index 87ed3dc496dc..5ab05e75edea 100644
+--- a/sound/soc/codecs/nau8824.c
++++ b/sound/soc/codecs/nau8824.c
+@@ -681,8 +681,8 @@ static const struct snd_soc_dapm_widget nau8824_dapm_widgets[] = {
+ SND_SOC_DAPM_ADC("ADCR", NULL, NAU8824_REG_ANALOG_ADC_2,
+ NAU8824_ADCR_EN_SFT, 0),
+
+- SND_SOC_DAPM_AIF_OUT("AIFTX", "HiFi Capture", 0, SND_SOC_NOPM, 0, 0),
+- SND_SOC_DAPM_AIF_IN("AIFRX", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("AIFRX", "Playback", 0, SND_SOC_NOPM, 0, 0),
+
+ SND_SOC_DAPM_DAC("DACL", NULL, NAU8824_REG_RDAC,
+ NAU8824_DACL_EN_SFT, 0),
+@@ -831,6 +831,36 @@ static void nau8824_int_status_clear_all(struct regmap *regmap)
+ }
+ }
+
++static void nau8824_dapm_disable_pin(struct nau8824 *nau8824, const char *pin)
++{
++ struct snd_soc_dapm_context *dapm = nau8824->dapm;
++ const char *prefix = dapm->component->name_prefix;
++ char prefixed_pin[80];
++
++ if (prefix) {
++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
++ prefix, pin);
++ snd_soc_dapm_disable_pin(dapm, prefixed_pin);
++ } else {
++ snd_soc_dapm_disable_pin(dapm, pin);
++ }
++}
++
++static void nau8824_dapm_enable_pin(struct nau8824 *nau8824, const char *pin)
++{
++ struct snd_soc_dapm_context *dapm = nau8824->dapm;
++ const char *prefix = dapm->component->name_prefix;
++ char prefixed_pin[80];
++
++ if (prefix) {
++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
++ prefix, pin);
++ snd_soc_dapm_force_enable_pin(dapm, prefixed_pin);
++ } else {
++ snd_soc_dapm_force_enable_pin(dapm, pin);
++ }
++}
++
+ static void nau8824_eject_jack(struct nau8824 *nau8824)
+ {
+ struct snd_soc_dapm_context *dapm = nau8824->dapm;
+@@ -839,8 +869,8 @@ static void nau8824_eject_jack(struct nau8824 *nau8824)
+ /* Clear all interruption status */
+ nau8824_int_status_clear_all(regmap);
+
+- snd_soc_dapm_disable_pin(dapm, "SAR");
+- snd_soc_dapm_disable_pin(dapm, "MICBIAS");
++ nau8824_dapm_disable_pin(nau8824, "SAR");
++ nau8824_dapm_disable_pin(nau8824, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+
+ /* Enable the insertion interruption, disable the ejection
+@@ -870,8 +900,8 @@ static void nau8824_jdet_work(struct work_struct *work)
+ struct regmap *regmap = nau8824->regmap;
+ int adc_value, event = 0, event_mask = 0;
+
+- snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
+- snd_soc_dapm_force_enable_pin(dapm, "SAR");
++ nau8824_dapm_enable_pin(nau8824, "MICBIAS");
++ nau8824_dapm_enable_pin(nau8824, "SAR");
+ snd_soc_dapm_sync(dapm);
+
+ msleep(100);
+@@ -882,8 +912,8 @@ static void nau8824_jdet_work(struct work_struct *work)
+ if (adc_value < HEADSET_SARADC_THD) {
+ event |= SND_JACK_HEADPHONE;
+
+- snd_soc_dapm_disable_pin(dapm, "SAR");
+- snd_soc_dapm_disable_pin(dapm, "MICBIAS");
++ nau8824_dapm_disable_pin(nau8824, "SAR");
++ nau8824_dapm_disable_pin(nau8824, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+ } else {
+ event |= SND_JACK_HEADSET;
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch b/patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch
new file mode 100644
index 0000000000..4689137bd0
--- /dev/null
+++ b/patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch
@@ -0,0 +1,49 @@
+From 2b13bee3884926cba22061efa75bd315e871de24 Mon Sep 17 00:00:00 2001
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Date: Tue, 12 Mar 2019 18:40:06 +0100
+Subject: [PATCH] ASoC: samsung: odroid: Fix clock configuration for 44100 sample rate
+Git-commit: 2b13bee3884926cba22061efa75bd315e871de24
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+After commit fbeec965b8d1c ("ASoC: samsung: odroid: Fix 32000 sample rate
+handling") the audio root clock frequency is configured improperly for
+44100 sample rate. Due to clock rate rounding it's 20070401 Hz instead
+of 22579000 Hz. This results in a too low value of the PSR clock divider
+in the CPU DAI driver and too fast actual sample rate for fs=44100. E.g.
+1 kHz tone has actual 1780 Hz frequency (1 kHz * 20070401/22579000 * 2).
+
+Fix this by increasing the correction passed to clk_set_rate() to take
+into account inaccuracy of the EPLL frequency properly.
+
+Fixes: fbeec965b8d1c ("ASoC: samsung: odroid: Fix 32000 sample rate handling")
+Reported-by: JaeChul Lee <jcsing.lee@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/samsung/odroid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c
+index 694512f980fd..1dc54c4206f0 100644
+--- a/sound/soc/samsung/odroid.c
++++ b/sound/soc/samsung/odroid.c
+@@ -91,11 +91,11 @@ static int odroid_card_be_hw_params(struct snd_pcm_substream *substream,
+ return ret;
+
+ /*
+- * We add 1 to the rclk_freq value in order to avoid too low clock
++ * We add 2 to the rclk_freq value in order to avoid too low clock
+ * frequency values due to the EPLL output frequency not being exact
+ * multiple of the audio sampling rate.
+ */
+- rclk_freq = params_rate(params) * rfs + 1;
++ rclk_freq = params_rate(params) * rfs + 2;
+
+ ret = clk_set_rate(priv->sclk_i2s, rclk_freq);
+ if (ret < 0)
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch b/patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch
new file mode 100644
index 0000000000..091c8a4aae
--- /dev/null
+++ b/patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch
@@ -0,0 +1,64 @@
+From 570f18b6a8d1f0e60e8caf30e66161b6438dcc91 Mon Sep 17 00:00:00 2001
+From: Rander Wang <rander.wang@linux.intel.com>
+Date: Fri, 8 Mar 2019 16:38:57 +0800
+Subject: [PATCH] ASoC:soc-pcm:fix a codec fixup issue in TDM case
+Git-commit: 570f18b6a8d1f0e60e8caf30e66161b6438dcc91
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+On HDaudio platforms, if playback is started when capture is working,
+there is no audible output.
+
+This can be root-caused to the use of the rx|tx_mask to store an HDaudio
+stream tag.
+
+If capture is stared before playback, rx_mask would be non-zero on HDaudio
+platform, then the channel number of playback, which is in the same codec
+dai with the capture, would be changed by soc_pcm_codec_params_fixup based
+on the tx_mask at first, then overwritten by this function based on rx_mask
+at last.
+
+According to the author of tx|rx_mask, tx_mask is for playback and rx_mask
+is for capture. And stream direction is checked at all other references of
+tx|rx_mask in ASoC, so here should be an error. This patch checks stream
+direction for tx|rx_mask for fixup function.
+
+This issue would affect not only HDaudio+ASoC, but also I2S codecs if the
+channel number based on rx_mask is not equal to the one for tx_mask. It could
+be rarely reproduecd because most drivers in kernel set the same channel number
+to tx|rx_mask or rx_mask is zero.
+
+Tested on all platforms using stream_tag & HDaudio and intel I2S platforms.
+
+Signed-off-by: Rander Wang <rander.wang@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/soc-pcm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index a5b40e82dea4..e70555a4ea06 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -954,10 +954,13 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream,
+ codec_params = *params;
+
+ /* fixup params based on TDM slot masks */
+- if (codec_dai->tx_mask)
++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
++ codec_dai->tx_mask)
+ soc_pcm_codec_params_fixup(&codec_params,
+ codec_dai->tx_mask);
+- if (codec_dai->rx_mask)
++
++ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE &&
++ codec_dai->rx_mask)
+ soc_pcm_codec_params_fixup(&codec_params,
+ codec_dai->rx_mask);
+
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-stm32-fix-sai-driver-name-initialisation.patch b/patches.drivers/ASoC-stm32-fix-sai-driver-name-initialisation.patch
new file mode 100644
index 0000000000..37746e6740
--- /dev/null
+++ b/patches.drivers/ASoC-stm32-fix-sai-driver-name-initialisation.patch
@@ -0,0 +1,44 @@
+From 17d3069ccf06970e2db3f7cbf4335f207524279e Mon Sep 17 00:00:00 2001
+From: Arnaud Pouliquen <arnaud.pouliquen@st.com>
+Date: Fri, 5 Apr 2019 11:19:11 +0200
+Subject: [PATCH] ASoC: stm32: fix sai driver name initialisation
+Git-commit: 17d3069ccf06970e2db3f7cbf4335f207524279e
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+This patch fixes the sai driver structure overwriting which results in
+a cpu dai name equal NULL.
+
+Fixes: 3e086ed ("ASoC: stm32: add SAI driver")
+
+Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@st.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/stm/stm32_sai_sub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index 55d802f51c15..83d8a7ac56f4 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -1419,7 +1419,6 @@ static int stm32_sai_sub_dais_init(struct platform_device *pdev,
+ if (!sai->cpu_dai_drv)
+ return -ENOMEM;
+
+- sai->cpu_dai_drv->name = dev_name(&pdev->dev);
+ if (STM_SAI_IS_PLAYBACK(sai)) {
+ memcpy(sai->cpu_dai_drv, &stm32_sai_playback_dai,
+ sizeof(stm32_sai_playback_dai));
+@@ -1429,6 +1428,7 @@ static int stm32_sai_sub_dais_init(struct platform_device *pdev,
+ sizeof(stm32_sai_capture_dai));
+ sai->cpu_dai_drv->capture.stream_name = sai->cpu_dai_drv->name;
+ }
++ sai->cpu_dai_drv->name = dev_name(&pdev->dev);
+
+ return 0;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch b/patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch
new file mode 100644
index 0000000000..0d36cb72b5
--- /dev/null
+++ b/patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch
@@ -0,0 +1,35 @@
+From c63adb28f6d913310430f14c69f0a2ea55eed0cc Mon Sep 17 00:00:00 2001
+From: Annaliese McDermond <nh6z@nh6z.net>
+Date: Sat, 30 Mar 2019 09:02:02 -0700
+Subject: [PATCH] ASoC: tlv320aic32x4: Fix Common Pins
+Git-commit: c63adb28f6d913310430f14c69f0a2ea55eed0cc
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The common pins were mistakenly not added to the DAPM graph.
+Adding these pins will allow valid graphs to be created.
+
+Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/tlv320aic32x4.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
+index 96f1526cb258..5520044929f4 100644
+--- a/sound/soc/codecs/tlv320aic32x4.c
++++ b/sound/soc/codecs/tlv320aic32x4.c
+@@ -490,6 +490,8 @@ static const struct snd_soc_dapm_widget aic32x4_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("IN2_R"),
+ SND_SOC_DAPM_INPUT("IN3_L"),
+ SND_SOC_DAPM_INPUT("IN3_R"),
++ SND_SOC_DAPM_INPUT("CM_L"),
++ SND_SOC_DAPM_INPUT("CM_R"),
+ };
+
+ static const struct snd_soc_dapm_route aic32x4_dapm_routes[] = {
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch b/patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch
new file mode 100644
index 0000000000..d1a65f1134
--- /dev/null
+++ b/patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch
@@ -0,0 +1,69 @@
+From a2225a6d155fcb247fe4c6d87f7c91807462966d Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Tue, 19 Mar 2019 11:52:06 +0000
+Subject: [PATCH] ASoC: wm_adsp: Add locking to wm_adsp2_bus_error
+Git-commit: a2225a6d155fcb247fe4c6d87f7c91807462966d
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+Best to lock across handling the bus error to ensure the DSP doesn't
+change power state as we are reading the status registers.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/wm_adsp.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index b3348a213c18..c19a8a041d4d 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -3922,11 +3922,13 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ struct regmap *regmap = dsp->regmap;
+ int ret = 0;
+
++ mutex_lock(&dsp->pwr_lock);
++
+ ret = regmap_read(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL, &val);
+ if (ret) {
+ adsp_err(dsp,
+ "Failed to read Region Lock Ctrl register: %d\n", ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ if (val & ADSP2_WDT_TIMEOUT_STS_MASK) {
+@@ -3945,7 +3947,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ adsp_err(dsp,
+ "Failed to read Bus Err Addr register: %d\n",
+ ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ adsp_err(dsp, "bus error address = 0x%x\n",
+@@ -3958,7 +3960,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ adsp_err(dsp,
+ "Failed to read Pmem Xmem Err Addr register: %d\n",
+ ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ adsp_err(dsp, "xmem error address = 0x%x\n",
+@@ -3971,6 +3973,9 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ regmap_update_bits(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL,
+ ADSP2_CTRL_ERR_EINT, ADSP2_CTRL_ERR_EINT);
+
++error:
++ mutex_unlock(&dsp->pwr_lock);
++
+ return IRQ_HANDLED;
+ }
+ EXPORT_SYMBOL_GPL(wm_adsp2_bus_error);
+--
+2.16.4
+
diff --git a/patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch b/patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch
new file mode 100644
index 0000000000..9d6139897f
--- /dev/null
+++ b/patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch
@@ -0,0 +1,58 @@
+From d5bb334a8e171b262e48f378bd2096c0ea458265 Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Wed, 24 Apr 2019 22:19:17 +0200
+Subject: [PATCH] Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
+Git-commit: d5bb334a8e171b262e48f378bd2096c0ea458265
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The minimum encryption key size for LE connections is 56 bits and to
+align LE with BR/EDR, enforce 56 bits of minimum encryption key size for
+BR/EDR connections as well.
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/net/bluetooth/hci_core.h | 3 +++
+ net/bluetooth/hci_conn.c | 8 ++++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 094e61e07030..05b1b96f4d9e 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -190,6 +190,9 @@ struct adv_info {
+
+ #define HCI_MAX_SHORT_NAME_LENGTH 10
+
++/* Min encryption key size to match with SMP */
++#define HCI_MIN_ENC_KEY_SIZE 7
++
+ /* Default LE RPA expiry time, 15 minutes */
+ #define HCI_DEFAULT_RPA_TIMEOUT (15 * 60)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index bd4978ce8c45..3cf0764d5793 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1276,6 +1276,14 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
+ !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ return 0;
+
++ /* The minimum encryption key size needs to be enforced by the
++ * host stack before establishing any L2CAP connections. The
++ * specification in theory allows a minimum of 1, but to align
++ * BR/EDR and LE transports, a minimum of 7 is chosen.
++ */
++ if (conn->enc_key_size < HCI_MIN_ENC_KEY_SIZE)
++ return 0;
++
+ return 1;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch b/patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch
new file mode 100644
index 0000000000..62087c0f46
--- /dev/null
+++ b/patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch
@@ -0,0 +1,38 @@
+From a1616a5ac99ede5d605047a9012481ce7ff18b16 Mon Sep 17 00:00:00 2001
+From: Young Xiao <YangX92@hotmail.com>
+Date: Fri, 12 Apr 2019 15:24:30 +0800
+Subject: [PATCH] Bluetooth: hidp: fix buffer overflow
+Git-commit: a1616a5ac99ede5d605047a9012481ce7ff18b16
+Patch-mainline: v5.2-rc1
+References: bsc#1051510, CVE-2019-11884, bsc#1134848
+
+Struct ca is copied from userspace. It is not checked whether the "name"
+field is NULL terminated, which allows local users to obtain potentially
+sensitive information from kernel stack memory, via a HIDPCONNADD command.
+
+This vulnerability is similar to CVE-2011-1079.
+
+Signed-off-by: Young Xiao <YangX92@hotmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/bluetooth/hidp/sock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
+index 9f85a1943be9..2151913892ce 100644
+--- a/net/bluetooth/hidp/sock.c
++++ b/net/bluetooth/hidp/sock.c
+@@ -75,6 +75,7 @@ static int do_hidp_sock_ioctl(struct socket *sock, unsigned int cmd, void __user
+ sockfd_put(csock);
+ return err;
+ }
++ ca.name[sizeof(ca.name)-1] = 0;
+
+ err = hidp_connection_add(&ca, csock, isock);
+ if (!err && copy_to_user(argp, &ca, sizeof(ca)))
+--
+2.16.4
+
diff --git a/patches.drivers/HID-debug-fix-race-condition-with-between-rdesc_show.patch b/patches.drivers/HID-debug-fix-race-condition-with-between-rdesc_show.patch
new file mode 100644
index 0000000000..551e5f433b
--- /dev/null
+++ b/patches.drivers/HID-debug-fix-race-condition-with-between-rdesc_show.patch
@@ -0,0 +1,62 @@
+From cef0d4948cb0a02db37ebfdc320e127c77ab1637 Mon Sep 17 00:00:00 2001
+From: "He, Bo" <bo.he@intel.com>
+Date: Thu, 14 Mar 2019 02:28:21 +0000
+Subject: [PATCH] HID: debug: fix race condition with between rdesc_show() and device removal
+Git-commit: cef0d4948cb0a02db37ebfdc320e127c77ab1637
+Patch-mainline: v5.1-rc4
+References: bsc#1051510
+
+There is a race condition that could happen if hid_debug_rdesc_show()
+is running while hdev is in the process of going away (device removal,
+system suspend, etc) which could result in NULL pointer dereference:
+
+ BUG: unable to handle kernel paging request at 0000000783316040
+ CPU: 1 PID: 1512 Comm: getevent Tainted: G U O 4.19.20-quilt-2e5dc0ac-00029-gc455a447dd55 #1
+ RIP: 0010:hid_dump_device+0x9b/0x160
+ Call Trace:
+ hid_debug_rdesc_show+0x72/0x1d0
+ seq_read+0xe0/0x410
+ full_proxy_read+0x5f/0x90
+ __vfs_read+0x3a/0x170
+ vfs_read+0xa0/0x150
+ ksys_read+0x58/0xc0
+ __x64_sys_read+0x1a/0x20
+ do_syscall_64+0x55/0x110
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Grab driver_input_lock to make sure the input device exists throughout the
+whole process of dumping the rdesc.
+
+[jkosina@suse.cz: update changelog a bit]
+Signed-off-by: he, bo <bo.he@intel.com>
+Signed-off-by: "Zhang, Jun" <jun.zhang@intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/hid-debug.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
+index ac9fda1b5a72..1384e57182af 100644
+--- a/drivers/hid/hid-debug.c
++++ b/drivers/hid/hid-debug.c
+@@ -1060,10 +1060,15 @@ static int hid_debug_rdesc_show(struct seq_file *f, void *p)
+ seq_printf(f, "\n\n");
+
+ /* dump parsed data and input mappings */
++ if (down_interruptible(&hdev->driver_input_lock))
++ return 0;
++
+ hid_dump_device(hdev, f);
+ seq_printf(f, "\n");
+ hid_dump_input_mapping(hdev, f);
+
++ up(&hdev->driver_input_lock);
++
+ return 0;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/HID-input-add-mapping-for-Assistant-key.patch b/patches.drivers/HID-input-add-mapping-for-Assistant-key.patch
new file mode 100644
index 0000000000..b0b4f42609
--- /dev/null
+++ b/patches.drivers/HID-input-add-mapping-for-Assistant-key.patch
@@ -0,0 +1,35 @@
+From ce856634af8cda3490947df8ac1ef5843e6356af Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Tue, 2 Apr 2019 09:57:13 -0700
+Subject: [PATCH] HID: input: add mapping for Assistant key
+Git-commit: ce856634af8cda3490947df8ac1ef5843e6356af
+Patch-mainline: v5.1-rc4
+References: bsc#1051510
+
+According to HUTRR89 usage 0x1cb from the consumer page was assigned to
+allow launching desktop-aware assistant application, so let's add the
+mapping.
+
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/hid-input.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index b10b1922c5bd..1fce0076e7dc 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -998,6 +998,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
+ case 0x1b8: map_key_clear(KEY_VIDEO); break;
+ case 0x1bc: map_key_clear(KEY_MESSENGER); break;
+ case 0x1bd: map_key_clear(KEY_INFO); break;
++ case 0x1cb: map_key_clear(KEY_ASSISTANT); break;
+ case 0x201: map_key_clear(KEY_NEW); break;
+ case 0x202: map_key_clear(KEY_OPEN); break;
+ case 0x203: map_key_clear(KEY_CLOSE); break;
+--
+2.16.4
+
diff --git a/patches.drivers/HID-logitech-check-the-return-value-of-create_single.patch b/patches.drivers/HID-logitech-check-the-return-value-of-create_single.patch
new file mode 100644
index 0000000000..52c7c276e0
--- /dev/null
+++ b/patches.drivers/HID-logitech-check-the-return-value-of-create_single.patch
@@ -0,0 +1,49 @@
+From 6c44b15e1c9076d925d5236ddadf1318b0a25ce2 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Thu, 14 Mar 2019 00:24:02 -0500
+Subject: [PATCH] HID: logitech: check the return value of create_singlethread_workqueue
+Git-commit: 6c44b15e1c9076d925d5236ddadf1318b0a25ce2
+Patch-mainline: v5.1-rc4
+References: bsc#1051510
+
+create_singlethread_workqueue may fail and return NULL. The fix checks if it is
+NULL to avoid NULL pointer dereference. Also, the fix moves the call of
+create_singlethread_workqueue earlier to avoid resource-release issues.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/hid-logitech-hidpp.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 15ed6177a7a3..0a243247b231 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -2111,6 +2111,13 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
+ kfree(data);
+ return -ENOMEM;
+ }
++ data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
++ if (!data->wq) {
++ kfree(data->effect_ids);
++ kfree(data);
++ return -ENOMEM;
++ }
++
+ data->hidpp = hidpp;
+ data->feature_index = feature_index;
+ data->version = version;
+@@ -2155,7 +2162,6 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index)
+ /* ignore boost value at response.fap.params[2] */
+
+ /* init the hardware command queue */
+- data->wq = create_singlethread_workqueue("hidpp-ff-sendqueue");
+ atomic_set(&data->workqueue_size, 0);
+
+ /* initialize with zero autocenter to get wheel in usable state */
+--
+2.16.4
+
diff --git a/patches.drivers/Input-introduce-KEY_ASSISTANT.patch b/patches.drivers/Input-introduce-KEY_ASSISTANT.patch
new file mode 100644
index 0000000000..2dd4342066
--- /dev/null
+++ b/patches.drivers/Input-introduce-KEY_ASSISTANT.patch
@@ -0,0 +1,33 @@
+From 88832613715eb46c90b1e75b4c0a537f1cb5797e Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Thu, 22 Jun 2017 09:24:15 -0700
+Subject: [PATCH] Input: introduce KEY_ASSISTANT
+Git-commit: 88832613715eb46c90b1e75b4c0a537f1cb5797e
+Patch-mainline: v4.13-rc1
+References: bsc#1051510
+
+This adds a new keycode to allow users invoke a context-aware desktop
+assistant application.
+
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/uapi/linux/input-event-codes.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
+index f5a8d96e1e09..179891074b3c 100644
+--- a/include/uapi/linux/input-event-codes.h
++++ b/include/uapi/linux/input-event-codes.h
+@@ -600,6 +600,7 @@
+ #define KEY_APPSELECT 0x244 /* AL Select Task/Application */
+ #define KEY_SCREENSAVER 0x245 /* AL Screen Saver */
+ #define KEY_VOICECOMMAND 0x246 /* Listening Voice Command */
++#define KEY_ASSISTANT 0x247 /* AL Context-aware desktop assistant */
+
+ #define KEY_BRIGHTNESS_MIN 0x250 /* Set Brightness to Minimum */
+ #define KEY_BRIGHTNESS_MAX 0x251 /* Set Brightness to Maximum */
+--
+2.16.4
+
diff --git a/patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch b/patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch
new file mode 100644
index 0000000000..b33d241243
--- /dev/null
+++ b/patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch
@@ -0,0 +1,51 @@
+From f0654ba94e33699b295ce4f3dc73094db6209035 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Apr 2019 19:58:32 +0200
+Subject: [PATCH] Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex"
+Git-commit: f0654ba94e33699b295ce4f3dc73094db6209035
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This reverts commit feb689025fbb6f0aa6297d3ddf97de945ea4ad32.
+
+The fix attempt was incorrect, leading to the mutex deadlock through
+the close of OSS sequencer client. The proper fix needs more
+consideration, so let's revert it now.
+
+Fixes: feb689025fbb ("ALSA: seq: Protect in-kernel ioctl calls with mutex")
+Reported-by: syzbot+47ded6c0f23016cde310@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index f256704dc401..de320b1b90de 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2334,19 +2334,14 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
+ {
+ const struct ioctl_handler *handler;
+ struct snd_seq_client *client;
+- int err;
+
+ client = clientptr(clientid);
+ if (client == NULL)
+ return -ENXIO;
+
+ for (handler = ioctl_handlers; handler->cmd > 0; ++handler) {
+- if (handler->cmd == cmd) {
+- mutex_lock(&client->ioctl_mutex);
+- err = handler->func(client, arg);
+- mutex_unlock(&client->ioctl_mutex);
+- return err;
+- }
++ if (handler->cmd == cmd)
++ return handler->func(client, arg);
+ }
+
+ pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n",
+--
+2.16.4
+
diff --git a/patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch b/patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch
new file mode 100644
index 0000000000..675eb7ea9f
--- /dev/null
+++ b/patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch
@@ -0,0 +1,69 @@
+From 0eae4686a128d87503863a261e84887750c8bc68 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 29 Mar 2019 15:47:40 +0100
+Subject: [PATCH] Revert "tty: pty: Fix race condition between release_one_tty and pty_write"
+Git-commit: 0eae4686a128d87503863a261e84887750c8bc68
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This reverts commit b9ca5f8560af244489b4a1bc1ae88b341f24bc95 as 0-day
+shows it has a circular locking dependency.
