Home Home > GIT Browse > openSUSE-15.0
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2018-10-31 07:01:35 +0100
committerKernel Build Daemon <kbuild@suse.de>2018-10-31 07:01:35 +0100
commitd95ffc7fe6013a6a2a62d6507acfbbf06c9aefcc (patch)
tree7e9234a1f09d209b65708c7c746323b6ec085bd6
parentd809a9ce8eba704fbf51e88748aeaebb1e9bf5a9 (diff)
parent9f4f0cc409d0ae5727064214b69ee3b3a72b5128 (diff)
Merge branch 'SLE15' into openSUSE-15.0
-rw-r--r--blacklist.conf3
-rw-r--r--patches.drivers/drm-i915-Restore-vblank-interrupts-earlier.patch94
-rw-r--r--patches.drivers/drm-i915-dp-Link-train-Fallback-on-eDP-only-if-fallb.patch143
-rw-r--r--patches.drivers/iio-adc-at91-fix-acking-DRDY-irq-on-simple-conversio.patch43
-rw-r--r--patches.drivers/iio-adc-at91-fix-wrong-channel-number-in-triggered-b.patch53
-rw-r--r--patches.drivers/iio-adc-imx25-gcq-Fix-leak-of-device_node-in-mx25_gc.patch77
-rw-r--r--patches.drivers/media-cx231xx-fix-potential-sign-extension-overflow-.patch43
-rw-r--r--patches.drivers/media-dvb-fix-compat-ioctl-translation.patch77
-rw-r--r--patches.drivers/media-em28xx-fix-input-name-for-Terratec-AV-350.patch43
-rw-r--r--patches.drivers/media-em28xx-use-a-default-format-if-TRY_FMT-fails.patch44
-rw-r--r--patches.drivers/media-pci-cx23885-handle-adding-to-list-failure.patch69
-rw-r--r--patches.drivers/media-tvp5150-avoid-going-past-array-on-v4l2_queryme.patch84
-rw-r--r--patches.drivers/media-tvp5150-fix-switch-exit-in-set-control-handler.patch43
-rw-r--r--patches.drivers/media-tvp5150-fix-width-alignment-during-set_selecti.patch59
-rw-r--r--patches.drivers/media-uvcvideo-Fix-uvc_alloc_entity-allocation-align.patch41
-rw-r--r--patches.drivers/media-v4l2-tpg-fix-kernel-oops-when-enabling-HFLIP-a.patch42
-rw-r--r--patches.drivers/media-vsp1-Fix-YCbCr-planar-formats-pitch-calculatio.patch56
-rw-r--r--patches.drivers/serial-8250-Fix-clearing-FIFOs-in-RS485-mode-again.patch94
-rw-r--r--patches.drivers/soc-tegra-pmc-Fix-child-node-lookup.patch43
-rw-r--r--patches.drivers/staging-comedi-ni_mio_common-protect-register-write-.patch90
-rw-r--r--patches.fixes/0001-drm-amdgpu-powerplay-fix-missing-break-in-switch-sta.patch101
-rw-r--r--patches.fixes/0001-drm-hisilicon-hibmc-Do-not-carry-error-code-in-HiBMC.patch89
-rw-r--r--patches.fixes/0001-drm-hisilicon-hibmc-Don-t-overwrite-fb-helper-surfac.patch42
-rw-r--r--patches.fixes/0001-drm-i915-audio-Hook-up-component-bindings-even-if-di.patch44
-rw-r--r--patches.fixes/0001-drm-i915-gen9-Fix-initial-readout-for-Y-tiled-frameb.patch91
-rw-r--r--patches.fixes/0001-drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch55
-rw-r--r--patches.fixes/0001-drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch55
-rw-r--r--patches.fixes/fs-aio-fix-the-increment-of-aio-nr-and-counting-agai.patch2
-rw-r--r--patches.suse/Kbuild-fix-escaping-in-.cmd-files-for-future-Make.patch122
-rw-r--r--patches.suse/random-rate-limit-unseeded-randomness-warnings.patch89
-rw-r--r--patches.suse/tools-build-fix-escaping-in-.cmd-files-for-future-Ma.patch57
-rwxr-xr-xscripts/git_sort/git_sort.py3
-rwxr-xr-xscripts/series2git2
-rw-r--r--series.conf37
34 files changed, 2024 insertions, 6 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 67d91d31f6..4e1f3f276c 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -877,3 +877,6 @@ b8fe1120b4ba342b4f156d24e952d6e686b20298 # typo fix
747df19747bc9752cd40b9cce761e17a033aa5c2 # asoc: sta32x: need a prerequisite commit that breaks kABI
d52e4d0c0c428bf2ba35074a7495cdb28e2efbae # usb: gadget: need a prerequisite commit that breaks kABI
af424a410749ed7e0c2bffd3cedbc7c274d0ff6f # usb: dwc2: breaks kABI
+e7c52b84fb18f08ce49b6067ae6285aca79084a8 # kasan fix
+ad1a56f1bf2bd2394f98320baf9ad430f7b1534c # We don't carry the reverted patch.
+d60996ab430c8a6033a0944c068edc5ec5becb9b # Duplicate of 3af71f649d22f359790b4032446456a967a81742
diff --git a/patches.drivers/drm-i915-Restore-vblank-interrupts-earlier.patch b/patches.drivers/drm-i915-Restore-vblank-interrupts-earlier.patch
new file mode 100644
index 0000000000..5276d6b3c1
--- /dev/null
+++ b/patches.drivers/drm-i915-Restore-vblank-interrupts-earlier.patch
@@ -0,0 +1,94 @@
+From 7cada4d0b7a0fb813dbc9777fec092e9ed0546e9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 3 Oct 2018 17:49:51 +0300
+Subject: [PATCH] drm/i915: Restore vblank interrupts earlier
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 7cada4d0b7a0fb813dbc9777fec092e9ed0546e9
+Patch-mainline: v4.20-rc1
+No-fix: 68bc30deac625b8be8d3950b30dc93d09a3645f5
+References: bsc#1051510
+
+Plane sanitation needs vblank interrupts (on account of CxSR disable).
+So let's restore vblank interrupts earlier.
+
+V2: Make it actually build
+V3: Add comment to explain why we need this (Daniel)
+
+Cc: stable@vger.kernel.org
+Cc: Dennis <dennis.nezic@utoronto.ca>
+Tested-by: Dennis <dennis.nezic@utoronto.ca>
+Tested-by: Peter Nowee <peter.nowee@gmail.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105637
+Fixes: b1e01595a66d ("drm/i915: Redo plane sanitation during readout")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181003144951.4397-1-ville.syrjala@linux.intel.com
+(cherry picked from commit 68bc30deac625b8be8d3950b30dc93d09a3645f5)
+
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index aa6e79dfd571..ce23b0546407 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -15526,13 +15526,9 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc,
+ I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK);
+ }
+
+- /* restore vblank interrupts to correct state */
+- drm_crtc_vblank_reset(&crtc->base);
+ if (crtc->active) {
+ struct intel_plane *plane;
+
+- drm_crtc_vblank_on(&crtc->base);
+-
+ /* Disable everything but the primary plane */
+ for_each_intel_plane_on_crtc(dev, crtc, plane) {
+ const struct intel_plane_state *plane_state =
+@@ -15874,7 +15870,6 @@ intel_modeset_setup_hw_state(struct drm_device *dev,
+ struct drm_modeset_acquire_ctx *ctx)
+ {
+ struct drm_i915_private *dev_priv = to_i915(dev);
+- enum pipe pipe;
+ struct intel_crtc *crtc;
+ struct intel_encoder *encoder;
+ int i;
+@@ -15887,15 +15882,23 @@ intel_modeset_setup_hw_state(struct drm_device *dev,
+ /* HW state is read out, now we need to sanitize this mess. */
+ get_encoder_power_domains(dev_priv);
+
+- intel_sanitize_plane_mapping(dev_priv);
++ /*
++ * intel_sanitize_plane_mapping() may need to do vblank
++ * waits, so we need vblank interrupts restored beforehand.
++ */
++ for_each_intel_crtc(&dev_priv->drm, crtc) {
++ drm_crtc_vblank_reset(&crtc->base);
+
+- for_each_intel_encoder(dev, encoder) {
+- intel_sanitize_encoder(encoder);
++ if (crtc->active)
++ drm_crtc_vblank_on(&crtc->base);
+ }
+
+- for_each_pipe(dev_priv, pipe) {
+- crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
++ intel_sanitize_plane_mapping(dev_priv);
+
++ for_each_intel_encoder(dev, encoder)
++ intel_sanitize_encoder(encoder);
++
++ for_each_intel_crtc(&dev_priv->drm, crtc) {
+ intel_sanitize_crtc(crtc, ctx);
+ intel_dump_pipe_config(crtc, crtc->config,
+ "[setup_hw_state]");
+--
+2.19.1
+
diff --git a/patches.drivers/drm-i915-dp-Link-train-Fallback-on-eDP-only-if-fallb.patch b/patches.drivers/drm-i915-dp-Link-train-Fallback-on-eDP-only-if-fallb.patch
new file mode 100644
index 0000000000..2d19f28cdf
--- /dev/null
+++ b/patches.drivers/drm-i915-dp-Link-train-Fallback-on-eDP-only-if-fallb.patch
@@ -0,0 +1,143 @@
+From 041444458835d7fb2c9f042598bfe16bf375b15d Mon Sep 17 00:00:00 2001
+From: Manasi Navare <manasi.d.navare@intel.com>
+Date: Tue, 9 Oct 2018 14:28:04 -0700
+Subject: [PATCH] drm/i915/dp: Link train Fallback on eDP only if fallback link BW can fit panel's native mode
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 041444458835d7fb2c9f042598bfe16bf375b15d
+Patch-mainline: v4.20-rc1
+No-fix: 1e712535c51ab025ebc776d4405683d81521996d
+References: bsc#1051510
+
+This patch fixes the original commit c0cfb10d9e1de49 ("drm/i915/edp:
+Do not do link training fallback or prune modes on EDP") that causes
+a blank screen in case of certain eDP panels (Eg: seen on Dell XPS13 9350)
+where first link training fails and a retraining is required by falling
+back to lower link rate/lane count.
+In case of some panels they advertise higher link rate/lane count
+than whats required for supporting the panel's native mode.
+But we always link train at highest link rate/lane count for eDP
+and if that fails we can still fallback to lower link rate/lane count
+as long as the fallback link BW still fits the native mode to avoid
+pruning the panel's native mode yet retraining at fallback values
+to recover from a blank screen.
