Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohannes Thumshirn <jthumshirn@suse.de>2018-10-11 08:50:50 +0200
committerJohannes Thumshirn <jthumshirn@suse.de>2018-10-11 09:36:25 +0200
commit40bbe7889b389fc518553455600980883e92ada4 (patch)
tree467222ba78aeb274827822d9266cafa0fcc03532
parentc36fc6bb15f74f12f22f5f88d32261f8cf2a0407 (diff)
parent987dd44700b00284bef06156b0cecf93fe88813b (diff)
Merge remote-tracking branch 'origin/SLE15' into SLE12-SP4
Conflicts: series.conf
-rw-r--r--blacklist.conf8
-rw-r--r--patches.drivers/ALSA-hda-realtek-Cannot-adjust-speaker-s-volume-on-D.patch38
-rw-r--r--patches.drivers/HID-add-support-for-Apple-Magic-Keyboards.patch82
-rw-r--r--patches.drivers/HID-hid-saitek-Add-device-ID-for-RAT-7-Contagion.patch45
-rw-r--r--patches.drivers/PM-Domains-Fix-genpd-to-deal-with-drivers-returning-.patch58
-rw-r--r--patches.drivers/Revert-drm-amdgpu-Add-an-ATPX-quirk-for-hybrid-lapto.patch38
-rw-r--r--patches.drivers/Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-eDP4
-rw-r--r--patches.drivers/Revert-drm-i915-gvt-set-max-priority-for-gvt-context.patch39
-rw-r--r--patches.drivers/Revert-drm-radeon-pm-autoswitch-power-state-when-in-1
-rw-r--r--patches.drivers/Revert-gpio-set-up-initial-state-from-.get_direction.patch70
-rw-r--r--patches.drivers/Revert-mwifiex-fix-incorrect-ht-capability-problem.patch91
-rw-r--r--patches.drivers/Revert-mwifiex-handle-race-during-mwifiex_usb_discon.patch38
-rw-r--r--patches.drivers/Revert-pinctrl-sunxi-Don-t-enforce-bias-disable-for-.patch40
-rw-r--r--patches.drivers/cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch45
-rw-r--r--patches.drivers/crypto-mxs-dcp-Fix-wait-logic-on-chan-threads.patch158
-rw-r--r--patches.drivers/crypto-qat-Fix-KASAN-stack-out-of-bounds-bug-in-adf_.patch233
-rw-r--r--patches.drivers/drm-amdgpu-Pulling-old-prepare-and-submit-for-flip-b.patch226
-rw-r--r--patches.drivers/drm-amdgpu-add-another-ATPX-quirk-for-TOPAZ.patch35
-rw-r--r--patches.drivers/drm-amdgpu-revert-fix-deadlock-of-reservation-betwee.patch58
-rw-r--r--patches.drivers/drm-nouveau-TBDdevinit-don-t-fail-when-PMU-PRE_OS-is.patch37
-rw-r--r--patches.drivers/drm-nouveau-disp-fix-DP-disable-race.patch118
-rw-r--r--patches.drivers/floppy-Do-not-copy-a-kernel-pointer-to-user-memory-i.patch52
-rw-r--r--patches.drivers/gpio-Fix-crash-due-to-registration-race.patch72
-rw-r--r--patches.drivers/gpio-adp5588-Fix-sleep-in-atomic-context-bug.patch80
-rw-r--r--patches.drivers/gpio-mb86s70-Revert-Return-error-if-requesting-an-al.patch47
-rw-r--r--patches.drivers/gpiolib-acpi-Register-GpioInt-ACPI-event-handlers-fr.patch201
-rw-r--r--patches.drivers/hwmon-adt7475-Make-adt7475_read_word-return-errors.patch51
-rw-r--r--patches.drivers/hwmon-ina2xx-fix-sysfs-shunt-resistor-read-access.patch90
-rw-r--r--patches.drivers/media-videobuf-dma-sg-Fix-dma_-sync-unmap-_sg-calls.patch56
-rw-r--r--patches.drivers/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch57
-rw-r--r--patches.drivers/revert-iommu-io-pgtable-avoid-redundant-tlb-syncs73
-rw-r--r--patches.fixes/mac80211-Fix-station-bandwidth-setting-after-channel.patch108
-rw-r--r--patches.fixes/mac80211-Run-TXQ-teardown-code-before-de-registering.patch50
-rw-r--r--patches.fixes/mac80211-correct-use-of-IEEE80211_VHT_CAP_RXSTBC_X.patch41
-rw-r--r--patches.fixes/mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch50
-rw-r--r--patches.fixes/mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch91
-rw-r--r--patches.fixes/mac80211-fix-a-race-between-restart-and-CSA-flows.patch100
-rw-r--r--patches.fixes/mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch40
-rw-r--r--patches.fixes/mac80211-shorten-the-IBSS-debug-messages.patch82
-rw-r--r--patches.fixes/mac80211_hwsim-correct-use-of-IEEE80211_VHT_CAP_RXST.patch39
-rw-r--r--patches.fixes/mac80211_hwsim-require-at-least-one-channel.patch39