+
+Fixes: b9ca5f8560af ("tty: pty: Fix race condition between release_one_tty and pty_write")
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Sahara <keun-o.park@darkmatter.ae>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/pty.c | 7 -------
+ drivers/tty/tty_io.c | 3 ---
+ 2 files changed, 10 deletions(-)
+
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index ef72031ab5b9..00099a8439d2 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -116,12 +116,6 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
+ if (tty->stopped)
+ return 0;
+
+- mutex_lock(&tty_mutex);
+- if (to->magic != TTY_MAGIC) {
+- mutex_unlock(&tty_mutex);
+- return -EIO;
+- }
+-
+ if (c > 0) {
+ spin_lock_irqsave(&to->port->lock, flags);
+ /* Stuff the data into the input queue of the other end */
+@@ -131,7 +125,6 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
+ tty_flip_buffer_push(to->port);
+ spin_unlock_irqrestore(&to->port->lock, flags);
+ }
+- mutex_unlock(&tty_mutex);
+ return c;
+ }
+
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index c27777f3b8c4..5fa250157025 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1448,13 +1448,10 @@ static void release_one_tty(struct work_struct *work)
+ struct tty_driver *driver = tty->driver;
+ struct module *owner = driver->owner;
+
+- mutex_lock(&tty_mutex);
+ if (tty->ops->cleanup)
+ tty->ops->cleanup(tty);
+
+ tty->magic = 0;
+- mutex_unlock(&tty_mutex);
+-
+ tty_driver_kref_put(driver);
+ module_put(owner);
+
+--
+2.16.4
+
diff --git a/patches.drivers/USB-cdc-acm-fix-unthrottle-races.patch b/patches.drivers/USB-cdc-acm-fix-unthrottle-races.patch
new file mode 100644
index 0000000000..734e713598
--- /dev/null
+++ b/patches.drivers/USB-cdc-acm-fix-unthrottle-races.patch
@@ -0,0 +1,136 @@
+From 764478f41130f1b8d8057575b89e69980a0f600d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 25 Apr 2019 18:05:39 +0200
+Subject: [PATCH] USB: cdc-acm: fix unthrottle races
+Git-commit: 764478f41130f1b8d8057575b89e69980a0f600d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Fix two long-standing bugs which could potentially lead to memory
+corruption or leave the port throttled until it is reopened (on weakly
+ordered systems), respectively, when read-URB completion races with
+unthrottle().
+
+First, the URB must not be marked as free before processing is complete
+to prevent it from being submitted by unthrottle() on another CPU.
+
+ CPU 1 CPU 2
+ ================ ================
+ complete() unthrottle()
+ process_urb();
+ smp_mb__before_atomic();
+ set_bit(i, free); if (test_and_clear_bit(i, free))
+ submit_urb();
+
+Second, the URB must be marked as free before checking the throttled
+flag to prevent unthrottle() on another CPU from failing to observe that
+the URB needs to be submitted if complete() sees that the throttled flag
+is set.
+
+ CPU 1 CPU 2
+ ================ ================
+ complete() unthrottle()
+ set_bit(i, free); throttled = 0;
+ smp_mb__after_atomic(); smp_mb();
+ if (throttled) if (test_and_clear_bit(i, free))
+ return; submit_urb();
+
+Note that test_and_clear_bit() only implies barriers when the test is
+successful. To handle the case where the URB is still in use an explicit
+barrier needs to be added to unthrottle() for the second race condition.
+
+Also note that the first race was fixed by 36e59e0d70d6 ("cdc-acm: fix
+race between callback and unthrottle") back in 2015, but the bug was
+reintroduced a year later.
+
+Fixes: 1aba579f3cf5 ("cdc-acm: handle read pipe errors")
+Fixes: 088c64f81284 ("USB: cdc-acm: re-write read processing")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c | 32 +++++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index ec666eb4b7b4..c03aa8550980 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -470,12 +470,12 @@ static void acm_read_bulk_callback(struct urb *urb)
+ struct acm *acm = rb->instance;
+ unsigned long flags;
+ int status = urb->status;
++ bool stopped = false;
++ bool stalled = false;
+
+ dev_vdbg(&acm->data->dev, "got urb %d, len %d, status %d\n",
+ rb->index, urb->actual_length, status);
+
+- set_bit(rb->index, &acm->read_urbs_free);
+-
+ if (!acm->dev) {
+ dev_dbg(&acm->data->dev, "%s - disconnected\n", __func__);
+ return;
+@@ -488,15 +488,16 @@ static void acm_read_bulk_callback(struct urb *urb)
+ break;
+ case -EPIPE:
+ set_bit(EVENT_RX_STALL, &acm->flags);
+- schedule_work(&acm->work);
+- return;
++ stalled = true;
++ break;
+ case -ENOENT:
+ case -ECONNRESET:
+ case -ESHUTDOWN:
+ dev_dbg(&acm->data->dev,
+ "%s - urb shutting down with status: %d\n",
+ __func__, status);
+- return;
++ stopped = true;
++ break;
+ default:
+ dev_dbg(&acm->data->dev,
+ "%s - nonzero urb status received: %d\n",
+@@ -505,10 +506,24 @@ static void acm_read_bulk_callback(struct urb *urb)
+ }
+
+ /*
+- * Unthrottle may run on another CPU which needs to see events
+- * in the same order. Submission has an implict barrier
++ * Make sure URB processing is done before marking as free to avoid
++ * racing with unthrottle() on another CPU. Matches the barriers
++ * implied by the test_and_clear_bit() in acm_submit_read_urb().
+ */
+ smp_mb__before_atomic();
++ set_bit(rb->index, &acm->read_urbs_free);
++ /*
++ * Make sure URB is marked as free before checking the throttled flag
++ * to avoid racing with unthrottle() on another CPU. Matches the
++ * smp_mb() in unthrottle().
++ */
++ smp_mb__after_atomic();
++
++ if (stopped || stalled) {
++ if (stalled)
++ schedule_work(&acm->work);
++ return;
++ }
+
+ /* throttle device if requested by tty */
+ spin_lock_irqsave(&acm->read_lock, flags);
+@@ -842,6 +857,9 @@ static void acm_tty_unthrottle(struct tty_struct *tty)
+ acm->throttle_req = 0;
+ spin_unlock_irq(&acm->read_lock);
+
++ /* Matches the smp_mb__after_atomic() in acm_read_bulk_callback(). */
++ smp_mb();
++
+ if (was_throttled)
+ acm_submit_read_urbs(acm, GFP_KERNEL);
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/USB-core-Fix-bug-caused-by-duplicate-interface-PM-us.patch b/patches.drivers/USB-core-Fix-bug-caused-by-duplicate-interface-PM-us.patch
new file mode 100644
index 0000000000..cdde2539aa
--- /dev/null
+++ b/patches.drivers/USB-core-Fix-bug-caused-by-duplicate-interface-PM-us.patch
@@ -0,0 +1,222 @@
+From c2b71462d294cf517a0bc6e4fd6424d7cee5596f Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 19 Apr 2019 13:52:38 -0400
+Subject: [PATCH] USB: core: Fix bug caused by duplicate interface PM usage counter
+Git-commit: c2b71462d294cf517a0bc6e4fd6424d7cee5596f
+Patch-mainline: v5.1
+References: bsc#1051510
+
+The syzkaller fuzzer reported a bug in the USB hub driver which turned
+out to be caused by a negative runtime-PM usage counter. This allowed
+a hub to be runtime suspended at a time when the driver did not expect
+it. The symptom is a WARNING issued because the hub's status URB is
+submitted while it is already active:
+
+ URB 0000000031fb463e submitted while active
+ WARNING: CPU: 0 PID: 2917 at drivers/usb/core/urb.c:363
+
+The negative runtime-PM usage count was caused by an unfortunate
+design decision made when runtime PM was first implemented for USB.
+At that time, USB class drivers were allowed to unbind from their
+interfaces without balancing the usage counter (i.e., leaving it with
+a positive count). The core code would take care of setting the
+counter back to 0 before allowing another driver to bind to the
+interface.
+
+Later on when runtime PM was implemented for the entire kernel, the
+opposite decision was made: Drivers were required to balance their
+runtime-PM get and put calls. In order to maintain backward
+compatibility, however, the USB subsystem adapted to the new
+implementation by keeping an independent usage counter for each
+interface and using it to automatically adjust the normal usage
+counter back to 0 whenever a driver was unbound.
+
+This approach involves duplicating information, but what is worse, it
+doesn't work properly in cases where a USB class driver delays
+decrementing the usage counter until after the driver's disconnect()
+routine has returned and the counter has been adjusted back to 0.
+Doing so would cause the usage counter to become negative. There's
+even a warning about this in the USB power management documentation!
+
+As it happens, this is exactly what the hub driver does. The
+kick_hub_wq() routine increments the runtime-PM usage counter, and the
+corresponding decrement is carried out by hub_event() in the context
+of the hub_wq work-queue thread. This work routine may sometimes run
+after the driver has been unbound from its interface, and when it does
+it causes the usage counter to go negative.
+
+It is not possible for hub_disconnect() to wait for a pending
+hub_event() call to finish, because hub_disconnect() is called with
+the device lock held and hub_event() acquires that lock. The only
+feasible fix is to reverse the original design decision: remove the
+duplicate interface-specific usage counter and require USB drivers to
+balance their runtime PM gets and puts. As far as I know, all
+existing drivers currently do this.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: syzbot+7634edaea4d0b341c625@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ Documentation/driver-api/usb/power-management.rst | 14 +++++++++-----
+ drivers/usb/core/driver.c | 13 -------------
+ drivers/usb/storage/realtek_cr.c | 13 +++++--------
+ include/linux/usb.h | 2 --
+ 4 files changed, 14 insertions(+), 28 deletions(-)
+
+diff --git a/Documentation/driver-api/usb/power-management.rst b/Documentation/driver-api/usb/power-management.rst
+index 79beb807996b..4a74cf6f2797 100644
+--- a/Documentation/driver-api/usb/power-management.rst
++++ b/Documentation/driver-api/usb/power-management.rst
+@@ -370,11 +370,15 @@ autosuspend the interface's device. When the usage counter is = 0
+ then the interface is considered to be idle, and the kernel may
+ autosuspend the device.
+
+-Drivers need not be concerned about balancing changes to the usage
+-counter; the USB core will undo any remaining "get"s when a driver
+-is unbound from its interface. As a corollary, drivers must not call
+-any of the ``usb_autopm_*`` functions after their ``disconnect``
+-routine has returned.
++Drivers must be careful to balance their overall changes to the usage
++counter. Unbalanced "get"s will remain in effect when a driver is
++unbound from its interface, preventing the device from going into
++runtime suspend should the interface be bound to a driver again. On
++the other hand, drivers are allowed to achieve this balance by calling
++the ``usb_autopm_*`` functions even after their ``disconnect`` routine
++has returned -- say from within a work-queue routine -- provided they
++retain an active reference to the interface (via ``usb_get_intf`` and
++``usb_put_intf``).
+
+ Drivers using the async routines are responsible for their own
+ synchronization and mutual exclusion.
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index 8987cec9549d..ebcadaad89d1 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -473,11 +473,6 @@ static int usb_unbind_interface(struct device *dev)
+ pm_runtime_disable(dev);
+ pm_runtime_set_suspended(dev);
+
+- /* Undo any residual pm_autopm_get_interface_* calls */
+- for (r = atomic_read(&intf->pm_usage_cnt); r > 0; --r)
+- usb_autopm_put_interface_no_suspend(intf);
+- atomic_set(&intf->pm_usage_cnt, 0);
+-
+ if (!error)
+ usb_autosuspend_device(udev);
+
+@@ -1633,7 +1628,6 @@ void usb_autopm_put_interface(struct usb_interface *intf)
+ int status;
+
+ usb_mark_last_busy(udev);
+- atomic_dec(&intf->pm_usage_cnt);
+ status = pm_runtime_put_sync(&intf->dev);
+ dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
+ __func__, atomic_read(&intf->dev.power.usage_count),
+@@ -1662,7 +1656,6 @@ void usb_autopm_put_interface_async(struct usb_interface *intf)
+ int status;
+
+ usb_mark_last_busy(udev);
+- atomic_dec(&intf->pm_usage_cnt);
+ status = pm_runtime_put(&intf->dev);
+ dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
+ __func__, atomic_read(&intf->dev.power.usage_count),
+@@ -1684,7 +1677,6 @@ void usb_autopm_put_interface_no_suspend(struct usb_interface *intf)
+ struct usb_device *udev = interface_to_usbdev(intf);
+
+ usb_mark_last_busy(udev);
+- atomic_dec(&intf->pm_usage_cnt);
+ pm_runtime_put_noidle(&intf->dev);
+ }
+ EXPORT_SYMBOL_GPL(usb_autopm_put_interface_no_suspend);
+@@ -1715,8 +1707,6 @@ int usb_autopm_get_interface(struct usb_interface *intf)
+ status = pm_runtime_get_sync(&intf->dev);
+ if (status < 0)
+ pm_runtime_put_sync(&intf->dev);
+- else
+- atomic_inc(&intf->pm_usage_cnt);
+ dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
+ __func__, atomic_read(&intf->dev.power.usage_count),
+ status);
+@@ -1750,8 +1740,6 @@ int usb_autopm_get_interface_async(struct usb_interface *intf)
+ status = pm_runtime_get(&intf->dev);
+ if (status < 0 && status != -EINPROGRESS)
+ pm_runtime_put_noidle(&intf->dev);
+- else
+- atomic_inc(&intf->pm_usage_cnt);
+ dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
+ __func__, atomic_read(&intf->dev.power.usage_count),
+ status);
+@@ -1775,7 +1763,6 @@ void usb_autopm_get_interface_no_resume(struct usb_interface *intf)
+ struct usb_device *udev = interface_to_usbdev(intf);
+
+ usb_mark_last_busy(udev);
+- atomic_inc(&intf->pm_usage_cnt);
+ pm_runtime_get_noresume(&intf->dev);
+ }
+ EXPORT_SYMBOL_GPL(usb_autopm_get_interface_no_resume);
+diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
+index 31b024441938..cc794e25a0b6 100644
+--- a/drivers/usb/storage/realtek_cr.c
++++ b/drivers/usb/storage/realtek_cr.c
+@@ -763,18 +763,16 @@ static void rts51x_suspend_timer_fn(struct timer_list *t)
+ break;
+ case RTS51X_STAT_IDLE:
+ case RTS51X_STAT_SS:
+- usb_stor_dbg(us, "RTS51X_STAT_SS, intf->pm_usage_cnt:%d, power.usage:%d\n",
+- atomic_read(&us->pusb_intf->pm_usage_cnt),
++ usb_stor_dbg(us, "RTS51X_STAT_SS, power.usage:%d\n",
+ atomic_read(&us->pusb_intf->dev.power.usage_count));
+
+- if (atomic_read(&us->pusb_intf->pm_usage_cnt) > 0) {
++ if (atomic_read(&us->pusb_intf->dev.power.usage_count) > 0) {
+ usb_stor_dbg(us, "Ready to enter SS state\n");
+ rts51x_set_stat(chip, RTS51X_STAT_SS);
+ /* ignore mass storage interface's children */
+ pm_suspend_ignore_children(&us->pusb_intf->dev, true);
+ usb_autopm_put_interface_async(us->pusb_intf);
+- usb_stor_dbg(us, "RTS51X_STAT_SS 01, intf->pm_usage_cnt:%d, power.usage:%d\n",
+- atomic_read(&us->pusb_intf->pm_usage_cnt),
++ usb_stor_dbg(us, "RTS51X_STAT_SS 01, power.usage:%d\n",
+ atomic_read(&us->pusb_intf->dev.power.usage_count));
+ }
+ break;
+@@ -807,11 +805,10 @@ static void rts51x_invoke_transport(struct scsi_cmnd *srb, struct us_data *us)
+ int ret;
+
+ if (working_scsi(srb)) {
+- usb_stor_dbg(us, "working scsi, intf->pm_usage_cnt:%d, power.usage:%d\n",
+- atomic_read(&us->pusb_intf->pm_usage_cnt),
++ usb_stor_dbg(us, "working scsi, power.usage:%d\n",
+ atomic_read(&us->pusb_intf->dev.power.usage_count));
+
+- if (atomic_read(&us->pusb_intf->pm_usage_cnt) <= 0) {
++ if (atomic_read(&us->pusb_intf->dev.power.usage_count) <= 0) {
+ ret = usb_autopm_get_interface(us->pusb_intf);
+ usb_stor_dbg(us, "working scsi, ret=%d\n", ret);
+ }
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 5e49e82c4368..ff010d1fd1c7 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -200,7 +200,6 @@ usb_find_last_int_out_endpoint(struct usb_host_interface *alt,
+ * @dev: driver model's view of this device
+ * @usb_dev: if an interface is bound to the USB major, this will point
+ * to the sysfs representation for that device.
+- * @pm_usage_cnt: PM usage counter for this interface
+ * @reset_ws: Used for scheduling resets from atomic context.
+ * @resetting_device: USB core reset the device, so use alt setting 0 as
+ * current; needs bandwidth alloc after reset.
+@@ -257,7 +256,6 @@ struct usb_interface {
+
+ struct device dev; /* interface specific device info */
+ struct device *usb_dev;
+- atomic_t pm_usage_cnt; /* usage counter for autosuspend */
+ struct work_struct reset_ws; /* for resets in atomic context */
+ };
+ #define to_usb_interface(d) container_of(d, struct usb_interface, dev)
+--
+2.16.4
+
diff --git a/patches.drivers/USB-core-Fix-unterminated-string-returned-by-usb_str.patch b/patches.drivers/USB-core-Fix-unterminated-string-returned-by-usb_str.patch
new file mode 100644
index 0000000000..b7dee04f1e
--- /dev/null
+++ b/patches.drivers/USB-core-Fix-unterminated-string-returned-by-usb_str.patch
@@ -0,0 +1,54 @@
+From c01c348ecdc66085e44912c97368809612231520 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 15 Apr 2019 11:51:38 -0400
+Subject: [PATCH] USB: core: Fix unterminated string returned by usb_string()
+Git-commit: c01c348ecdc66085e44912c97368809612231520
+Patch-mainline: v5.1
+References: bsc#1051510
+
+Some drivers (such as the vub300 MMC driver) expect usb_string() to
+return a properly NUL-terminated string, even when an error occurs.
+(In fact, vub300's probe routine doesn't bother to check the return
+code from usb_string().) When the driver goes on to use an
+unterminated string, it leads to kernel errors such as
+stack-out-of-bounds, as found by the syzkaller USB fuzzer.
+
+An out-of-range string index argument is not at all unlikely, given
+that some devices don't provide string descriptors and therefore list
+0 as the value for their string indexes. This patch makes
+usb_string() return a properly terminated empty string along with the
+-EINVAL error code when an out-of-range index is encountered.
+
+And since a USB string index is a single-byte value, indexes >= 256
+are just as invalid as values of 0 or below.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: syzbot+b75b85111c10b8d680f1@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/core/message.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index 82239f27c4cc..e844bb7b5676 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -820,9 +820,11 @@ int usb_string(struct usb_device *dev, int index, char *buf, size_t size)
+
+ if (dev->state == USB_STATE_SUSPENDED)
+ return -EHOSTUNREACH;
+- if (size <= 0 || !buf || !index)
++ if (size <= 0 || !buf)
+ return -EINVAL;
+ buf[0] = 0;
++ if (index <= 0 || index >= 256)
++ return -EINVAL;
+ tbuf = kmalloc(256, GFP_NOIO);
+ if (!tbuf)
+ return -ENOMEM;
+--
+2.16.4
+
diff --git a/patches.drivers/USB-serial-f81232-fix-interrupt-worker-not-stop.patch b/patches.drivers/USB-serial-f81232-fix-interrupt-worker-not-stop.patch
new file mode 100644
index 0000000000..dcd37d93fa
--- /dev/null
+++ b/patches.drivers/USB-serial-f81232-fix-interrupt-worker-not-stop.patch
@@ -0,0 +1,97 @@
+From 804dbee1e49774918339c1e5a87400988c0819e8 Mon Sep 17 00:00:00 2001
+From: "Ji-Ze Hong (Peter Hong)" <hpeter@gmail.com>
+Date: Tue, 30 Apr 2019 09:22:29 +0800
+Subject: [PATCH] USB: serial: f81232: fix interrupt worker not stop
+Git-commit: 804dbee1e49774918339c1e5a87400988c0819e8
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The F81232 will use interrupt worker to handle MSR change.
+This patch will fix the issue that interrupt work should stop
+in close() and suspend().
+
+This also fixes line-status events being disabled after a suspend cycle
+until the port is re-opened.
+
+Signed-off-by: Ji-Ze Hong (Peter Hong) <hpeter+linux_kernel@gmail.com>
+[ johan: amend commit message ]
+
+Fixes: 87fe5adcd8de ("USB: f81232: implement read IIR/MSR with endpoint")
+Cc: stable <stable@vger.kernel.org> # 4.1
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/f81232.c | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/drivers/usb/serial/f81232.c b/drivers/usb/serial/f81232.c
+index 0dcdcb4b2cde..dee6f2caf9b5 100644
+--- a/drivers/usb/serial/f81232.c
++++ b/drivers/usb/serial/f81232.c
+@@ -556,9 +556,12 @@ static int f81232_open(struct tty_struct *tty, struct usb_serial_port *port)
+
+ static void f81232_close(struct usb_serial_port *port)
+ {
++ struct f81232_private *port_priv = usb_get_serial_port_data(port);
++
+ f81232_port_disable(port);
+ usb_serial_generic_close(port);
+ usb_kill_urb(port->interrupt_in_urb);
++ flush_work(&port_priv->interrupt_work);
+ }
+
+ static void f81232_dtr_rts(struct usb_serial_port *port, int on)
+@@ -632,6 +635,40 @@ static int f81232_port_remove(struct usb_serial_port *port)
+ return 0;
+ }
+
++static int f81232_suspend(struct usb_serial *serial, pm_message_t message)
++{
++ struct usb_serial_port *port = serial->port[0];
++ struct f81232_private *port_priv = usb_get_serial_port_data(port);
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(port->read_urbs); ++i)
++ usb_kill_urb(port->read_urbs[i]);
++
++ usb_kill_urb(port->interrupt_in_urb);
++
++ if (port_priv)
++ flush_work(&port_priv->interrupt_work);
++
++ return 0;
++}
++
++static int f81232_resume(struct usb_serial *serial)
++{
++ struct usb_serial_port *port = serial->port[0];
++ int result;
++
++ if (tty_port_initialized(&port->port)) {
++ result = usb_submit_urb(port->interrupt_in_urb, GFP_NOIO);
++ if (result) {
++ dev_err(&port->dev, "submit interrupt urb failed: %d\n",
++ result);
++ return result;
++ }
++ }
++
++ return usb_serial_generic_resume(serial);
++}
++
+ static struct usb_serial_driver f81232_device = {
+ .driver = {
+ .owner = THIS_MODULE,
+@@ -655,6 +692,8 @@ static struct usb_serial_driver f81232_device = {
+ .read_int_callback = f81232_read_int_callback,
+ .port_probe = f81232_port_probe,
+ .port_remove = f81232_port_remove,
++ .suspend = f81232_suspend,
++ .resume = f81232_resume,
+ };
+
+ static struct usb_serial_driver * const serial_drivers[] = {
+--
+2.16.4
+
diff --git a/patches.drivers/USB-serial-fix-unthrottle-races.patch b/patches.drivers/USB-serial-fix-unthrottle-races.patch
new file mode 100644
index 0000000000..2054a10859
--- /dev/null
+++ b/patches.drivers/USB-serial-fix-unthrottle-races.patch
@@ -0,0 +1,136 @@
+From 3f5edd58d040bfa4b74fb89bc02f0bc6b9cd06ab Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 25 Apr 2019 18:05:36 +0200
+Subject: [PATCH] USB: serial: fix unthrottle races
+Git-commit: 3f5edd58d040bfa4b74fb89bc02f0bc6b9cd06ab
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Fix two long-standing bugs which could potentially lead to memory
+corruption or leave the port throttled until it is reopened (on weakly
+ordered systems), respectively, when read-URB completion races with
+unthrottle().
+
+First, the URB must not be marked as free before processing is complete
+to prevent it from being submitted by unthrottle() on another CPU.
+
+ CPU 1 CPU 2
+ ================ ================
+ complete() unthrottle()
+ process_urb();
+ smp_mb__before_atomic();
+ set_bit(i, free); if (test_and_clear_bit(i, free))
+ submit_urb();
+
+Second, the URB must be marked as free before checking the throttled
+flag to prevent unthrottle() on another CPU from failing to observe that
+the URB needs to be submitted if complete() sees that the throttled flag
+is set.
+
+ CPU 1 CPU 2
+ ================ ================
+ complete() unthrottle()
+ set_bit(i, free); throttled = 0;
+ smp_mb__after_atomic(); smp_mb();
+ if (throttled) if (test_and_clear_bit(i, free))
+ return; submit_urb();
+
+Note that test_and_clear_bit() only implies barriers when the test is
+successful. To handle the case where the URB is still in use an explicit
+barrier needs to be added to unthrottle() for the second race condition.
+
+Fixes: d83b405383c9 ("USB: serial: add support for multiple read urbs")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/generic.c | 39 ++++++++++++++++++++++++++++++++-------
+ 1 file changed, 32 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
+index 2274d9625f63..0fff4968ea1b 100644
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -376,6 +376,7 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
+ struct usb_serial_port *port = urb->context;
+ unsigned char *data = urb->transfer_buffer;
+ unsigned long flags;
++ bool stopped = false;
+ int status = urb->status;
+ int i;
+
+@@ -383,33 +384,51 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
+ if (urb == port->read_urbs[i])
+ break;
+ }
+- set_bit(i, &port->read_urbs_free);
+
+ dev_dbg(&port->dev, "%s - urb %d, len %d\n", __func__, i,
+ urb->actual_length);
+ switch (status) {
+ case 0:
++ usb_serial_debug_data(&port->dev, __func__, urb->actual_length,
++ data);
++ port->serial->type->process_read_urb(urb);
+ break;
+ case -ENOENT:
+ case -ECONNRESET:
+ case -ESHUTDOWN:
+ dev_dbg(&port->dev, "%s - urb stopped: %d\n",
+ __func__, status);
+- return;
++ stopped = true;
++ break;
+ case -EPIPE:
+ dev_err(&port->dev, "%s - urb stopped: %d\n",
+ __func__, status);
+- return;
++ stopped = true;
++ break;
+ default:
+ dev_dbg(&port->dev, "%s - nonzero urb status: %d\n",
+ __func__, status);
+- goto resubmit;
++ break;
+ }
+
+- usb_serial_debug_data(&port->dev, __func__, urb->actual_length, data);
+- port->serial->type->process_read_urb(urb);
++ /*
++ * Make sure URB processing is done before marking as free to avoid
++ * racing with unthrottle() on another CPU. Matches the barriers
++ * implied by the test_and_clear_bit() in
++ * usb_serial_generic_submit_read_urb().