+
+V3:
+* Add const for fixed_mode (Ville)
+V2:
+* Send uevent if link failure on eDP unconditionally
+
+Fixes: c0cfb10d9e1d ("drm/i915/edp: Do not do link training fallback or prune modes on EDP")
+Cc: Clinton Taylor <clinton.a.taylor@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: <stable@vger.kernel.org> # v4.17+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107489
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105338
+Signed-off-by: Manasi Navare <manasi.d.navare@intel.com>
+Tested-by: Alexander Wilson <alexander.wilson@ncf.edu>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181009212804.702-1-manasi.d.navare@intel.com
+(cherry picked from commit 1e712535c51ab025ebc776d4405683d81521996d)
+
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_dp.c | 30 +++++++++++++++++++
+ drivers/gpu/drm/i915/intel_dp_link_training.c | 26 ++++++----------
+ 2 files changed, 39 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 6b4c19123f2a..06e91d7b6d8e 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -557,6 +557,22 @@ static bool intel_dp_link_params_valid(struct intel_dp *intel_dp, int link_rate,
+ return true;
+ }
+
++static bool intel_dp_can_link_train_fallback_for_edp(struct intel_dp *intel_dp,
++ int link_rate,
++ uint8_t lane_count)
++{
++ const struct drm_display_mode *fixed_mode =
++ intel_dp->attached_connector->panel.fixed_mode;
++ int mode_rate, max_rate;
++
++ mode_rate = intel_dp_link_required(fixed_mode->clock, 18);
++ max_rate = intel_dp_max_data_rate(link_rate, lane_count);
++ if (mode_rate > max_rate)
++ return false;
++
++ return true;
++}
++
+ int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp,
+ int link_rate, uint8_t lane_count)
+ {
+@@ -566,9 +582,23 @@ int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp,
+ intel_dp->num_common_rates,
+ link_rate);
+ if (index > 0) {
++ if (intel_dp_is_edp(intel_dp) &&
++ !intel_dp_can_link_train_fallback_for_edp(intel_dp,
++ intel_dp->common_rates[index - 1],
++ lane_count)) {
++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n");
++ return 0;
++ }
+ intel_dp->max_link_rate = intel_dp->common_rates[index - 1];
+ intel_dp->max_link_lane_count = lane_count;
+ } else if (lane_count > 1) {
++ if (intel_dp_is_edp(intel_dp) &&
++ !intel_dp_can_link_train_fallback_for_edp(intel_dp,
++ intel_dp_max_common_rate(intel_dp),
++ lane_count >> 1)) {
++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n");
++ return 0;
++ }
+ intel_dp->max_link_rate = intel_dp_max_common_rate(intel_dp);
+ intel_dp->max_link_lane_count = lane_count >> 1;
+ } else {
+diff --git a/drivers/gpu/drm/i915/intel_dp_link_training.c b/drivers/gpu/drm/i915/intel_dp_link_training.c
+index a9f40985a621..30be0e39bd5f 100644
+--- a/drivers/gpu/drm/i915/intel_dp_link_training.c
++++ b/drivers/gpu/drm/i915/intel_dp_link_training.c
+@@ -367,22 +367,14 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
+ return;
+
+ failure_handling:
+- /* Dont fallback and prune modes if its eDP */
+- if (!intel_dp_is_edp(intel_dp)) {
+- DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
+- intel_connector->base.base.id,
+- intel_connector->base.name,
+- intel_dp->link_rate, intel_dp->lane_count);
+- if (!intel_dp_get_link_train_fallback_values(intel_dp,
+- intel_dp->link_rate,
+- intel_dp->lane_count))
+- /* Schedule a Hotplug Uevent to userspace to start modeset */
+- schedule_work(&intel_connector->modeset_retry_work);
+- } else {
+- DRM_ERROR("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
+- intel_connector->base.base.id,
+- intel_connector->base.name,
+- intel_dp->link_rate, intel_dp->lane_count);
+- }
++ DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
++ intel_connector->base.base.id,
++ intel_connector->base.name,
++ intel_dp->link_rate, intel_dp->lane_count);
++ if (!intel_dp_get_link_train_fallback_values(intel_dp,
++ intel_dp->link_rate,
++ intel_dp->lane_count))
++ /* Schedule a Hotplug Uevent to userspace to start modeset */
++ schedule_work(&intel_connector->modeset_retry_work);
+ return;
+ }
+--
+2.19.1
+
diff --git a/patches.drivers/iio-adc-at91-fix-acking-DRDY-irq-on-simple-conversio.patch b/patches.drivers/iio-adc-at91-fix-acking-DRDY-irq-on-simple-conversio.patch
new file mode 100644
index 0000000000..fff8d10340
--- /dev/null
+++ b/patches.drivers/iio-adc-at91-fix-acking-DRDY-irq-on-simple-conversio.patch
@@ -0,0 +1,43 @@
+From bc1b45326223e7e890053cf6266357adfa61942d Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Mon, 24 Sep 2018 10:51:43 +0300
+Subject: [PATCH] iio: adc: at91: fix acking DRDY irq on simple conversions
+Git-commit: bc1b45326223e7e890053cf6266357adfa61942d
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+When doing simple conversions, the driver did not acknowledge the DRDY irq.
+If this irq status is not acked, it will be left pending, and as soon as a
+trigger is enabled, the irq handler will be called, it doesn't know why
+this status has occurred because no channel is pending, and then it will go
+int a irq loop and board will hang.
+To avoid this situation, read the LCDR after a raw conversion is done.
+
+Fixes: 0e589d5fb ("ARM: AT91: IIO: Add AT91 ADC driver.")
+Cc: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/adc/at91_adc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index 44b516863c9d..e3be88e7192c 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -279,6 +279,8 @@ static void handle_adc_eoc_trigger(int irq, struct iio_dev *idev)
+ iio_trigger_poll(idev->trig);
+ } else {
+ st->last_value = at91_adc_readl(st, AT91_ADC_CHAN(st, st->chnb));
++ /* Needed to ACK the DRDY interruption */
++ at91_adc_readl(st, AT91_ADC_LCDR);
+ st->done = true;
+ wake_up_interruptible(&st->wq_data_avail);
+ }
+--
+2.19.1
+
diff --git a/patches.drivers/iio-adc-at91-fix-wrong-channel-number-in-triggered-b.patch b/patches.drivers/iio-adc-at91-fix-wrong-channel-number-in-triggered-b.patch
new file mode 100644
index 0000000000..090581119c
--- /dev/null
+++ b/patches.drivers/iio-adc-at91-fix-wrong-channel-number-in-triggered-b.patch
@@ -0,0 +1,53 @@
+From aea835f2dc8a682942b859179c49ad1841a6c8b9 Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Mon, 24 Sep 2018 10:51:44 +0300
+Subject: [PATCH] iio: adc: at91: fix wrong channel number in triggered buffer mode
+Git-commit: aea835f2dc8a682942b859179c49ad1841a6c8b9
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+When channels are registered, the hardware channel number is not the
+actual iio channel number.
+This is because the driver is probed with a certain number of accessible
+channels. Some pins are routed and some not, depending on the description of
+the board in the DT.
+Because of that, channels 0,1,2,3 can correspond to hardware channels
+2,3,4,5 for example.
+In the buffered triggered case, we need to do the translation accordingly.
+Fixed the channel number to stop reading the wrong channel.
+
+Fixes: 0e589d5fb ("ARM: AT91: IIO: Add AT91 ADC driver.")
+Cc: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/adc/at91_adc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index e3be88e7192c..75d2f73582a3 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -248,12 +248,14 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *idev = pf->indio_dev;
+ struct at91_adc_state *st = iio_priv(idev);
++ struct iio_chan_spec const *chan;
+ int i, j = 0;
+
+ for (i = 0; i < idev->masklength; i++) {
+ if (!test_bit(i, idev->active_scan_mask))
+ continue;
+- st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, i));
++ chan = idev->channels + i;
++ st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, chan->channel));
+ j++;
+ }
+
+--
+2.19.1
+
diff --git a/patches.drivers/iio-adc-imx25-gcq-Fix-leak-of-device_node-in-mx25_gc.patch b/patches.drivers/iio-adc-imx25-gcq-Fix-leak-of-device_node-in-mx25_gc.patch
new file mode 100644
index 0000000000..0dd5585cb3
--- /dev/null
+++ b/patches.drivers/iio-adc-imx25-gcq-Fix-leak-of-device_node-in-mx25_gc.patch
@@ -0,0 +1,77 @@
+From d3fa21c73c391975488818b085b894c2980ea052 Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Sat, 22 Sep 2018 00:58:02 +0300
+Subject: [PATCH] iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs()
+Git-commit: d3fa21c73c391975488818b085b894c2980ea052
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Leaving for_each_child_of_node loop we should release child device node,
+if it is not stored for future use.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Jc: I'm not sending this as a quick fix as it's been wrong for years,
+but good to pick up for stable after the merge window.
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Fixes: 6df2e98c3ea56 ("iio: adc: Add imx25-gcq ADC driver")
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/adc/fsl-imx25-gcq.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/iio/adc/fsl-imx25-gcq.c b/drivers/iio/adc/fsl-imx25-gcq.c
+index ea264fa9e567..929c617db364 100644
+--- a/drivers/iio/adc/fsl-imx25-gcq.c
++++ b/drivers/iio/adc/fsl-imx25-gcq.c
+@@ -209,12 +209,14 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ ret = of_property_read_u32(child, "reg", &reg);
+ if (ret) {
+ dev_err(dev, "Failed to get reg property\n");
++ of_node_put(child);
+ return ret;
+ }
+
+ if (reg >= MX25_NUM_CFGS) {
+ dev_err(dev,
+ "reg value is greater than the number of available configuration registers\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+@@ -228,6 +230,7 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ if (IS_ERR(priv->vref[refp])) {
+ dev_err(dev, "Error, trying to use external voltage reference without a vref-%s regulator.",
+ mx25_gcq_refp_names[refp]);
++ of_node_put(child);
+ return PTR_ERR(priv->vref[refp]);
+ }
+ priv->channel_vref_mv[reg] =
+@@ -240,6 +243,7 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ break;
+ default:
+ dev_err(dev, "Invalid positive reference %d\n", refp);
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+@@ -254,10 +258,12 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+
+ if ((refp & MX25_ADCQ_CFG_REFP_MASK) != refp) {
+ dev_err(dev, "Invalid fsl,adc-refp property value\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+ if ((refn & MX25_ADCQ_CFG_REFN_MASK) != refn) {
+ dev_err(dev, "Invalid fsl,adc-refn property value\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+--
+2.19.1
+
diff --git a/patches.drivers/media-cx231xx-fix-potential-sign-extension-overflow-.patch b/patches.drivers/media-cx231xx-fix-potential-sign-extension-overflow-.patch
new file mode 100644
index 0000000000..db5cbb9a73
--- /dev/null
+++ b/patches.drivers/media-cx231xx-fix-potential-sign-extension-overflow-.patch
@@ -0,0 +1,43 @@
+From 32ae592036d7aeaabcccb2b1715373a68639a768 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Sat, 6 Oct 2018 14:01:42 -0400
+Subject: [PATCH] media: cx231xx: fix potential sign-extension overflow on large shift
+Git-commit: 32ae592036d7aeaabcccb2b1715373a68639a768
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Shifting the u8 value[3] by an int can lead to sign-extension
+overflow. For example, if value[3] is 0xff and the shift is 24 then it
+is promoted to int and then the top bit is sign-extended so that all
+upper 32 bits are set. Fix this by casting value[3] to a u32 before
+the shift.
+
+Detected by CoverityScan, CID#1016522 ("Unintended sign extension")
+
+Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/usb/cx231xx/cx231xx-video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/cx231xx/cx231xx-video.c b/drivers/media/usb/cx231xx/cx231xx-video.c
+index 29160df76cf7..f2f034c5cd62 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-video.c
++++ b/drivers/media/usb/cx231xx/cx231xx-video.c
+@@ -1389,7 +1389,7 @@ int cx231xx_g_register(struct file *file, void *priv,
+ ret = cx231xx_read_ctrl_reg(dev, VRT_GET_REGISTER,
+ (u16)reg->reg, value, 4);
+ reg->val = value[0] | value[1] << 8 |
+- value[2] << 16 | value[3] << 24;
++ value[2] << 16 | (u32)value[3] << 24;
+ reg->size = 4;
+ break;
+ case 1: /* AFE - read byte */
+--
+2.19.1
+
diff --git a/patches.drivers/media-dvb-fix-compat-ioctl-translation.patch b/patches.drivers/media-dvb-fix-compat-ioctl-translation.patch
new file mode 100644
index 0000000000..85c0bf238f
--- /dev/null
+++ b/patches.drivers/media-dvb-fix-compat-ioctl-translation.patch
@@ -0,0 +1,77 @@
+From 1ccbeeb888ac33627d91f1ccf0b84ef3bcadef24 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 27 Aug 2018 15:56:21 -0400
+Subject: [PATCH] media: dvb: fix compat ioctl translation
+Git-commit: 1ccbeeb888ac33627d91f1ccf0b84ef3bcadef24
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The VIDEO_GET_EVENT and VIDEO_STILLPICTURE was added back in 2005 but
+it never worked because the command number is wrong.
+
+Using the right command number means we have a better chance of them
+actually doing the right thing, though clearly nobody has ever tried
+it successfully.
+
+I noticed these while auditing the remaining users of compat_time_t
+for y2038 bugs. This one is fine in that regard, it just never did
+anything.