-rw-r--r--patches.suse/msft-hv-1588-x86-hyperv-Check-for-required-priviliges-in-hyperv_i.patch (renamed from patches.arch/x86-hyperv-check-for-required-priviliges-in-hyperv_init)0
-rw-r--r--patches.suse/msft-hv-1677-x86-Delay-skip-of-emulated-hypercall-instruction.patch (renamed from patches.arch/x86-delay-skip-of-emulated-hypercall-instruction)0
-rw-r--r--patches.suse/msft-hv-1696-KVM-x86-fix-UD-address-of-failed-Hyper-V-hypercalls.patch (renamed from patches.arch/kvm-x86-fix-ud-address-of-failed-hyper-v-hypercalls)0
-rw-r--r--series.conf46
45 files changed, 2921 insertions, 6 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 0ac946bbc6..b28b2932bb 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -510,3 +510,11 @@ d0a8d9378d16eb3c69bd8e6d23779fbdbee3a8c7 # Breaks build
cc51e5428ea54f575d49cfcede1d4cb3a72b4ec4 # Warning fix only, breaks kABI
c685af1108d7c303f0b901413405d68eaeac4477 # serial/mvebu-uart: not buildable
e0bf2d4982fe7d9ddaf550dd023803ea286f47fc # serial/mvebu-uart: not applicable
+ca26cffa4e4aaeb09bb9e308f95c7835cb149248 # might break bpf clang target
+65099ea85e885c3ea1272eca8774b771419d8ce8 # iio: revert: not applicable
+07fb3299adc40b2e87bbe7047b7b1614deae0d05 # iwlwifi: revert: not applicable
+12f92866f13f9ca12e158c07978246ed83d52ed0 # media: revert: not applicable
+99fb0f25c448ab72481bd700b66e0e48c583ef5a # mfd: cros_ec: not applicable
+a81d1ab3cad77e20c2df8baef0a35a4980fc511c # nfc: revert: not applicable
+1051e2c304b5cf17d4117505985f8128c5c64fd9 # devfreq: revert: need rest series
+c2ef60fea2dc7f903450926aee1f9c282ea529ca # xhci: revert: no fixes backported
diff --git a/patches.drivers/ALSA-hda-realtek-Cannot-adjust-speaker-s-volume-on-D.patch b/patches.drivers/ALSA-hda-realtek-Cannot-adjust-speaker-s-volume-on-D.patch
new file mode 100644
index 0000000000..88ed2a586e
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Cannot-adjust-speaker-s-volume-on-D.patch
@@ -0,0 +1,38 @@
+From 709ae62e8e6d9ac4df7dadb3b8ae432675c45ef9 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Thu, 4 Oct 2018 11:39:42 +0800
+Subject: [PATCH] ALSA: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760
+Git-commit: 709ae62e8e6d9ac4df7dadb3b8ae432675c45ef9
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+The issue is the same as commit dd9aa335c880 ("ALSA: hda/realtek - Can't
+adjust speaker's volume on a Dell AIO"), the output requires to connect
+to a node with Amp-out capability.
+
+Applying the same fixup ALC298_FIXUP_SPK_VOLUME can fix the issue.
+
+Buglink: https://bugs.launchpad.net/bugs/1775068
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1d117f00d04d..3ac7ba9b342d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6409,6 +6409,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
++ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
+ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+--
+2.18.0
+
diff --git a/patches.drivers/HID-add-support-for-Apple-Magic-Keyboards.patch b/patches.drivers/HID-add-support-for-Apple-Magic-Keyboards.patch
new file mode 100644
index 0000000000..436fbb3671
--- /dev/null
+++ b/patches.drivers/HID-add-support-for-Apple-Magic-Keyboards.patch
@@ -0,0 +1,82 @@
+From ee345492437043a79db058a3d4f029ebcb52089a Mon Sep 17 00:00:00 2001
+From: Sean O'Brien <seobrien@chromium.org>
+Date: Mon, 27 Aug 2018 13:02:15 -0700
+Subject: [PATCH] HID: add support for Apple Magic Keyboards
+Git-commit: ee345492437043a79db058a3d4f029ebcb52089a
+Patch-mainline: v4.19-rc4
+References: bsc#1051510
+
+USB device
+ Vendor 05ac (Apple)
+ Device 026c (Magic Keyboard with Numeric Keypad)
+
+Bluetooth devices
+ Vendor 004c (Apple)
+ Device 0267 (Magic Keyboard)
+ Device 026c (Magic Keyboard with Numeric Keypad)
+
+Support already exists for the Magic Keyboard over USB connection.
+Add support for the Magic Keyboard over Bluetooth connection, and for
+the Magic Keyboard with Numeric Keypad over Bluetooth and USB
+connection.