++ */
++ smp_mb__before_atomic();
++ set_bit(i, &port->read_urbs_free);
++ /*
++ * Make sure URB is marked as free before checking the throttled flag
++ * to avoid racing with unthrottle() on another CPU. Matches the
++ * smp_mb() in unthrottle().
++ */
++ smp_mb__after_atomic();
++
++ if (stopped)
++ return;
+
+-resubmit:
+ /* Throttle the device if requested by tty */
+ spin_lock_irqsave(&port->lock, flags);
+ port->throttled = port->throttle_req;
+@@ -484,6 +503,12 @@ void usb_serial_generic_unthrottle(struct tty_struct *tty)
+ port->throttled = port->throttle_req = 0;
+ spin_unlock_irq(&port->lock);
+
++ /*
++ * Matches the smp_mb__after_atomic() in
++ * usb_serial_generic_read_bulk_callback().
++ */
++ smp_mb();
++
+ if (was_throttled)
+ usb_serial_generic_submit_read_urbs(port, GFP_KERNEL);
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/USB-w1-ds2490-Fix-bug-caused-by-improper-use-of-alts.patch b/patches.drivers/USB-w1-ds2490-Fix-bug-caused-by-improper-use-of-alts.patch
new file mode 100644
index 0000000000..a4d4123f5c
--- /dev/null
+++ b/patches.drivers/USB-w1-ds2490-Fix-bug-caused-by-improper-use-of-alts.patch
@@ -0,0 +1,55 @@
+From c114944d7d67f24e71562fcfc18d550ab787e4d4 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 22 Apr 2019 11:16:04 -0400
+Subject: [PATCH] USB: w1 ds2490: Fix bug caused by improper use of altsetting array
+Git-commit: c114944d7d67f24e71562fcfc18d550ab787e4d4
+Patch-mainline: v5.1
+References: bsc#1051510
+
+The syzkaller USB fuzzer spotted a slab-out-of-bounds bug in the
+ds2490 driver. This bug is caused by improper use of the altsetting
+array in the usb_interface structure (the array's entries are not
+always stored in numerical order), combined with a naive assumption
+that all interfaces probed by the driver will have the expected number
+of altsettings.
+
+The bug can be fixed by replacing references to the possibly
+non-existent intf->altsetting[alt] entry with the guaranteed-to-exist
+intf->cur_altsetting entry.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: syzbot+d65f673b847a1a96cdba@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/w1/masters/ds2490.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/w1/masters/ds2490.c b/drivers/w1/masters/ds2490.c
+index 0f4ecfcdb549..a9fb77585272 100644
+--- a/drivers/w1/masters/ds2490.c
++++ b/drivers/w1/masters/ds2490.c
+@@ -1016,15 +1016,15 @@ static int ds_probe(struct usb_interface *intf,
+ /* alternative 3, 1ms interrupt (greatly speeds search), 64 byte bulk */
+ alt = 3;
+ err = usb_set_interface(dev->udev,
+- intf->altsetting[alt].desc.bInterfaceNumber, alt);
++ intf->cur_altsetting->desc.bInterfaceNumber, alt);
+ if (err) {
+ dev_err(&dev->udev->dev, "Failed to set alternative setting %d "
+ "for %d interface: err=%d.\n", alt,
+- intf->altsetting[alt].desc.bInterfaceNumber, err);
++ intf->cur_altsetting->desc.bInterfaceNumber, err);
+ goto err_out_clear;
+ }
+
+- iface_desc = &intf->altsetting[alt];
++ iface_desc = intf->cur_altsetting;
+ if (iface_desc->desc.bNumEndpoints != NUM_EP-1) {
+ pr_info("Num endpoints=%d. It is not DS9490R.\n",
+ iface_desc->desc.bNumEndpoints);
+--
+2.16.4
+
diff --git a/patches.drivers/USB-yurex-Fix-protection-fault-after-device-removal.patch b/patches.drivers/USB-yurex-Fix-protection-fault-after-device-removal.patch
new file mode 100644
index 0000000000..31cc850efb
--- /dev/null
+++ b/patches.drivers/USB-yurex-Fix-protection-fault-after-device-removal.patch
@@ -0,0 +1,45 @@
+From ef61eb43ada6c1d6b94668f0f514e4c268093ff3 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 23 Apr 2019 14:48:29 -0400
+Subject: [PATCH] USB: yurex: Fix protection fault after device removal
+Git-commit: ef61eb43ada6c1d6b94668f0f514e4c268093ff3
+Patch-mainline: v5.1
+References: bsc#1051510
+
+The syzkaller USB fuzzer found a general-protection-fault bug in the
+yurex driver. The fault occurs when a device has been unplugged; the
+driver's interrupt-URB handler logs an error message referring to the
+device by name, after the device has been unregistered and its name
+deallocated.
+
+This problem is caused by the fact that the interrupt URB isn't
+cancelled until the driver's private data structure is released, which
+can happen long after the device is gone. The cure is to make sure
+that the interrupt URB is killed before yurex_disconnect() returns;
+this is exactly the sort of thing that usb_poison_urb() was meant for.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: syzbot+2eb9121678bdb36e6d57@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/misc/yurex.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index 6d9fd5f64903..7b306aa22d25 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -314,6 +314,7 @@ static void yurex_disconnect(struct usb_interface *interface)
+ usb_deregister_dev(interface, &yurex_class);
+
+ /* prevent more I/O from starting */
++ usb_poison_urb(dev->urb);
+ mutex_lock(&dev->io_mutex);
+ dev->interface = NULL;
+ mutex_unlock(&dev->io_mutex);
+--
+2.16.4
+
diff --git a/patches.drivers/at76c50x-usb-Don-t-register-led_trigger-if-usb_regis.patch b/patches.drivers/at76c50x-usb-Don-t-register-led_trigger-if-usb_regis.patch
new file mode 100644
index 0000000000..6314c59e40
--- /dev/null
+++ b/patches.drivers/at76c50x-usb-Don-t-register-led_trigger-if-usb_regis.patch
@@ -0,0 +1,93 @@
+From 09ac2694b0475f96be895848687ebcbba97eeecf Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Mon, 8 Apr 2019 11:45:29 +0800
+Subject: [PATCH] at76c50x-usb: Don't register led_trigger if usb_register_driver failed
+Git-commit: 09ac2694b0475f96be895848687ebcbba97eeecf
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Syzkaller report this:
+
+[ 1213.468581] BUG: unable to handle kernel paging request at fffffbfff83bf338
+[ 1213.469530] #PF error: [normal kernel read fault]
+[ 1213.469530] PGD 237fe4067 P4D 237fe4067 PUD 237e60067 PMD 1c868b067 PTE 0
+[ 1213.473514] Oops: 0000 [#1] SMP KASAN PTI
+[ 1213.473514] CPU: 0 PID: 6321 Comm: syz-executor.0 Tainted: G C 5.1.0-rc3+ #8
+[ 1213.473514] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+[ 1213.473514] RIP: 0010:strcmp+0x31/0xa0
+[ 1213.473514] Code: 00 00 00 00 fc ff df 55 53 48 83 ec 08 eb 0a 84 db 48 89 ef 74 5a 4c 89 e6 48 89 f8 48 89 fa 48 8d 6f 01 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 04 84 c0 75 50 48 89 f0 48 89 f2 0f b6 5d
+[ 1213.473514] RSP: 0018:ffff8881f2b7f950 EFLAGS: 00010246
+[ 1213.473514] RAX: 1ffffffff83bf338 RBX: ffff8881ea6f7240 RCX: ffffffff825350c6
+[ 1213.473514] RDX: 0000000000000000 RSI: ffffffffc1ee19c0 RDI: ffffffffc1df99c0
+[ 1213.473514] RBP: ffffffffc1df99c1 R08: 0000000000000001 R09: 0000000000000004
+[ 1213.473514] R10: 0000000000000000 R11: ffff8881de353f00 R12: ffff8881ee727900
+[ 1213.473514] R13: dffffc0000000000 R14: 0000000000000001 R15: ffffffffc1eeaaf0
+[ 1213.473514] FS: 00007fa66fa01700(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000
+[ 1213.473514] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 1213.473514] CR2: fffffbfff83bf338 CR3: 00000001ebb9e005 CR4: 00000000007606f0
+[ 1213.473514] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 1213.473514] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 1213.473514] PKRU: 55555554
+[ 1213.473514] Call Trace:
+[ 1213.473514] led_trigger_register+0x112/0x3f0
+[ 1213.473514] led_trigger_register_simple+0x7a/0x110
+[ 1213.473514] ? 0xffffffffc1c10000
+[ 1213.473514] at76_mod_init+0x77/0x1000 [at76c50x_usb]
+[ 1213.473514] do_one_initcall+0xbc/0x47d
+[ 1213.473514] ? perf_trace_initcall_level+0x3a0/0x3a0
+[ 1213.473514] ? kasan_unpoison_shadow+0x30/0x40
+[ 1213.473514] ? kasan_unpoison_shadow+0x30/0x40
+[ 1213.473514] do_init_module+0x1b5/0x547
+[ 1213.473514] load_module+0x6405/0x8c10
+[ 1213.473514] ? module_frob_arch_sections+0x20/0x20
+[ 1213.473514] ? kernel_read_file+0x1e6/0x5d0
+[ 1213.473514] ? find_held_lock+0x32/0x1c0
+[ 1213.473514] ? cap_capable+0x1ae/0x210
+[ 1213.473514] ? __do_sys_finit_module+0x162/0x190
+[ 1213.473514] __do_sys_finit_module+0x162/0x190
+[ 1213.473514] ? __ia32_sys_init_module+0xa0/0xa0
+[ 1213.473514] ? __mutex_unlock_slowpath+0xdc/0x690
+[ 1213.473514] ? wait_for_completion+0x370/0x370
+[ 1213.473514] ? vfs_write+0x204/0x4a0
+[ 1213.473514] ? do_syscall_64+0x18/0x450
+[ 1213.473514] do_syscall_64+0x9f/0x450
+[ 1213.473514] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 1213.473514] RIP: 0033:0x462e99
+[ 1213.473514] Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
+[ 1213.473514] RSP: 002b:00007fa66fa00c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+[ 1213.473514] RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
+[ 1213.473514] RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000003
+[ 1213.473514] RBP: 00007fa66fa00c70 R08: 0000000000000000 R09: 0000000000000000
+[ 1213.473514] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa66fa016bc
+[ 1213.473514] R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004
+
+If usb_register failed, no need to call led_trigger_register_simple.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 1264b951463a ("at76c50x-usb: add driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/atmel/at76c50x-usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c
+index e99e766a3028..1cabae424839 100644
+--- a/drivers/net/wireless/atmel/at76c50x-usb.c
++++ b/drivers/net/wireless/atmel/at76c50x-usb.c
+@@ -2585,8 +2585,8 @@ static int __init at76_mod_init(void)
+ if (result < 0)
+ printk(KERN_ERR DRIVER_NAME
+ ": usb_register failed (status %d)\n", result);
+-
+- led_trigger_register_simple("at76_usb-tx", &ledtrig_tx);
++ else
++ led_trigger_register_simple("at76_usb-tx", &ledtrig_tx);
+ return result;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/b43-shut-up-clang-Wuninitialized-variable-warning.patch b/patches.drivers/b43-shut-up-clang-Wuninitialized-variable-warning.patch
new file mode 100644
index 0000000000..cd788bc106
--- /dev/null
+++ b/patches.drivers/b43-shut-up-clang-Wuninitialized-variable-warning.patch
@@ -0,0 +1,71 @@
+From d825db346270dbceef83b7b750dbc29f1d7dcc0e Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 22 Mar 2019 15:37:02 +0100
+Subject: [PATCH] b43: shut up clang -Wuninitialized variable warning
+Git-commit: d825db346270dbceef83b7b750dbc29f1d7dcc0e
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Clang warns about what is clearly a case of passing an uninitalized
+variable into a static function:
+
+drivers/net/wireless/broadcom/b43/phy_lp.c:1852:23: error: variable 'gains' is uninitialized when used here
+ [-Werror,-Wuninitialized]
+ lpphy_papd_cal(dev, gains, 0, 1, 30);
+ ^~~~~
+drivers/net/wireless/broadcom/b43/phy_lp.c:1838:2: note: variable 'gains' is declared here
+ struct lpphy_tx_gains gains, oldgains;
+ ^
+1 error generated.
+
+However, this function is empty, and its arguments are never evaluated,
+so gcc in contrast does not warn here. Both compilers behave in a
+reasonable way as far as I can tell, so we should change the code
+to avoid the warning everywhere.
+
+We could just eliminate the lpphy_papd_cal() function entirely,
+given that it has had the TODO comment in it for 10 years now
+and is rather unlikely to ever get done. I'm doing a simpler
+change here, and just pass the 'oldgains' variable in that has
+been initialized, based on the guess that this is what was
+originally meant.
+
+Fixes: 2c0d6100da3e ("b43: LP-PHY: Begin implementing calibration & software RFKILL support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/broadcom/b43/phy_lp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/phy_lp.c b/drivers/net/wireless/broadcom/b43/phy_lp.c
+index 46408a560814..aedee026c5e2 100644
+--- a/drivers/net/wireless/broadcom/b43/phy_lp.c
++++ b/drivers/net/wireless/broadcom/b43/phy_lp.c
+@@ -1835,7 +1835,7 @@ static void lpphy_papd_cal(struct b43_wldev *dev, struct lpphy_tx_gains gains,
+ static void lpphy_papd_cal_txpwr(struct b43_wldev *dev)
+ {
+ struct b43_phy_lp *lpphy = dev->phy.lp;
+- struct lpphy_tx_gains gains, oldgains;
++ struct lpphy_tx_gains oldgains;
+ int old_txpctl, old_afe_ovr, old_rf, old_bbmult;
+
+ lpphy_read_tx_pctl_mode_from_hardware(dev);
+@@ -1849,9 +1849,9 @@ static void lpphy_papd_cal_txpwr(struct b43_wldev *dev)
+ lpphy_set_tx_power_control(dev, B43_LPPHY_TXPCTL_OFF);
+
+ if (dev->dev->chip_id == 0x4325 && dev->dev->chip_rev == 0)
+- lpphy_papd_cal(dev, gains, 0, 1, 30);
++ lpphy_papd_cal(dev, oldgains, 0, 1, 30);
+ else
+- lpphy_papd_cal(dev, gains, 0, 1, 65);
++ lpphy_papd_cal(dev, oldgains, 0, 1, 65);
+
+ if (old_afe_ovr)
+ lpphy_set_tx_gains(dev, oldgains);
+--
+2.16.4
+
diff --git a/patches.drivers/brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch b/patches.drivers/brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch
new file mode 100644
index 0000000000..14301feb22
--- /dev/null
+++ b/patches.drivers/brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch
@@ -0,0 +1,59 @@
+From e025da3d7aa4770bb1d1b3b0aa7cc4da1744852d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 24 Apr 2019 12:52:18 +0300
+Subject: [PATCH] brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler()
+Git-commit: e025da3d7aa4770bb1d1b3b0aa7cc4da1744852d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+If "ret_len" is negative then it could lead to a NULL dereference.
+
+The "ret_len" value comes from nl80211_vendor_cmd(), if it's negative
+then we don't allocate the "dcmd_buf" buffer. Then we pass "ret_len" to
+brcmf_fil_cmd_data_set() where it is cast to a very high u32 value.
+Most of the functions in that call tree check whether the buffer we pass
+is NULL but there are at least a couple places which don't such as
+brcmf_dbg_hex_dump() and brcmf_msgbuf_query_dcmd(). We memcpy() to and
+from the buffer so it would result in a NULL dereference.
+
+The fix is to change the types so that "ret_len" can't be negative. (If
+we memcpy() zero bytes to NULL, that's a no-op and doesn't cause an
+issue).
+
+Fixes: 1bacb0487d0e ("brcmfmac: replace cfg80211 testmode with vendor command")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
+index 8eff2753abad..d493021f6031 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
+@@ -35,9 +35,10 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
+ struct brcmf_if *ifp;
+ const struct brcmf_vndr_dcmd_hdr *cmdhdr = data;
+ struct sk_buff *reply;
+- int ret, payload, ret_len;
++ unsigned int payload, ret_len;
+ void *dcmd_buf = NULL, *wr_pointer;
+ u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
++ int ret;
+
+ if (len < sizeof(*cmdhdr)) {
+ brcmf_err("vendor command too short: %d\n", len);
+@@ -65,7 +66,7 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
+ brcmf_err("oversize return buffer %d\n", ret_len);
+ ret_len = BRCMF_DCMD_MAXLEN;
+ }
+- payload = max(ret_len, len) + 1;
++ payload = max_t(unsigned int, ret_len, len) + 1;
+ dcmd_buf = vzalloc(payload);
+ if (NULL == dcmd_buf)
+ return -ENOMEM;
+--
+2.16.4
+
diff --git a/patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch b/patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch
new file mode 100644
index 0000000000..8d127b34a4
--- /dev/null
+++ b/patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch
@@ -0,0 +1,85 @@
+From 00c0cd9e59d265b393553e9afa54fee8b10e8158 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Thu, 11 Apr 2019 06:55:55 -0700
+Subject: [PATCH] clk: rockchip: Fix video codec clocks on rk3288
+Git-commit: 00c0cd9e59d265b393553e9afa54fee8b10e8158
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+It appears that there is a typo in the rk3288 TRM. For
+GRF_SOC_CON0[7] it says that 0 means "vepu" and 1 means "vdpu". It's
+the other way around.
+
+How do I know? Here's my evidence:
+
+1. Prior to commit 4d3e84f99628 ("clk: rockchip: describe aclk_vcodec
+ using the new muxgrf type on rk3288") we always pretended that we
+ were using "aclk_vdpu" and the comment in the code said that this
+ matched the default setting in the system. In fact the default
+ setting is 0 according to the TRM and according to reading memory
+ at bootup. In addition rk3288-based Chromebooks ran like this and
+ the video codecs worked.
+2. With the existing clock code if you boot up and try to enable the
+ new VIDEO_ROCKCHIP_VPU as a module (and without "clk_ignore_unused"
+ on the command line), you get errors like "failed to get ack on
+ domain 'pd_video', val=0x80208". After flipping vepu/vdpu things
+ init OK.
+3. If I export and add both the vepu and vdpu to the list of clocks
+ for RK3288_PD_VIDEO I can get past the power domain errors, but now
+ I freeze when the vpu_mmu gets initted.
+4. If I just mark the "vdpu" as IGNORE_UNUSED then everything boots up
+ and probes OK showing that somehow the "vdpu" was important to keep
+ enabled. This is because we were actually using it as a parent.
+5. After this change I can hack "aclk_vcodec_pre" to parent from
+ "aclk_vepu" using assigned-clocks and the video codec still probes
+ OK.
+6. Rockchip has said so on the mailing list [1].
+
+...so let's fix it.
+
+Let's also add CLK_SET_RATE_PARENT to "aclk_vcodec_pre" as suggested
+by Jonas Karlman. Prior to the same commit you could do
+clk_set_rate() on "aclk_vcodec" and it would change "aclk_vdpu".
+That's because "aclk_vcodec" was a simple gate clock (always gets
+CLK_SET_RATE_PARENT) and its direct parent was "aclk_vdpu". After
+that commit "aclk_vcodec_pre" gets in the way so we need to add
+CLK_SET_RATE_PARENT to it too.
+
+[1] https://lkml.kernel.org/r/1d17b015-9e17-34b9-baf8-c285dc1957aa@rock-chips.com
+
+Fixes: 4d3e84f99628 ("clk: rockchip: describe aclk_vcodec using the new muxgrf type on rk3288")
+Suggested-by: Jonas Karlman <jonas@kwiboo.se>
+Suggested-by: Randy Li <ayaka@soulik.info>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/rockchip/clk-rk3288.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3288.c b/drivers/clk/rockchip/clk-rk3288.c
+index f47d514cba36..94cbcb0aa49f 100644
+--- a/drivers/clk/rockchip/clk-rk3288.c
++++ b/drivers/clk/rockchip/clk-rk3288.c
+@@ -219,7 +219,7 @@ PNAME(mux_hsadcout_p) = { "hsadc_src", "ext_hsadc" };
+ PNAME(mux_edp_24m_p) = { "ext_edp_24m", "xin24m" };
+ PNAME(mux_tspout_p) = { "cpll", "gpll", "npll", "xin27m" };
+
+-PNAME(mux_aclk_vcodec_pre_p) = { "aclk_vepu", "aclk_vdpu" };
++PNAME(mux_aclk_vcodec_pre_p) = { "aclk_vdpu", "aclk_vepu" };
+ PNAME(mux_usbphy480m_p) = { "sclk_otgphy1_480m", "sclk_otgphy2_480m",
+ "sclk_otgphy0_480m" };
+ PNAME(mux_hsicphy480m_p) = { "cpll", "gpll", "usbphy480m_src" };
+@@ -420,7 +420,7 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = {
+ COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_usb480m_p, 0,
+ RK3288_CLKSEL_CON(32), 14, 2, MFLAGS, 8, 5, DFLAGS,
+ RK3288_CLKGATE_CON(3), 11, GFLAGS),
+- MUXGRF(0, "aclk_vcodec_pre", mux_aclk_vcodec_pre_p, 0,
++ MUXGRF(0, "aclk_vcodec_pre", mux_aclk_vcodec_pre_p, CLK_SET_RATE_PARENT,
+ RK3288_GRF_SOC_CON(0), 7, 1, MFLAGS),
+ GATE(ACLK_VCODEC, "aclk_vcodec", "aclk_vcodec_pre", 0,
+ RK3288_CLKGATE_CON(9), 0, GFLAGS),
+--
+2.16.4
+
diff --git a/patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch b/patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch
new file mode 100644
index 0000000000..42552ae89c
--- /dev/null
+++ b/patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch
@@ -0,0 +1,92 @@
+From fb903392131a324a243c7731389277db1cd9f8df Mon Sep 17 00:00:00 2001
+From: Jonas Karlman <jonas@kwiboo.se>
+Date: Sun, 10 Mar 2019 12:00:45 +0000
+Subject: [PATCH] clk: rockchip: fix wrong clock definitions for rk3328
+Git-commit: fb903392131a324a243c7731389277db1cd9f8df
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This patch fixes definition of several clock gate and select register
+that is wrong for rk3328 referring to the TRM and vendor kernel.
+Also use correct number of softrst registers.
+
+Fix clock definition for:
+- clk_crypto
+- aclk_h265
+- pclk_h265
+- aclk_h264
+- hclk_h264
+- aclk_axisram
+- aclk_gmac
+- aclk_usb3otg
+
+Fixes: fe3511ad8a1c ("clk: rockchip: add clock controller for rk3328")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Tested-by: Peter Geis <pgwipeout@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/rockchip/clk-rk3328.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -458,7 +458,7 @@ static struct rockchip_clk_branch rk3328
+ RK3328_CLKSEL_CON(35), 15, 1, MFLAGS, 8, 7, DFLAGS,
+ RK3328_CLKGATE_CON(2), 12, GFLAGS),
+ COMPOSITE(SCLK_CRYPTO, "clk_crypto", mux_2plls_p, 0,
+- RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 7, DFLAGS,
++ RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(2), 4, GFLAGS),
+ COMPOSITE_NOMUX(SCLK_TSADC, "clk_tsadc", "clk_24m", 0,
+ RK3328_CLKSEL_CON(22), 0, 10, DFLAGS,
+@@ -550,15 +550,15 @@ static struct rockchip_clk_branch rk3328
+ GATE(0, "hclk_rkvenc_niu", "hclk_rkvenc", CLK_IGNORE_UNUSED,
+ RK3328_CLKGATE_CON(25), 1, GFLAGS),
+ GATE(ACLK_H265, "aclk_h265", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 2, GFLAGS),
+ GATE(PCLK_H265, "pclk_h265", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 3, GFLAGS),
+ GATE(ACLK_H264, "aclk_h264", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 4, GFLAGS),
+ GATE(HCLK_H264, "hclk_h264", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 5, GFLAGS),
+ GATE(ACLK_AXISRAM, "aclk_axisram", "aclk_rkvenc", CLK_IGNORE_UNUSED,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 6, GFLAGS),
+
+ COMPOSITE(SCLK_VENC_CORE, "sclk_venc_core", mux_4plls_p, 0,
+ RK3328_CLKSEL_CON(51), 14, 2, MFLAGS, 8, 5, DFLAGS,
+@@ -663,7 +663,7 @@ static struct rockchip_clk_branch rk3328
+
+ /* PD_GMAC */
+ COMPOSITE(ACLK_GMAC, "aclk_gmac", mux_2plls_hdmiphy_p, 0,
+- RK3328_CLKSEL_CON(35), 6, 2, MFLAGS, 0, 5, DFLAGS,
++ RK3328_CLKSEL_CON(25), 6, 2, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(3), 2, GFLAGS),
+ COMPOSITE_NOMUX(PCLK_GMAC, "pclk_gmac", "aclk_gmac", 0,
+ RK3328_CLKSEL_CON(25), 8, 3, DFLAGS,
+@@ -733,7 +733,7 @@ static struct rockchip_clk_branch rk3328
+
+ /* PD_PERI */
+ GATE(0, "aclk_peri_noc", "aclk_peri", CLK_IGNORE_UNUSED, RK3328_CLKGATE_CON(19), 11, GFLAGS),
+- GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 4, GFLAGS),
++ GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 14, GFLAGS),
+
+ GATE(HCLK_SDMMC, "hclk_sdmmc", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 0, GFLAGS),
+ GATE(HCLK_SDIO, "hclk_sdio", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 1, GFLAGS),
+@@ -894,7 +894,7 @@ static void __init rk3328_clk_init(struc
+ &rk3328_cpuclk_data, rk3328_cpuclk_rates,
+ ARRAY_SIZE(rk3328_cpuclk_rates));
+
+- rockchip_register_softrst(np, 11, reg_base + RK3328_SOFTRST_CON(0),
++ rockchip_register_softrst(np, 12, reg_base + RK3328_SOFTRST_CON(0),
+ ROCKCHIP_SOFTRST_HIWORD_MASK);
+
+ rockchip_register_restart_notifier(ctx, RK3328_GLB_SRST_FST, NULL);
diff --git a/patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch b/patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch
new file mode 100644
index 0000000000..647bf4914e
--- /dev/null
+++ b/patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch
@@ -0,0 +1,45 @@
+From 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9 Mon Sep 17 00:00:00 2001
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Date: Tue, 26 Mar 2019 16:05:20 +0200
+Subject: [PATCH] dmaengine: axi-dmac: Don't check the number of frames for alignment
+Git-commit: 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In 2D transfers (for the AXI DMAC), the number of frames (numf) represents
+Y_LENGTH, and the length of a frame is X_LENGTH. 2D transfers are useful
+for video transfers where screen resolutions ( X * Y ) are typically
+aligned for X, but not for Y.