+
+Fixes: 6e87abd0b8cb ("[DVB]: Add compat ioctl handling.")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ fs/compat_ioctl.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -160,6 +160,7 @@ struct compat_video_event {
+ unsigned int frame_rate;
+ } u;
+ };
++#define VIDEO_GET_EVENT32 _IOR('o', 28, struct compat_video_event)
+
+ static int do_video_get_event(struct file *file,
+ unsigned int cmd, struct compat_video_event __user *up)
+@@ -171,7 +172,7 @@ static int do_video_get_event(struct fil
+ if (kevent == NULL)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long)kevent);
++ err = do_ioctl(file, VIDEO_GET_EVENT, (unsigned long)kevent);
+ if (!err) {
+ err = convert_in_user(&kevent->type, &up->type);
+ err |= convert_in_user(&kevent->timestamp, &up->timestamp);
+@@ -190,6 +191,7 @@ struct compat_video_still_picture {
+ compat_uptr_t iFrame;
+ int32_t size;
+ };
++#define VIDEO_STILLPICTURE32 _IOW('o', 30, struct compat_video_still_picture)
+
+ static int do_video_stillpicture(struct file *file,
+ unsigned int cmd, struct compat_video_still_picture __user *up)
+@@ -212,7 +214,7 @@ static int do_video_stillpicture(struct
+ if (err)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long) up_native);
++ err = do_ioctl(file, VIDEO_STILLPICTURE, (unsigned long) up_native);
+
+ return err;
+ }
+@@ -1487,9 +1489,9 @@ static long do_ioctl_trans(unsigned int
+ return rtc_ioctl(file, cmd, argp);
+
+ /* dvb */
+- case VIDEO_GET_EVENT:
++ case VIDEO_GET_EVENT32:
+ return do_video_get_event(file, cmd, argp);
+- case VIDEO_STILLPICTURE:
++ case VIDEO_STILLPICTURE32:
+ return do_video_stillpicture(file, cmd, argp);
+ case VIDEO_SET_SPU_PALETTE:
+ return do_video_set_spu_palette(file, cmd, argp);
diff --git a/patches.drivers/media-em28xx-fix-input-name-for-Terratec-AV-350.patch b/patches.drivers/media-em28xx-fix-input-name-for-Terratec-AV-350.patch
new file mode 100644
index 0000000000..75788a0c34
--- /dev/null
+++ b/patches.drivers/media-em28xx-fix-input-name-for-Terratec-AV-350.patch
@@ -0,0 +1,43 @@
+From 15644bfa195bd166d0a5ed76ae2d587f719c3dac Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Fri, 14 Sep 2018 00:20:21 -0400
+Subject: [PATCH] media: em28xx: fix input name for Terratec AV 350
+Git-commit: 15644bfa195bd166d0a5ed76ae2d587f719c3dac
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Instead of using a register value, use an AMUX name, as otherwise
+VIDIOC_G_AUDIO would fail.
+
+Cc: stable@vger.kernel.org
+Fixes: 766ed64de554 ("V4L/DVB (11827): Add support for Terratec Grabster AV350")
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/usb/em28xx/em28xx-cards.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index 06a7e09ded6e..87b887b7604e 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -2141,13 +2141,13 @@ const struct em28xx_board em28xx_boards[] = {
+ .input = { {
+ .type = EM28XX_VMUX_COMPOSITE,
+ .vmux = TVP5150_COMPOSITE1,
+- .amux = EM28XX_AUDIO_SRC_LINE,
++ .amux = EM28XX_AMUX_LINE_IN,
+ .gpio = terratec_av350_unmute_gpio,
+
+ }, {
+ .type = EM28XX_VMUX_SVIDEO,
+ .vmux = TVP5150_SVIDEO,
+- .amux = EM28XX_AUDIO_SRC_LINE,
++ .amux = EM28XX_AMUX_LINE_IN,
+ .gpio = terratec_av350_unmute_gpio,
+ } },
+ },
+--
+2.19.1
+
diff --git a/patches.drivers/media-em28xx-use-a-default-format-if-TRY_FMT-fails.patch b/patches.drivers/media-em28xx-use-a-default-format-if-TRY_FMT-fails.patch
new file mode 100644
index 0000000000..42b2caf0aa
--- /dev/null
+++ b/patches.drivers/media-em28xx-use-a-default-format-if-TRY_FMT-fails.patch
@@ -0,0 +1,44 @@
+From f823ce2a1202d47110a7ef86b65839f0be8adc38 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Thu, 13 Sep 2018 23:22:40 -0400
+Subject: [PATCH] media: em28xx: use a default format if TRY_FMT fails
+Git-commit: f823ce2a1202d47110a7ef86b65839f0be8adc38
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Follow the V4L2 spec, as warned by v4l2-compliance:
+
+ warn: v4l2-test-formats.cpp(732): TRY_FMT cannot handle an invalid pixelformat.
+ warn: v4l2-test-formats.cpp(733): This may or may not be a problem. For more information see:
+
+Warn: v4l2-test-formats.cpp(734): http://www.mail-archive.com/linux-media@vger.kernel.org/msg56550.html
+
+Cc: stable@vger.kernel.org
+Fixes: bddcf63313c6 ("V4L/DVB (9927): em28xx: use a more standard way to specify video formats")
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/usb/em28xx/em28xx-video.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
+index fbdfe6762cb2..4b08da45032d 100644
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1471,9 +1471,9 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
+
+ fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+ if (!fmt) {
+- em28xx_videodbg("Fourcc format (%08x) invalid.\n",
+- f->fmt.pix.pixelformat);
+- return -EINVAL;
++ fmt = &format[0];
++ em28xx_videodbg("Fourcc format (%08x) invalid. Using default (%08x).\n",
++ f->fmt.pix.pixelformat, fmt->fourcc);
+ }
+
+ if (dev->board.is_em2800) {
+--
+2.19.1
+
diff --git a/patches.drivers/media-pci-cx23885-handle-adding-to-list-failure.patch b/patches.drivers/media-pci-cx23885-handle-adding-to-list-failure.patch
new file mode 100644
index 0000000000..a96f2a0ef3
--- /dev/null
+++ b/patches.drivers/media-pci-cx23885-handle-adding-to-list-failure.patch
@@ -0,0 +1,69 @@
+From c5d59528e24ad22500347b199d52b9368e686a42 Mon Sep 17 00:00:00 2001
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Sun, 9 Sep 2018 12:02:32 -0400
+Subject: [PATCH] media: pci: cx23885: handle adding to list failure
+Git-commit: c5d59528e24ad22500347b199d52b9368e686a42
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+altera_hw_filt_init() which calls append_internal() assumes
+that the node was successfully linked in while in fact it can
+silently fail. So the call-site needs to set return to -ENOMEM
+on append_internal() returning NULL and exit through the err path.
+
+Fixes: 349bcf02e361 ("[media] Altera FPGA based CI driver module")
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/cx23885/altera-ci.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/media/pci/cx23885/altera-ci.c b/drivers/media/pci/cx23885/altera-ci.c
+index 62bc8049b320..198c05e83f5c 100644
+--- a/drivers/media/pci/cx23885/altera-ci.c
++++ b/drivers/media/pci/cx23885/altera-ci.c
+@@ -665,6 +665,10 @@ static int altera_hw_filt_init(struct altera_ci_config *config, int hw_filt_nr)
+ }
+
+ temp_int = append_internal(inter);
++ if (!temp_int) {
++ ret = -ENOMEM;
++ goto err;
++ }
+ inter->filts_used = 1;
+ inter->dev = config->dev;
+ inter->fpga_rw = config->fpga_rw;
+@@ -699,6 +703,7 @@ static int altera_hw_filt_init(struct altera_ci_config *config, int hw_filt_nr)
+ __func__, ret);
+
+ kfree(pid_filt);
++ kfree(inter);
+
+ return ret;
+ }
+@@ -733,6 +738,10 @@ int altera_ci_init(struct altera_ci_config *config, int ci_nr)
+ }
+
+ temp_int = append_internal(inter);
++ if (!temp_int) {
++ ret = -ENOMEM;
++ goto err;
++ }
+ inter->cis_used = 1;
+ inter->dev = config->dev;
+ inter->fpga_rw = config->fpga_rw;
+@@ -801,6 +810,7 @@ int altera_ci_init(struct altera_ci_config *config, int ci_nr)
+ ci_dbg_print("%s: Cannot initialize CI: Error %d.\n", __func__, ret);
+
+ kfree(state);
++ kfree(inter);
+
+ return ret;
+ }
+--
+2.19.1
+
diff --git a/patches.drivers/media-tvp5150-avoid-going-past-array-on-v4l2_queryme.patch b/patches.drivers/media-tvp5150-avoid-going-past-array-on-v4l2_queryme.patch
new file mode 100644
index 0000000000..12b2ecd447
--- /dev/null
+++ b/patches.drivers/media-tvp5150-avoid-going-past-array-on-v4l2_queryme.patch
@@ -0,0 +1,84 @@
+From 5c4c4505b716cb782ad7263091edc466c4d1fbd4 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Thu, 13 Sep 2018 16:49:51 -0400
+Subject: [PATCH] media: tvp5150: avoid going past array on v4l2_querymenu()
+Git-commit: 5c4c4505b716cb782ad7263091edc466c4d1fbd4
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The parameters of v4l2_ctrl_new_std_menu_items() are tricky: instead of
+the number of possible values, it requires the number of the maximum
+value. In other words, the ARRAY_SIZE() value should be decremented,
+otherwise it will go past the array bounds, as warned by KASAN:
+
+[ 279.839688] BUG: KASAN: global-out-of-bounds in v4l2_querymenu+0x10d/0x180 [videodev]
+[ 279.839709] Read of size 8 at addr ffffffffc10a4cb0 by task v4l2-compliance/16676
+
+[ 279.839736] CPU: 1 PID: 16676 Comm: v4l2-compliance Not tainted 4.18.0-rc2+ #120
+[ 279.839741] Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
+[ 279.839743] Call Trace:
+[ 279.839758] dump_stack+0x71/0xab
+[ 279.839807] ? v4l2_querymenu+0x10d/0x180 [videodev]
+[ 279.839817] print_address_description+0x1c9/0x270
+[ 279.839863] ? v4l2_querymenu+0x10d/0x180 [videodev]
+[ 279.839871] kasan_report+0x237/0x360
+[ 279.839918] v4l2_querymenu+0x10d/0x180 [videodev]
+[ 279.839964] __video_do_ioctl+0x2c8/0x590 [videodev]
+[ 279.840011] ? copy_overflow+0x20/0x20 [videodev]
+[ 279.840020] ? avc_ss_reset+0xa0/0xa0
+[ 279.840028] ? check_stack_object+0x21/0x60
+[ 279.840036] ? __check_object_size+0xe7/0x240
+[ 279.840080] video_usercopy+0xed/0x730 [videodev]
+[ 279.840123] ? copy_overflow+0x20/0x20 [videodev]
+[ 279.840167] ? v4l_enumstd+0x40/0x40 [videodev]
+[ 279.840177] ? __handle_mm_fault+0x9f9/0x1ba0
+[ 279.840186] ? __pmd_alloc+0x2c0/0x2c0
+[ 279.840193] ? __vfs_write+0xb6/0x350
+[ 279.840200] ? kernel_read+0xa0/0xa0
+[ 279.840244] ? video_usercopy+0x730/0x730 [videodev]
+[ 279.840284] v4l2_ioctl+0xa1/0xb0 [videodev]
+[ 279.840295] do_vfs_ioctl+0x117/0x8a0
+[ 279.840303] ? selinux_file_ioctl+0x211/0x2f0
+[ 279.840313] ? ioctl_preallocate+0x120/0x120
+[ 279.840319] ? selinux_capable+0x20/0x20
+[ 279.840332] ksys_ioctl+0x70/0x80
+[ 279.840342] __x64_sys_ioctl+0x3d/0x50
+[ 279.840351] do_syscall_64+0x6d/0x1c0
+[ 279.840361] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 279.840367] RIP: 0033:0x7fdfb46275d7
+[ 279.840369] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48
+[ 279.840474] RSP: 002b:00007ffee1179038 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
+[ 279.840483] RAX: ffffffffffffffda RBX: 00007ffee1179180 RCX: 00007fdfb46275d7
+[ 279.840488] RDX: 00007ffee11790c0 RSI: 00000000c02c5625 RDI: 0000000000000003
+[ 279.840493] RBP: 0000000000000002 R08: 0000000000000020 R09: 00000000009f0902
+[ 279.840497] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffee117a5a0
+[ 279.840501] R13: 00007ffee11790c0 R14: 0000000000000002 R15: 0000000000000000
+
+[ 279.840515] The buggy address belongs to the variable:
+[ 279.840535] tvp5150_test_patterns+0x10/0xffffffffffffe360 [tvp5150]
+
+Fixes: c43875f66140 ("[media] tvp5150: replace MEDIA_ENT_F_CONN_TEST by a control")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/i2c/tvp5150.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index f337e523821b..57b2102586bc 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -1534,7 +1534,7 @@ static int tvp5150_probe(struct i2c_client *c,
+ 27000000, 1, 27000000);
+ v4l2_ctrl_new_std_menu_items(&core->hdl, &tvp5150_ctrl_ops,
+ V4L2_CID_TEST_PATTERN,
+- ARRAY_SIZE(tvp5150_test_patterns),
++ ARRAY_SIZE(tvp5150_test_patterns) - 1,
+ 0, 0, tvp5150_test_patterns);
+ sd->ctrl_handler = &core->hdl;
+ if (core->hdl.error) {
+--
+2.19.1
+
diff --git a/patches.drivers/media-tvp5150-fix-switch-exit-in-set-control-handler.patch b/patches.drivers/media-tvp5150-fix-switch-exit-in-set-control-handler.patch
new file mode 100644
index 0000000000..39a983a11b
--- /dev/null
+++ b/patches.drivers/media-tvp5150-fix-switch-exit-in-set-control-handler.patch
@@ -0,0 +1,43 @@
+From 2d29bcc8c237874795175b2930fa9a45a115175a Mon Sep 17 00:00:00 2001
+From: Marco Felsch <m.felsch@pengutronix.de>
+Date: Thu, 28 Jun 2018 12:20:34 -0400
+Subject: [PATCH] media: tvp5150: fix switch exit in set control handler
+Git-commit: 2d29bcc8c237874795175b2930fa9a45a115175a
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The function only consists of a single switch case block without a
+default case. Unsupported control requests are indicated by the -EINVAL
+return code trough the last return statement at the end of the function. So
+exiting just the switch case block returns the -EINVAL error code but the
+hue control is supported and a zero should be returned instead.