+
+Signed-off-by: Sean O'Brien <seobrien@chromium.org>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/hid-apple.c | 9 ++++++++-
+ drivers/hid/hid-ids.h | 2 ++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 25b7bd56ae11..1cb41992aaa1 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -335,7 +335,8 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ struct hid_field *field, struct hid_usage *usage,
+ unsigned long **bit, int *max)
+ {
+- if (usage->hid == (HID_UP_CUSTOM | 0x0003)) {
++ if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
++ usage->hid == (HID_UP_MSVENDOR | 0x0003)) {
+ /* The fn key on Apple USB keyboards */
+ set_bit(EV_REP, hi->input->evbit);
+ hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
+@@ -472,6 +473,12 @@ static const struct hid_device_id apple_devices[] = {
+ .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI),
+ .driver_data = APPLE_HAS_FN },
++ { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI),
++ .driver_data = APPLE_HAS_FN },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI),
++ .driver_data = APPLE_HAS_FN },
++ { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI),
++ .driver_data = APPLE_HAS_FN },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ANSI),
+ .driver_data = APPLE_HAS_FN },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING_ISO),
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 34367df61b28..cb2d3170d9dc 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -88,6 +88,7 @@
+ #define USB_DEVICE_ID_ANTON_TOUCH_PAD 0x3101
+
+ #define USB_VENDOR_ID_APPLE 0x05ac
++#define BT_VENDOR_ID_APPLE 0x004c
+ #define USB_DEVICE_ID_APPLE_MIGHTYMOUSE 0x0304
+ #define USB_DEVICE_ID_APPLE_MAGICMOUSE 0x030d
+ #define USB_DEVICE_ID_APPLE_MAGICTRACKPAD 0x030e
+@@ -157,6 +158,7 @@
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO 0x0256
+ #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_JIS 0x0257
+ #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI 0x0267
++#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI 0x026c
+ #define USB_DEVICE_ID_APPLE_WELLSPRING8_ANSI 0x0290
+ #define USB_DEVICE_ID_APPLE_WELLSPRING8_ISO 0x0291
+ #define USB_DEVICE_ID_APPLE_WELLSPRING8_JIS 0x0292
+--
+2.18.0
+
diff --git a/patches.drivers/HID-hid-saitek-Add-device-ID-for-RAT-7-Contagion.patch b/patches.drivers/HID-hid-saitek-Add-device-ID-for-RAT-7-Contagion.patch
new file mode 100644
index 0000000000..f69ae87d1a
--- /dev/null
+++ b/patches.drivers/HID-hid-saitek-Add-device-ID-for-RAT-7-Contagion.patch
@@ -0,0 +1,45 @@
+From 43822c98f2ebb2cbd5e467ab72bbcdae7f0caa22 Mon Sep 17 00:00:00 2001
+From: Harry Mallon <hjmallon@gmail.com>
+Date: Tue, 28 Aug 2018 22:51:29 +0100
+Subject: [PATCH] HID: hid-saitek: Add device ID for RAT 7 Contagion
+Git-commit: 43822c98f2ebb2cbd5e467ab72bbcdae7f0caa22
+Patch-mainline: v4.19-rc4
+References: bsc#1051510
+
+Signed-off-by: Harry Mallon <hjmallon@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-saitek.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index cb2d3170d9dc..19a66ceca217 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -953,6 +953,7 @@
+ #define USB_DEVICE_ID_SAITEK_RUMBLEPAD 0xff17
+ #define USB_DEVICE_ID_SAITEK_PS1000 0x0621
+ #define USB_DEVICE_ID_SAITEK_RAT7_OLD 0x0ccb
++#define USB_DEVICE_ID_SAITEK_RAT7_CONTAGION 0x0ccd
+ #define USB_DEVICE_ID_SAITEK_RAT7 0x0cd7
+ #define USB_DEVICE_ID_SAITEK_RAT9 0x0cfa
+ #define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0
+diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c
+index 39e642686ff0..683861f324e3 100644
+--- a/drivers/hid/hid-saitek.c
++++ b/drivers/hid/hid-saitek.c
+@@ -183,6 +183,8 @@ static const struct hid_device_id saitek_devices[] = {
+ .driver_data = SAITEK_RELEASE_MODE_RAT7 },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7),
+ .driver_data = SAITEK_RELEASE_MODE_RAT7 },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT7_CONTAGION),
++ .driver_data = SAITEK_RELEASE_MODE_RAT7 },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RAT9),
+ .driver_data = SAITEK_RELEASE_MODE_RAT7 },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9),
+--
+2.18.0
+
diff --git a/patches.drivers/PM-Domains-Fix-genpd-to-deal-with-drivers-returning-.patch b/patches.drivers/PM-Domains-Fix-genpd-to-deal-with-drivers-returning-.patch
new file mode 100644
index 0000000000..a3ca29ee0a
--- /dev/null
+++ b/patches.drivers/PM-Domains-Fix-genpd-to-deal-with-drivers-returning-.patch
@@ -0,0 +1,58 @@
+From 5241ab40f6e742f8a1631f8826faf6dc6412b3b5 Mon Sep 17 00:00:00 2001
+From: Ulf Hansson <ulf.hansson@linaro.org>
+Date: Wed, 8 Nov 2017 10:11:02 +0100
+Subject: [PATCH] PM / Domains: Fix genpd to deal with drivers returning 1 from ->prepare()
+Git-commit: 5241ab40f6e742f8a1631f8826faf6dc6412b3b5
+Patch-mainline: v4.15-rc1
+References: bsc#1051510
+
+During system-wide PM, genpd relies on its PM callbacks to be invoked for
+all its attached devices, as to deal with powering off/on the PM domain. In
+other words, genpd is not compatible with the direct_complete path, if
+executed by the PM core for any of its attached devices.