+
+There is no requirement for Y_LENGTH to be aligned to the bus-width (or
+anything), and this is also true for AXI DMAC.
+
+Checking the Y_LENGTH for alignment causes false errors when initiating DMA
+transfers. This change fixes this by checking only that the Y_LENGTH is
+non-zero.
+
+Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/dma/dma-axi-dmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
+index eecb367b4f3e..cdbef59a9542 100644
+--- a/drivers/dma/dma-axi-dmac.c
++++ b/drivers/dma/dma-axi-dmac.c
+@@ -526,7 +526,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
+
+ if (chan->hw_2d) {
+ if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
+- !axi_dmac_check_len(chan, xt->numf))
++ xt->numf == 0)
+ return NULL;
+ if (xt->sgl[0].size + dst_icg > chan->max_length ||
+ xt->sgl[0].size + src_icg > chan->max_length)
+--
+2.16.4
+
diff --git a/patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch b/patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch
new file mode 100644
index 0000000000..ebb023a581
--- /dev/null
+++ b/patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch
@@ -0,0 +1,90 @@
+From f030e419501cb95e961e9ed35c493b5d46a04eca Mon Sep 17 00:00:00 2001
+From: Sameer Pujar <spujar@nvidia.com>
+Date: Thu, 2 May 2019 18:25:16 +0530
+Subject: [PATCH] dmaengine: tegra210-dma: free dma controller in remove()
+Git-commit: f030e419501cb95e961e9ed35c493b5d46a04eca
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Following kernel panic is seen during DMA driver unload->load sequence
+==========================================================================
+Unable to handle kernel paging request at virtual address ffffff8001198880
+Internal error: Oops: 86000007 [#1] PREEMPT SMP
+Cpu: 0 PID: 5907 Comm: HwBinder:4123_1 Tainted: G C 4.9.128-tegra-g065839f
+Hardware name: galen (DT)
+Task: ffffffc3590d1a80 task.stack: ffffffc3d0678000
+PC is at 0xffffff8001198880
+LR is at of_dma_request_slave_channel+0xd8/0x1f8
+pc : [<ffffff8001198880>] lr : [<ffffff8008746f30>] pstate: 60400045
+sp : ffffffc3d067b710
+X29: ffffffc3d067b710 x28: 000000000000002f
+X27: ffffff800949e000 x26: ffffff800949e750
+X25: ffffff800949e000 x24: ffffffbefe817d84
+X23: ffffff8009f77cb0 x22: 0000000000000028
+X21: ffffffc3ffda49c8 x20: 0000000000000029
+X19: 0000000000000001 x18: ffffffffffffffff
+X17: 0000000000000000 x16: ffffff80082b66a0
+X15: ffffff8009e78250 x14: 000000000000000a
+X13: 0000000000000038 x12: 0101010101010101
+X11: 0000000000000030 x10: 0101010101010101
+x9 : fffffffffffffffc x8 : 7f7f7f7f7f7f7f7f
+x7 : 62ff726b6b64622c x6 : 0000000000008064
+x5 : 6400000000000000 x4 : ffffffbefe817c44
+x3 : ffffffc3ffda3e08 x2 : ffffff8001198880
+x1 : ffffffc3d48323c0 x0 : ffffffc3d067b788
+
+Process HwBinder:4123_1 (pid: 5907, stack limit = 0xffffffc3d0678028)
+Call trace:
+[<ffffff8001198880>] 0xffffff8001198880
+[<ffffff80087459f8>] dma_request_chan+0x50/0x1f0
+[<ffffff8008745bc0>] dma_request_slave_channel+0x28/0x40
+[<ffffff8001552c44>] tegra_alt_pcm_open+0x114/0x170
+[<ffffff8008d65fa4>] soc_pcm_open+0x10c/0x878
+[<ffffff8008d18618>] snd_pcm_open_substream+0xc0/0x170
+[<ffffff8008d1878c>] snd_pcm_open+0xc4/0x240
+[<ffffff8008d189e0>] snd_pcm_playback_open+0x58/0x80
+[<ffffff8008cfc6d4>] snd_open+0xb4/0x178
+[<ffffff8008250628>] chrdev_open+0xb8/0x1d0
+[<ffffff8008246fdc>] do_dentry_open+0x214/0x318
+[<ffffff80082485d0>] vfs_open+0x58/0x88
+[<ffffff800825bce0>] do_last+0x450/0xde0
+[<ffffff800825c718>] path_openat+0xa8/0x368
+[<ffffff800825dd84>] do_filp_open+0x8c/0x110
+[<ffffff8008248a74>] do_sys_open+0x164/0x220
+[<ffffff80082b66dc>] compat_SyS_openat+0x3c/0x50
+[<ffffff8008083040>] el0_svc_naked+0x34/0x38
+
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---[ end trace 67e6d544e65b5145 ]---
+Kernel panic - not syncing: Fatal exception
+==========================================================================
+
+In device probe(), of_dma_controller_register() registers DMA controller.
+But when driver is removed, this is not freed. During driver reload this
+results in data abort and kernel panic. Add of_dma_controller_free() in
+driver remove path to fix the issue.
+
+Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA")
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+---
+ drivers/dma/tegra210-adma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index f26c458d584e..953669d35479 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -888,6 +888,7 @@ static int tegra_adma_remove(struct platform_device *pdev)
+ struct tegra_adma *tdma = platform_get_drvdata(pdev);
+ int i;
+
++ of_dma_controller_free(pdev->dev.of_node);
+ dma_async_device_unregister(&tdma->dma_dev);
+
+ for (i = 0; i < tdma->nr_channels; ++i)
+--
+2.16.4
+
diff --git a/patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch b/patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch
new file mode 100644
index 0000000000..1103708253
--- /dev/null
+++ b/patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch
@@ -0,0 +1,39 @@
+From 5acb4b970184d189d901192d075997c933b82260 Mon Sep 17 00:00:00 2001
+From: Minas Harutyunyan <minas.harutyunyan@synopsys.com>
+Date: Fri, 22 Feb 2019 15:49:19 +0400
+Subject: [PATCH] dwc2: gadget: Fix completed transfer size calculation in DDMA
+Git-commit: 5acb4b970184d189d901192d075997c933b82260
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Fix calculation of transfer size on completion in function
+dwc2_gadget_get_xfersize_ddma().
+
+Added increment of descriptor pointer to move to next descriptor in
+the loop.
+
+Fixes: aa3e8bc81311 ("usb: dwc2: gadget: DDMA transfer start and complete")
+
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/dwc2/gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index a17e444e467b..16ffd9fd9361 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -2325,6 +2325,7 @@ static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep)
+ if (status & DEV_DMA_STS_MASK)
+ dev_err(hsotg->dev, "descriptor %d closed with %x\n",
+ i, status & DEV_DMA_STS_MASK);
++ desc++;
+ }
+
+ return bytes_rem;
+--
+2.16.4
+
diff --git a/patches.drivers/ghes-edac-fix-ghes_edac-registration.patch b/patches.drivers/ghes-edac-fix-ghes_edac-registration.patch
new file mode 100644
index 0000000000..38b69616d7
--- /dev/null
+++ b/patches.drivers/ghes-edac-fix-ghes_edac-registration.patch
@@ -0,0 +1,120 @@
+From: Borislav Petkov <bp@suse.de>
+Date: Mon, 23 Apr 2018 14:16:46 +0200
+Subject: ghes, EDAC: Fix ghes_edac registration
+Git-commit: cc7f3f132658289b6661ab8294ab08a9d32ea026
+Patch-mainline: v4.18-rc1
+References: bsc#1133176
+
+Tony reported seeing
+
+ "Internal error: Can't find EDAC structure"
+
+when injecting correctable errors due to the fact that ghes_edac would
+still load even if the whitelist won't hit. Drop the pr_err() in
+ghes_edac_report_mem_error() for now due to the hacky way how ghes_edac
+depends on ghes.c.
+
+While at it, make ghes_edac_register() return an error if it doesn't hit
+in the whitelist as it is the only sensible thing to do in that
+situation.
+
+Furthermore, move the call to it to happen last in ghes_probe() so that
+GHES initializing properly does not depend on ghes_edac init at all
+as latter is only reporting errors and not required for GHES's proper
+functioning.
+
+Reviewed-by: Toshi Kani <toshi.kani@hpe.com>
+Tested-by: Sughosh Ganu <sughosh.ganu@arm.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
+Cc: Tony Luck <tony.luck@intel.com>
+Link: https://lkml.kernel.org/r/20180420182015.zao3olss4tvvlxki@agluck-desk
+---
+ drivers/acpi/apei/ghes.c | 14 ++++++--------
+ drivers/edac/ghes_edac.c | 6 ++----
+ include/acpi/ghes.h | 2 +-
+ 3 files changed, 9 insertions(+), 13 deletions(-)
+
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -1072,10 +1072,6 @@ static int ghes_probe(struct platform_de
+ goto err;
+ }
+
+- rc = ghes_edac_register(ghes, &ghes_dev->dev);
+- if (rc < 0)
+- goto err;
+-
+ switch (generic->notify.type) {
+ case ACPI_HEST_NOTIFY_POLLED:
+ setup_deferrable_timer(&ghes->timer, ghes_poll_func,
+@@ -1088,14 +1084,14 @@ static int ghes_probe(struct platform_de
+ if (rc) {
+ pr_err(GHES_PFX "Failed to map GSI to IRQ for generic hardware error source: %d\n",
+ generic->header.source_id);
+- goto err_edac_unreg;
++ goto err;
+ }
+ rc = request_irq(ghes->irq, ghes_irq_func, IRQF_SHARED,
+ "GHES IRQ", ghes);
+ if (rc) {
+ pr_err(GHES_PFX "Failed to register IRQ for generic hardware error source: %d\n",
+ generic->header.source_id);
+- goto err_edac_unreg;
++ goto err;
+ }
+ break;
+
+@@ -1118,14 +1114,16 @@ static int ghes_probe(struct platform_de
+ default:
+ BUG();
+ }
++
+ platform_set_drvdata(ghes_dev, ghes);
+
++ ghes_edac_register(ghes, &ghes_dev->dev);
++
+ /* Handle any pending errors right away */
+ ghes_proc(ghes);
+
+ return 0;
+-err_edac_unreg:
+- ghes_edac_unregister(ghes);
++
+ err:
+ if (ghes) {
+ ghes_fini(ghes);
+--- a/drivers/edac/ghes_edac.c
++++ b/drivers/edac/ghes_edac.c
+@@ -185,10 +185,8 @@ void ghes_edac_report_mem_error(struct g
+ char *p;
+ u8 grain_bits;
+
+- if (!pvt) {
+- pr_err("Internal error: Can't find EDAC structure\n");
++ if (!pvt)
+ return;
+- }
+
+ /*
+ * We can do the locking below because GHES defers error processing
+@@ -441,7 +439,7 @@ int ghes_edac_register(struct ghes *ghes
+ /* Check if safe to enable on this system */
+ idx = acpi_match_platform_list(plat_list);
+ if (!force_load && idx < 0)
+- return 0;
++ return -ENODEV;
+
+ /*
+ * We have only one logical memory controller to which all DIMMs belong.
+--- a/include/acpi/ghes.h
++++ b/include/acpi/ghes.h
+@@ -69,7 +69,7 @@ static inline void ghes_edac_report_mem_
+
+ static inline int ghes_edac_register(struct ghes *ghes, struct device *dev)
+ {
+- return 0;
++ return -ENODEV;
+ }
+
+ static inline void ghes_edac_unregister(struct ghes *ghes)
diff --git a/patches.drivers/gpio-aspeed-fix-a-potential-NULL-pointer-dereference.patch b/patches.drivers/gpio-aspeed-fix-a-potential-NULL-pointer-dereference.patch
new file mode 100644
index 0000000000..b64150c23b
--- /dev/null
+++ b/patches.drivers/gpio-aspeed-fix-a-potential-NULL-pointer-dereference.patch
@@ -0,0 +1,36 @@
+From 6cf4511e9729c00a7306cf94085f9cc3c52ee723 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Sun, 24 Mar 2019 18:10:02 -0500
+Subject: [PATCH] gpio: aspeed: fix a potential NULL pointer dereference
+Git-commit: 6cf4511e9729c00a7306cf94085f9cc3c52ee723
+Patch-mainline: v5.1-rc3
+References: bsc#1051510
+
+In case devm_kzalloc, the patch returns ENOMEM to avoid potential
+NULL pointer dereference.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpio-aspeed.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
+index 854bce4fb9e7..217507002dbc 100644
+--- a/drivers/gpio/gpio-aspeed.c
++++ b/drivers/gpio/gpio-aspeed.c
+@@ -1224,6 +1224,8 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev)
+
+ gpio->offset_timer =
+ devm_kzalloc(&pdev->dev, gpio->chip.ngpio, GFP_KERNEL);
++ if (!gpio->offset_timer)
++ return -ENOMEM;
+
+ return aspeed_gpio_setup_irqs(gpio, pdev);
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/hwmon-f71805f-Use-request_muxed_region-for-Super-IO-.patch b/patches.drivers/hwmon-f71805f-Use-request_muxed_region-for-Super-IO-.patch
new file mode 100644
index 0000000000..6a837d156f
--- /dev/null
+++ b/patches.drivers/hwmon-f71805f-Use-request_muxed_region-for-Super-IO-.patch
@@ -0,0 +1,93 @@
+From 73e6ff71a7ea924fb7121d576a2d41e3be3fc6b5 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 4 Apr 2019 10:52:43 -0700
+Subject: [PATCH] hwmon: (f71805f) Use request_muxed_region for Super-IO accesses
+Git-commit: 73e6ff71a7ea924fb7121d576a2d41e3be3fc6b5
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Super-IO accesses may fail on a system with no or unmapped LPC bus.
+
+Unable to handle kernel paging request at virtual address ffffffbffee0002e
+pgd = ffffffc1d68d4000
+[ffffffbffee0002e] *pgd=0000000000000000, *pud=0000000000000000
+Internal error: Oops: 94000046 [#1] PREEMPT SMP
+Modules linked in: f71805f(+) hwmon
+Cpu: 3 PID: 1659 Comm: insmod Not tainted 4.5.0+ #88
+Hardware name: linux,dummy-virt (DT)
+Task: ffffffc1f6665400 ti: ffffffc1d6418000 task.ti: ffffffc1d6418000
+PC is at f71805f_find+0x6c/0x358 [f71805f]
+
+Also, other drivers may attempt to access the LPC bus at the same time,
+resulting in undefined behavior.
+
+Use request_muxed_region() to ensure that IO access on the requested
+address space is supported, and to ensure that access by multiple
+drivers is synchronized.
+
+Fixes: e53004e20a58e ("hwmon: New f71805f driver")
+Reported-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Reported-by: John Garry <john.garry@huawei.com>
+Cc: John Garry <john.garry@huawei.com>
+Acked-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwmon/f71805f.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/f71805f.c b/drivers/hwmon/f71805f.c
+index 73c681162653..623736d2a7c1 100644
+--- a/drivers/hwmon/f71805f.c
++++ b/drivers/hwmon/f71805f.c
+@@ -96,17 +96,23 @@ superio_select(int base, int ld)
+ outb(ld, base + 1);
+ }
+
+-static inline void
++static inline int
+ superio_enter(int base)
+ {
++ if (!request_muxed_region(base, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x87, base);
+ outb(0x87, base);
++
++ return 0;
+ }
+
+ static inline void
+ superio_exit(int base)
+ {
+ outb(0xaa, base);
++ release_region(base, 2);
+ }
+
+ /*
+@@ -1561,7 +1567,7 @@ static int __init f71805f_device_add(unsigned short address,
+ static int __init f71805f_find(int sioaddr, unsigned short *address,
+ struct f71805f_sio_data *sio_data)
+ {
+- int err = -ENODEV;
++ int err;
+ u16 devid;
+
+ static const char * const names[] = {
+@@ -1569,8 +1575,11 @@ static int __init f71805f_find(int sioaddr, unsigned short *address,
+ "F71872F/FG or F71806F/FG",
+ };
+
+- superio_enter(sioaddr);
++ err = superio_enter(sioaddr);
++ if (err)
++ return err;
+
++ err = -ENODEV;
+ devid = superio_inw(sioaddr, SIO_REG_MANID);
+ if (devid != SIO_FINTEK_ID)
+ goto exit;
+--
+2.16.4
+
diff --git a/patches.drivers/hwmon-pc87427-Use-request_muxed_region-for-Super-IO-.patch b/patches.drivers/hwmon-pc87427-Use-request_muxed_region-for-Super-IO-.patch
new file mode 100644
index 0000000000..bf18e47eb9
--- /dev/null
+++ b/patches.drivers/hwmon-pc87427-Use-request_muxed_region-for-Super-IO-.patch
@@ -0,0 +1,71 @@
+From 755a9b0f8aaa5639ba5671ca50080852babb89ce Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 4 Apr 2019 11:16:20 -0700
+Subject: [PATCH] hwmon: (pc87427) Use request_muxed_region for Super-IO accesses
+Git-commit: 755a9b0f8aaa5639ba5671ca50080852babb89ce
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Super-IO accesses may fail on a system with no or unmapped LPC bus.
+
+Also, other drivers may attempt to access the LPC bus at the same time,
+resulting in undefined behavior.
+
+Use request_muxed_region() to ensure that IO access on the requested
+address space is supported, and to ensure that access by multiple drivers
+is synchronized.
+
+Fixes: ba224e2c4f0a7 ("hwmon: New PC87427 hardware monitoring driver")
+Reported-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Reported-by: John Garry <john.garry@huawei.com>
+Cc: John Garry <john.garry@huawei.com>
+Acked-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwmon/pc87427.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pc87427.c b/drivers/hwmon/pc87427.c
+index d1a3f2040c00..58eee8fa3e6d 100644
+--- a/drivers/hwmon/pc87427.c
++++ b/drivers/hwmon/pc87427.c
+@@ -106,6 +106,13 @@ static const char *logdev_str[2] = { DRVNAME " FMC", DRVNAME " HMC" };
+ #define LD_IN 1
+ #define LD_TEMP 1
+
++static inline int superio_enter(int sioaddr)
++{
++ if (!request_muxed_region(sioaddr, 2, DRVNAME))
++ return -EBUSY;
++ return 0;
++}
++
+ static inline void superio_outb(int sioaddr, int reg, int val)
+ {
+ outb(reg, sioaddr);
+@@ -122,6 +129,7 @@ static inline void superio_exit(int sioaddr)
+ {
+ outb(0x02, sioaddr);
+ outb(0x02, sioaddr + 1);
++ release_region(sioaddr, 2);
+ }
+
+ /*
+@@ -1195,7 +1203,11 @@ static int __init pc87427_find(int sioaddr, struct pc87427_sio_data *sio_data)
+ {
+ u16 val;
+ u8 cfg, cfg_b;
+- int i, err = 0;
++ int i, err;
++
++ err = superio_enter(sioaddr);
++ if (err)
++ return err;
+
+ /* Identify device */
+ val = force_id ? force_id : superio_inb(sioaddr, SIOREG_DEVID);
+--
+2.16.4
+
diff --git a/patches.drivers/hwmon-smsc47b397-Use-request_muxed_region-for-Super-.patch b/patches.drivers/hwmon-smsc47b397-Use-request_muxed_region-for-Super-.patch
new file mode 100644
index 0000000000..fe2d0432ed
--- /dev/null
+++ b/patches.drivers/hwmon-smsc47b397-Use-request_muxed_region-for-Super-.patch
@@ -0,0 +1,71 @@
+From 8c0826756744c0ac1df600a5e4cca1a341b13101 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 4 Apr 2019 11:22:42 -0700
+Subject: [PATCH] hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses
+Git-commit: 8c0826756744c0ac1df600a5e4cca1a341b13101
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Super-IO accesses may fail on a system with no or unmapped LPC bus.
+
+Also, other drivers may attempt to access the LPC bus at the same time,
+resulting in undefined behavior.
+
+Use request_muxed_region() to ensure that IO access on the requested
+address space is supported, and to ensure that access by multiple drivers
+is synchronized.
+
+Fixes: 8d5d45fb1468 ("I2C: Move hwmon drivers (2/3)")
+Reported-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Reported-by: John Garry <john.garry@huawei.com>
+Cc: John Garry <john.garry@huawei.com>
+Acked-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwmon/smsc47b397.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/smsc47b397.c b/drivers/hwmon/smsc47b397.c
+index c0775084dde0..60e193f2e970 100644
+--- a/drivers/hwmon/smsc47b397.c
++++ b/drivers/hwmon/smsc47b397.c
+@@ -72,14 +72,19 @@ static inline void superio_select(int ld)
+ superio_outb(0x07, ld);
+ }
+
+-static inline void superio_enter(void)
++static inline int superio_enter(void)
+ {
++ if (!request_muxed_region(REG, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x55, REG);
++ return 0;
+ }
+
+ static inline void superio_exit(void)
+ {
+ outb(0xAA, REG);
++ release_region(REG, 2);
+ }
+
+ #define SUPERIO_REG_DEVID 0x20
+@@ -300,8 +305,12 @@ static int __init smsc47b397_find(void)
+ u8 id, rev;
+ char *name;
+ unsigned short addr;
++ int err;
++
++ err = superio_enter();
++ if (err)
++ return err;
+
+- superio_enter();
+ id = force_id ? force_id : superio_inb(SUPERIO_REG_DEVID);
+
+ switch (id) {
+--
+2.16.4
+
diff --git a/patches.drivers/hwmon-smsc47m1-Use-request_muxed_region-for-Super-IO.patch b/patches.drivers/hwmon-smsc47m1-Use-request_muxed_region-for-Super-IO.patch
new file mode 100644
index 0000000000..4cc335c338
--- /dev/null
+++ b/patches.drivers/hwmon-smsc47m1-Use-request_muxed_region-for-Super-IO.patch
@@ -0,0 +1,95 @@
+From d6410408ad2a798c4cc685252c1baa713be0ad69 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Thu, 4 Apr 2019 11:28:37 -0700
+Subject: [PATCH] hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses
+Git-commit: d6410408ad2a798c4cc685252c1baa713be0ad69
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Super-IO accesses may fail on a system with no or unmapped LPC bus.
+
+Also, other drivers may attempt to access the LPC bus at the same time,
+resulting in undefined behavior.
+
+Use request_muxed_region() to ensure that IO access on the requested
+address space is supported, and to ensure that access by multiple drivers
+is synchronized.
+
+Fixes: 8d5d45fb1468 ("I2C: Move hwmon drivers (2/3)")
+Reported-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Reported-by: John Garry <john.garry@huawei.com>
+Cc: John Garry <john.garry@huawei.com>
+Acked-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwmon/smsc47m1.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
+index 5d0c6eaae6f2..5f92eab24c62 100644
+--- a/drivers/hwmon/smsc47m1.c
++++ b/drivers/hwmon/smsc47m1.c
+@@ -73,16 +73,21 @@ superio_inb(int reg)
+ /* logical device for fans is 0x0A */
+ #define superio_select() superio_outb(0x07, 0x0A)
+
+-static inline void
++static inline int
+ superio_enter(void)
+ {
++ if (!request_muxed_region(REG, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x55, REG);
++ return 0;
+ }
+
+ static inline void
+ superio_exit(void)
+ {
+ outb(0xAA, REG);
++ release_region(REG, 2);
+ }
+
+ #define SUPERIO_REG_ACT 0x30
+@@ -535,8 +540,12 @@ static int __init smsc47m1_find(struct smsc47m1_sio_data *sio_data)
+ {
+ u8 val;
+ unsigned short addr;
++ int err;
++
++ err = superio_enter();
++ if (err)
++ return err;
+
+- superio_enter();
+ val = force_id ? force_id : superio_inb(SUPERIO_REG_DEVID);
+
+ /*
+@@ -612,13 +621,14 @@ static int __init smsc47m1_find(struct smsc47m1_sio_data *sio_data)
+ static void smsc47m1_restore(const struct smsc47m1_sio_data *sio_data)
+ {
+ if ((sio_data->activate & 0x01) == 0) {
+- superio_enter();
+- superio_select();
+-
+- pr_info("Disabling device\n");
+- superio_outb(SUPERIO_REG_ACT, sio_data->activate);
+-
+- superio_exit();
++ if (!superio_enter()) {
++ superio_select();
++ pr_info("Disabling device\n");
++ superio_outb(SUPERIO_REG_ACT, sio_data->activate);
++ superio_exit();
++ } else {
++ pr_warn("Failed to disable device\n");
++ }
+ }
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/hwmon-vt1211-Use-request_muxed_region-for-Super-IO-a.patch b/patches.drivers/hwmon-vt1211-Use-request_muxed_region-for-Super-IO-a.patch
new file mode 100644
index 0000000000..88b893d98f
--- /dev/null
+++ b/patches.drivers/hwmon-vt1211-Use-request_muxed_region-for-Super-IO-a.patch
@@ -0,0 +1,72 @@
+From 14b97ba5c20056102b3dd22696bf17b057e60976 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Fri, 5 Apr 2019 08:53:08 -0700
+Subject: [PATCH] hwmon: (vt1211) Use request_muxed_region for Super-IO accesses
+Git-commit: 14b97ba5c20056102b3dd22696bf17b057e60976
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Super-IO accesses may fail on a system with no or unmapped LPC bus.
+
+Also, other drivers may attempt to access the LPC bus at the same time,
+resulting in undefined behavior.
+
+Use request_muxed_region() to ensure that IO access on the requested
+address space is supported, and to ensure that access by multiple drivers
+is synchronized.