+
+Replace the break by a 'return 0' to fix this behaviour.
+
+Fixes: d183e4efcae8 ("[media] v4l: tvp5150: Add missing break in set
+control handler")
+
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/i2c/tvp5150.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 7dda77a4e6dc..0857f113b21d 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -834,7 +834,7 @@ static int tvp5150_s_ctrl(struct v4l2_ctrl *ctrl)
+ return 0;
+ case V4L2_CID_HUE:
+ tvp5150_write(sd, TVP5150_HUE_CTL, ctrl->val);
+- break;
++ return 0;
+ case V4L2_CID_TEST_PATTERN:
+ decoder->enable = ctrl->val ? false : true;
+ tvp5150_selmux(sd);
+--
+2.19.1
+
diff --git a/patches.drivers/media-tvp5150-fix-width-alignment-during-set_selecti.patch b/patches.drivers/media-tvp5150-fix-width-alignment-during-set_selecti.patch
new file mode 100644
index 0000000000..e46bd7faed
--- /dev/null
+++ b/patches.drivers/media-tvp5150-fix-width-alignment-during-set_selecti.patch
@@ -0,0 +1,59 @@
+From bd24db04101f45a9c1d874fe21b0c7eab7bcadec Mon Sep 17 00:00:00 2001
+From: Marco Felsch <m.felsch@pengutronix.de>
+Date: Thu, 28 Jun 2018 12:20:33 -0400
+Subject: [PATCH] media: tvp5150: fix width alignment during set_selection()
+Git-commit: bd24db04101f45a9c1d874fe21b0c7eab7bcadec
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The driver ignored the width alignment which exists due to the UYVY
+colorspace format. Fix the width alignment and make use of the the
+provided v4l2 helper function to set the width, height and all
+alignments in one.
+
+Fixes: 963ddc63e20d ("[media] media: tvp5150: Add cropping support")
+
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/i2c/tvp5150.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 92af47f2565e..7dda77a4e6dc 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -907,9 +907,6 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd,
+
+ /* tvp5150 has some special limits */
+ rect.left = clamp(rect.left, 0, TVP5150_MAX_CROP_LEFT);
+- rect.width = clamp_t(unsigned int, rect.width,
+- TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left,
+- TVP5150_H_MAX - rect.left);
+ rect.top = clamp(rect.top, 0, TVP5150_MAX_CROP_TOP);
+
+ /* Calculate height based on current standard */
+@@ -923,9 +920,16 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd,
+ else
+ hmax = TVP5150_V_MAX_OTHERS;
+
+- rect.height = clamp_t(unsigned int, rect.height,
++ /*
++ * alignments:
++ * - width = 2 due to UYVY colorspace
++ * - height, image = no special alignment
++ */
++ v4l_bound_align_image(&rect.width,
++ TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left,
++ TVP5150_H_MAX - rect.left, 1, &rect.height,
+ hmax - TVP5150_MAX_CROP_TOP - rect.top,
+- hmax - rect.top);
++ hmax - rect.top, 0, 0);
+
+ tvp5150_write(sd, TVP5150_VERT_BLANKING_START, rect.top);
+ tvp5150_write(sd, TVP5150_VERT_BLANKING_STOP,
+--
+2.19.1
+
diff --git a/patches.drivers/media-uvcvideo-Fix-uvc_alloc_entity-allocation-align.patch b/patches.drivers/media-uvcvideo-Fix-uvc_alloc_entity-allocation-align.patch
new file mode 100644
index 0000000000..602557c8d1
--- /dev/null
+++ b/patches.drivers/media-uvcvideo-Fix-uvc_alloc_entity-allocation-align.patch
@@ -0,0 +1,41 @@
+From 89dd34caf73e28018c58cd193751e41b1f8bdc56 Mon Sep 17 00:00:00 2001
+From: Nadav Amit <namit@vmware.com>
+Date: Mon, 4 Jun 2018 09:47:13 -0400
+Subject: [PATCH] media: uvcvideo: Fix uvc_alloc_entity() allocation alignment
+Git-commit: 89dd34caf73e28018c58cd193751e41b1f8bdc56
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The use of ALIGN() in uvc_alloc_entity() is incorrect, since the size of
+(entity->pads) is not a power of two. As a stop-gap, until a better
+solution is adapted, use roundup() instead.
+
+Found by a static assertion. Compile-tested only.
+
+Fixes: 4ffc2d89f38a ("uvcvideo: Register subdevices for each entity")
+
+Signed-off-by: Nadav Amit <namit@vmware.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/usb/uvc/uvc_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 0692017f0b80..21b0270067c1 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -914,7 +914,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
+ unsigned int size;
+ unsigned int i;
+
+- extra_size = ALIGN(extra_size, sizeof(*entity->pads));
++ extra_size = roundup(extra_size, sizeof(*entity->pads));
+ num_inputs = (type & UVC_TERM_OUTPUT) ? num_pads : num_pads - 1;
+ size = sizeof(*entity) + extra_size + sizeof(*entity->pads) * num_pads
+ + num_inputs;
+--
+2.19.1
+
diff --git a/patches.drivers/media-v4l2-tpg-fix-kernel-oops-when-enabling-HFLIP-a.patch b/patches.drivers/media-v4l2-tpg-fix-kernel-oops-when-enabling-HFLIP-a.patch
new file mode 100644
index 0000000000..c2eac7754d
--- /dev/null
+++ b/patches.drivers/media-v4l2-tpg-fix-kernel-oops-when-enabling-HFLIP-a.patch
@@ -0,0 +1,42 @@
+From 250854eed5d45a73d81e4137dfd85180af6f2ec3 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Mon, 8 Oct 2018 15:08:27 -0400
+Subject: [PATCH] media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD
+Git-commit: 250854eed5d45a73d81e4137dfd85180af6f2ec3
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+When the OSD is on (i.e. vivid displays text on top of the test pattern), and
+you enable hflip, then the driver crashes.
+
+The cause turned out to be a division of a negative number by an unsigned value.
+You expect that -8 / 2U would be -4, but in reality it is 2147483644 :-(
+
+Fixes: 3e14e7a82c1ef ("vivid-tpg: add hor/vert downsampling support to tpg_gen_text")
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Reported-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Cc: <stable@vger.kernel.org> # for v4.1 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+index 76b125ebee6d..fa483b95bc5a 100644
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+@@ -1801,7 +1801,7 @@ typedef struct { u16 __; u8 _; } __packed x24;
+ pos[7] = (chr & (0x01 << 0) ? fg : bg); \
+ } \
+ \
+- pos += (tpg->hflip ? -8 : 8) / hdiv; \
++ pos += (tpg->hflip ? -8 : 8) / (int)hdiv; \
+ } \
+ } \
+ } while (0)
+--
+2.19.1
+
diff --git a/patches.drivers/media-vsp1-Fix-YCbCr-planar-formats-pitch-calculatio.patch b/patches.drivers/media-vsp1-Fix-YCbCr-planar-formats-pitch-calculatio.patch
new file mode 100644
index 0000000000..bd88fa98c1
--- /dev/null
+++ b/patches.drivers/media-vsp1-Fix-YCbCr-planar-formats-pitch-calculatio.patch
@@ -0,0 +1,56 @@
+From 9b2798d5b71c50f64c41a40f0cbcae47c3fbd067 Mon Sep 17 00:00:00 2001
+From: Koji Matsuoka <koji.matsuoka.xm@renesas.com>
+Date: Thu, 26 Oct 2017 02:27:51 -0400
+Subject: [PATCH] media: vsp1: Fix YCbCr planar formats pitch calculation
+Git-commit: 9b2798d5b71c50f64c41a40f0cbcae47c3fbd067
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+YCbCr planar formats can have different pitch values for the luma and
+chroma planes. This isn't taken into account in the driver. Fix it.
+
+Based on a BSP patch from Koji Matsuoka <koji.matsuoka.xm@renesas.com>.
+
+Fixes: 7863ac504bc5 ("drm: rcar-du: Add tri-planar memory formats support")
+[Updated documentation of the struct vsp1_du_atomic_config pitch field]
+
+Signed-off-by: Koji Matsuoka <koji.matsuoka.xm@renesas.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/platform/vsp1/vsp1_drm.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/vsp1/vsp1_drm.c
++++ b/drivers/media/platform/vsp1/vsp1_drm.c
+@@ -260,6 +260,7 @@ int vsp1_du_atomic_update(struct device
+ {
+ struct vsp1_device *vsp1 = dev_get_drvdata(dev);
+ const struct vsp1_format_info *fmtinfo;
++ unsigned int chroma_hsub;
+ struct vsp1_rwpf *rpf;
+
+ if (rpf_index >= vsp1->info->rpf_count)
+@@ -294,10 +295,18 @@ int vsp1_du_atomic_update(struct device
+ return -EINVAL;
+ }
+
++ /*
++ * Only formats with three planes can affect the chroma planes pitch.
++ * All formats with two planes have a horizontal subsampling value of 2,
++ * but combine U and V in a single chroma plane, which thus results in
++ * the luma plane and chroma plane having the same pitch.
++ */
++ chroma_hsub = (fmtinfo->planes == 3) ? fmtinfo->hsub : 1;
++
+ rpf->fmtinfo = fmtinfo;
+ rpf->format.num_planes = fmtinfo->planes;
+ rpf->format.plane_fmt[0].bytesperline = cfg->pitch;
+- rpf->format.plane_fmt[1].bytesperline = cfg->pitch;
++ rpf->format.plane_fmt[1].bytesperline = cfg->pitch / chroma_hsub;
+ rpf->alpha = cfg->alpha;
+
+ rpf->mem.addr[0] = cfg->mem[0];
diff --git a/patches.drivers/serial-8250-Fix-clearing-FIFOs-in-RS485-mode-again.patch b/patches.drivers/serial-8250-Fix-clearing-FIFOs-in-RS485-mode-again.patch
new file mode 100644
index 0000000000..0656b1e9cf
--- /dev/null
+++ b/patches.drivers/serial-8250-Fix-clearing-FIFOs-in-RS485-mode-again.patch
@@ -0,0 +1,94 @@
+From f6aa5beb45be27968a4df90176ca36dfc4363d37 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Mon, 3 Sep 2018 02:44:52 +0200
+Subject: [PATCH] serial: 8250: Fix clearing FIFOs in RS485 mode again
+Git-commit: f6aa5beb45be27968a4df90176ca36dfc4363d37
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The 8250 FIFOs indeed need to be cleared after stopping transmission in
+RS485 mode without SER_RS485_RX_DURING_TX flag set. But there are two
+problems with the approach taken by the previous patch from Fixes tag.