+
+However, when genpd's ->prepare() callback invokes pm_generic_prepare(), it
+does not take into account that it may return 1. Instead it treats that as
+an error internally and expects the PM core to abort the prepare phase and
+roll back. This leads to genpd not properly powering on/off the PM domain,
+because its internal counters gets wrongly balanced.
+
+To fix the behaviour, allow drivers to return 1 from their ->prepare()
+callbacks, but let's return 0 from genpd's ->prepare() callback in such
+case, as that prevents the PM core from running the direct_complete path
+for the device.
+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/base/power/domain.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index b914e373a478..47fb71a8066a 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -1010,7 +1010,7 @@ static int genpd_prepare(struct device *dev)
+ genpd_unlock(genpd);
+
+ ret = pm_generic_prepare(dev);
+- if (ret) {
++ if (ret < 0) {
+ genpd_lock(genpd);
+
+ genpd->prepared_count--;
+@@ -1018,7 +1018,8 @@ static int genpd_prepare(struct device *dev)
+ genpd_unlock(genpd);
+ }
+
+- return ret;
++ /* Never return 1, as genpd don't cope with the direct_complete path. */
++ return ret >= 0 ? 0 : ret;
+ }
+
+ /**
+--
+2.18.0
+
diff --git a/patches.drivers/Revert-drm-amdgpu-Add-an-ATPX-quirk-for-hybrid-lapto.patch b/patches.drivers/Revert-drm-amdgpu-Add-an-ATPX-quirk-for-hybrid-lapto.patch
new file mode 100644
index 0000000000..dd70cc69e4
--- /dev/null
+++ b/patches.drivers/Revert-drm-amdgpu-Add-an-ATPX-quirk-for-hybrid-lapto.patch
@@ -0,0 +1,38 @@
+From 161c68eb502e90a5cf25913c577e23217590e43f Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 24 May 2018 14:37:39 -0500
+Subject: [PATCH] Revert "drm/amdgpu: Add an ATPX quirk for hybrid laptop"
+Git-commit: 161c68eb502e90a5cf25913c577e23217590e43f
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+This reverts commit 13b40935cf64f59b93cf1c716a2033488e5a228c.
+
+This was a workaround for a bug in the HDA driver that prevented
+the HDA audio chip from going into runtime pm which prevented
+the GPU from going into runtime pm.
+
+Bug: https://bugs.freedesktop.org/show_bug.cgi?id=106597
+Reviewed-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+index 1bcb2b247335..daa06e7c5bb7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+@@ -569,7 +569,6 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
+ { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
+- { 0x1002, 0x67DF, 0x1028, 0x0774, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0, 0, 0, 0, 0 },
+ };
+
+--
+2.18.0
+
diff --git a/patches.drivers/Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-eDP b/patches.drivers/Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-eDP
index 790620472a..4b3a440196 100644
--- a/patches.drivers/Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-eDP
+++ b/patches.drivers/Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-eDP
@@ -4,8 +4,8 @@ Date: Wed, 16 May 2018 11:01:10 +0300
Subject: Revert "drm/i915/edp: Allow alternate fixed mode for eDP if
available."
Git-commit: d93fa1b47b8fcd149b5091f18385304f402a8e15
-Git-repo: git://anongit.freedesktop.org/drm-tip
-Patch-mainline: Queued in subsystem maintainer repository
+No-fix: 368b554d63948133aca05e63ff8f5f4fbc2804d4
+Patch-mainline: v4.19-rc1
References: bsc#1093604
This reverts commit dc911f5bd8aacfcf8aabd5c26c88e04c837a938e.
diff --git a/patches.drivers/Revert-drm-i915-gvt-set-max-priority-for-gvt-context.patch b/patches.drivers/Revert-drm-i915-gvt-set-max-priority-for-gvt-context.patch
new file mode 100644
index 0000000000..cb712b4820
--- /dev/null
+++ b/patches.drivers/Revert-drm-i915-gvt-set-max-priority-for-gvt-context.patch
@@ -0,0 +1,39 @@
+From 41e403d04e7050c8d88682939febcdbe117d4c82 Mon Sep 17 00:00:00 2001
+From: Weinan Li <weinan.z.li@intel.com>
+Date: Wed, 21 Mar 2018 15:40:32 +0800
+Subject: [PATCH] Revert "drm/i915/gvt: set max priority for gvt context"
+Git-commit: 41e403d04e7050c8d88682939febcdbe117d4c82
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+This reverts commit 11474e9091cf2002e948647fd9f63a7f027e488a.
+
+There are issues which will block the host preemption before, instead of
+disabling it use one workaround "setting max priority for gvt context"
+to avoid the gvt context be preempted by the host. Now the issues have been
+cleared, so revert this patch to enable host preemption.