+
+Fixes: 2219cd81a6cd ("hwmon/vt1211: Add probing of alternate config index port")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwmon/vt1211.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/vt1211.c b/drivers/hwmon/vt1211.c
+index 3a6bfa51cb94..95d5e8ec8b7f 100644
+--- a/drivers/hwmon/vt1211.c
++++ b/drivers/hwmon/vt1211.c
+@@ -226,15 +226,21 @@ static inline void superio_select(int sio_cip, int ldn)
+ outb(ldn, sio_cip + 1);
+ }
+
+-static inline void superio_enter(int sio_cip)
++static inline int superio_enter(int sio_cip)
+ {
++ if (!request_muxed_region(sio_cip, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x87, sio_cip);
+ outb(0x87, sio_cip);
++
++ return 0;
+ }
+
+ static inline void superio_exit(int sio_cip)
+ {
+ outb(0xaa, sio_cip);
++ release_region(sio_cip, 2);
+ }
+
+ /* ---------------------------------------------------------------------
+@@ -1282,11 +1288,14 @@ static int __init vt1211_device_add(unsigned short address)
+
+ static int __init vt1211_find(int sio_cip, unsigned short *address)
+ {
+- int err = -ENODEV;
++ int err;
+ int devid;
+
+- superio_enter(sio_cip);
++ err = superio_enter(sio_cip);
++ if (err)
++ return err;
+
++ err = -ENODEV;
+ devid = force_id ? force_id : superio_inb(sio_cip, SIO_VT1211_DEVID);
+ if (devid != SIO_VT1211_ID)
+ goto EXIT;
+--
+2.16.4
+
diff --git a/patches.drivers/hwmon-w83627hf-Use-request_muxed_region-for-Super-IO.patch b/patches.drivers/hwmon-w83627hf-Use-request_muxed_region-for-Super-IO.patch
new file mode 100644
index 0000000000..e87af352ee
--- /dev/null
+++ b/patches.drivers/hwmon-w83627hf-Use-request_muxed_region-for-Super-IO.patch
@@ -0,0 +1,121 @@
+From e95fd518d05bfc087da6fcdea4900a57cfb083bd Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Fri, 5 Apr 2019 08:44:41 -0700
+Subject: [PATCH] hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
+Git-commit: e95fd518d05bfc087da6fcdea4900a57cfb083bd
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Super-IO accesses may fail on a system with no or unmapped LPC bus.
+
+Also, other drivers may attempt to access the LPC bus at the same time,
+resulting in undefined behavior.
+
+Use request_muxed_region() to ensure that IO access on the requested
+address space is supported, and to ensure that access by multiple drivers
+is synchronized.
+
+Fixes: b72656dbc491 ("hwmon: (w83627hf) Stop using globals for I/O port numbers")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwmon/w83627hf.c | 42 +++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 37 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
+index 97bbf1af11e8..7ca53a28c305 100644
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data *sio, int ld)
+ outb(ld, sio->sioaddr + 1);
+ }
+
+-static inline void
++static inline int
+ superio_enter(struct w83627hf_sio_data *sio)
+ {
++ if (!request_muxed_region(sio->sioaddr, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x87, sio->sioaddr);
+ outb(0x87, sio->sioaddr);
++
++ return 0;
+ }
+
+ static inline void
+ superio_exit(struct w83627hf_sio_data *sio)
+ {
+ outb(0xAA, sio->sioaddr);
++ release_region(sio->sioaddr, 2);
+ }
+
+ #define W627_DEVID 0x52
+@@ -1254,7 +1260,7 @@ static DEVICE_ATTR_RO(name);
+ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ struct w83627hf_sio_data *sio_data)
+ {
+- int err = -ENODEV;
++ int err;
+ u16 val;
+
+ static __initconst char *const names[] = {
+@@ -1266,7 +1272,11 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ };
+
+ sio_data->sioaddr = sioaddr;
+- superio_enter(sio_data);
++ err = superio_enter(sio_data);
++ if (err)
++ return err;
++
++ err = -ENODEV;
+ val = force_id ? force_id : superio_inb(sio_data, DEVID);
+ switch (val) {
+ case W627_DEVID:
+@@ -1619,9 +1629,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
+ struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ int res = 0xff, sel;
+
+- superio_enter(sio_data);
++ if (superio_enter(sio_data)) {
++ /*
++ * Some other driver reserved the address space for itself.
++ * We don't want to fail driver instantiation because of that,
++ * so display a warning and keep going.
++ */
++ dev_warn(&pdev->dev,
++ "Can not read VID data: Failed to enable SuperIO access\n");
++ return res;
++ }
++
+ superio_select(sio_data, W83627HF_LD_GPIO5);
+
++ res = 0xff;
++
+ /* Make sure these GPIO pins are enabled */
+ if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
+ dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
+@@ -1652,7 +1674,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
+ struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ int res = 0xff;
+
+- superio_enter(sio_data);
++ if (superio_enter(sio_data)) {
++ /*
++ * Some other driver reserved the address space for itself.
++ * We don't want to fail driver instantiation because of that,
++ * so display a warning and keep going.
++ */
++ dev_warn(&pdev->dev,
++ "Can not read VID data: Failed to enable SuperIO access\n");
++ return res;
++ }
++
+ superio_select(sio_data, W83627HF_LD_HWM);
+
+ /* Make sure these GPIO pins are enabled */
+--
+2.16.4
+
diff --git a/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch b/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch
index 5ddcb5196e..ddb42f7bbf 100644
--- a/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch
+++ b/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch
@@ -4,8 +4,7 @@ Date: Tue, 19 Mar 2019 10:28:51 -0300
Subject: [PATCH] ibmvnic: Report actual backing device speed and duplex values
References: bsc#1129923
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Patch-mainline: v5.2-rc1
Git-commit: f8d6ae0d27ec1e81e4be454e63bc96086bbf8e6b
The ibmvnic driver currently reports a fixed value for both speed and
diff --git a/patches.drivers/intel_th-msu-Fix-single-mode-with-IOMMU.patch b/patches.drivers/intel_th-msu-Fix-single-mode-with-IOMMU.patch
new file mode 100644
index 0000000000..e82ab71902
--- /dev/null
+++ b/patches.drivers/intel_th-msu-Fix-single-mode-with-IOMMU.patch
@@ -0,0 +1,109 @@
+From 4e0eaf239fb33ebc671303e2b736fa043462e2f4 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Fri, 3 May 2019 11:44:34 +0300
+Subject: [PATCH] intel_th: msu: Fix single mode with IOMMU
+Git-commit: 4e0eaf239fb33ebc671303e2b736fa043462e2f4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Currently, the pages that are allocated for the single mode of MSC are not
+mapped into the device's dma space and the code is incorrectly using
+*_to_phys() in place of a dma address. This fails with IOMMU enabled and
+is otherwise bad practice.
+
+Fix the single mode buffer allocation to map the pages into the device's
+DMA space.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: ba82664c134e ("intel_th: Add Memory Storage Unit driver")
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwtracing/intel_th/msu.c | 35 ++++++++++++++++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
+index ba7aaf421f36..8ff326c0c406 100644
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -84,6 +84,7 @@ struct msc_iter {
+ * @reg_base: register window base address
+ * @thdev: intel_th_device pointer
+ * @win_list: list of windows in multiblock mode
++ * @single_sgt: single mode buffer
+ * @nr_pages: total number of pages allocated for this buffer
+ * @single_sz: amount of data in single mode
+ * @single_wrap: single mode wrap occurred
+@@ -104,6 +105,7 @@ struct msc {
+ struct intel_th_device *thdev;
+
+ struct list_head win_list;
++ struct sg_table single_sgt;
+ unsigned long nr_pages;
+ unsigned long single_sz;
+ unsigned int single_wrap : 1;
+@@ -617,22 +619,45 @@ static void intel_th_msc_deactivate(struct intel_th_device *thdev)
+ */
+ static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size)
+ {
++ unsigned long nr_pages = size >> PAGE_SHIFT;
+ unsigned int order = get_order(size);
+ struct page *page;
++ int ret;
+
+ if (!size)
+ return 0;
+
++ ret = sg_alloc_table(&msc->single_sgt, 1, GFP_KERNEL);
++ if (ret)
++ goto err_out;
++
++ ret = -ENOMEM;
+ page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
+ if (!page)
+- return -ENOMEM;
++ goto err_free_sgt;
+
+ split_page(page, order);
+- msc->nr_pages = size >> PAGE_SHIFT;
++ sg_set_buf(msc->single_sgt.sgl, page_address(page), size);
++
++ ret = dma_map_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, 1,
++ DMA_FROM_DEVICE);
++ if (ret < 0)
++ goto err_free_pages;
++
++ msc->nr_pages = nr_pages;
+ msc->base = page_address(page);
+- msc->base_addr = page_to_phys(page);
++ msc->base_addr = sg_dma_address(msc->single_sgt.sgl);
+
+ return 0;
++
++err_free_pages:
++ __free_pages(page, order);
++
++err_free_sgt:
++ sg_free_table(&msc->single_sgt);
++
++err_out:
++ return ret;
+ }
+
+ /**
+@@ -643,6 +668,10 @@ static void msc_buffer_contig_free(struct msc *msc)
+ {
+ unsigned long off;
+
++ dma_unmap_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl,
++ 1, DMA_FROM_DEVICE);
++ sg_free_table(&msc->single_sgt);
++
+ for (off = 0; off < msc->nr_pages << PAGE_SHIFT; off += PAGE_SIZE) {
+ struct page *page = virt_to_page(msc->base + off);
+
+--
+2.16.4
+
diff --git a/patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch b/patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch
new file mode 100644
index 0000000000..6fe6f153d8
--- /dev/null
+++ b/patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch
@@ -0,0 +1,38 @@
+From e60e9a4b231a20a199d7a61caadc48693c30d695 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 17 Apr 2019 10:35:36 +0300
+Subject: [PATCH] intel_th: pci: Add Comet Lake support
+Git-commit: e60e9a4b231a20a199d7a61caadc48693c30d695
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This adds support for Intel TH on Comet Lake.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwtracing/intel_th/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 1cf6290d6435..70f2cb90adc5 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -165,6 +165,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x34a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Comet Lake */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x02a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ { 0 },
+ };
+
+--
+2.16.4
+
diff --git a/patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock b/patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock
new file mode 100644
index 0000000000..02ec82e57c
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock
@@ -0,0 +1,101 @@
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Fri, 19 Apr 2019 14:43:29 +0800
+Subject: iommu/vt-d: Don't request page request irq under dmar_global_lock
+Git-commit: a7755c3cfa5df755e39447b08c28203e011fb98c
+References: bsc#1135006
+Patch-mainline: v5.2-rc1
+
+Requesting page reqest irq under dmar_global_lock could cause
+potential lock race condition (caught by lockdep).
+
+[ 4.100055] ======================================================
+[ 4.100063] WARNING: possible circular locking dependency detected
+[ 4.100072] 5.1.0-rc4+ #2169 Not tainted
+[ 4.100078] ------------------------------------------------------
+[ 4.100086] swapper/0/1 is trying to acquire lock:
+[ 4.100094] 000000007dcbe3c3 (dmar_lock){+.+.}, at: dmar_alloc_hwirq+0x35/0x140
+[ 4.100112] but task is already holding lock:
+[ 4.100120] 0000000060bbe946 (dmar_global_lock){++++}, at: intel_iommu_init+0x191/0x1438
+[ 4.100136] which lock already depends on the new lock.
+[ 4.100146] the existing dependency chain (in reverse order) is:
+[ 4.100155]
+ -> #2 (dmar_global_lock){++++}:
+[ 4.100169] down_read+0x44/0xa0
+[ 4.100178] intel_irq_remapping_alloc+0xb2/0x7b0
+[ 4.100186] mp_irqdomain_alloc+0x9e/0x2e0
+[ 4.100195] __irq_domain_alloc_irqs+0x131/0x330
+[ 4.100203] alloc_isa_irq_from_domain.isra.4+0x9a/0xd0
+[ 4.100212] mp_map_pin_to_irq+0x244/0x310
+[ 4.100221] setup_IO_APIC+0x757/0x7ed
+[ 4.100229] x86_late_time_init+0x17/0x1c
+[ 4.100238] start_kernel+0x425/0x4e3
+[ 4.100247] secondary_startup_64+0xa4/0xb0
+[ 4.100254]
+ -> #1 (irq_domain_mutex){+.+.}:
+[ 4.100265] __mutex_lock+0x7f/0x9d0
+[ 4.100273] __irq_domain_add+0x195/0x2b0
+[ 4.100280] irq_domain_create_hierarchy+0x3d/0x40
+[ 4.100289] msi_create_irq_domain+0x32/0x110
+[ 4.100297] dmar_alloc_hwirq+0x111/0x140
+[ 4.100305] dmar_set_interrupt.part.14+0x1a/0x70
+[ 4.100314] enable_drhd_fault_handling+0x2c/0x6c
+[ 4.100323] apic_bsp_setup+0x75/0x7a
+[ 4.100330] x86_late_time_init+0x17/0x1c
+[ 4.100338] start_kernel+0x425/0x4e3
+[ 4.100346] secondary_startup_64+0xa4/0xb0
+[ 4.100352]
+ -> #0 (dmar_lock){+.+.}:
+[ 4.100364] lock_acquire+0xb4/0x1c0
+[ 4.100372] __mutex_lock+0x7f/0x9d0
+[ 4.100379] dmar_alloc_hwirq+0x35/0x140
+[ 4.100389] intel_svm_enable_prq+0x61/0x180
+[ 4.100397] intel_iommu_init+0x1128/0x1438
+[ 4.100406] pci_iommu_init+0x16/0x3f
+[ 4.100414] do_one_initcall+0x5d/0x2be
+[ 4.100422] kernel_init_freeable+0x1f0/0x27c
+[ 4.100431] kernel_init+0xa/0x110
+[ 4.100438] ret_from_fork+0x3a/0x50
+[ 4.100444]
+ other info that might help us debug this:
+
+[ 4.100454] Chain exists of:
+ dmar_lock --> irq_domain_mutex --> dmar_global_lock
+[ 4.100469] Possible unsafe locking scenario:
+
+[ 4.100476] CPU0 CPU1
+[ 4.100483] ---- ----
+[ 4.100488] lock(dmar_global_lock);
+[ 4.100495] lock(irq_domain_mutex);
+[ 4.100503] lock(dmar_global_lock);
+[ 4.100512] lock(dmar_lock);
+[ 4.100518]
+ *** DEADLOCK ***
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Cc: Kevin Tian <kevin.tian@intel.com>
+Reported-by: Dave Jiang <dave.jiang@intel.com>
+Fixes: a222a7f0bb6c9 ("iommu/vt-d: Implement page request handling")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3435,7 +3435,13 @@ domains_done:
+
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+ if (pasid_enabled(iommu) && ecap_prs(iommu->ecap)) {
++ /*
++ * Call dmar_alloc_hwirq() with dmar_global_lock held,
++ * could cause possible lock race condition.
++ */
++ up_write(&dmar_global_lock);
+ ret = intel_svm_enable_prq(iommu);
++ down_write(&dmar_global_lock);
+ if (ret)
+ goto free_iommu;
+ }
+
diff --git a/patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu b/patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu
new file mode 100644
index 0000000000..4ede87ac04
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu
@@ -0,0 +1,42 @@
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Thu, 2 May 2019 09:34:26 +0800
+Subject: iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
+Git-commit: 5daab58043ee2bca861068e2595564828f3bc663
+References: bsc#1135007
+Patch-mainline: v5.2-rc1
+
+The kernel parameter igfx_off is used by users to disable
+DMA remapping for the Intel integrated graphic device. It
+was designed for bare metal cases where a dedicated IOMMU
+is used for graphic. This doesn't apply to virtual IOMMU
+case where an include-all IOMMU is used. This makes the
+kernel parameter work with virtual IOMMU as well.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Tested-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3351,9 +3351,12 @@ static int __init init_dmars(void)
+ iommu_identity_mapping |= IDENTMAP_ALL;
+
+ #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
+- iommu_identity_mapping |= IDENTMAP_GFX;
++ dmar_map_gfx = 0;
+ #endif
+
++ if (!dmar_map_gfx)
++ iommu_identity_mapping |= IDENTMAP_GFX;
++
+ check_tylersburg_isoch();
+
+ if (iommu_identity_mapping) {
+
diff --git a/patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly b/patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly
new file mode 100644
index 0000000000..f84fdbca56
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly
@@ -0,0 +1,49 @@
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Thu, 2 May 2019 09:34:25 +0800
+Subject: iommu/vt-d: Set intel_iommu_gfx_mapped correctly
+Git-commit: cf1ec4539a50bdfe688caad4615ca47646884316
+References: bsc#1135008
+Patch-mainline: v5.2-rc1
+
+The intel_iommu_gfx_mapped flag is exported by the Intel
+IOMMU driver to indicate whether an IOMMU is used for the
+graphic device. In a virtualized IOMMU environment (e.g.
+QEMU), an include-all IOMMU is used for graphic device.
+This flag is found to be clear even the IOMMU is used.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Cc: Kevin Tian <kevin.tian@intel.com>
+Reported-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -4131,9 +4131,7 @@ static void __init init_no_remapping_dev
+
+ /* This IOMMU has *only* gfx devices. Either bypass it or
+ set the gfx_mapped flag, as appropriate */
+- if (dmar_map_gfx) {
+- intel_iommu_gfx_mapped = 1;
+- } else {
++ if (!dmar_map_gfx) {
+ drhd->ignored = 1;
+ for_each_active_dev_scope(drhd->devices,
+ drhd->devices_cnt, i, dev)
+@@ -4933,6 +4931,9 @@ int __init intel_iommu_init(void)
+ goto out_free_reserved_range;
+ }
+
++ if (dmar_map_gfx)
++ intel_iommu_gfx_mapped = 1;
++
+ init_no_remapping_devices();
+
+ ret = init_dmars();
+
diff --git a/patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch b/patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch
new file mode 100644
index 0000000000..60159f93ca
--- /dev/null
+++ b/patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch
@@ -0,0 +1,55 @@
+From 55be8658c7e2feb11a5b5b33ee031791dbd23a69 Mon Sep 17 00:00:00 2001
+From: Kamlakant Patel <kamlakantp@marvell.com>
+Date: Wed, 24 Apr 2019 11:50:43 +0000
+Subject: [PATCH] ipmi:ssif: compare block number correctly for multi-part return messages
+Git-commit: 55be8658c7e2feb11a5b5b33ee031791dbd23a69
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+According to ipmi spec, block number is a number that is incremented,
+starting with 0, for each new block of message data returned using the
+middle transaction.
+
+Here, the 'blocknum' is data[0] which always starts from zero(0) and
+'ssif_info->multi_pos' starts from 1.
+So, we need to add +1 to blocknum while comparing with multi_pos.
+
+Fixes: 7d6380cd40f79 ("ipmi:ssif: Fix handling of multi-part return messages").
+Reported-by: Kiran Kolukuluru <kirank@ami.com>
+Signed-off-by: Kamlakant Patel <kamlakantp@marvell.com>
+Message-id: <1556106615-18722-1-git-send-email-kamlakantp@marvell.com>
+[Also added a debug log if the block numbers don't match.]
+
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Cc: stable@vger.kernel.org # 4.4
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/char/ipmi/ipmi_ssif.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 8b5aec5430f1..aaccb0ff1ea6 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -727,12 +727,16 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ /* End of read */
+ len = ssif_info->multi_len;
+ data = ssif_info->data;
+- } else if (blocknum != ssif_info->multi_pos) {
++ } else if (blocknum + 1 != ssif_info->multi_pos) {
+ /*
+ * Out of sequence block, just abort. Block
+ * numbers start at zero for the second block,
+ * but multi_pos starts at one, so the +1.
+ */
++ if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
++ dev_dbg(&ssif_info->client->dev,
++ "Received message out of sequence, expected %u, got %u\n",
++ ssif_info->multi_pos - 1, blocknum);
+ result = -EIO;
+ } else {
+ ssif_inc_stat(ssif_info, received_message_parts);
+--
+2.16.4
+
diff --git a/patches.drivers/leds-avoid-races-with-workqueue.patch b/patches.drivers/leds-avoid-races-with-workqueue.patch
new file mode 100644
index 0000000000..ba166c7c25
--- /dev/null
+++ b/patches.drivers/leds-avoid-races-with-workqueue.patch
@@ -0,0 +1,64 @@
+From 0db37915d912e8dc6588f25da76d3ed36718d92f Mon Sep 17 00:00:00 2001
+From: Pavel Machek <pavel@ucw.cz>
+Date: Mon, 29 Apr 2019 17:22:59 +0200
+Subject: [PATCH] leds: avoid races with workqueue
+Git-commit: 0db37915d912e8dc6588f25da76d3ed36718d92f
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+There are races between "main" thread and workqueue. They manifest
+themselves on Thinkpad X60:
+
+This should result in LED blinking, but it turns it off instead:
+
+ root@amd:/data/pavel# cd /sys/class/leds/tpacpi\:\:power
+ root@amd:/sys/class/leds/tpacpi::power# echo timer > trigger
+ root@amd:/sys/class/leds/tpacpi::power# echo timer > trigger
+
+It should be possible to transition from blinking to solid on by echo
+0 > brightness; echo 1 > brightness... but that does not work, either,
+if done too quickly.
+
+Synchronization of the workqueue fixes both.
+
+Fixes: 1afcadfcd184 ("leds: core: Use set_brightness_work for the blocking op")
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/leds/led-class.c | 1 +
+ drivers/leds/led-core.c | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
+index 3c7e3487b373..85848c5da705 100644
+--- a/drivers/leds/led-class.c
++++ b/drivers/leds/led-class.c
+@@ -57,6 +57,7 @@ static ssize_t brightness_store(struct device *dev,
+ if (state == LED_OFF)
+ led_trigger_remove(led_cdev);
+ led_set_brightness(led_cdev, state);
++ flush_work(&led_cdev->set_brightness_work);
+
+ ret = size;
+ unlock:
+diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
+index e3da7c03da1b..e9ae7f87ab90 100644
+--- a/drivers/leds/led-core.c
++++ b/drivers/leds/led-core.c
+@@ -164,6 +164,11 @@ static void led_blink_setup(struct led_classdev *led_cdev,
+ unsigned long *delay_on,
+ unsigned long *delay_off)
+ {
++ /*
++ * If "set brightness to 0" is pending in workqueue, we don't
++ * want that to be reordered after blink_set()
++ */
++ flush_work(&led_cdev->set_brightness_work);
+ if (!test_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags) &&
+ led_cdev->blink_set &&
+ !led_cdev->blink_set(led_cdev, delay_on, delay_off))
+--
+2.16.4
+
diff --git a/patches.drivers/libata-fix-using-DMA-buffers-on-stack.patch b/patches.drivers/libata-fix-using-DMA-buffers-on-stack.patch
new file mode 100644
index 0000000000..8b69ea94a1
--- /dev/null
+++ b/patches.drivers/libata-fix-using-DMA-buffers-on-stack.patch
@@ -0,0 +1,89 @@
+From dd08a8d9a66de4b54575c294a92630299f7e0fe7 Mon Sep 17 00:00:00 2001
+From: raymond pang <raymondpangxd@gmail.com>
+Date: Thu, 28 Mar 2019 12:19:25 +0000
+Subject: [PATCH] libata: fix using DMA buffers on stack
+Git-commit: dd08a8d9a66de4b54575c294a92630299f7e0fe7
+Patch-mainline: v5.1-rc3
+References: bsc#1051510
+
+When CONFIG_VMAP_STACK=y, __pa() returns incorrect physical address for
+a stack virtual address. Stack DMA buffers must be avoided.
+
+Signed-off-by: raymond pang <raymondpangxd@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/ata/libata-zpodd.c | 34 ++++++++++++++++++++++++----------
+ 1 file changed, 24 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
+index b3ed8f9953a8..173e6f2dd9af 100644
+--- a/drivers/ata/libata-zpodd.c
++++ b/drivers/ata/libata-zpodd.c
+@@ -52,38 +52,52 @@ static int eject_tray(struct ata_device *dev)
+ /* Per the spec, only slot type and drawer type ODD can be supported */
+ static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
+ {
+- char buf[16];
++ char *buf;
+ unsigned int ret;
+- struct rm_feature_desc *desc = (void *)(buf + 8);
++ struct rm_feature_desc *desc;
+ struct ata_taskfile tf;
+ static const char cdb[] = { GPCMD_GET_CONFIGURATION,
+ 2, /* only 1 feature descriptor requested */
+ 0, 3, /* 3, removable medium feature */
+ 0, 0, 0,/* reserved */
+- 0, sizeof(buf),
++ 0, 16,
+ 0, 0, 0,
+ };
+
++ buf = kzalloc(16, GFP_KERNEL);
++ if (!buf)
++ return ODD_MECH_TYPE_UNSUPPORTED;
++ desc = (void *)(buf + 8);
++
+ ata_tf_init(dev, &tf);
+ tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+ tf.command = ATA_CMD_PACKET;
+ tf.protocol = ATAPI_PROT_PIO;
+- tf.lbam = sizeof(buf);
++ tf.lbam = 16;
+
+ ret = ata_exec_internal(dev, &tf, cdb, DMA_FROM_DEVICE,
+- buf, sizeof(buf), 0);
+- if (ret)
++ buf, 16, 0);
++ if (ret) {
++ kfree(buf);
+ return ODD_MECH_TYPE_UNSUPPORTED;
++ }
+
+- if (be16_to_cpu(desc->feature_code) != 3)
++ if (be16_to_cpu(desc->feature_code) != 3) {
++ kfree(buf);
+ return ODD_MECH_TYPE_UNSUPPORTED;
++ }
+
+- if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1)
++ if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1) {
++ kfree(buf);
+ return ODD_MECH_TYPE_SLOT;
+- else if (desc->mech_type == 1 && desc->load == 0 && desc->eject == 1)
++ } else if (desc->mech_type == 1 && desc->load == 0 &&
++ desc->eject == 1) {
++ kfree(buf);
+ return ODD_MECH_TYPE_DRAWER;
+- else
++ } else {
++ kfree(buf);
+ return ODD_MECH_TYPE_UNSUPPORTED;
++ }
+ }
+
+ /* Test if ODD is zero power ready by sense code */
+--
+2.16.4
+
diff --git a/patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch b/patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
new file mode 100644
index 0000000000..fd62d631a3
--- /dev/null
+++ b/patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
@@ -0,0 +1,37 @@
+From 7afb0df554292dca7568446f619965fb8153085d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Feb 2019 01:37:02 -0500
+Subject: [PATCH] media: cx18: update *pos correctly in cx18_read_pos()
+Git-commit: 7afb0df554292dca7568446f619965fb8153085d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We should be updating *pos. The current code is a no-op.