+
+First, serial8250_clear_fifos() should clear fifos, but what it really
+does is it enables the FIFOs unconditionally if present, clears them
+and then sets the FCR register to zero, which effectively disables the
+FIFOs. In case the FIFO is disabled, enabling it and clearing it makes
+no sense and in fact can trigger misbehavior of the 8250 core. Moreover,
+the FCR register may contain other FIFO configuration bits which may not
+be writable unconditionally and writing them incorrectly can trigger
+misbehavior of the 8250 core too. (ie. AM335x UART swallows the first
+byte and retransmits the last byte twice because of this FCR write).
+
+Second, serial8250_clear_and_reinit_fifos() completely reloads the FCR,
+but what really has to happen at the end of the RS485 transmission is
+clearing of the FIFOs and nothing else.
+
+This patch repairs serial8250_clear_fifos() so that it really only
+clears the FIFOs by operating on FCR[2:1] bits and leaves all the
+other bits alone. It also undoes serial8250_clear_and_reinit_fifos()
+from __do_stop_tx_rs485() as serial8250_clear_fifos() is sufficient.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Fixes: 2bed8a8e7072 ("Clearing FIFOs in RS485 emulation mode causes subsequent transmits to break")
+Cc: Daniel Jedrychowski <avistel@gmail.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: stable <stable@vger.kernel.org> # let it bake a bit before merging
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/8250/8250_port.c | 29 ++++++++++++++++++++++++-----
+ 1 file changed, 24 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 3f779d25ec0c..f776b3eafb96 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -552,11 +552,30 @@ static unsigned int serial_icr_read(struct uart_8250_port *up, int offset)
+ */
+ static void serial8250_clear_fifos(struct uart_8250_port *p)
+ {
++ unsigned char fcr;
++ unsigned char clr_mask = UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT;
++
+ if (p->capabilities & UART_CAP_FIFO) {
+- serial_out(p, UART_FCR, UART_FCR_ENABLE_FIFO);
+- serial_out(p, UART_FCR, UART_FCR_ENABLE_FIFO |
+- UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT);
+- serial_out(p, UART_FCR, 0);
++ /*
++ * Make sure to avoid changing FCR[7:3] and ENABLE_FIFO bits.
++ * In case ENABLE_FIFO is not set, there is nothing to flush
++ * so just return. Furthermore, on certain implementations of
++ * the 8250 core, the FCR[7:3] bits may only be changed under
++ * specific conditions and changing them if those conditions
++ * are not met can have nasty side effects. One such core is
++ * the 8250-omap present in TI AM335x.
++ */
++ fcr = serial_in(p, UART_FCR);
++
++ /* FIFO is not enabled, there's nothing to clear. */
++ if (!(fcr & UART_FCR_ENABLE_FIFO))
++ return;
++
++ fcr |= clr_mask;
++ serial_out(p, UART_FCR, fcr);
++
++ fcr &= ~clr_mask;
++ serial_out(p, UART_FCR, fcr);
+ }
+ }
+
+@@ -1448,7 +1467,7 @@ static void __do_stop_tx_rs485(struct uart_8250_port *p)
+ * Enable previously disabled RX interrupts.
+ */
+ if (!(p->port.rs485.flags & SER_RS485_RX_DURING_TX)) {
+- serial8250_clear_and_reinit_fifos(p);
++ serial8250_clear_fifos(p);
+
+ p->ier |= UART_IER_RLSI | UART_IER_RDI;
+ serial_port_out(&p->port, UART_IER, p->ier);
+--
+2.19.1
+
diff --git a/patches.drivers/soc-tegra-pmc-Fix-child-node-lookup.patch b/patches.drivers/soc-tegra-pmc-Fix-child-node-lookup.patch
new file mode 100644
index 0000000000..4c09159ddf
--- /dev/null
+++ b/patches.drivers/soc-tegra-pmc-Fix-child-node-lookup.patch
@@ -0,0 +1,43 @@
+From 1dc6bd5e39a29453bdcc17348dd2a89f1aa4004e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 15 Nov 2017 10:44:58 +0100
+Subject: [PATCH] soc/tegra: pmc: Fix child-node lookup
+Git-commit: 1dc6bd5e39a29453bdcc17348dd2a89f1aa4004e
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Fix child-node lookup during probe, which ended up searching the whole
+device tree depth-first starting at the parent rather than just matching
+on its children.
+
+To make things worse, the parent pmc node could end up being prematurely
+freed as of_find_node_by_name() drops a reference to its first argument.
+
+Fixes: 3568df3d31d6 ("soc: tegra: Add thermal reset (thermtrip) support to PMC")
+Cc: stable <stable@vger.kernel.org> # 4.0
+Cc: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/soc/tegra/pmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
+index 2d6f3fcf3211..ed71a4c9c8b2 100644
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -1288,7 +1288,7 @@ static void tegra_pmc_init_tsense_reset(struct tegra_pmc *pmc)
+ if (!pmc->soc->has_tsense_reset)
+ return;
+
+- np = of_find_node_by_name(pmc->dev->of_node, "i2c-thermtrip");
++ np = of_get_child_by_name(pmc->dev->of_node, "i2c-thermtrip");
+ if (!np) {
+ dev_warn(dev, "i2c-thermtrip node not found, %s.\n", disabled);
+ return;
+--
+2.19.1
+
diff --git a/patches.drivers/staging-comedi-ni_mio_common-protect-register-write-.patch b/patches.drivers/staging-comedi-ni_mio_common-protect-register-write-.patch
new file mode 100644
index 0000000000..4b20b64143
--- /dev/null
+++ b/patches.drivers/staging-comedi-ni_mio_common-protect-register-write-.patch
@@ -0,0 +1,90 @@
+From 1cbca5852d6c16e85a21487a15d211195aacd4a1 Mon Sep 17 00:00:00 2001
+From: "Spencer E. Olson" <olsonse@umich.edu>
+Date: Wed, 3 Oct 2018 14:54:16 -0600
+Subject: [PATCH] staging: comedi: ni_mio_common: protect register write overflow
+Git-commit: 1cbca5852d6c16e85a21487a15d211195aacd4a1
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Fixes two problems introduced as early as
+commit 03aef4b6dc12 ("Staging: comedi: add ni_mio_common code"):
+(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is
+ not unduly overwritten on e-series devices. On e-series devices, the
+ first three of the last four bits are reserved. The last bit defines
+ the output selection of the RGOUT0 pin, otherwise known as
+ RTSI_Sub_Selection. For m-series devices, these last four bits are
+ indeed used as the output selection of the RTSI7 pin (and the
+ RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the
+ RTSI_Trig_Direction register.
+(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI
+ lines.
+
+This patch also cleans up the ni_get_rtsi_routing command for readability.
+
+Fixes: 03aef4b6dc12 ("Staging: comedi: add ni_mio_common code")
+Signed-off-by: Spencer E. Olson <olsonse@umich.edu>
+Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ .../staging/comedi/drivers/ni_mio_common.c | 24 +++++++++++++------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index 4dee2fc37aed..44fcb3790113 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -4980,7 +4980,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
+ case NI_RTSI_OUTPUT_G_SRC0:
+ case NI_RTSI_OUTPUT_G_GATE0:
+ case NI_RTSI_OUTPUT_RGOUT0:
+- case NI_RTSI_OUTPUT_RTSI_BRD_0:
++ case NI_RTSI_OUTPUT_RTSI_BRD(0):
++ case NI_RTSI_OUTPUT_RTSI_BRD(1):
++ case NI_RTSI_OUTPUT_RTSI_BRD(2):
++ case NI_RTSI_OUTPUT_RTSI_BRD(3):
+ return 1;
+ case NI_RTSI_OUTPUT_RTSI_OSC:
+ return (devpriv->is_m_series) ? 1 : 0;
+@@ -5001,11 +5004,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
+ devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
+ NISTC_RTSI_TRIGA_OUT_REG);
+- } else if (chan < 8) {
++ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
+ devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
+ NISTC_RTSI_TRIGB_OUT_REG);
++ } else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++ /* probably should never reach this, since the
++ * ni_valid_rtsi_output_source above errors out if chan is too
++ * high
++ */
++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++ return -EINVAL;
+ }
+ return 2;
+ }
+@@ -5021,12 +5031,12 @@ static unsigned int ni_get_rtsi_routing(struct comedi_device *dev,
+ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ return NISTC_RTSI_TRIG_TO_SRC(chan,
+ devpriv->rtsi_trig_b_output_reg);
+- } else {
+- if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
+- return NI_RTSI_OUTPUT_RTSI_OSC;
+- dev_err(dev->class_dev, "bug! should never get here?\n");
+- return 0;
++ } else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++ return NI_RTSI_OUTPUT_RTSI_OSC;
+ }
++
++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++ return -EINVAL;
+ }
+
+ static int ni_rtsi_insn_config(struct comedi_device *dev,
+--
+2.19.1
+
diff --git a/patches.fixes/0001-drm-amdgpu-powerplay-fix-missing-break-in-switch-sta.patch b/patches.fixes/0001-drm-amdgpu-powerplay-fix-missing-break-in-switch-sta.patch
new file mode 100644
index 0000000000..e48edf5d75
--- /dev/null
+++ b/patches.fixes/0001-drm-amdgpu-powerplay-fix-missing-break-in-switch-sta.patch
@@ -0,0 +1,101 @@
+From 14b284832e7dea6f54f0adfd7bed105548b94e57 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Mon, 8 Oct 2018 17:22:28 +0100
+Subject: drm/amdgpu/powerplay: fix missing break in switch statements
+Git-commit: 14b284832e7dea6f54f0adfd7bed105548b94e57
+Git-repo: git://anongit.freedesktop.org/drm/drm-misc
+Patch-mainline: Queued in subsystem maintainer repository
+References: bsc#1113722
+
+There are several switch statements that are missing break statements.
+Add missing breaks to handle any fall-throughs corner cases.
+
+Detected by CoverityScan, CID#1457175 ("Missing break in switch")
+
+Backporting notes:
+
+ * applied patch in {fiji,iceland,tonga}_smc.c files
+ * fixed similar bug in polaris10_smc.c
+
+Fixes: 18aafc59b106 ("drm/amd/powerplay: implement fw related smu interface for iceland.")
+Acked-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/amd/powerplay/smumgr/fiji_smc.c | 2 ++
+ drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c | 2 ++
+ drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c | 2 ++
+ drivers/gpu/drm/amd/powerplay/smumgr/tonga_smc.c | 2 ++
+ 4 files changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smc.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smc.c
+@@ -2193,6 +2193,7 @@ uint32_t fiji_get_offsetof(uint32_t type
+ case UcodeLoadStatus:
+ return offsetof(SMU73_SoftRegisters, UcodeLoadStatus);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2204,6 +2205,7 @@ uint32_t fiji_get_offsetof(uint32_t type
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU73_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c
+@@ -2140,11 +2140,13 @@ uint32_t iceland_get_offsetof(uint32_t t
+ case UcodeLoadStatus:
+ return offsetof(SMU71_SoftRegisters, UcodeLoadStatus);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU71_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c
+@@ -2211,6 +2211,7 @@ uint32_t polaris10_get_offsetof(uint32_t
+ case UcodeLoadStatus:
+ return offsetof(SMU74_SoftRegisters, UcodeLoadStatus);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2222,6 +2223,7 @@ uint32_t polaris10_get_offsetof(uint32_t
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU74_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smc.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smc.c
+@@ -2683,6 +2683,7 @@ uint32_t tonga_get_offsetof(uint32_t typ
+ case UcodeLoadStatus:
+ return offsetof(SMU72_SoftRegisters, UcodeLoadStatus);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2694,6 +2695,7 @@ uint32_t tonga_get_offsetof(uint32_t typ
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU72_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
diff --git a/patches.fixes/0001-drm-hisilicon-hibmc-Do-not-carry-error-code-in-HiBMC.patch b/patches.fixes/0001-drm-hisilicon-hibmc-Do-not-carry-error-code-in-HiBMC.patch
new file mode 100644
index 0000000000..97ae2d8eca
--- /dev/null
+++ b/patches.fixes/0001-drm-hisilicon-hibmc-Do-not-carry-error-code-in-HiBMC.patch
@@ -0,0 +1,89 @@
+From 331d880b35a76b5de0eec8cbcecbf615d758a5f9 Mon Sep 17 00:00:00 2001
+From: John Garry <john.garry@huawei.com>
+Date: Sat, 22 Sep 2018 01:25:25 +0800
+Subject: drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer
+ pointer
+Git-commit: 331d880b35a76b5de0eec8cbcecbf615d758a5f9
+Git-repo: git://anongit.freedesktop.org/drm/drm-misc
+Patch-mainline: Queued in subsystem maintainer repository
+References: bsc#1113722
+
+In hibmc_drm_fb_create(), when the call to hibmc_framebuffer_init() fails
+with error, do not store the error code in the HiBMC device frame-buffer
+pointer, as this will be later checked for non-zero value in
+hibmc_fbdev_destroy() when our intention is to check for a valid function
+pointer.