+
+V2:
+- refine description(Zhenyu)
+
+Signed-off-by: Weinan Li <weinan.z.li@intel.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Zhi Wang <zhi.a.wang@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/i915/gvt/scheduler.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gvt/scheduler.c
++++ b/drivers/gpu/drm/i915/gvt/scheduler.c
+@@ -1094,9 +1094,6 @@ int intel_vgpu_setup_submission(struct i
+ if (IS_ERR(s->shadow_ctx))
+ return PTR_ERR(s->shadow_ctx);
+
+- if (INTEL_INFO(vgpu->gvt->dev_priv)->has_logical_ring_preemption)
+- s->shadow_ctx->priority = INT_MAX;
+-
+ bitmap_zero(s->shadow_ctx_desc_updated, I915_NUM_ENGINES);
+
+ s->workloads = kmem_cache_create("gvt-g_vgpu_workload",
diff --git a/patches.drivers/Revert-drm-radeon-pm-autoswitch-power-state-when-in- b/patches.drivers/Revert-drm-radeon-pm-autoswitch-power-state-when-in-
index f546b09b43..04393d3108 100644
--- a/patches.drivers/Revert-drm-radeon-pm-autoswitch-power-state-when-in-
+++ b/patches.drivers/Revert-drm-radeon-pm-autoswitch-power-state-when-in-
@@ -3,6 +3,7 @@ From: Alex Deucher <alexander.deucher@amd.com>
Date: Thu, 15 Feb 2018 08:40:30 -0500
Subject: [PATCH] Revert "drm/radeon/pm: autoswitch power state when in balanced mode"
Git-commit: 53bf277b487eb5ae6695db01bede0fe406792119
+No-fix: 9aff8b2ae71dcf7f02443821a894a736f40e4919
Patch-mainline: v4.16-rc4
References: bsc#1051510
diff --git a/patches.drivers/Revert-gpio-set-up-initial-state-from-.get_direction.patch b/patches.drivers/Revert-gpio-set-up-initial-state-from-.get_direction.patch
new file mode 100644
index 0000000000..f8e4813baa
--- /dev/null
+++ b/patches.drivers/Revert-gpio-set-up-initial-state-from-.get_direction.patch
@@ -0,0 +1,70 @@
+From 1ca2a92b2a99323f666f1b669b7484df4bda05e4 Mon Sep 17 00:00:00 2001
+From: Timur Tabi <timur@codeaurora.org>
+Date: Wed, 20 Dec 2017 13:10:31 -0600
+Subject: [PATCH] Revert "gpio: set up initial state from .get_direction()"
+Git-commit: 1ca2a92b2a99323f666f1b669b7484df4bda05e4
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+This reverts commit 72d3200061776264941be1b5a9bb8e926b3b30a5.
+
+We cannot blindly query the direction of all GPIOs when the pins are
+first registered. The get_direction callback normally triggers a
+read/write to hardware, but we shouldn't be touching the hardware for
+an individual GPIO until after it's been properly claimed.
+
+Signed-off-by: Timur Tabi <timur@codeaurora.org>
+Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpiolib.c | 31 +++++++------------------------
+ 1 file changed, 7 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index e9ec44ffaaaf..45c20307630a 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1217,31 +1217,14 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
+ struct gpio_desc *desc = &gdev->descs[i];
+
+ desc->gdev = gdev;
+- /*
+- * REVISIT: most hardware initializes GPIOs as inputs
+- * (often with pullups enabled) so power usage is
+- * minimized. Linux code should set the gpio direction
+- * first thing; but until it does, and in case
+- * chip->get_direction is not set, we may expose the
+- * wrong direction in sysfs.
+- */
+-
+- if (chip->get_direction) {
+- /*
+- * If we have .get_direction, set up the initial
+- * direction flag from the hardware.
+- */
+- int dir = chip->get_direction(chip, i);
+
+- if (!dir)
+- set_bit(FLAG_IS_OUT, &desc->flags);
+- } else if (!chip->direction_input) {
+- /*
+- * If the chip lacks the .direction_input callback
+- * we logically assume all lines are outputs.
+- */
+- set_bit(FLAG_IS_OUT, &desc->flags);
+- }
++ /* REVISIT: most hardware initializes GPIOs as inputs (often
++ * with pullups enabled) so power usage is minimized. Linux
++ * code should set the gpio direction first thing; but until
++ * it does, and in case chip->get_direction is not set, we may
++ * expose the wrong direction in sysfs.
++ */
++ desc->flags = !chip->direction_input ? (1 << FLAG_IS_OUT) : 0;
+ }
+
+ #ifdef CONFIG_PINCTRL
+--
+2.18.0
+
diff --git a/patches.drivers/Revert-mwifiex-fix-incorrect-ht-capability-problem.patch b/patches.drivers/Revert-mwifiex-fix-incorrect-ht-capability-problem.patch
new file mode 100644
index 0000000000..f416741679
--- /dev/null
+++ b/patches.drivers/Revert-mwifiex-fix-incorrect-ht-capability-problem.patch
@@ -0,0 +1,91 @@
+From 53a7094204b7f2b9016648b5c4b5ece8e810a461 Mon Sep 17 00:00:00 2001
+From: Ganapathi Bhat <gbhat@marvell.com>
+Date: Fri, 9 Mar 2018 23:45:24 +0530
+Subject: [PATCH] Revert "mwifiex: fix incorrect ht capability problem"
+Git-commit: 53a7094204b7f2b9016648b5c4b5ece8e810a461
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+This reverts commit bcc920e8f08336cbbdcdba7c4449c27137e6b4b9.