+
+Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/cx18/cx18-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
+index f778965a2eb8..59e78fb17575 100644
+--- a/drivers/media/pci/cx18/cx18-fileops.c
++++ b/drivers/media/pci/cx18/cx18-fileops.c
+@@ -484,7 +484,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
+
+ CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/media-cx23885-check-allocation-return.patch b/patches.drivers/media-cx23885-check-allocation-return.patch
new file mode 100644
index 0000000000..5dffa95e6c
--- /dev/null
+++ b/patches.drivers/media-cx23885-check-allocation-return.patch
@@ -0,0 +1,43 @@
+From a3d7f22ef34ec4206b50ee121384d5c8bebd5591 Mon Sep 17 00:00:00 2001
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Sat, 19 Jan 2019 22:52:23 -0500
+Subject: [PATCH] media: cx23885: check allocation return
+Git-commit: a3d7f22ef34ec4206b50ee121384d5c8bebd5591
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Checking of kmalloc() seems to have been committed - as
+cx23885_dvb_register() is checking for != 0 return, returning
+-ENOMEM should be fine here. While at it address the coccicheck
+suggestion to move to kmemdup rather than using kmalloc+memcpy.
+
+Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2")
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/cx23885/cx23885-dvb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
+index 0d0929c54f93..e2e63f05645e 100644
+--- a/drivers/media/pci/cx23885/cx23885-dvb.c
++++ b/drivers/media/pci/cx23885/cx23885-dvb.c
+@@ -1474,8 +1474,9 @@ static int dvb_register(struct cx23885_tsport *port)
+ if (fe0->dvb.frontend != NULL) {
+ struct i2c_adapter *tun_i2c;
+
+- fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
+- memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
++ fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
++ if (!fe0->dvb.frontend->sec_priv)
++ return -ENOMEM;
+ tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
+ if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
+ return -ENODEV;
+--
+2.16.4
+
diff --git a/patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch b/patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch
new file mode 100644
index 0000000000..b11b752246
--- /dev/null
+++ b/patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch
@@ -0,0 +1,78 @@
+From 0e633f97162c1c74c68e2eb20bbd9259dce87cd9 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 22 Mar 2019 10:34:22 -0400
+Subject: [PATCH] media: davinci-isif: avoid uninitialized variable use
+Git-commit: 0e633f97162c1c74c68e2eb20bbd9259dce87cd9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+clang warns about a possible variable use that gcc never
+complained about:
+
+drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here
+ [-Werror,-Wuninitialized]
+ dm365_vpss_set_pg_frame_size(frame_size);
+ ^~~~~~~~~~
+drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here
+ struct vpss_pg_frame_size frame_size;
+ ^
+1 error generated.
+
+There is no initialization for this variable at all, and there
+has never been one in the mainline kernel, so we really should
+not put that stack data into an mmio register.
+
+On the other hand, I suspect that gcc checks the condition
+more closely and notices that the global
+isif_cfg.bayer.config_params.test_pat_gen flag is initialized
+to zero and never written to from any code path, so anything
+depending on it can be eliminated.
+
+To shut up the clang warning, just remove the dead code manually,
+it has probably never been used because any attempt to do so
+would have resulted in undefined behavior.
+
+Fixes: 63e3ab142fa3 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/platform/davinci/isif.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
+index 47cecd10eb9f..2dee9af6d413 100644
+--- a/drivers/media/platform/davinci/isif.c
++++ b/drivers/media/platform/davinci/isif.c
+@@ -884,9 +884,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
+ static int isif_config_ycbcr(void)
+ {
+ struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
+- struct vpss_pg_frame_size frame_size;
+ u32 modeset = 0, ccdcfg = 0;
+- struct vpss_sync_pol sync;
+
+ dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
+
+@@ -974,13 +972,6 @@ static int isif_config_ycbcr(void)
+ /* two fields are interleaved in memory */
+ regw(0x00000249, SDOFST);
+
+- /* Setup test pattern if enabled */
+- if (isif_cfg.bayer.config_params.test_pat_gen) {
+- sync.ccdpg_hdpol = params->hd_pol;
+- sync.ccdpg_vdpol = params->vd_pol;
+- dm365_vpss_set_sync_pol(sync);
+- dm365_vpss_set_pg_frame_size(frame_size);
+- }
+ return 0;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch b/patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
new file mode 100644
index 0000000000..fcdf04ad5c
--- /dev/null
+++ b/patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
@@ -0,0 +1,37 @@
+From f8e579f3ca0973daef263f513da5edff520a6c0d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Feb 2019 01:36:41 -0500
+Subject: [PATCH] media: ivtv: update *pos correctly in ivtv_read_pos()
+Git-commit: f8e579f3ca0973daef263f513da5edff520a6c0d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We had intended to update *pos, but the current code is a no-op.
+
+Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/ivtv/ivtv-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index 6196daae4b3e..043ac0ae9ed0 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
+
+ IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch b/patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
new file mode 100644
index 0000000000..5c64655395
--- /dev/null
+++ b/patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
@@ -0,0 +1,39 @@
+From 384538bda10913e5c94ec5b5d34bd3075931bcf4 Mon Sep 17 00:00:00 2001
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Sat, 30 Mar 2019 10:01:32 -0400
+Subject: [PATCH] media: ov2659: fix unbalanced mutex_lock/unlock
+Git-commit: 384538bda10913e5c94ec5b5d34bd3075931bcf4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Avoid returning with mutex locked.
+
+Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API")
+
+Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/i2c/ov2659.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index a1e9a980a445..5ed2413eac8a 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -1132,7 +1132,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
+ mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+ *mf = fmt->format;
+ #else
+- return -ENOTTY;
++ ret = -ENOTTY;
+ #endif
+ } else {
+ s64 val;
+--
+2.16.4
+
diff --git a/patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch b/patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch
new file mode 100644
index 0000000000..538bbec145
--- /dev/null
+++ b/patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch
@@ -0,0 +1,141 @@
+From 56cd26b618855c9af48c8301aa6754ced8dd0beb Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 5 Mar 2019 00:40:26 -0500
+Subject: [PATCH] media: serial_ir: Fix use-after-free in serial_ir_init_module
+Git-commit: 56cd26b618855c9af48c8301aa6754ced8dd0beb
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Syzkaller report this:
+
+Bug: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
+Read of size 8 at addr ffff8881dc7ae030 by task syz-executor.0/6249
+
+Cpu: 1 PID: 6249 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xfa/0x1ce lib/dump_stack.c:113
+ print_address_description+0x65/0x270 mm/kasan/report.c:187
+ kasan_report+0x149/0x18d mm/kasan/report.c:317
+ ? 0xffffffffc1728000
+ sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
+ sysfs_remove_file include/linux/sysfs.h:519 [inline]
+ driver_remove_file+0x40/0x50 drivers/base/driver.c:122
+ remove_bind_files drivers/base/bus.c:585 [inline]
+ bus_remove_driver+0x186/0x220 drivers/base/bus.c:725
+ driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
+ serial_ir_init_module+0x169/0x1000 [serial_ir]
+ do_one_initcall+0xfa/0x5ca init/main.c:887
+ do_init_module+0x204/0x5f6 kernel/module.c:3460
+ load_module+0x66b2/0x8570 kernel/module.c:3808
+ __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+Rip: 0033:0x462e99
+Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
+Rsp: 002b:00007f9450132c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+Rax: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
+Rdx: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
+Rbp: 00007f9450132c70 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94501336bc
+R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004
+
+Allocated by task 6249:
+ set_track mm/kasan/common.c:85 [inline]
+ __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:495
+ kmalloc include/linux/slab.h:545 [inline]
+ kzalloc include/linux/slab.h:740 [inline]
+ bus_add_driver+0xc0/0x610 drivers/base/bus.c:651
+ driver_register+0x1bb/0x3f0 drivers/base/driver.c:170
+ serial_ir_init_module+0xe8/0x1000 [serial_ir]
+ do_one_initcall+0xfa/0x5ca init/main.c:887
+ do_init_module+0x204/0x5f6 kernel/module.c:3460
+ load_module+0x66b2/0x8570 kernel/module.c:3808
+ __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Freed by task 6249:
+ set_track mm/kasan/common.c:85 [inline]
+ __kasan_slab_free+0x130/0x180 mm/kasan/common.c:457
+ slab_free_hook mm/slub.c:1430 [inline]
+ slab_free_freelist_hook mm/slub.c:1457 [inline]
+ slab_free mm/slub.c:3005 [inline]
+ kfree+0xe1/0x270 mm/slub.c:3957
+ kobject_cleanup lib/kobject.c:662 [inline]
+ kobject_release lib/kobject.c:691 [inline]
+ kref_put include/linux/kref.h:67 [inline]
+ kobject_put+0x146/0x240 lib/kobject.c:708
+ bus_remove_driver+0x10e/0x220 drivers/base/bus.c:732
+ driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
+ serial_ir_init_module+0x14c/0x1000 [serial_ir]
+ do_one_initcall+0xfa/0x5ca init/main.c:887
+ do_init_module+0x204/0x5f6 kernel/module.c:3460
+ load_module+0x66b2/0x8570 kernel/module.c:3808
+ __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+The buggy address belongs to the object at ffff8881dc7ae000
+ which belongs to the cache kmalloc-256 of size 256
+The buggy address is located 48 bytes inside of
+ 256-byte region [ffff8881dc7ae000, ffff8881dc7ae100)
+The buggy address belongs to the page:
+page:ffffea000771eb80 count:1 mapcount:0 mapping:ffff8881f6c02e00 index:0x0
+Flags: 0x2fffc0000000200(slab)
+Raw: 02fffc0000000200 ffffea0007d14800 0000000400000002 ffff8881f6c02e00
+Raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff8881dc7adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ ffff8881dc7adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+>ffff8881dc7ae000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881dc7ae080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881dc7ae100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
+
+There are already cleanup handlings in serial_ir_init error path,
+no need to call serial_ir_exit do it again in serial_ir_init_module,
+otherwise will trigger a use-after-free issue.
+
+Fixes: fa5dc29c1fcc ("[media] lirc_serial: move out of staging and rename to serial_ir")
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/rc/serial_ir.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
+index ffe2c672d105..3998ba29beb6 100644
+--- a/drivers/media/rc/serial_ir.c
++++ b/drivers/media/rc/serial_ir.c
+@@ -773,8 +773,6 @@ static void serial_ir_exit(void)
+
+ static int __init serial_ir_init_module(void)
+ {
+- int result;
+-
+ switch (type) {
+ case IR_HOMEBREW:
+ case IR_IRDEO:
+@@ -802,12 +800,7 @@ static int __init serial_ir_init_module(void)
+ if (sense != -1)
+ sense = !!sense;
+
+- result = serial_ir_init();
+- if (!result)
+- return 0;
+-
+- serial_ir_exit();
+- return result;
++ return serial_ir_init();
+ }
+
+ static void __exit serial_ir_exit_module(void)
+--
+2.16.4
+
diff --git a/patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch b/patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch
new file mode 100644
index 0000000000..903cea3e5a
--- /dev/null
+++ b/patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch
@@ -0,0 +1,46 @@
+From 2e7682ebfc750177a4944eeb56e97a3f05734528 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 14 Mar 2019 22:01:24 -0400
+Subject: [PATCH] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame
+Git-commit: 2e7682ebfc750177a4944eeb56e97a3f05734528
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+'vb' null check should be done before dereferencing it in
+tw5864_handle_frame, otherwise a NULL pointer dereference
+may occur.
+
+Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/tw5864/tw5864-video.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
+index 5a1f3aa4101a..434d313a3c15 100644
+--- a/drivers/media/pci/tw5864/tw5864-video.c
++++ b/drivers/media/pci/tw5864/tw5864-video.c
+@@ -1395,13 +1395,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
+ input->vb = NULL;
+ spin_unlock_irqrestore(&input->slock, flags);
+
+- v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
+-
+ if (!vb) { /* Gone because of disabling */
+ dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
+ return;
+ }
+
++ v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
++
+ /*
+ * Check for space.
+ * Mind the overhead of startcode emulation prevention.
+--
+2.16.4
+
diff --git a/patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch b/patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch
new file mode 100644
index 0000000000..7dbf7f646c
--- /dev/null
+++ b/patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch
@@ -0,0 +1,41 @@
+From dad7e270ba712ba1c99cd2d91018af6044447a06 Mon Sep 17 00:00:00 2001
+From: Alexander Potapenko <glider@google.com>
+Date: Thu, 4 Apr 2019 10:56:46 -0400
+Subject: [PATCH] media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
+Git-commit: dad7e270ba712ba1c99cd2d91018af6044447a06
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+syzkaller reported crashes on kfree() called from
+vivid_vid_cap_s_selection(). This looks like a simple typo, as
+dev->bitmap_cap is allocated with vzalloc() throughout the file.
+
+Fixes: ef834f7836ec0 ("[media] vivid: add the video capture and output
+parts")
+
+Signed-off-by: Alexander Potapenko <glider@google.com>
+Reported-by: Syzbot <syzbot+6c0effb5877f6b0344e2@syzkaller.appspotmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/platform/vivid/vivid-vid-cap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
+index 52eeda624d7e..530ac8decb25 100644
+--- a/drivers/media/platform/vivid/vivid-vid-cap.c
++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
+@@ -1007,7 +1007,7 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection
+ v4l2_rect_map_inside(&s->r, &dev->fmt_cap_rect);
+ if (dev->bitmap_cap && (compose->width != s->r.width ||
+ compose->height != s->r.height)) {
+- kfree(dev->bitmap_cap);
++ vfree(dev->bitmap_cap);
+ dev->bitmap_cap = NULL;
+ }
+ *compose = s->r;
+--
+2.16.4
+
diff --git a/patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch b/patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch
new file mode 100644
index 0000000000..08ab610d26
--- /dev/null
+++ b/patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch
@@ -0,0 +1,40 @@
+From ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 6 Mar 2019 02:27:43 -0500
+Subject: [PATCH] media: wl128x: Fix an error code in fm_download_firmware()
+Git-commit: ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We forgot to set "ret" on this error path.
+
+Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/radio/wl128x/fmdrv_common.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index 3c8987af3772..1614809f7d35 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -1268,8 +1268,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
+
+ switch (action->type) {
+ case ACTION_SEND_COMMAND: /* Send */
+- if (fmc_send_cmd(fmdev, 0, 0, action->data,
+- action->size, NULL, NULL))
++ ret = fmc_send_cmd(fmdev, 0, 0, action->data,
++ action->size, NULL, NULL);
++ if (ret)
+ goto rel_fw;
+
+ cmd_cnt++;
+--
+2.16.4
+
diff --git a/patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch b/patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch
new file mode 100644
index 0000000000..238ca550b4
--- /dev/null
+++ b/patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch
@@ -0,0 +1,64 @@
+From 9c2ccc324b3a6cbc865ab8b3e1a09e93d3c8ade9 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 26 Mar 2019 01:12:07 -0400
+Subject: [PATCH] media: wl128x: prevent two potential buffer overflows
+Git-commit: 9c2ccc324b3a6cbc865ab8b3e1a09e93d3c8ade9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Smatch marks skb->data as untrusted so it warns that "evt_hdr->dlen"
+can copy up to 255 bytes and we only have room for two bytes. Even
+if this comes from the firmware and we trust it, the new policy
+generally is just to fix it as kernel hardenning.
+
+I can't test this code so I tried to be very conservative. I considered
+not allowing "evt_hdr->dlen == 1" because it doesn't initialize the
+whole variable but in the end I decided to allow it and manually
+initialized "asic_id" and "asic_ver" to zero.
+
+Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/radio/wl128x/fmdrv_common.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index 1614809f7d35..a1fcb80a2191 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -489,7 +489,8 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload,
+ return -EIO;
+ }
+ /* Send response data to caller */
+- if (response != NULL && response_len != NULL && evt_hdr->dlen) {
++ if (response != NULL && response_len != NULL && evt_hdr->dlen &&
++ evt_hdr->dlen <= payload_len) {
+ /* Skip header info and copy only response data */
+ skb_pull(skb, sizeof(struct fm_event_msg_hdr));
+ memcpy(response, skb->data, evt_hdr->dlen);
+@@ -583,6 +584,8 @@ static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev)
+ return;
+
+ fm_evt_hdr = (void *)skb->data;
++ if (fm_evt_hdr->dlen > sizeof(fmdev->irq_info.flag))
++ return;
+
+ /* Skip header info and copy only response data */
+ skb_pull(skb, sizeof(struct fm_event_msg_hdr));
+@@ -1309,7 +1312,7 @@ static int load_default_rx_configuration(struct fmdev *fmdev)
+ static int fm_power_up(struct fmdev *fmdev, u8 mode)
+ {
+ u16 payload;
+- __be16 asic_id, asic_ver;
++ __be16 asic_id = 0, asic_ver = 0;
+ int resp_len, ret;
+ u8 fw_name[50];
+
+--
+2.16.4
+
diff --git a/patches.drivers/mmc-core-fix-possible-use-after-free-of-host.patch b/patches.drivers/mmc-core-fix-possible-use-after-free-of-host.patch
new file mode 100644
index 0000000000..7ecc0b0856
--- /dev/null
+++ b/patches.drivers/mmc-core-fix-possible-use-after-free-of-host.patch
@@ -0,0 +1,40 @@
+From 8e1943af2986db42bee2b8dddf49a36cdb2e9219 Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Wed, 17 Apr 2019 16:28:37 +0800
+Subject: [PATCH] mmc: core: fix possible use after free of host
+Git-commit: 8e1943af2986db42bee2b8dddf49a36cdb2e9219
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In the function mmc_alloc_host, the function put_device is called to
+release allocated resources when mmc_gpio_alloc fails. Finally, the
+function pointed by host->class_dev.class->dev_release (i.e.,
+mmc_host_classdev_release) is used to release resources including the
+host structure. However, after put_device, host is used and released
+again. Resulting in a use-after-free bug.
+
+Fixes: 1ed217194488 ("mmc: core: fix error path in mmc_host_alloc")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/core/host.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index b3fa9c916142..6a51f7a06ce7 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -429,8 +429,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
+
+ if (mmc_gpio_alloc(host)) {
+ put_device(&host->class_dev);
+- ida_simple_remove(&mmc_host_ida, host->index);
+- kfree(host);
+ return NULL;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch b/patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch
new file mode 100644
index 0000000000..1d78c24e1c
--- /dev/null
+++ b/patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch
@@ -0,0 +1,38 @@
+From 32937a82f36c7bbe08db4052de94bc7ade4e3c51 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 23 Jan 2019 14:58:27 +0800
+Subject: [PATCH] mtd: docg3: Fix passing zero to 'PTR_ERR' warning in doc_probe_device
+Git-commit: 32937a82f36c7bbe08db4052de94bc7ade4e3c51
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Fix a static code checker warning:
+drivers/mtd/devices/docg3.c:1875
+ doc_probe_device() warn: passing zero to 'ERR_PTR'
+
+Fixes: ae9d4934b2d7 ("mtd: docg3: add multiple floor support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mtd/devices/docg3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
+index 4c94fc096696..60ddc38a5431 100644
+--- a/drivers/mtd/devices/docg3.c
++++ b/drivers/mtd/devices/docg3.c
+@@ -1872,7 +1872,7 @@ doc_probe_device(struct docg3_cascade *cascade, int floor, struct device *dev)
+ nomem2:
+ kfree(docg3);
+ nomem1:
+- return ERR_PTR(ret);
++ return ret ? ERR_PTR(ret) : NULL;
+ }
+
+ /**
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch b/patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch
new file mode 100644
index 0000000000..cc6078d719
--- /dev/null
+++ b/patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch
@@ -0,0 +1,46 @@
+From b0dd77a796423ad3c609b6708260adca85a0798f Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 25 Jan 2019 10:12:42 +0800
+Subject: [PATCH] mtd: docg3: fix a possible memory leak of mtd->name
+Git-commit: b0dd77a796423ad3c609b6708260adca85a0798f
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+In case DOC_CHIPID_G3, mtd->name is not freed in err handling path,
+which is alloced by kasprintf(). Fix this by using devm_kasprintf().
+
+Fixes: ae9d4934b2d7 ("mtd: docg3: add multiple floor support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mtd/devices/docg3.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
+index 60ddc38a5431..7754803e3463 100644
+--- a/drivers/mtd/devices/docg3.c
++++ b/drivers/mtd/devices/docg3.c
+@@ -1767,8 +1767,8 @@ static int __init doc_set_driver_info(int chip_id, struct mtd_info *mtd)
+
+ switch (chip_id) {
+ case DOC_CHIPID_G3:
+- mtd->name = kasprintf(GFP_KERNEL, "docg3.%d",
+- docg3->device_id);
++ mtd->name = devm_kasprintf(docg3->dev, GFP_KERNEL, "docg3.%d",
++ docg3->device_id);
+ if (!mtd->name)
+ return -ENOMEM;
+ docg3->max_block = 2047;
+@@ -1886,7 +1886,6 @@ static void doc_release_device(struct mtd_info *mtd)
+ mtd_device_unregister(mtd);
+ kfree(docg3->bbt);
+ kfree(docg3);
+- kfree(mtd->name);
+ kfree(mtd);
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch b/patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch
new file mode 100644
index 0000000000..8caac6e39d
--- /dev/null
+++ b/patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch
@@ -0,0 +1,34 @@
+From e90a619fb7e1acb5e18f1ab618c6d10b08f0fc70 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Thu, 7 Feb 2019 15:28:24 +0100
+Subject: [PATCH] mtd: nand: omap: Fix comment in platform data using wrong Kconfig symbol
+Git-commit: e90a619fb7e1acb5e18f1ab618c6d10b08f0fc70
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The symbol that is being used in the #if/#endif block is not the one
+which is mentioned at the bottom.
+
+Fixes: 93af53b8633c ("nand: omap2: Remove horrible ifdefs to fix module probe")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/linux/platform_data/elm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/platform_data/elm.h b/include/linux/platform_data/elm.h
+index b8686c00f15f..fef4b081b736 100644
+--- a/include/linux/platform_data/elm.h
++++ b/include/linux/platform_data/elm.h
+@@ -60,6 +60,6 @@ static inline int elm_config(struct device *dev, enum bch_ecc bch_type,
+ {
+ return -ENOSYS;
+ }
+-#endif /* CONFIG_MTD_NAND_ECC_BCH */
++#endif /* CONFIG_MTD_NAND_OMAP_BCH */
+
+ #endif /* __ELM_H */
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch b/patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch
new file mode 100644
index 0000000000..053b532d9a
--- /dev/null
+++ b/patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch
@@ -0,0 +1,40 @@
+From 3008ba87093852f3756c5d33f584602e5e2a4aa4 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 31 Jan 2019 14:08:20 +0000
+Subject: [PATCH] mtd: part: fix incorrect format specifier for an unsigned long long
+Git-commit: 3008ba87093852f3756c5d33f584602e5e2a4aa4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+An unsigned long long is being formatted with %lld instead of the unsigned
+version %llu. Fix this.
+
+Clean up cppcheck warning:
+%lld in format string (no. 1) requires 'long long' but the argument type
+is 'unsigned long long'.
+
+Fixes: a62c24d75529 ("mtd: part: Add sysfs variable for offset of partition")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mtd/mtdpart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index 37f174ccbcec..dfa241ad018b 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -572,7 +572,7 @@ static ssize_t mtd_partition_offset_show(struct device *dev,
+ {
+ struct mtd_info *mtd = dev_get_drvdata(dev);
+ struct mtd_part *part = mtd_to_part(mtd);
+- return snprintf(buf, PAGE_SIZE, "%lld\n", part->offset);
++ return snprintf(buf, PAGE_SIZE, "%llu\n", part->offset);
+ }
+
+ static DEVICE_ATTR(offset, S_IRUGO, mtd_partition_offset_show, NULL);
+--
+2.16.4
+
diff --git a/patches.drivers/mwifiex-Fix-mem-leak-in-mwifiex_tm_cmd.patch b/patches.drivers/mwifiex-Fix-mem-leak-in-mwifiex_tm_cmd.patch
new file mode 100644
index 0000000000..0cbcbd5026
--- /dev/null
+++ b/patches.drivers/mwifiex-Fix-mem-leak-in-mwifiex_tm_cmd.patch
@@ -0,0 +1,50 @@
+From 003b686ace820ce2d635a83f10f2d7f9c147dabc Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 12 Mar 2019 15:03:58 +0800
+Subject: [PATCH] mwifiex: Fix mem leak in mwifiex_tm_cmd
+Git-commit: 003b686ace820ce2d635a83f10f2d7f9c147dabc
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+'hostcmd' is alloced by kzalloc, should be freed before
+leaving from the error handling cases, otherwise it will
+cause mem leak.
+
+Fixes: 3935ccc14d2c ("mwifiex: add cfg80211 testmode support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index c46f0a54a0c7..e582d9b3e50c 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -4082,16 +4082,20 @@ static int mwifiex_tm_cmd(struct wiphy *wiphy, struct wireless_dev *wdev,
+
+ if (mwifiex_send_cmd(priv, 0, 0, 0, hostcmd, true)) {
+ dev_err(priv->adapter->dev, "Failed to process hostcmd\n");
++ kfree(hostcmd);
+ return -EFAULT;
+ }
+
+ /* process hostcmd response*/
+ skb = cfg80211_testmode_alloc_reply_skb(wiphy, hostcmd->len);
+- if (!skb)
++ if (!skb) {
++ kfree(hostcmd);
+ return -ENOMEM;
++ }
+ err = nla_put(skb, MWIFIEX_TM_ATTR_DATA,
+ hostcmd->len, hostcmd->cmd);
+ if (err) {
++ kfree(hostcmd);
+ kfree_skb(skb);
+ return -EMSGSIZE;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/mwifiex-prevent-an-array-overflow.patch b/patches.drivers/mwifiex-prevent-an-array-overflow.patch
new file mode 100644
index 0000000000..ff23be3f12
--- /dev/null
+++ b/patches.drivers/mwifiex-prevent-an-array-overflow.patch
@@ -0,0 +1,40 @@
+From b4c35c17227fe437ded17ce683a6927845f8c4a4 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 4 Apr 2019 11:44:23 +0300
+Subject: [PATCH] mwifiex: prevent an array overflow
+Git-commit: b4c35c17227fe437ded17ce683a6927845f8c4a4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The "rate_index" is only used as an index into the phist_data->rx_rate[]
+array in the mwifiex_hist_data_set() function. That array has
+MWIFIEX_MAX_AC_RX_RATES (74) elements and it's used to generate some
+debugfs information. The "rate_index" variable comes from the network
+skb->data[] and it is a u8 so it's in the 0-255 range. We need to cap
+it to prevent an array overflow.