+
+This fixes the following crash:
+[ 9.699791] Unable to handle kernel NULL pointer dereference at virtual address 000000000000001a
+[ 9.708672] Mem abort info:
+[ 9.711489] ESR = 0x96000004
+[ 9.714570] Exception class = DABT (current EL), IL = 32 bits
+[ 9.720551] SET = 0, FnV = 0
+[ 9.723631] EA = 0, S1PTW = 0
+[ 9.726799] Data abort info:
+[ 9.729702] ISV = 0, ISS = 0x00000004
+[ 9.733573] CM = 0, WnR = 0
+[ 9.736566] [000000000000001a] user address but active_mm is swapper
+[ 9.742987] Internal error: Oops: 96000004 [#1] PREEMPT SMP
+[ 9.748614] Modules linked in:
+[ 9.751694] CPU: 16 PID: 293 Comm: kworker/16:1 Tainted: G W 4.19.0-rc4-next-20180920-00001-g9b0012c #322
+[ 9.762681] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT21 Nemo 2.0 RC0 04/18/2018
+[ 9.771915] Workqueue: events work_for_cpu_fn
+[ 9.776312] pstate: 60000005 (nZCv daif -PAN -UAO)
+[ 9.781150] pc : drm_mode_object_put+0x0/0x20
+[ 9.785547] lr : hibmc_fbdev_fini+0x40/0x58
+[ 9.789767] sp : ffff00000af1bcf0
+[ 9.793108] x29: ffff00000af1bcf0 x28: 0000000000000000
+[ 9.798473] x27: 0000000000000000 x26: ffff000008f66630
+[ 9.803838] x25: 0000000000000000 x24: ffff0000095abb98
+[ 9.809203] x23: ffff8017db92fe00 x22: ffff8017d2b13000
+[ 9.814568] x21: ffffffffffffffea x20: ffff8017d2f80018
+[ 9.819933] x19: ffff8017d28a0018 x18: ffffffffffffffff
+[ 9.825297] x17: 0000000000000000 x16: 0000000000000000
+[ 9.830662] x15: ffff0000092296c8 x14: ffff00008939970f
+[ 9.836026] x13: ffff00000939971d x12: ffff000009229940
+[ 9.841391] x11: ffff0000085f8fc0 x10: ffff00000af1b9a0
+[ 9.846756] x9 : 000000000000000d x8 : 6620657a696c6169
+[ 9.852121] x7 : ffff8017d3340580 x6 : ffff8017d4168000
+[ 9.857486] x5 : 0000000000000000 x4 : ffff8017db92fb20
+[ 9.862850] x3 : 0000000000002690 x2 : ffff8017d3340480
+[ 9.868214] x1 : 0000000000000028 x0 : 0000000000000002
+[ 9.873580] Process kworker/16:1 (pid: 293, stack limit = 0x(____ptrval____))
+[ 9.880788] Call trace:
+[ 9.883252] drm_mode_object_put+0x0/0x20
+[ 9.887297] hibmc_unload+0x1c/0x80
+[ 9.890815] hibmc_pci_probe+0x170/0x3c8
+[ 9.894773] local_pci_probe+0x3c/0xb0
+[ 9.898555] work_for_cpu_fn+0x18/0x28
+[ 9.902337] process_one_work+0x1e0/0x318
+[ 9.906382] worker_thread+0x228/0x450
+[ 9.910164] kthread+0x128/0x130
+[ 9.913418] ret_from_fork+0x10/0x18
+[ 9.917024] Code: a94153f3 a8c27bfd d65f03c0 d503201f (f9400c01)
+[ 9.923180] ---[ end trace 2695ffa0af5be375 ]---
+
+Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer")
+Signed-off-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Signed-off-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+index b92595c477ef..8bd29075ae4e 100644
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+@@ -122,6 +122,7 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
+ hi_fbdev->fb = hibmc_framebuffer_init(priv->dev, &mode_cmd, gobj);
+ if (IS_ERR(hi_fbdev->fb)) {
+ ret = PTR_ERR(hi_fbdev->fb);
++ hi_fbdev->fb = NULL;
+ DRM_ERROR("failed to initialize framebuffer: %d\n", ret);
+ goto out_release_fbi;
+ }
+--
+2.19.1
+
diff --git a/patches.fixes/0001-drm-hisilicon-hibmc-Don-t-overwrite-fb-helper-surfac.patch b/patches.fixes/0001-drm-hisilicon-hibmc-Don-t-overwrite-fb-helper-surfac.patch
new file mode 100644
index 0000000000..e9a82d4ec0
--- /dev/null
+++ b/patches.fixes/0001-drm-hisilicon-hibmc-Don-t-overwrite-fb-helper-surfac.patch
@@ -0,0 +1,42 @@
+From 0ff9f49646353ce31312411e7e7bd2281492a40e Mon Sep 17 00:00:00 2001
+From: John Garry <john.garry@huawei.com>
+Date: Sat, 22 Sep 2018 01:25:26 +0800
+Subject: drm/hisilicon: hibmc: Don't overwrite fb helper surface depth
+Git-commit: 0ff9f49646353ce31312411e7e7bd2281492a40e
+Git-repo: git://anongit.freedesktop.org/drm/drm-misc
+Patch-mainline: Queued in subsystem maintainer repository
+References: bsc#1113722
+
+Currently the driver overwrites the surface depth provided by the fb
+helper to give an invalid bpp/surface depth combination.
+
+This has been exposed by commit 70109354fed2 ("drm: Reject unknown legacy
+bpp and depth for drm_mode_addfb ioctl"), which now causes the driver to
+fail to probe.
+
+Fix by not overwriting the surface depth.
+
+Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer")
+Signed-off-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Signed-off-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+index 8bd29075ae4e..edcca1761500 100644
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+@@ -71,7 +71,6 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
+ DRM_DEBUG_DRIVER("surface width(%d), height(%d) and bpp(%d)\n",
+ sizes->surface_width, sizes->surface_height,
+ sizes->surface_bpp);
+- sizes->surface_depth = 32;
+
+ bytes_per_pixel = DIV_ROUND_UP(sizes->surface_bpp, 8);
+
+--
+2.19.1
+
diff --git a/patches.fixes/0001-drm-i915-audio-Hook-up-component-bindings-even-if-di.patch b/patches.fixes/0001-drm-i915-audio-Hook-up-component-bindings-even-if-di.patch
new file mode 100644
index 0000000000..58fce69ed7
--- /dev/null
+++ b/patches.fixes/0001-drm-i915-audio-Hook-up-component-bindings-even-if-di.patch
@@ -0,0 +1,44 @@
+From 35a5fd9ebfa93758ca579e30f337b6c9126d995b Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Fri, 17 Aug 2018 11:02:41 +0100
+Subject: drm/i915/audio: Hook up component bindings even if displays are
+ disabled
+Git-commit: 35a5fd9ebfa93758ca579e30f337b6c9126d995b
+Git-repo: git://anongit.freedesktop.org/drm/drm-misc
+Patch-mainline: Queued in subsystem maintainer repository
+References: bsc#1113722
+
+If the display has been disabled by modparam, we still want to connect
+together the HW bits and bobs with the associated drivers so that we can
+continue to manage their runtime power gating.
+
+Fixes: 108109444ff6 ("drm/i915: Check num_pipes before initializing audio component")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Elaine Wang <elaine.wang@intel.com>
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180817100241.4628-1-chris@chris-wilson.co.uk
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/intel_audio.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
+index bb94172ffc07..f02cb211d3e7 100644
+--- a/drivers/gpu/drm/i915/intel_audio.c
++++ b/drivers/gpu/drm/i915/intel_audio.c
+@@ -960,9 +960,6 @@ void i915_audio_component_init(struct drm_i915_private *dev_priv)
+ {
+ int ret;
+
+- if (INTEL_INFO(dev_priv)->num_pipes == 0)
+- return;
+-
+ ret = component_add(dev_priv->drm.dev, &i915_audio_component_bind_ops);
+ if (ret < 0) {
+ DRM_ERROR("failed to add audio component (%d)\n", ret);
+--
+2.19.1
+
diff --git a/patches.fixes/0001-drm-i915-gen9-Fix-initial-readout-for-Y-tiled-frameb.patch b/patches.fixes/0001-drm-i915-gen9-Fix-initial-readout-for-Y-tiled-frameb.patch
new file mode 100644
index 0000000000..ee7c94ee5b
--- /dev/null
+++ b/patches.fixes/0001-drm-i915-gen9-Fix-initial-readout-for-Y-tiled-frameb.patch
@@ -0,0 +1,91 @@
+From d9a515867bdba59ebf196a6ade10faae8e8be36a Mon Sep 17 00:00:00 2001
+From: Imre Deak <imre.deak@intel.com>
+Date: Tue, 16 Oct 2018 19:00:11 +0300
+Subject: drm/i915/gen9+: Fix initial readout for Y tiled framebuffers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: d9a515867bdba59ebf196a6ade10faae8e8be36a
+Git-repo: git://anongit.freedesktop.org/drm/drm-misc
+Patch-mainline: Queued in subsystem maintainer repository
+References: bsc#1113722
+
+If BIOS configured a Y tiled FB we failed to set up the backing object
+tiling accordingly, leading to a lack of GT fence installed and a
+garbled console.
+
+The problem was bisected to
+commit 011f22eb545a ("drm/i915: Do NOT skip the first 4k of stolen memory for pre-allocated buffers v2")
+but it just revealed a pre-existing issue.
+
+Kudos to Ville who suspected a missing fence looking at the corruption
+on the screen.
+
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: <ronald@innovation.ch>
+Cc: <stable@vger.kernel.org>
+Reported-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reported-by: <ronald@innovation.ch>
+Tested-by: <ronald@innovation.ch>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108264
+Fixes: bc8d7dffacb1 ("drm/i915/skl: Provide a Skylake version of get_plane_config()")
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181016160011.28347-1-imre.deak@intel.com
+(cherry picked from commit 914a4fd8cd28016038ce749a818a836124a8d270)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/intel_display.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2657,6 +2657,17 @@ intel_alloc_initial_plane_obj(struct int
+ if (size_aligned * 2 > dev_priv->stolen_usable_size)
+ return false;
+
++ switch (fb->modifier) {
++ case DRM_FORMAT_MOD_LINEAR:
++ case I915_FORMAT_MOD_X_TILED:
++ case I915_FORMAT_MOD_Y_TILED:
++ break;
++ default:
++ DRM_DEBUG_DRIVER("Unsupported modifier for initial FB: 0x%llx\n",
++ fb->modifier);
++ return false;
++ }
++
+ mutex_lock(&dev->struct_mutex);
+ obj = i915_gem_object_create_stolen_for_preallocated(dev_priv,
+ base_aligned,
+@@ -2666,8 +2677,17 @@ intel_alloc_initial_plane_obj(struct int
+ if (!obj)
+ return false;
+
+- if (plane_config->tiling == I915_TILING_X)
+- obj->tiling_and_stride = fb->pitches[0] | I915_TILING_X;
++ switch (plane_config->tiling) {
++ case I915_TILING_NONE:
++ break;
++ case I915_TILING_X:
++ case I915_TILING_Y:
++ obj->tiling_and_stride = fb->pitches[0] | plane_config->tiling;
++ break;
++ default:
++ MISSING_CASE(plane_config->tiling);
++ return false;
++ }
+
+ mode_cmd.pixel_format = fb->format->format;
+ mode_cmd.width = fb->width;
+@@ -8520,6 +8540,7 @@ skylake_get_initial_plane_config(struct
+ fb->modifier = I915_FORMAT_MOD_X_TILED;
+ break;
+ case PLANE_CTL_TILED_Y:
++ plane_config->tiling = I915_TILING_Y;
+ if (val & PLANE_CTL_DECOMPRESSION_ENABLE)
+ fb->modifier = I915_FORMAT_MOD_Y_TILED_CCS;
+ else
diff --git a/patches.fixes/0001-drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch b/patches.fixes/0001-drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
new file mode 100644
index 0000000000..27cb2c1653
--- /dev/null
+++ b/patches.fixes/0001-drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
@@ -0,0 +1,55 @@
+From 66e31a72dc38543b2d9d1ce267dc78ba9beebcfd Mon Sep 17 00:00:00 2001
+From: Peter Rosin <peda@axentia.se>
+Date: Mon, 6 Aug 2018 08:19:09 +0200
+Subject: drm/sti: do not remove the drm_bridge that was never added
+Git-commit: 66e31a72dc38543b2d9d1ce267dc78ba9beebcfd
+Git-repo: git://anongit.freedesktop.org/drm/drm-misc
+Patch-mainline: Queued in subsystem maintainer repository
+References: bsc#1113722
+
+Removing the drm_bridge_remove call should avoid a NULL dereference
+during list processing in drm_bridge_remove if the error path is ever
+taken.