+
+Drivers gets hardware info and updates ht_cap field of
+wiphy->bands during initialization. Once updated during init,
+ht_cap must not be modified as it reflects the capability
+supported by hardwawre. Above patch tries to modify the ht_cap
+field and this results in wrongly advertising capabilities during
+association.
+
+Signed-off-by: Cathy Luo <cluo@marvell.com>
+Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ .../net/wireless/marvell/mwifiex/sta_ioctl.c | 44 +------------------
+ 1 file changed, 1 insertion(+), 43 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+index a6077ab3efc3..ed66f12d3301 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+@@ -146,7 +146,6 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
+ size_t beacon_ie_len;
+ struct mwifiex_bss_priv *bss_priv = (void *)bss->priv;
+ const struct cfg80211_bss_ies *ies;
+- int ret;
+
+ rcu_read_lock();
+ ies = rcu_dereference(bss->ies);
+@@ -190,48 +189,7 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
+ if (bss_desc->cap_info_bitmap & WLAN_CAPABILITY_SPECTRUM_MGMT)
+ bss_desc->sensed_11h = true;
+
+- ret = mwifiex_update_bss_desc_with_ie(priv->adapter, bss_desc);
+- if (ret)
+- return ret;
+-
+- /* Update HT40 capability based on current channel information */
+- if (bss_desc->bcn_ht_oper && bss_desc->bcn_ht_cap) {
+- u8 ht_param = bss_desc->bcn_ht_oper->ht_param;
+- u8 radio = mwifiex_band_to_radio_type(bss_desc->bss_band);
+- struct ieee80211_supported_band *sband =
+- priv->wdev.wiphy->bands[radio];
+- int freq = ieee80211_channel_to_frequency(bss_desc->channel,
+- radio);
+- struct ieee80211_channel *chan =
+- ieee80211_get_channel(priv->adapter->wiphy, freq);
+-
+- switch (ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+- case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+- if (chan->flags & IEEE80211_CHAN_NO_HT40PLUS) {
+- sband->ht_cap.cap &=
+- ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+- sband->ht_cap.cap &= ~IEEE80211_HT_CAP_SGI_40;
+- } else {
+- sband->ht_cap.cap |=
+- IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+- IEEE80211_HT_CAP_SGI_40;
+- }
+- break;
+- case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+- if (chan->flags & IEEE80211_CHAN_NO_HT40MINUS) {
+- sband->ht_cap.cap &=
+- ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+- sband->ht_cap.cap &= ~IEEE80211_HT_CAP_SGI_40;
+- } else {
+- sband->ht_cap.cap |=
+- IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+- IEEE80211_HT_CAP_SGI_40;
+- }
+- break;
+- }
+- }
+-
+- return 0;
++ return mwifiex_update_bss_desc_with_ie(priv->adapter, bss_desc);
+ }
+
+ void mwifiex_dnld_txpwr_table(struct mwifiex_private *priv)
+--
+2.18.0
+
diff --git a/patches.drivers/Revert-mwifiex-handle-race-during-mwifiex_usb_discon.patch b/patches.drivers/Revert-mwifiex-handle-race-during-mwifiex_usb_discon.patch
new file mode 100644
index 0000000000..d27ef2a8a5
--- /dev/null
+++ b/patches.drivers/Revert-mwifiex-handle-race-during-mwifiex_usb_discon.patch
@@ -0,0 +1,38 @@
+From 7e58e741c001813c02cab17720835d56398f9ffc Mon Sep 17 00:00:00 2001
+From: Ganapathi Bhat <gbhat@marvell.com>
+Date: Fri, 1 Jun 2018 16:11:19 +0530
+Subject: [PATCH] Revert "mwifiex: handle race during mwifiex_usb_disconnect"
+Git-commit: 7e58e741c001813c02cab17720835d56398f9ffc
+Patch-mainline: v4.18-rc6
+References: bsc#1051510
+
+This reverts commit b817047ae70c0bd67b677b65d0d69d72cd6e9728.
+
+We have a better fix for this issue, which will be sent on top
+of this revert.