+
+Fixes: cbf6e05527a7 ("mwifiex: add rx histogram statistics support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/marvell/mwifiex/cfp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfp.c b/drivers/net/wireless/marvell/mwifiex/cfp.c
+index bfe84e55df77..f1522fb1c1e8 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfp.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfp.c
+@@ -531,5 +531,8 @@ u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv,
+ rate_index = (rx_rate > MWIFIEX_RATE_INDEX_OFDM0) ?
+ rx_rate - 1 : rx_rate;
+
++ if (rate_index >= MWIFIEX_MAX_AC_RX_RATES)
++ rate_index = MWIFIEX_MAX_AC_RX_RATES - 1;
++
+ return rate_index;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/mwl8k-Fix-rate_idx-underflow.patch b/patches.drivers/mwl8k-Fix-rate_idx-underflow.patch
new file mode 100644
index 0000000000..2bb7753241
--- /dev/null
+++ b/patches.drivers/mwl8k-Fix-rate_idx-underflow.patch
@@ -0,0 +1,86 @@
+From 6b583201fa219b7b1b6aebd8966c8fd9357ef9f4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Thu, 11 Apr 2019 20:13:30 +0200
+Subject: [PATCH] mwl8k: Fix rate_idx underflow
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 6b583201fa219b7b1b6aebd8966c8fd9357ef9f4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+It was reported on OpenWrt bug tracking system[1], that several users
+are affected by the endless reboot of their routers if they configure
+5GHz interface with channel 44 or 48.
+
+The reboot loop is caused by the following excessive number of WARN_ON
+Messages:
+
+ WARNING: CPU: 0 PID: 0 at backports-4.19.23-1/net/mac80211/rx.c:4516
+ ieee80211_rx_napi+0x1fc/0xa54 [mac80211]
+
+as the messages are being correctly emitted by the following guard:
+
+ case RX_ENC_LEGACY:
+ if (WARN_ON(status->rate_idx >= sband->n_bitrates))
+
+as the rate_idx is in this case erroneously set to 251 (0xfb). This fix
+simply converts previously used magic number to proper constant and
+guards against substraction which is leading to the currently observed
+underflow.
+
+1. https://bugs.openwrt.org/index.php?do=details&task_id=2218
+
+Fixes: 854783444bab ("mwl8k: properly set receive status rate index on 5 GHz receive")
+Cc: <stable@vger.kernel.org>
+Tested-by: Eubert Bao <bunnier@gmail.com>
+Reported-by: Eubert Bao <bunnier@gmail.com>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/marvell/mwl8k.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
+index e0df51b62e97..70e69305197a 100644
+--- a/drivers/net/wireless/marvell/mwl8k.c
++++ b/drivers/net/wireless/marvell/mwl8k.c
+@@ -441,6 +441,9 @@ static const struct ieee80211_rate mwl8k_rates_50[] = {
+ #define MWL8K_CMD_UPDATE_STADB 0x1123
+ #define MWL8K_CMD_BASTREAM 0x1125
+
++#define MWL8K_LEGACY_5G_RATE_OFFSET \
++ (ARRAY_SIZE(mwl8k_rates_24) - ARRAY_SIZE(mwl8k_rates_50))
++
+ static const char *mwl8k_cmd_name(__le16 cmd, char *buf, int bufsize)
+ {
+ u16 command = le16_to_cpu(cmd);
+@@ -1016,8 +1019,9 @@ mwl8k_rxd_ap_process(void *_rxd, struct ieee80211_rx_status *status,
+
+ if (rxd->channel > 14) {
+ status->band = NL80211_BAND_5GHZ;
+- if (!(status->encoding == RX_ENC_HT))
+- status->rate_idx -= 5;
++ if (!(status->encoding == RX_ENC_HT) &&
++ status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
++ status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
+ } else {
+ status->band = NL80211_BAND_2GHZ;
+ }
+@@ -1124,8 +1128,9 @@ mwl8k_rxd_sta_process(void *_rxd, struct ieee80211_rx_status *status,
+
+ if (rxd->channel > 14) {
+ status->band = NL80211_BAND_5GHZ;
+- if (!(status->encoding == RX_ENC_HT))
+- status->rate_idx -= 5;
++ if (!(status->encoding == RX_ENC_HT) &&
++ status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
++ status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
+ } else {
+ status->band = NL80211_BAND_2GHZ;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch b/patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch
new file mode 100644
index 0000000000..f91883fe2c
--- /dev/null
+++ b/patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch
@@ -0,0 +1,160 @@
+From 62740e97881c78b45a117a358a866fb32975def6 Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Thu, 9 May 2019 23:13:43 -0500
+Subject: [PATCH] net/ibmvnic: Update MAC address settings after adapter reset
+
+References: bsc#1134760
+Patch-mainline: v5.2-rc1
+Git-commit: 62740e97881c78b45a117a358a866fb32975def6
+
+It was discovered in testing that the underlying hardware MAC
+address will revert to initial settings following a device reset,
+but the driver fails to resend the current OS MAC settings. This
+oversight can result in dropped packets should the scenario occur.
+Fix this by informing hardware of current MAC address settings
+following any adapter initialization or resets.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 53 ++++++++++++++++--------------
+ drivers/net/ethernet/ibm/ibmvnic.h | 2 --
+ 2 files changed, 28 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index b398d6c94dbd..2be3bcd0192f 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -118,7 +118,7 @@ static int init_sub_crq_irqs(struct ibmvnic_adapter *adapter);
+ static int ibmvnic_init(struct ibmvnic_adapter *);
+ static int ibmvnic_reset_init(struct ibmvnic_adapter *);
+ static void release_crq_queue(struct ibmvnic_adapter *);
+-static int __ibmvnic_set_mac(struct net_device *netdev, struct sockaddr *p);
++static int __ibmvnic_set_mac(struct net_device *, u8 *);
+ static int init_crq_queue(struct ibmvnic_adapter *adapter);
+ static int send_query_phys_parms(struct ibmvnic_adapter *adapter);
+
+@@ -849,11 +849,7 @@ static int ibmvnic_login(struct net_device *netdev)
+ }
+ } while (retry);
+
+- /* handle pending MAC address changes after successful login */
+- if (adapter->mac_change_pending) {
+- __ibmvnic_set_mac(netdev, &adapter->desired.mac);
+- adapter->mac_change_pending = false;
+- }
++ __ibmvnic_set_mac(netdev, adapter->mac_addr);
+
+ return 0;
+ }
+@@ -1686,28 +1682,40 @@ static void ibmvnic_set_multi(struct net_device *netdev)
+ }
+ }
+
+-static int __ibmvnic_set_mac(struct net_device *netdev, struct sockaddr *p)
++static int __ibmvnic_set_mac(struct net_device *netdev, u8 *dev_addr)
+ {
+ struct ibmvnic_adapter *adapter = netdev_priv(netdev);
+- struct sockaddr *addr = p;
+ union ibmvnic_crq crq;
+ int rc;
+
+- if (!is_valid_ether_addr(addr->sa_data))
+- return -EADDRNOTAVAIL;
++ if (!is_valid_ether_addr(dev_addr)) {
++ rc = -EADDRNOTAVAIL;
++ goto err;
++ }
+
+ memset(&crq, 0, sizeof(crq));
+ crq.change_mac_addr.first = IBMVNIC_CRQ_CMD;
+ crq.change_mac_addr.cmd = CHANGE_MAC_ADDR;
+- ether_addr_copy(&crq.change_mac_addr.mac_addr[0], addr->sa_data);
++ ether_addr_copy(&crq.change_mac_addr.mac_addr[0], dev_addr);
+
+ init_completion(&adapter->fw_done);
+ rc = ibmvnic_send_crq(adapter, &crq);
+- if (rc)
+- return rc;
++ if (rc) {
++ rc = -EIO;
++ goto err;
++ }
++
+ wait_for_completion(&adapter->fw_done);
+ /* netdev->dev_addr is changed in handle_change_mac_rsp function */
+- return adapter->fw_done_rc ? -EIO : 0;
++ if (adapter->fw_done_rc) {
++ rc = -EIO;
++ goto err;
++ }
++
++ return 0;
++err:
++ ether_addr_copy(adapter->mac_addr, netdev->dev_addr);
++ return rc;
+ }
+
+ static int ibmvnic_set_mac(struct net_device *netdev, void *p)
+@@ -1716,13 +1724,10 @@ static int ibmvnic_set_mac(struct net_device *netdev, void *p)
+ struct sockaddr *addr = p;
+ int rc;
+
+- if (adapter->state == VNIC_PROBED) {
+- memcpy(&adapter->desired.mac, addr, sizeof(struct sockaddr));
+- adapter->mac_change_pending = true;
+- return 0;
+- }
+-
+- rc = __ibmvnic_set_mac(netdev, addr);
++ rc = 0;
++ ether_addr_copy(adapter->mac_addr, addr->sa_data);
++ if (adapter->state != VNIC_PROBED)
++ rc = __ibmvnic_set_mac(netdev, addr->sa_data);
+
+ return rc;
+ }
+@@ -3937,8 +3942,8 @@ static int handle_change_mac_rsp(union ibmvnic_crq *crq,
+ dev_err(dev, "Error %ld in CHANGE_MAC_ADDR_RSP\n", rc);
+ goto out;
+ }
+- memcpy(netdev->dev_addr, &crq->change_mac_addr_rsp.mac_addr[0],
+- ETH_ALEN);
++ ether_addr_copy(netdev->dev_addr,
++ &crq->change_mac_addr_rsp.mac_addr[0]);
+ out:
+ complete(&adapter->fw_done);
+ return rc;
+@@ -4852,8 +4857,6 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
+ init_completion(&adapter->init_done);
+ adapter->resetting = false;
+
+- adapter->mac_change_pending = false;
+-
+ do {
+ rc = init_crq_queue(adapter);
+ if (rc) {
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index cffdac372a33..dcf2eb6d9290 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -969,7 +969,6 @@ struct ibmvnic_tunables {
+ u64 rx_entries;
+ u64 tx_entries;
+ u64 mtu;
+- struct sockaddr mac;
+ };
+
+ struct ibmvnic_adapter {
+@@ -1091,7 +1090,6 @@ struct ibmvnic_adapter {
+ bool resetting;
+ bool napi_enabled, from_passive_init;
+
+- bool mac_change_pending;
+ bool failover_pending;
+ bool force_reset_recovery;
+
+--
+2.20.1
+
diff --git a/patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch b/patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch
new file mode 100644
index 0000000000..5acb3e95be
--- /dev/null
+++ b/patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch
@@ -0,0 +1,66 @@
+From 0655f9943df2f2d71f406fd77b51d05548134fc2 Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Thu, 9 May 2019 23:13:44 -0500
+Subject: [PATCH] net/ibmvnic: Update carrier state after link state change
+
+References: bsc#1135100
+Patch-mainline: v5.2-rc1
+Git-commit: 0655f9943df2f2d71f406fd77b51d05548134fc2
+
+Only set the device carrier state to on after receiving an up link
+state indication from the underlying adapter. Likewise, if a down
+link indication is receieved, update the carrier state accordingly.
+This fix ensures that accurate carrier state is reported by the driver
+following a link state update by the underlying adapter.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 2be3bcd0192f..3dcd9c3d8781 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1111,7 +1111,6 @@ static int ibmvnic_open(struct net_device *netdev)
+ }
+
+ rc = __ibmvnic_open(netdev);
+- netif_carrier_on(netdev);
+
+ return rc;
+ }
+@@ -1864,8 +1863,6 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ adapter->reset_reason != VNIC_RESET_CHANGE_PARAM)
+ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev);
+
+- netif_carrier_on(netdev);
+-
+ return 0;
+ }
+
+@@ -1935,8 +1932,6 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
+ return 0;
+ }
+
+- netif_carrier_on(netdev);
+-
+ return 0;
+ }
+
+@@ -4480,6 +4475,10 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
+ crq->link_state_indication.phys_link_state;
+ adapter->logical_link_state =
+ crq->link_state_indication.logical_link_state;
++ if (adapter->phys_link_state && adapter->logical_link_state)
++ netif_carrier_on(netdev);
++ else
++ netif_carrier_off(netdev);
+ break;
+ case CHANGE_MAC_ADDR_RSP:
+ netdev_dbg(netdev, "Got MAC address change Response\n");
+--
+2.20.1
+
diff --git a/patches.drivers/net-smc-fix-byte_order-for-rx_curs_confirmed b/patches.drivers/net-smc-fix-byte_order-for-rx_curs_confirmed
new file mode 100644
index 0000000000..f1df61a923
--- /dev/null
+++ b/patches.drivers/net-smc-fix-byte_order-for-rx_curs_confirmed
@@ -0,0 +1,77 @@
+From: Ursula Braun <ubraun@linux.ibm.com>
+Date: Thu, 7 Feb 2019 14:52:54 +0100
+Subject: net/smc: fix byte_order for rx_curs_confirmed
+Git-commit: ccc8ca9b90acb45a3309f922b2591b07b4e070ec
+Patch-mainline: v5.0-rc7
+References: bsc#1129848 LTC#176249
+
+The recent change in the rx_curs_confirmed assignment disregards
+byte order, which causes problems on little endian architectures.
+This patch fixes it.
+
+Fixes: b8649efad879 ("net/smc: fix sender_free computation") (net-tree)
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ net/smc/smc_cdc.c | 4 +---
+ net/smc/smc_cdc.h | 19 ++++++++++---------
+ 2 files changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
+index a712c9f8699b..fb07ad8d69a6 100644
+--- a/net/smc/smc_cdc.c
++++ b/net/smc/smc_cdc.c
+@@ -101,9 +101,7 @@ int smc_cdc_msg_send(struct smc_connection *conn,
+
+ conn->tx_cdc_seq++;
+ conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
+- smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf,
+- &conn->local_tx_ctrl, conn);
+- smc_curs_copy(&cfed, &((struct smc_host_cdc_msg *)wr_buf)->cons, conn);
++ smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf, conn, &cfed);
+ rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
+ if (!rc)
+ smc_curs_copy(&conn->rx_curs_confirmed, &cfed, conn);
+diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
+index 271e2524dc8f..f1cdde9d4b89 100644
+--- a/net/smc/smc_cdc.h
++++ b/net/smc/smc_cdc.h
+@@ -211,26 +211,27 @@ static inline int smc_curs_diff_large(unsigned int size,
+
+ static inline void smc_host_cursor_to_cdc(union smc_cdc_cursor *peer,
+ union smc_host_cursor *local,
++ union smc_host_cursor *save,
+ struct smc_connection *conn)
+ {
+- union smc_host_cursor temp;
+-
+- smc_curs_copy(&temp, local, conn);
+- peer->count = htonl(temp.count);
+- peer->wrap = htons(temp.wrap);
++ smc_curs_copy(save, local, conn);
++ peer->count = htonl(save->count);
++ peer->wrap = htons(save->wrap);
+ /* peer->reserved = htons(0); must be ensured by caller */
+ }
+
+ static inline void smc_host_msg_to_cdc(struct smc_cdc_msg *peer,
+- struct smc_host_cdc_msg *local,
+- struct smc_connection *conn)
++ struct smc_connection *conn,
++ union smc_host_cursor *save)
+ {
++ struct smc_host_cdc_msg *local = &conn->local_tx_ctrl;
++
+ peer->common.type = local->common.type;
+ peer->len = local->len;
+ peer->seqno = htons(local->seqno);
+ peer->token = htonl(local->token);
+- smc_host_cursor_to_cdc(&peer->prod, &local->prod, conn);
+- smc_host_cursor_to_cdc(&peer->cons, &local->cons, conn);
++ smc_host_cursor_to_cdc(&peer->prod, &local->prod, save, conn);
++ smc_host_cursor_to_cdc(&peer->cons, &local->cons, save, conn);
+ peer->prod_flags = local->prod_flags;
+ peer->conn_state_flags = local->conn_state_flags;
+ }
+
diff --git a/patches.drivers/net-smc-fix-smc_poll-in-smc_init-state b/patches.drivers/net-smc-fix-smc_poll-in-smc_init-state
new file mode 100644
index 0000000000..13c95bae77
--- /dev/null
+++ b/patches.drivers/net-smc-fix-smc_poll-in-smc_init-state
@@ -0,0 +1,37 @@
+From: Ursula Braun <ubraun@linux.ibm.com>
+Date: Thu, 21 Feb 2019 12:56:54 +0100
+Subject: net/smc: fix smc_poll in SMC_INIT state
+Git-commit: d7cf4a3bf3a83c977a29055e1c4ffada7697b31f
+Patch-mainline: v5.0-rc8
+References: bsc#1129848 LTC#176249
+
+smc_poll() returns with mask bit EPOLLPRI if the connection urg_state
+is SMC_URG_VALID. Since SMC_URG_VALID is zero, smc_poll signals
+EPOLLPRI errorneously if called in state SMC_INIT before the connection
+is created, for instance in a non-blocking connect scenario.
+
+This patch switches to non-zero values for the urg states.
+
+Reviewed-by: Karsten Graul <kgraul@linux.ibm.com>
+Fixes: de8474eb9d50 ("net/smc: urgent data support")
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[ ptesarik: The upstream fix changes kABI by renumbering the enum. The
+ root cause of the original bug is an uninitialized struct member, so
+ an alternative fix is to initialize it properly and stop relying on
+ zeroing out the structure. ]
+Signed-off-by: Petr Tesarik <ptesarik@suse.com>
+---
+ net/smc/af_smc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -208,6 +208,7 @@ static struct sock *smc_sock_alloc(struc
+ INIT_WORK(&smc->tcp_listen_work, smc_tcp_listen_work);
+ INIT_WORK(&smc->connect_work, smc_connect_work);
+ INIT_DELAYED_WORK(&smc->conn.tx_work, smc_tx_work);
++ smc->conn.urg_state = SMC_URG_READ;
+ INIT_LIST_HEAD(&smc->accept_q);
+ spin_lock_init(&smc->accept_q_lock);
+ spin_lock_init(&smc->conn.send_lock);
diff --git a/patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch b/patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch
new file mode 100644
index 0000000000..40a103d589
--- /dev/null
+++ b/patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch
@@ -0,0 +1,64 @@
+From 787a79230a0f9984e59549b9baa4daf274973a0d Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Mon, 1 Apr 2019 17:46:56 +0200
+Subject: [PATCH] omapfb: add missing of_node_put after of_device_is_available
+Git-commit: 787a79230a0f9984e59549b9baa4daf274973a0d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Add an of_node_put when a tested device node is not available.
+
+The semantic patch that fixes this problem is as follows
+(http://coccinelle.lip6.fr):
+
+// <smpl>
+@@
+identifier f;
+local idexpression e;
+expression x;
+@@
+
+e = f(...);
+... when != of_node_put(e)
+ when != x = e
+ when != e = x
+ when any
+if (<+...of_device_is_available(e)...+>) {
+ ... when != of_node_put(e)
+(
+ return e;
+|
++ of_node_put(e);
+ return ...;
+)
+}
+// </smpl>
+
+Fixes: f76ee892a99e6 ("omapfb: copy omapdss & displays for omapfb")
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c b/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c
+index 136d30484d02..cb6acbac9c47 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c
+@@ -193,8 +193,10 @@ static int __init omapdss_boot_init(void)
+
+ dss = of_find_matching_node(NULL, omapdss_of_match);
+
+- if (dss == NULL || !of_device_is_available(dss))
++ if (dss == NULL || !of_device_is_available(dss)) {
++ of_node_put(dss);
+ return 0;
++ }
+
+ omapdss_walk_device(dss, true);
+
+--
+2.16.4
+
diff --git a/patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch b/patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch
new file mode 100644
index 0000000000..84e3a9aa93
--- /dev/null
+++ b/patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch
@@ -0,0 +1,50 @@
+From e6f32efb1b128344a2c7df9875bc1a1abaa1d395 Mon Sep 17 00:00:00 2001
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Date: Thu, 14 Mar 2019 14:05:18 +0100
+Subject: [PATCH] phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode
+Git-commit: e6f32efb1b128344a2c7df9875bc1a1abaa1d395
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+On platforms where the MUSB and HCI controllers share PHY0, PHY passby
+is required when using the HCI controller with the PHY, but it must be
+disabled when the MUSB controller is used instead.
+
+Without this, PHY0 passby is always enabled, which results in broken
+peripheral mode on such platforms (e.g. H3/H5).
+
+Fixes: ba4bdc9e1dc0 ("PHY: sunxi: Add driver for sunxi usb phy")
+
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/allwinner/phy-sun4i-usb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index 5163097b43df..7b23920e0068 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -551,6 +551,7 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
+ struct sun4i_usb_phy_data *data =
+ container_of(work, struct sun4i_usb_phy_data, detect.work);
+ struct phy *phy0 = data->phys[0].phy;
++ struct sun4i_usb_phy *phy = phy_get_drvdata(phy0);
+ bool force_session_end, id_notify = false, vbus_notify = false;
+ int id_det, vbus_det;
+
+@@ -607,6 +608,9 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
+ mutex_unlock(&phy0->mutex);
+ }
+
++ /* Enable PHY0 passby for host mode only. */
++ sun4i_usb_phy_passby(phy, !id_det);
++
+ /* Re-route PHY0 if necessary */
+ if (data->cfg->phy0_dual_route)
+ sun4i_usb_phy0_reroute(data, id_det);
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch b/patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
new file mode 100644
index 0000000000..e0e651a6f1
--- /dev/null
+++ b/patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
@@ -0,0 +1,38 @@
+From 6d1f8b3d75419a8659ac916a1e9543bb3513a882 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 24 Apr 2019 12:44:18 +0300
+Subject: [PATCH] platform/x86: alienware-wmi: printing the wrong error code
+Git-commit: 6d1f8b3d75419a8659ac916a1e9543bb3513a882
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The "out_data" variable is uninitialized at the point. Originally, this
+used to print "status" instead and that seems like the correct thing to
+print.
+
+Fixes: bc2ef884320b ("alienware-wmi: For WMAX HDMI method, introduce a way to query HDMI cable status")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/alienware-wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index c0d1555735cd..83fd7677af24 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -587,7 +587,7 @@ static ssize_t show_hdmi_source(struct device *dev,
+ return scnprintf(buf, PAGE_SIZE,
+ "input [gpu] unknown\n");
+ }
+- pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
++ pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
+ return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch b/patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch
new file mode 100644
index 0000000000..de90109446
--- /dev/null
+++ b/patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch
@@ -0,0 +1,45 @@
+From e28f296ea155da36f710eb1f1173d8780fbac49d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Valdis=20Kl=20=C4=93=20tnieks?= <valdis.kletnieks@vt.edu>
+Date: Tue, 12 Mar 2019 07:26:06 -0400
+Subject: [PATCH] platform/x86: dell-rbtn: Add missing #include
+Git-commit: e28f296ea155da36f710eb1f1173d8780fbac49d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Building with W=1 complains:
+ CC [M] drivers/platform/x86/dell-rbtn.o
+drivers/platform/x86/dell-rbtn.c:345:5: warning: no previous prototype for 'dell_rbtn_notifier_register' [-Wmissing-prototypes]
+ 345 | int dell_rbtn_notifier_register(struct notifier_block *nb)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/platform/x86/dell-rbtn.c:371:5: warning: no previous prototype for 'dell_rbtn_notifier_unregister' [-Wmissing-prototypes]
+ 371 | int dell_rbtn_notifier_unregister(struct notifier_block *nb)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The real problem is a missing include. Add it to keep dell-rbtn.c and .h in sync.
+
+Fixes: b05ffc95f9ed ("dell-rbtn: Export notifier for other kernel modules")
+Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+[andy: massaged commit message, added Fixes tag]
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/dell-rbtn.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/platform/x86/dell-rbtn.c b/drivers/platform/x86/dell-rbtn.c
+index f3afe778001e..56535d7222dd 100644
+--- a/drivers/platform/x86/dell-rbtn.c
++++ b/drivers/platform/x86/dell-rbtn.c
+@@ -18,6 +18,8 @@
+ #include <linux/rfkill.h>
+ #include <linux/input.h>
+
++#include "dell-rbtn.h"
++
+ enum rbtn_type {
+ RBTN_UNKNOWN,
+ RBTN_TOGGLE,
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch b/patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch
new file mode 100644
index 0000000000..16ef664c18
--- /dev/null
+++ b/patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch
@@ -0,0 +1,49 @@
+From e61985d0550df8c2078310202aaad9b41049c36c Mon Sep 17 00:00:00 2001
+From: Junxiao Chang <junxiao.chang@intel.com>
+Date: Mon, 8 Apr 2019 17:40:22 +0800
+Subject: [PATCH] platform/x86: intel_pmc_ipc: adding error handling
+Git-commit: e61985d0550df8c2078310202aaad9b41049c36c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+If punit or telemetry device initialization fails, pmc driver should
+unregister and return failure.
+
+This change is to fix a kernel panic when removing kernel module
+intel_pmc_ipc.
+
+Fixes: 48c1917088ba ("platform:x86: Add Intel telemetry platform device")
+Signed-off-by: Junxiao Chang <junxiao.chang@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/intel_pmc_ipc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel_pmc_ipc.c b/drivers/platform/x86/intel_pmc_ipc.c
+index 7964ba22ef8d..d37cbd1cf58c 100644
+--- a/drivers/platform/x86/intel_pmc_ipc.c
++++ b/drivers/platform/x86/intel_pmc_ipc.c
+@@ -771,13 +771,17 @@ static int ipc_create_pmc_devices(void)
+ if (ret) {
+ dev_err(ipcdev.dev, "Failed to add punit platform device\n");
+ platform_device_unregister(ipcdev.tco_dev);
++ return ret;
+ }
+
+ if (!ipcdev.telem_res_inval) {
+ ret = ipc_create_telemetry_device();
+- if (ret)
++ if (ret) {
+ dev_warn(ipcdev.dev,
+ "Failed to add telemetry platform device\n");
++ platform_device_unregister(ipcdev.punit_dev);
++ platform_device_unregister(ipcdev.tco_dev);
++ }
+ }
+
+ return ret;
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch b/patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch
new file mode 100644
index 0000000000..b650374073
--- /dev/null
+++ b/patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch
@@ -0,0 +1,61 @@
+From 0e5e80043b0db4c292aaf0ea86415da6193f861a Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 9 Apr 2019 14:25:15 +0300
+Subject: [PATCH] platform/x86: intel_punit_ipc: Revert "Fix resource ioremap warning"
+Git-commit: 0e5e80043b0db4c292aaf0ea86415da6193f861a
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Since we have a proper fix for intel_pmc_ipc driver for resource management,
+get rid of unneeded commit in the intel_punit_ipc driver.