+
+The more natural approach would perhaps be to add a drm_bridge_add,
+but there are several other bridges that never call drm_bridge_add.
+Just removing the drm_bridge_remove is the easier fix.
+
+Fixes: 84601dbdea36 ("drm: sti: rework init sequence")
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180806061910.29914-2-peda@axentia.se
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/sti/sti_hda.c | 1 -
+ drivers/gpu/drm/sti/sti_hdmi.c | 1 -
+ 2 files changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
+index 49438337f70d..19b9b5ed1297 100644
+--- a/drivers/gpu/drm/sti/sti_hda.c
++++ b/drivers/gpu/drm/sti/sti_hda.c
+@@ -721,7 +721,6 @@ static int sti_hda_bind(struct device *dev, struct device *master, void *data)
+ return 0;
+
+ err_sysfs:
+- drm_bridge_remove(bridge);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
+index 34cdc4644435..ccf718404a1c 100644
+--- a/drivers/gpu/drm/sti/sti_hdmi.c
++++ b/drivers/gpu/drm/sti/sti_hdmi.c
+@@ -1315,7 +1315,6 @@ static int sti_hdmi_bind(struct device *dev, struct device *master, void *data)
+ return 0;
+
+ err_sysfs:
+- drm_bridge_remove(bridge);
+ hdmi->drm_connector = NULL;
+ return -EINVAL;
+ }
+--
+2.19.1
+
diff --git a/patches.fixes/0001-drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch b/patches.fixes/0001-drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
new file mode 100644
index 0000000000..f12f9191bf
--- /dev/null
+++ b/patches.fixes/0001-drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
@@ -0,0 +1,55 @@
+From 09c4b49457434fa74749ad6194ef28464d9f5df9 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 4 Jul 2018 12:42:50 +0300
+Subject: drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
+Git-commit: 09c4b49457434fa74749ad6194ef28464d9f5df9
+Git-repo: git://anongit.freedesktop.org/drm/drm-misc
+Patch-mainline: Queued in subsystem maintainer repository
+References: bsc#1113722
+
+This doesn't affect runtime because in the current code "idx" is always
+valid.
+
+First, we read from "vgdev->capsets[idx].max_size" before checking
+whether "idx" is within bounds. And secondly the bounds check is off by
+one so we could end up reading one element beyond the end of the
+vgdev->capsets[] array.
+
+Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20180704094250.m7sgvvzg3dhcvv3h@kili.mountain
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/virtio/virtgpu_vq.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index 020070d483d3..4735bd1c7321 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -648,11 +648,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ {
+ struct virtio_gpu_get_capset *cmd_p;
+ struct virtio_gpu_vbuffer *vbuf;
+- int max_size = vgdev->capsets[idx].max_size;
++ int max_size;
+ struct virtio_gpu_drv_cap_cache *cache_ent;
+ void *resp_buf;
+
+- if (idx > vgdev->num_capsets)
++ if (idx >= vgdev->num_capsets)
+ return -EINVAL;
+
+ if (version > vgdev->capsets[idx].max_version)
+@@ -662,6 +662,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ if (!cache_ent)
+ return -ENOMEM;
+
++ max_size = vgdev->capsets[idx].max_size;
+ cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL);
+ if (!cache_ent->caps_cache) {
+ kfree(cache_ent);
+--
+2.19.1
+
diff --git a/patches.fixes/fs-aio-fix-the-increment-of-aio-nr-and-counting-agai.patch b/patches.fixes/fs-aio-fix-the-increment-of-aio-nr-and-counting-agai.patch
index b7f8953929..57863c3817 100644
--- a/patches.fixes/fs-aio-fix-the-increment-of-aio-nr-and-counting-agai.patch
+++ b/patches.fixes/fs-aio-fix-the-increment-of-aio-nr-and-counting-agai.patch
@@ -3,7 +3,7 @@ Date: Wed, 5 Jul 2017 10:53:16 -0300
Subject: fs: aio: fix the increment of aio-nr and counting against aio-max-nr
Patch-mainline: v4.14-rc1
Git-commit: 2a8a98673c13cb2a61a6476153acf8344adfa992
-References: bsc#1068075, bsc#1078921
+References: bsc#1068075, bsc#1078921, bsc#1104124
Currently, aio-nr is incremented in steps of 'num_possible_cpus() * 8'
for io_setup(nr_events, ..) with 'nr_events < num_possible_cpus() * 4':
diff --git a/patches.suse/Kbuild-fix-escaping-in-.cmd-files-for-future-Make.patch b/patches.suse/Kbuild-fix-escaping-in-.cmd-files-for-future-Make.patch
new file mode 100644
index 0000000000..402e8eb7b6
--- /dev/null
+++ b/patches.suse/Kbuild-fix-escaping-in-.cmd-files-for-future-Make.patch
@@ -0,0 +1,122 @@
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Date: Sun, 8 Apr 2018 23:35:28 +0200
+Subject: Kbuild: fix # escaping in .cmd files for future Make
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 9564a8cf422d7b58f6e857e3546d346fa970191e
+Patch-mainline: v4.17-rc1
+References: git-fixes
+
+I tried building using a freshly built Make (4.2.1-69-g8a731d1), but
+already the objtool build broke with
+
+orc_dump.c: In function ‘orc_dump’:
+orc_dump.c:106:2: error: ‘elf_getshnum’ is deprecated [-Werror=deprecated-declarations]
+ if (elf_getshdrnum(elf, &nr_sections)) {
+
+Turns out that with that new Make, the backslash was not removed, so cpp
+didn't see a #include directive, grep found nothing, and
+-DLIBELF_USE_DEPRECATED was wrongly put in CFLAGS.
+
+Now, that new Make behaviour is documented in their NEWS file:
+
+ * WARNING: Backward-incompatibility!
+ Number signs (#) appearing inside a macro reference or function invocation
+ no longer introduce comments and should not be escaped with backslashes:
+ thus a call such as:
+ foo := $(shell echo '#')
+ is legal. Previously the number sign needed to be escaped, for example:
+ foo := $(shell echo '\#')
+ Now this latter will resolve to "\#". If you want to write makefiles
+ portable to both versions, assign the number sign to a variable:
+ C := \#
+ foo := $(shell echo '$C')
+ This was claimed to be fixed in 3.81, but wasn't, for some reason.
+ To detect this change search for 'nocomment' in the .FEATURES variable.
+
+This also fixes up the two make-cmd instances to replace # with $(pound)
+rather than with \#. There might very well be other places that need
+similar fixup in preparation for whatever future Make release contains
+the above change, but at least this builds an x86_64 defconfig with the
+new make.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=197847
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ scripts/Kbuild.include | 5 +++--
+ tools/build/Build.include | 5 +++--
+ tools/objtool/Makefile | 2 +-
+ tools/scripts/Makefile.include | 2 ++
+ 4 files changed, 9 insertions(+), 5 deletions(-)
+
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -8,6 +8,7 @@ squote := '
+ empty :=
+ space := $(empty) $(empty)
+ space_escape := _-_SPACE_-_
++pound := \#
+
+ ###
+ # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o
+@@ -245,11 +246,11 @@ endif
+
+ # Replace >$< with >$$< to preserve $ when reloading the .cmd file
+ # (needed for make)
+-# Replace >#< with >\#< to avoid starting a comment in the .cmd file
++# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file
+ # (needed for make)
+ # Replace >'< with >'\''< to be able to enclose the whole string in '...'
+ # (needed for the shell)
+-make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1)))))
++make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1)))))
+
+ # Find any prerequisites that is newer than target or that does not exist.
+ # PHONY targets skipped in both cases.
+--- a/tools/build/Build.include
++++ b/tools/build/Build.include
+@@ -12,6 +12,7 @@
+ # Convenient variables
+ comma := ,
+ squote := '
++pound := \#
+
+ ###
+ # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o
+@@ -43,11 +44,11 @@ echo-cmd = $(if $($(quiet)cmd_$(1)),\
+ ###
+ # Replace >$< with >$$< to preserve $ when reloading the .cmd file
+ # (needed for make)
+-# Replace >#< with >\#< to avoid starting a comment in the .cmd file
++# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file
+ # (needed for make)
+ # Replace >'< with >'\''< to be able to enclose the whole string in '...'
+ # (needed for the shell)
+-make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1)))))
++make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1)))))
+
+ ###
+ # Find any prerequisites that is newer than target or that does not exist.
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -33,7 +33,7 @@ CFLAGS += -Wall -Werror $(EXTRA_WARNIN
+ LDFLAGS += -lelf $(LIBSUBCMD)
+
+ # Allow old libelf to be used:
+-elfshdr := $(shell echo '\#include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr)
++elfshdr := $(shell echo '$(pound)include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr)
+ CFLAGS += $(if $(elfshdr),,-DLIBELF_USE_DEPRECATED)
+
+ AWK = awk
+--- a/tools/scripts/Makefile.include
++++ b/tools/scripts/Makefile.include
+@@ -104,3 +104,5 @@ ifneq ($(silent),1)
+ QUIET_INSTALL = @printf ' INSTALL %s\n' $1;
+ endif
+ endif
++
++pound := \#
diff --git a/patches.suse/random-rate-limit-unseeded-randomness-warnings.patch b/patches.suse/random-rate-limit-unseeded-randomness-warnings.patch
new file mode 100644
index 0000000000..31e82d03fb
--- /dev/null
+++ b/patches.suse/random-rate-limit-unseeded-randomness-warnings.patch
@@ -0,0 +1,89 @@
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 25 Apr 2018 01:12:32 -0400
+Subject: random: rate limit unseeded randomness warnings
+Git-commit: 4e00b339e264802851aff8e73cde7d24b57b18ce
+Patch-mainline: v4.17-rc3
+References: git-fixes
+
+On systems without sufficient boot randomness, no point spamming dmesg.