+
+Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/marvell/mwifiex/usb.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
+index 6e3cf9817730..bc475b83bb15 100644
+--- a/drivers/net/wireless/marvell/mwifiex/usb.c
++++ b/drivers/net/wireless/marvell/mwifiex/usb.c
+@@ -644,9 +644,6 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
+ MWIFIEX_FUNC_SHUTDOWN);
+ }
+
+- if (adapter->workqueue)
+- flush_workqueue(adapter->workqueue);
+-
+ mwifiex_usb_free(card);
+
+ mwifiex_dbg(adapter, FATAL,
+--
+2.18.0
+
diff --git a/patches.drivers/Revert-pinctrl-sunxi-Don-t-enforce-bias-disable-for-.patch b/patches.drivers/Revert-pinctrl-sunxi-Don-t-enforce-bias-disable-for-.patch
new file mode 100644
index 0000000000..6ce6700986
--- /dev/null
+++ b/patches.drivers/Revert-pinctrl-sunxi-Don-t-enforce-bias-disable-for-.patch
@@ -0,0 +1,40 @@
+From ac059e2aa01dcbbd7e0b2609abbef5790486fafe Mon Sep 17 00:00:00 2001
+From: Priit Laes <plaes@plaes.org>
+Date: Sun, 27 Aug 2017 15:55:23 +0300
+Subject: [PATCH] Revert "pinctrl: sunxi: Don't enforce bias disable (for now)"
+Git-commit: ac059e2aa01dcbbd7e0b2609abbef5790486fafe
+Patch-mainline: v4.14-rc1
+References: bsc#1051510
+
+This reverts commit 2154d94b40ea2a5de05245521371d0461bb0d669.
+
+The original patch was intented to avoid some issues with the sunxi
+gpio rework and was supposed to be reverted after all the required
+DT bits had been merged around v4.10.
+
+Signed-off-by: Priit Laes <plaes@plaes.org>
+Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pinctrl/sunxi/pinctrl-sunxi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+index 0dfd7fa66c48..52edf3b5988d 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+@@ -564,7 +564,8 @@ static int sunxi_pconf_group_set(struct pinctrl_dev *pctldev,
+ val = arg / 10 - 1;
+ break;
+ case PIN_CONFIG_BIAS_DISABLE:
+- continue;
++ val = 0;
++ break;
+ case PIN_CONFIG_BIAS_PULL_UP:
+ if (arg == 0)
+ return -EINVAL;
+--
+2.18.0
+
diff --git a/patches.drivers/cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch b/patches.drivers/cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
new file mode 100644
index 0000000000..dbee5d77f2
--- /dev/null
+++ b/patches.drivers/cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
@@ -0,0 +1,45 @@
+From 8442938c3a2177ba16043b3a935f2c78266ad399 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 31 Aug 2018 11:10:55 +0300
+Subject: [PATCH] cfg80211: fix a type issue in ieee80211_chandef_to_operating_class()
+Git-commit: 8442938c3a2177ba16043b3a935f2c78266ad399
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+The "chandef->center_freq1" variable is a u32 but "freq" is a u16 so we
+are truncating away the high bits. I noticed this bug because in commit
+9cf0a0b4b64a ("cfg80211: Add support for 60GHz band channels 5 and 6")
+we made "freq <= 56160 + 2160 * 6" a valid requency when before it was
+only "freq <= 56160 + 2160 * 4" that was valid. It introduces a static
+checker warning:
+
+ net/wireless/util.c:1571 ieee80211_chandef_to_operating_class()
+ warn: always true condition '(freq <= 56160 + 2160 * 6) => (0-u16max <= 69120)'
+
+But really we probably shouldn't have been truncating the high bits
+away to begin with.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/wireless/util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 3c654cd7ba56..908bf5b6d89e 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1374,7 +1374,7 @@ bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
+ u8 *op_class)
+ {
+ u8 vht_opclass;
+- u16 freq = chandef->center_freq1;
++ u32 freq = chandef->center_freq1;
+
+ if (freq >= 2412 && freq <= 2472) {
+ if (chandef->width > NL80211_CHAN_WIDTH_40)
+--
+2.18.0
+
diff --git a/patches.drivers/crypto-mxs-dcp-Fix-wait-logic-on-chan-threads.patch b/patches.drivers/crypto-mxs-dcp-Fix-wait-logic-on-chan-threads.patch
new file mode 100644
index 0000000000..2b25130c23
--- /dev/null
+++ b/patches.drivers/crypto-mxs-dcp-Fix-wait-logic-on-chan-threads.patch
@@ -0,0 +1,158 @@
+From d80771c08363ad7fbf0f56f5301e7ca65065c582 Mon Sep 17 00:00:00 2001
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Fri, 21 Sep 2018 18:03:18 +0300
+Subject: [PATCH] crypto: mxs-dcp - Fix wait logic on chan threads
+Git-commit: d80771c08363ad7fbf0f56f5301e7ca65065c582
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+When compiling with CONFIG_DEBUG_ATOMIC_SLEEP=y the mxs-dcp driver
+prints warnings such as:
+
+Warning: CPU: 0 PID: 120 at kernel/sched/core.c:7736 __might_sleep+0x98/0x9c
+do not call blocking ops when !TASK_RUNNING; state=1 set at [<8081978c>] dcp_chan_thread_sha+0x3c/0x2ec
+
+The problem is that blocking ops will manipulate current->state
+themselves so it is not allowed to call them between
+set_current_state(TASK_INTERRUPTIBLE) and schedule().