+
+This reverts commit 6cc8cbbc8868033f279b63e98b26b75eaa0006ab.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/intel_punit_ipc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c
+index 79671927f4ef..ab7ae1950867 100644
+--- a/drivers/platform/x86/intel_punit_ipc.c
++++ b/drivers/platform/x86/intel_punit_ipc.c
+@@ -252,28 +252,28 @@ static int intel_punit_get_bars(struct platform_device *pdev)
+ * - GTDRIVER_IPC BASE_IFACE
+ */
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[ISPDRIVER_IPC][BASE_DATA] = addr;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 3);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[ISPDRIVER_IPC][BASE_IFACE] = addr;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 4);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[GTDRIVER_IPC][BASE_DATA] = addr;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 5);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[GTDRIVER_IPC][BASE_IFACE] = addr;
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-pmc_atom-Drop-__initconst-on-dmi-table.patch b/patches.drivers/platform-x86-pmc_atom-Drop-__initconst-on-dmi-table.patch
new file mode 100644
index 0000000000..49ae6764b7
--- /dev/null
+++ b/patches.drivers/platform-x86-pmc_atom-Drop-__initconst-on-dmi-table.patch
@@ -0,0 +1,42 @@
+From b995dcca7cf12f208cfd95fd9d5768dca7cccec7 Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@kernel.org>
+Date: Thu, 11 Apr 2019 10:22:43 -0700
+Subject: [PATCH] platform/x86: pmc_atom: Drop __initconst on dmi table
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: b995dcca7cf12f208cfd95fd9d5768dca7cccec7
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+It's used by probe and that isn't an init function. Drop this so that we
+don't get a section mismatch.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Cc: David Müller <dave.mueller@gmx.ch>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
+Fixes: 7c2e07130090 ("clk: x86: Add system specific quirk to mark clocks as critical")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/pmc_atom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index eaec2d306481..c7039f52ad51 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -396,7 +396,7 @@ static int pmc_dbgfs_register(struct pmc_dev *pmc)
+ * Some systems need one or more of their pmc_plt_clks to be
+ * marked as critical.
+ */
+-static const struct dmi_system_id critclk_systems[] __initconst = {
++static const struct dmi_system_id critclk_systems[] = {
+ {
+ .ident = "MPL CEC1x",
+ .matches = {
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch b/patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch
new file mode 100644
index 0000000000..b8e921de15
--- /dev/null
+++ b/patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch
@@ -0,0 +1,57 @@
+From 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 24 Apr 2019 13:09:34 -0500
+Subject: [PATCH] platform/x86: sony-laptop: Fix unintentional fall-through
+Git-commit: 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+It seems that the default case should return AE_CTRL_TERMINATE, instead
+of falling through to case ACPI_RESOURCE_TYPE_END_TAG and returning AE_OK;
+otherwise the line of code at the end of the function is unreachable and
+makes no sense:
+
+return AE_CTRL_TERMINATE;
+
+This fix is based on the following thread of discussion:
+
+https://lore.kernel.org/patchwork/patch/959782/
+
+Fixes: 33a04454527e ("sony-laptop: Add SNY6001 device handling (sonypi reimplementation)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/sony-laptop.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index 4bfbfa3f78e6..2058445fc456 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -4424,14 +4424,16 @@ sony_pic_read_possible_resource(struct acpi_resource *resource, void *context)
+ }
+ return AE_OK;
+ }
++
++ case ACPI_RESOURCE_TYPE_END_TAG:
++ return AE_OK;
++
+ default:
+ dprintk("Resource %d isn't an IRQ nor an IO port\n",
+ resource->type);
++ return AE_CTRL_TERMINATE;
+
+- case ACPI_RESOURCE_TYPE_END_TAG:
+- return AE_OK;
+ }
+- return AE_CTRL_TERMINATE;
+ }
+
+ static int sony_pic_possible_resources(struct acpi_device *device)
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch b/patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch
new file mode 100644
index 0000000000..3ef35ff60f
--- /dev/null
+++ b/patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch
@@ -0,0 +1,277 @@
+From 347ab9480313737c0f1aaa08e8f2e1a791235535 Mon Sep 17 00:00:00 2001
+From: Phong Hoang <phong.hoang.wz@renesas.com>
+Date: Tue, 19 Mar 2019 19:40:08 +0900
+Subject: [PATCH] pwm: Fix deadlock warning when removing PWM device
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 347ab9480313737c0f1aaa08e8f2e1a791235535
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This patch fixes deadlock warning if removing PWM device
+when CONFIG_PROVE_LOCKING is enabled.
+
+This issue can be reproceduced by the following steps on
+the R-Car H3 Salvator-X board if the backlight is disabled:
+
+ # cd /sys/class/pwm/pwmchip0
+ # echo 0 > export
+ # ls
+ device export npwm power pwm0 subsystem uevent unexport
+ # cd device/driver
+ # ls
+ bind e6e31000.pwm uevent unbind
+ # echo e6e31000.pwm > unbind
+
+[ 87.659974] ======================================================
+[ 87.666149] WARNING: possible circular locking dependency detected
+[ 87.672327] 5.0.0 #7 Not tainted
+[ 87.675549] ------------------------------------------------------
+[ 87.681723] bash/2986 is trying to acquire lock:
+[ 87.686337] 000000005ea0e178 (kn->count#58){++++}, at: kernfs_remove_by_name_ns+0x50/0xa0
+[ 87.694528]
+[ 87.694528] but task is already holding lock:
+[ 87.700353] 000000006313b17c (pwm_lock){+.+.}, at: pwmchip_remove+0x28/0x13c
+[ 87.707405]
+[ 87.707405] which lock already depends on the new lock.
+[ 87.707405]
+[ 87.715574]
+[ 87.715574] the existing dependency chain (in reverse order) is:
+[ 87.723048]
+[ 87.723048] -> #1 (pwm_lock){+.+.}:
+[ 87.728017] __mutex_lock+0x70/0x7e4
+[ 87.732108] mutex_lock_nested+0x1c/0x24
+[ 87.736547] pwm_request_from_chip.part.6+0x34/0x74
+[ 87.741940] pwm_request_from_chip+0x20/0x40
+[ 87.746725] export_store+0x6c/0x1f4
+[ 87.750820] dev_attr_store+0x18/0x28
+[ 87.754998] sysfs_kf_write+0x54/0x64
+[ 87.759175] kernfs_fop_write+0xe4/0x1e8
+[ 87.763615] __vfs_write+0x40/0x184
+[ 87.767619] vfs_write+0xa8/0x19c
+[ 87.771448] ksys_write+0x58/0xbc
+[ 87.775278] __arm64_sys_write+0x18/0x20
+[ 87.779721] el0_svc_common+0xd0/0x124
+[ 87.783986] el0_svc_compat_handler+0x1c/0x24
+[ 87.788858] el0_svc_compat+0x8/0x18
+[ 87.792947]
+[ 87.792947] -> #0 (kn->count#58){++++}:
+[ 87.798260] lock_acquire+0xc4/0x22c
+[ 87.802353] __kernfs_remove+0x258/0x2c4
+[ 87.806790] kernfs_remove_by_name_ns+0x50/0xa0
+[ 87.811836] remove_files.isra.1+0x38/0x78
+[ 87.816447] sysfs_remove_group+0x48/0x98
+[ 87.820971] sysfs_remove_groups+0x34/0x4c
+[ 87.825583] device_remove_attrs+0x6c/0x7c
+[ 87.830197] device_del+0x11c/0x33c
+[ 87.834201] device_unregister+0x14/0x2c
+[ 87.838638] pwmchip_sysfs_unexport+0x40/0x4c
+[ 87.843509] pwmchip_remove+0xf4/0x13c
+[ 87.847773] rcar_pwm_remove+0x28/0x34
+[ 87.852039] platform_drv_remove+0x24/0x64
+[ 87.856651] device_release_driver_internal+0x18c/0x21c
+[ 87.862391] device_release_driver+0x14/0x1c
+[ 87.867175] unbind_store+0xe0/0x124
+[ 87.871265] drv_attr_store+0x20/0x30
+[ 87.875442] sysfs_kf_write+0x54/0x64
+[ 87.879618] kernfs_fop_write+0xe4/0x1e8
+[ 87.884055] __vfs_write+0x40/0x184
+[ 87.888057] vfs_write+0xa8/0x19c
+[ 87.891887] ksys_write+0x58/0xbc
+[ 87.895716] __arm64_sys_write+0x18/0x20
+[ 87.900154] el0_svc_common+0xd0/0x124
+[ 87.904417] el0_svc_compat_handler+0x1c/0x24
+[ 87.909289] el0_svc_compat+0x8/0x18
+[ 87.913378]
+[ 87.913378] other info that might help us debug this:
+[ 87.913378]
+[ 87.921374] Possible unsafe locking scenario:
+[ 87.921374]
+[ 87.927286] CPU0 CPU1
+[ 87.931808] ---- ----
+[ 87.936331] lock(pwm_lock);
+[ 87.939293] lock(kn->count#58);
+[ 87.945120] lock(pwm_lock);
+[ 87.950599] lock(kn->count#58);
+[ 87.953908]
+[ 87.953908] *** DEADLOCK ***
+[ 87.953908]
+[ 87.959821] 4 locks held by bash/2986:
+[ 87.963563] #0: 00000000ace7bc30 (sb_writers#6){.+.+}, at: vfs_write+0x188/0x19c
+[ 87.971044] #1: 00000000287991b2 (&of->mutex){+.+.}, at: kernfs_fop_write+0xb4/0x1e8
+[ 87.978872] #2: 00000000f739d016 (&dev->mutex){....}, at: device_release_driver_internal+0x40/0x21c
+[ 87.988001] #3: 000000006313b17c (pwm_lock){+.+.}, at: pwmchip_remove+0x28/0x13c
+[ 87.995481]
+[ 87.995481] stack backtrace:
+[ 87.999836] CPU: 0 PID: 2986 Comm: bash Not tainted 5.0.0 #7
+[ 88.005489] Hardware name: Renesas Salvator-X board based on r8a7795 ES1.x (DT)
+[ 88.012791] Call trace:
+[ 88.015235] dump_backtrace+0x0/0x190
+[ 88.018891] show_stack+0x14/0x1c
+[ 88.022204] dump_stack+0xb0/0xec
+[ 88.025514] print_circular_bug.isra.32+0x1d0/0x2e0
+[ 88.030385] __lock_acquire+0x1318/0x1864
+[ 88.034388] lock_acquire+0xc4/0x22c
+[ 88.037958] __kernfs_remove+0x258/0x2c4
+[ 88.041874] kernfs_remove_by_name_ns+0x50/0xa0
+[ 88.046398] remove_files.isra.1+0x38/0x78
+[ 88.050487] sysfs_remove_group+0x48/0x98
+[ 88.054490] sysfs_remove_groups+0x34/0x4c
+[ 88.058580] device_remove_attrs+0x6c/0x7c
+[ 88.062671] device_del+0x11c/0x33c
+[ 88.066154] device_unregister+0x14/0x2c
+[ 88.070070] pwmchip_sysfs_unexport+0x40/0x4c
+[ 88.074421] pwmchip_remove+0xf4/0x13c
+[ 88.078163] rcar_pwm_remove+0x28/0x34
+[ 88.081906] platform_drv_remove+0x24/0x64
+[ 88.085996] device_release_driver_internal+0x18c/0x21c
+[ 88.091215] device_release_driver+0x14/0x1c
+[ 88.095478] unbind_store+0xe0/0x124
+[ 88.099048] drv_attr_store+0x20/0x30
+[ 88.102704] sysfs_kf_write+0x54/0x64
+[ 88.106359] kernfs_fop_write+0xe4/0x1e8
+[ 88.110275] __vfs_write+0x40/0x184
+[ 88.113757] vfs_write+0xa8/0x19c
+[ 88.117065] ksys_write+0x58/0xbc
+[ 88.120374] __arm64_sys_write+0x18/0x20
+[ 88.124291] el0_svc_common+0xd0/0x124
+[ 88.128034] el0_svc_compat_handler+0x1c/0x24
+[ 88.132384] el0_svc_compat+0x8/0x18
+
+The sysfs unexport in pwmchip_remove() is completely asymmetric
+to what we do in pwmchip_add_with_polarity() and commit 0733424c9ba9
+("pwm: Unexport children before chip removal") is a strong indication
+that this was wrong to begin with. We should just move
+pwmchip_sysfs_unexport() where it belongs, which is right after
+pwmchip_sysfs_unexport_children(). In that case, we do not need
+separate functions anymore either.
+
+We also really want to remove sysfs irrespective of whether or not
+the chip will be removed as a result of pwmchip_remove(). We can only
+assume that the driver will be gone after that, so we shouldn't leave
+any dangling sysfs files around.
+
+This warning disappears if we move pwmchip_sysfs_unexport() to
+the top of pwmchip_remove(), pwmchip_sysfs_unexport_children().
+That way it is also outside of the pwm_lock section, which indeed
+doesn't seem to be needed.
+
+Moving the pwmchip_sysfs_export() call outside of that section also
+seems fine and it'd be perfectly symmetric with pwmchip_remove() again.
+
+So, this patch fixes them.
+
+Signed-off-by: Phong Hoang <phong.hoang.wz@renesas.com>
+[shimoda: revise the commit log and code]
+Fixes: 76abbdde2d95 ("pwm: Add sysfs interface")
+Fixes: 0733424c9ba9 ("pwm: Unexport children before chip removal")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Hoan Nguyen An <na-hoan@jinso.co.jp>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/core.c | 10 +++++-----
+ drivers/pwm/sysfs.c | 14 +-------------
+ include/linux/pwm.h | 5 -----
+ 3 files changed, 6 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
+index 3149204567f3..8c9200a0df5e 100644
+--- a/drivers/pwm/core.c
++++ b/drivers/pwm/core.c
+@@ -311,10 +311,12 @@ int pwmchip_add_with_polarity(struct pwm_chip *chip,
+ if (IS_ENABLED(CONFIG_OF))
+ of_pwmchip_add(chip);
+
+- pwmchip_sysfs_export(chip);
+-
+ out:
+ mutex_unlock(&pwm_lock);
++
++ if (!ret)
++ pwmchip_sysfs_export(chip);
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(pwmchip_add_with_polarity);
+@@ -348,7 +350,7 @@ int pwmchip_remove(struct pwm_chip *chip)
+ unsigned int i;
+ int ret = 0;
+
+- pwmchip_sysfs_unexport_children(chip);
++ pwmchip_sysfs_unexport(chip);
+
+ mutex_lock(&pwm_lock);
+
+@@ -368,8 +370,6 @@ int pwmchip_remove(struct pwm_chip *chip)
+
+ free_pwms(chip);
+
+- pwmchip_sysfs_unexport(chip);
+-
+ out:
+ mutex_unlock(&pwm_lock);
+ return ret;
+diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
+index ceb233dd6048..13d9bd54dfce 100644
+--- a/drivers/pwm/sysfs.c
++++ b/drivers/pwm/sysfs.c
+@@ -409,19 +409,6 @@ void pwmchip_sysfs_export(struct pwm_chip *chip)
+ }
+
+ void pwmchip_sysfs_unexport(struct pwm_chip *chip)
+-{
+- struct device *parent;
+-
+- parent = class_find_device(&pwm_class, NULL, chip,
+- pwmchip_sysfs_match);
+- if (parent) {
+- /* for class_find_device() */
+- put_device(parent);
+- device_unregister(parent);
+- }
+-}
+-
+-void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+ {
+ struct device *parent;
+ unsigned int i;
+@@ -439,6 +426,7 @@ void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+ }
+
+ put_device(parent);
++ device_unregister(parent);
+ }
+
+ static int __init pwm_sysfs_init(void)
+diff --git a/include/linux/pwm.h b/include/linux/pwm.h
+index b628abfffacc..eaa5c6e3fc9f 100644
+--- a/include/linux/pwm.h
++++ b/include/linux/pwm.h
+@@ -596,7 +596,6 @@ static inline void pwm_remove_table(struct pwm_lookup *table, size_t num)
+ #ifdef CONFIG_PWM_SYSFS
+ void pwmchip_sysfs_export(struct pwm_chip *chip);
+ void pwmchip_sysfs_unexport(struct pwm_chip *chip);
+-void pwmchip_sysfs_unexport_children(struct pwm_chip *chip);
+ #else
+ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
+ {
+@@ -605,10 +604,6 @@ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
+ static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip)
+ {
+ }
+-
+-static inline void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+-{
+-}
+ #endif /* CONFIG_PWM_SYSFS */
+
+ #endif /* __LINUX_PWM_H */
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch b/patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch
new file mode 100644
index 0000000000..ea93de3c0f
--- /dev/null
+++ b/patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch
@@ -0,0 +1,54 @@
+From 51496e4446875726d50a5617a6e0e0dabbc2e6da Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Mon, 1 Apr 2019 20:18:16 +0200
+Subject: [PATCH] pwm: meson: Consider 128 a valid pre-divider
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 51496e4446875726d50a5617a6e0e0dabbc2e6da
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The pre-divider allows configuring longer PWM periods compared to using
+the input clock directly. The pre-divider is 7 bit wide, meaning it's
+maximum value is 128 (the register value is off-by-one: 0x7f or 127).
+
+Change the loop to also allow for the maximum possible value to be
+considered valid.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-meson.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index c1ed641b3e26..aaae48ab484e 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -184,7 +184,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ do_div(fin_ps, fin_freq);
+
+ /* Calc pre_div with the period */
+- for (pre_div = 0; pre_div < MISC_CLK_DIV_MASK; pre_div++) {
++ for (pre_div = 0; pre_div <= MISC_CLK_DIV_MASK; pre_div++) {
+ cnt = DIV_ROUND_CLOSEST_ULL((u64)period * 1000,
+ fin_ps * (pre_div + 1));
+ dev_dbg(meson->chip.dev, "fin_ps=%llu pre_div=%u cnt=%u\n",
+@@ -193,7 +193,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ break;
+ }
+
+- if (pre_div == MISC_CLK_DIV_MASK) {
++ if (pre_div > MISC_CLK_DIV_MASK) {
+ dev_err(meson->chip.dev, "unable to get period pre_div\n");
+ return -EINVAL;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch b/patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch
new file mode 100644
index 0000000000..f69c349142
--- /dev/null
+++ b/patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch
@@ -0,0 +1,44 @@
+From a279345807e1e0ae79567a52cfdd9d30c9174a3c Mon Sep 17 00:00:00 2001
+From: Bichao Zheng <bichao.zheng@amlogic.com>
+Date: Mon, 1 Apr 2019 20:18:17 +0200
+Subject: [PATCH] pwm: meson: Don't disable PWM when setting duty repeatedly
+Git-commit: a279345807e1e0ae79567a52cfdd9d30c9174a3c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+There is an abnormally low about 20ms,when setting duty repeatedly.
+Because setting the duty will disable PWM and then enable. Delete
+this operation now.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Bichao Zheng <bichao.zheng@amlogic.com>
+[ Dropped code instead of hiding it behind a comment ]
+
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-meson.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index aaae48ab484e..2ab3d216b35a 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -314,11 +314,6 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ if (state->period != channel->state.period ||
+ state->duty_cycle != channel->state.duty_cycle ||
+ state->polarity != channel->state.polarity) {
+- if (channel->state.enabled) {
+- meson_pwm_disable(meson, pwm->hwpwm);
+- channel->state.enabled = false;
+- }
+-
+ if (state->polarity != channel->state.polarity) {
+ if (state->polarity == PWM_POLARITY_NORMAL)
+ meson->inverter_mask |= BIT(pwm->hwpwm);
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch b/patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch
new file mode 100644
index 0000000000..742eba0206
--- /dev/null
+++ b/patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch
@@ -0,0 +1,144 @@
+From f173747fffdf037c791405ab4f1ec0eb392fc48e Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Mon, 1 Apr 2019 19:57:48 +0200
+Subject: [PATCH] pwm: meson: Use the spin-lock only to protect register modifications
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: f173747fffdf037c791405ab4f1ec0eb392fc48e
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Holding the spin-lock for all of the code in meson_pwm_apply() can
+result in a "BUG: scheduling while atomic". This can happen because
+clk_get_rate() (which is called from meson_pwm_calc()) may sleep.
+Only hold the spin-lock when modifying registers to solve this.
+
+The reason why we need a spin-lock in the driver is because the
+REG_MISC_AB register is shared between the two channels provided by one
+PWM controller. The only functions where REG_MISC_AB is modified are
+meson_pwm_enable() and meson_pwm_disable() so the register reads/writes
+in there need to be protected by the spin-lock.
+
+The original code also used the spin-lock to protect the values in
+struct meson_pwm_channel. This could be necessary if two consumers can
+use the same PWM channel. However, PWM core doesn't allow this so we
+don't need to protect the values in struct meson_pwm_channel with a
+lock.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-meson.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index 2ab3d216b35a..e247ab632530 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -111,6 +111,10 @@ struct meson_pwm {
+ const struct meson_pwm_data *data;
+ void __iomem *base;
+ u8 inverter_mask;
++ /*
++ * Protects register (write) access to the REG_MISC_AB register
++ * that is shared between the two PWMs.
++ */
+ spinlock_t lock;
+ };
+
+@@ -235,6 +239,7 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ {
+ u32 value, clk_shift, clk_enable, enable;
+ unsigned int offset;
++ unsigned long flags;
+
+ switch (id) {
+ case 0:
+@@ -255,6 +260,8 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ return;
+ }
+
++ spin_lock_irqsave(&meson->lock, flags);
++
+ value = readl(meson->base + REG_MISC_AB);
+ value &= ~(MISC_CLK_DIV_MASK << clk_shift);
+ value |= channel->pre_div << clk_shift;
+@@ -267,11 +274,14 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ value = readl(meson->base + REG_MISC_AB);
+ value |= enable;
+ writel(value, meson->base + REG_MISC_AB);
++
++ spin_unlock_irqrestore(&meson->lock, flags);
+ }
+
+ static void meson_pwm_disable(struct meson_pwm *meson, unsigned int id)
+ {
+ u32 value, enable;
++ unsigned long flags;
+
+ switch (id) {
+ case 0:
+@@ -286,9 +296,13 @@ static void meson_pwm_disable(struct meson_pwm *meson, unsigned int id)
+ return;
+ }
+
++ spin_lock_irqsave(&meson->lock, flags);
++
+ value = readl(meson->base + REG_MISC_AB);
+ value &= ~enable;
+ writel(value, meson->base + REG_MISC_AB);
++
++ spin_unlock_irqrestore(&meson->lock, flags);
+ }
+
+ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+@@ -296,19 +310,16 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ {
+ struct meson_pwm_channel *channel = pwm_get_chip_data(pwm);
+ struct meson_pwm *meson = to_meson_pwm(chip);
+- unsigned long flags;
+ int err = 0;
+
+ if (!state)
+ return -EINVAL;
+
+- spin_lock_irqsave(&meson->lock, flags);
+-
+ if (!state->enabled) {
+ meson_pwm_disable(meson, pwm->hwpwm);
+ channel->state.enabled = false;
+
+- goto unlock;
++ return 0;
+ }
+
+ if (state->period != channel->state.period ||
+@@ -324,7 +335,7 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ err = meson_pwm_calc(meson, channel, pwm->hwpwm,
+ state->duty_cycle, state->period);
+ if (err < 0)
+- goto unlock;
++ return err;
+
+ channel->state.polarity = state->polarity;
+ channel->state.period = state->period;
+@@ -336,9 +347,7 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ channel->state.enabled = true;
+ }
+
+-unlock:
+- spin_unlock_irqrestore(&meson->lock, flags);
+- return err;
++ return 0;
+ }
+
+ static void meson_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch b/patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch
new file mode 100644
index 0000000000..df57e12413
--- /dev/null
+++ b/patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch
@@ -0,0 +1,48 @@
+From b00ef53053191d3025c15e8041699f8c9d132daf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christoph=20Vogtl=C3=A4nder?= <c.vogtlaender@sigma-surface-science.com>
+Date: Tue, 12 Mar 2019 14:38:46 +0530
+Subject: [PATCH] pwm: tiehrpwm: Update shadow register for disabling PWMs
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: b00ef53053191d3025c15e8041699f8c9d132daf
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+It must be made sure that immediate mode is not already set, when
+modifying shadow register value in ehrpwm_pwm_disable(). Otherwise
+modifications to the action-qualifier continuous S/W force
+register(AQSFRC) will be done in the active register.
+This may happen when both channels are being disabled. In this case,
+only the first channel state will be recorded as disabled in the shadow
+register. Later, when enabling the first channel again, the second
+channel would be enabled as well. Setting RLDCSF to zero, first, ensures
+that the shadow register is updated as desired.
+
+Fixes: 38dabd91ff0b ("pwm: tiehrpwm: Fix disabling of output of PWMs")
+Signed-off-by: Christoph Vogtländer <c.vogtlaender@sigma-surface-science.com>
+[vigneshr@ti.com: Improve commit message]
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-tiehrpwm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index f7b8a86fa5c5..ad4a40c0f27c 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -382,6 +382,8 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ }
+
+ /* Update shadow register first before modifying active register */
++ ehrpwm_modify(pc->mmio_base, AQSFRC, AQSFRC_RLDCSF_MASK,
++ AQSFRC_RLDCSF_ZRO);
+ ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
+ /*
+ * Changes to immediate action on Action Qualifier. This puts
+--
+2.16.4
+
diff --git a/patches.drivers/qmi_wwan-add-Olicard-600.patch b/patches.drivers/qmi_wwan-add-Olicard-600.patch
new file mode 100644
index 0000000000..4410d39ed3
--- /dev/null
+++ b/patches.drivers/qmi_wwan-add-Olicard-600.patch
@@ -0,0 +1,67 @@
+From 6289d0facd9ebce4cc83e5da39e15643ee998dc5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Wed, 27 Mar 2019 15:26:01 +0100
+Subject: [PATCH] qmi_wwan: add Olicard 600
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 6289d0facd9ebce4cc83e5da39e15643ee998dc5
+Patch-mainline: v5.1-rc4
+References: bsc#1051510
+
+This is a Qualcomm based device with a QMI function on interface 4.
+It is mode switched from 2020:2030 using a standard eject message.
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=2020 ProdID=2031 Rev= 2.32
+S: Manufacturer=Mobile Connect
+S: Product=Mobile Connect
+S: SerialNumber=0123456789ABCDEF
+C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
+E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 74bebbdb4b15..9195f3476b1d 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1203,6 +1203,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */
+ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */
+ {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */
++ {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */
+ {QMI_FIXED_INTF(0x2020, 0x20