+
+[js] dropped hunk for unseeded_warning as it is not built anyway
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/char/random.c | 34 +++++++++++++++++++++++++++++++---
+ 1 file changed, 31 insertions(+), 3 deletions(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -262,6 +262,7 @@
+ #include <linux/kmemcheck.h>
+ #include <linux/workqueue.h>
+ #include <linux/irq.h>
++#include <linux/ratelimit.h>
+ #include <linux/syscalls.h>
+ #include <linux/completion.h>
+ #include <linux/uuid.h>
+@@ -439,6 +440,16 @@ static void _crng_backtrack_protect(stru
+ __u8 tmp[CHACHA20_BLOCK_SIZE], int used);
+ static void process_random_ready_list(void);
+
++static struct ratelimit_state unseeded_warning =
++ RATELIMIT_STATE_INIT("warn_unseeded_randomness", HZ, 3);
++static struct ratelimit_state urandom_warning =
++ RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3);
++
++static int ratelimit_disable __read_mostly;
++
++module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
++MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
++
+ /**********************************************************************
+ *
+ * OS independent entropy store. Here are the functions which handle
+@@ -932,6 +943,18 @@ static void crng_reseed(struct crng_stat
+ process_random_ready_list();
+ wake_up_interruptible(&crng_init_wait);
+ pr_notice("random: crng init done\n");
++ if (unseeded_warning.missed) {
++ pr_notice("random: %d get_random_xx warning(s) missed "
++ "due to ratelimiting\n",
++ unseeded_warning.missed);
++ unseeded_warning.missed = 0;
++ }
++ if (urandom_warning.missed) {
++ pr_notice("random: %d urandom warning(s) missed "
++ "due to ratelimiting\n",
++ urandom_warning.missed);
++ urandom_warning.missed = 0;
++ }
+ }
+ }
+
+@@ -1743,6 +1766,10 @@ static int rand_initialize(void)
+ init_std_data(&blocking_pool);
+ crng_initialize(&primary_crng);
+ crng_global_init_time = jiffies;
++ if (ratelimit_disable) {
++ urandom_warning.interval = 0;
++ unseeded_warning.interval = 0;
++ }
+ return 0;
+ }
+ early_initcall(rand_initialize);
+@@ -1810,9 +1837,10 @@ urandom_read(struct file *file, char __u
+
+ if (!crng_ready() && maxwarn > 0) {
+ maxwarn--;
+- printk(KERN_NOTICE "random: %s: uninitialized urandom read "
+- "(%zd bytes read)\n",
+- current->comm, nbytes);
++ if (__ratelimit(&urandom_warning))
++ printk(KERN_NOTICE "random: %s: uninitialized "
++ "urandom read (%zd bytes read)\n",
++ current->comm, nbytes);
+ spin_lock_irqsave(&primary_crng.lock, flags);
+ crng_init_cnt = 0;
+ spin_unlock_irqrestore(&primary_crng.lock, flags);
diff --git a/patches.suse/tools-build-fix-escaping-in-.cmd-files-for-future-Ma.patch b/patches.suse/tools-build-fix-escaping-in-.cmd-files-for-future-Ma.patch
new file mode 100644
index 0000000000..7a5794e599
--- /dev/null
+++ b/patches.suse/tools-build-fix-escaping-in-.cmd-files-for-future-Ma.patch
@@ -0,0 +1,57 @@
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+Date: Tue, 5 Jun 2018 19:00:22 +0200
+Subject: tools build: fix # escaping in .cmd files for future Make
+Git-commit: 9feeb638cde083c737e295c0547f1b4f28e99583
+Patch-mainline: v4.18-rc5
+References: git-fixes
+
+In 2016 GNU Make made a backwards incompatible change to the way '#'
+characters were handled in Makefiles when used inside functions or
+macros:
+
+http://git.savannah.gnu.org/cgit/make.git/commit/?id=c6966b323811c37acedff05b57
+
+Due to this change, when attempting to run `make prepare' I get a
+spurious make syntax error:
+
+ /home/earnest/linux/tools/objtool/.fixdep.o.cmd:1: *** missing separator. Stop.
+
+When inspecting `.fixdep.o.cmd' it includes two lines which use
+unescaped comment characters at the top:
+
+ \# cannot find fixdep (/home/earnest/linux/tools/objtool//fixdep)
+ \# using basic dep data
+
+This is because `tools/build/Build.include' prints these '\#'
+characters:
+
+ printf '\# cannot find fixdep (%s)\n' $(fixdep) > $(dot-target).cmd; \
+ printf '\# using basic dep data\n\n' >> $(dot-target).cmd; \
+
+This completes commit 9564a8cf422d ("Kbuild: fix # escaping in .cmd files
+for future Make").
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=197847
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ tools/build/Build.include | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/build/Build.include
++++ b/tools/build/Build.include
+@@ -63,8 +63,8 @@ dep-cmd = $(if $(wildcard $(fixdep)),
+ $(fixdep) $(depfile) $@ '$(make-cmd)' > $(dot-target).tmp; \
+ rm -f $(depfile); \
+ mv -f $(dot-target).tmp $(dot-target).cmd, \
+- printf '\# cannot find fixdep (%s)\n' $(fixdep) > $(dot-target).cmd; \
+- printf '\# using basic dep data\n\n' >> $(dot-target).cmd; \
++ printf '$(pound) cannot find fixdep (%s)\n' $(fixdep) > $(dot-target).cmd; \
++ printf '$(pound) using basic dep data\n\n' >> $(dot-target).cmd; \
+ cat $(depfile) >> $(dot-target).cmd; \
+ printf '\n%s\n' 'cmd_$@ := $(make-cmd)' >> $(dot-target).cmd)
+
diff --git a/scripts/git_sort/git_sort.py b/scripts/git_sort/git_sort.py
index 05f20ed542..abdf30573f 100755
--- a/scripts/git_sort/git_sort.py
+++ b/scripts/git_sort/git_sort.py
@@ -188,6 +188,7 @@ remotes = (
Head(RepoURL("tj/libata.git"), "for-next"),
Head(RepoURL("https://github.com/kdave/btrfs-devel.git"), "misc-next"),
Head(RepoURL("git://people.freedesktop.org/~airlied/linux"), "drm-next"),
+ Head(RepoURL("git://anongit.freedesktop.org/drm/drm-misc"), "drm-misc-next"),
Head(RepoURL("gregkh/tty.git"), "tty-next"),
Head(RepoURL("jj/linux-apparmor.git"), "apparmor-next"),
Head(RepoURL("pablo/nf.git")),
@@ -443,7 +444,7 @@ class Cache(object):
# This detailed check may be needed if an older git-sort (which
# didn't set a cache version) modified the cache.
if (not isinstance(cache_history, list) or
- len(cache_history) < 1 or
+ len(cache_history) < 1 or
len(cache_history[0]) != 4 or
not isinstance(cache_history[0][3], dict)):
raise CInconsistent
diff --git a/scripts/series2git b/scripts/series2git
index defcb51574..e62ccc7e02 100755
--- a/scripts/series2git
+++ b/scripts/series2git
@@ -200,7 +200,7 @@ apply_patch()
GIT_AUTHOR_EMAIL=
;;
esac
- local subject=$(ex_hdr Subject "$patch")
+ local subject=$(ex_hdr Subject "$patch" | sed -es'/\[[^]]*\] //')
GIT_AUTHOR_DATE=$(ex_hdr Date "$patch")
GIT_AUTHOR_DATE=$(ex_hdr Date "$patch" \
| perl -p -e 's/(\d\d:\d\d:\d\d) (\d{4})/$2 $1/;s/:$//')
diff --git a/series.conf b/series.conf
index 162e981df8..54422b4a26 100644
--- a/series.conf
+++ b/series.conf
@@ -15119,6 +15119,7 @@
patches.fixes/0001-sched-rt-Fix-rq-clock_update_flags-RQCF_ACT_SKIP-war.patch
patches.arch/x86-mm-do-not-forbid-page_rw-before-init-for-_ro_after_init
patches.arch/x86-pgtable-don-t-set-huge-pud-pmd-on-non-leaf-entries
+ patches.suse/Kbuild-fix-escaping-in-.cmd-files-for-future-Make.patch
patches.drivers/scsi-qla2xxx-Fix-small-memory-leak-in-qla2x00_probe_.patch
patches.fixes/scsi-qla2xxx-avoid-double-completion-of-abort-command.patch
patches.drivers/scsi-qla2xxx-Fix-race-condition-between-iocb-timeout.patch
@@ -15236,6 +15237,7 @@
patches.arch/s390-dasd-fix-IO-error-for-newly-defined-devices.patch
patches.arch/s390-correct-module-section-names-for-expoline-code.patch
patches.drivers/random-fix-possible-sleeping-allocation-from-irq-con
+ patches.suse/random-rate-limit-unseeded-randomness-warnings.patch
patches.drivers/ACPI-scan-Initialize-watchdog-before-PNP.patch
patches.drivers/ACPI-watchdog-Prefer-iTCO_wdt-on-Lenovo-Z50-70
patches.drivers/ACPI-button-make-module-loadable-when-booted-in-non-
@@ -16921,6 +16923,7 @@
patches.drivers/ALSA-hda-Handle-pm-failure-during-hotplug
patches.drivers/ALSA-hda-realtek-two-more-lenovo-models-need-fixup-o
patches.arch/ARM-8780-1-ftrace-Only-set-kernel-memory-back-to-rea.patch
+ patches.suse/tools-build-fix-escaping-in-.cmd-files-for-future-Ma.patch
patches.drivers/iw_cxgb4-correctly-enforce-the-max-reg_mr-depth.patch
patches.drivers/RDMA-uverbs-Protect-from-attempts-to-create-flows-on.patch
patches.drivers/IB-hfi1-Fix-incorrect-mixing-of-ERR_PTR-and-NULL-ret.patch
@@ -18288,6 +18291,25 @@
patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch
patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID
+ patches.drivers/drm-i915-Restore-vblank-interrupts-earlier.patch
+ patches.drivers/drm-i915-dp-Link-train-Fallback-on-eDP-only-if-fallb.patch
+ patches.drivers/iio-adc-imx25-gcq-Fix-leak-of-device_node-in-mx25_gc.patch
+ patches.drivers/iio-adc-at91-fix-acking-DRDY-irq-on-simple-conversio.patch
+ patches.drivers/iio-adc-at91-fix-wrong-channel-number-in-triggered-b.patch
+ patches.drivers/staging-comedi-ni_mio_common-protect-register-write-.patch
+ patches.drivers/serial-8250-Fix-clearing-FIFOs-in-RS485-mode-again.patch
+ patches.drivers/media-uvcvideo-Fix-uvc_alloc_entity-allocation-align.patch
+ patches.drivers/media-dvb-fix-compat-ioctl-translation.patch
+ patches.drivers/media-tvp5150-avoid-going-past-array-on-v4l2_queryme.patch
+ patches.drivers/media-em28xx-use-a-default-format-if-TRY_FMT-fails.patch
+ patches.drivers/media-em28xx-fix-input-name-for-Terratec-AV-350.patch
+ patches.drivers/media-tvp5150-fix-width-alignment-during-set_selecti.patch
+ patches.drivers/media-tvp5150-fix-switch-exit-in-set-control-handler.patch
+ patches.drivers/media-vsp1-Fix-YCbCr-planar-formats-pitch-calculatio.patch
+ patches.drivers/media-pci-cx23885-handle-adding-to-list-failure.patch
+ patches.drivers/media-cx231xx-fix-potential-sign-extension-overflow-.patch
+ patches.drivers/media-v4l2-tpg-fix-kernel-oops-when-enabling-HFLIP-a.patch
+ patches.drivers/soc-tegra-pmc-Fix-child-node-lookup.patch
# dhowells/linux-fs keys-uefi
patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
@@ -18297,7 +18319,19 @@
patches.suse/0005-MODSIGN-Allow-the-db-UEFI-variable-to-be-suppressed.patch
patches.suse/0006-modsign-Use-secondary-trust-keyring-for-module-signi.patch
+ # git://anongit.freedesktop.org/drm/drm-misc.git drm-misc-next
+ patches.fixes/0001-drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
+ patches.fixes/0001-drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
+ patches.fixes/0001-drm-i915-audio-Hook-up-component-bindings-even-if-di.patch
+ patches.fixes/0001-drm-hisilicon-hibmc-Do-not-carry-error-code-in-HiBMC.patch
+ patches.fixes/0001-drm-hisilicon-hibmc-Don-t-overwrite-fb-helper-surfac.patch
+ patches.fixes/0001-drm-amdgpu-powerplay-fix-missing-break-in-switch-sta.patch
+ patches.fixes/0001-drm-i915-gen9-Fix-initial-readout-for-Y-tiled-frameb.patch
+
# out-of-tree patches
+ ########################################################
+ # end of sorted patches
+ ########################################################
patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch
patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch
patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch
@@ -18309,9 +18343,6 @@
patches.fixes/0001-Revert-mm-vmacache-optimize-overflow-system-wide-flu.patch
patches.fixes/nfs-set-acl-perm.patch
- ########################################################
- # end of sorted patches
- ########################################################
########################################################
#