+
+Fix this by converting the per-chan mutex to a spinlock (it only
+protects tiny list ops anyway) and rearranging the wait logic so that
+callbacks are called current->state as TASK_RUNNING. Those callbacks
+will indeed call blocking ops themselves so this is required.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/mxs-dcp.c | 53 +++++++++++++++++++++++-----------------
+ 1 file changed, 30 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index a10c418d4e5c..56bd28174f52 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -63,7 +63,7 @@ struct dcp {
+ struct dcp_coherent_block *coh;
+
+ struct completion completion[DCP_MAX_CHANS];
+- struct mutex mutex[DCP_MAX_CHANS];
++ spinlock_t lock[DCP_MAX_CHANS];
+ struct task_struct *thread[DCP_MAX_CHANS];
+ struct crypto_queue queue[DCP_MAX_CHANS];
+ };
+@@ -349,13 +349,20 @@ static int dcp_chan_thread_aes(void *data)
+
+ int ret;
+
+- do {
+- __set_current_state(TASK_INTERRUPTIBLE);
++ while (!kthread_should_stop()) {
++ set_current_state(TASK_INTERRUPTIBLE);
+
+- mutex_lock(&sdcp->mutex[chan]);
++ spin_lock(&sdcp->lock[chan]);
+ backlog = crypto_get_backlog(&sdcp->queue[chan]);
+ arq = crypto_dequeue_request(&sdcp->queue[chan]);
+- mutex_unlock(&sdcp->mutex[chan]);
++ spin_unlock(&sdcp->lock[chan]);
++
++ if (!backlog && !arq) {
++ schedule();
++ continue;
++ }
++
++ set_current_state(TASK_RUNNING);
+
+ if (backlog)
+ backlog->complete(backlog, -EINPROGRESS);
+@@ -363,11 +370,8 @@ static int dcp_chan_thread_aes(void *data)
+ if (arq) {
+ ret = mxs_dcp_aes_block_crypt(arq);
+ arq->complete(arq, ret);
+- continue;
+ }
+-
+- schedule();
+- } while (!kthread_should_stop());
++ }
+
+ return 0;
+ }
+@@ -409,9 +413,9 @@ static int mxs_dcp_aes_enqueue(struct ablkcipher_request *req, int enc, int ecb)
+ rctx->ecb = ecb;
+ actx->chan = DCP_CHAN_CRYPTO;
+
+- mutex_lock(&sdcp->mutex[actx->chan]);
++ spin_lock(&sdcp->lock[actx->chan]);
+ ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);
+- mutex_unlock(&sdcp->mutex[actx->chan]);
++ spin_unlock(&sdcp->lock[actx->chan]);
+
+ wake_up_process(sdcp->thread[actx->chan]);
+
+@@ -640,13 +644,20 @@ static int dcp_chan_thread_sha(void *data)
+ struct ahash_request *req;
+ int ret, fini;
+
+- do {
+- __set_current_state(TASK_INTERRUPTIBLE);
++ while (!kthread_should_stop()) {
++ set_current_state(TASK_INTERRUPTIBLE);
+
+- mutex_lock(&sdcp->mutex[chan]);
++ spin_lock(&sdcp->lock[chan]);
+ backlog = crypto_get_backlog(&sdcp->queue[chan]);
+ arq = crypto_dequeue_request(&sdcp->queue[chan]);
+- mutex_unlock(&sdcp->mutex[chan]);
++ spin_unlock(&sdcp->lock[chan]);
++
++ if (!backlog && !arq) {
++ schedule();
++ continue;
++ }
++
++ set_current_state(TASK_RUNNING);
+
+ if (backlog)
+ backlog->complete(backlog, -EINPROGRESS);
+@@ -658,12 +669,8 @@ static int dcp_chan_thread_sha(void *data)
+ ret = dcp_sha_req_to_buf(arq);
+ fini = rctx->fini;
+ arq->complete(arq, ret);
+- if (!fini)
+- continue;
+ }
+-
+- schedule();
+- } while (!kthread_should_stop());
++ }
+
+ return 0;
+ }
+@@ -721,9 +728,9 @@ static int dcp_sha_update_fx(struct ahash_request *req, int fini)
+ rctx->init = 1;
+ }
+
+- mutex_lock(&sdcp->mutex[actx->chan]);
++ spin_lock(&sdcp->lock[actx->chan]);
+ ret = crypto_enqueue_request(&sdcp->queue[actx->chan], &req->base);
+- mutex_unlock(&sdcp->mutex[actx->chan]);
++ spin_unlock(&sdcp->lock[actx->chan]);
+
+ wake_up_process(sdcp->thread[actx->chan]);
+ mutex_unlock(&actx->mutex);
+@@ -997,7 +1004,7 @@ static int mxs_dcp_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, sdcp);
+
+ for (i = 0; i < DCP_MAX_CHANS; i++) {
+- mutex_init(&sdcp->mutex[i]);
++ spin_lock_init(&sdcp->lock[i]);
+ init_completion(&sdcp->completion[i]);
+ crypto_init_queue(&sdcp->queue[i], 50);
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/crypto-qat-Fix-KASAN-stack-out-of-bounds-bug-in-adf_.patch b/patches.drivers/crypto-qat-Fix-KASAN-stack-out-of-bounds-bug-in-adf_.patch
new file mode 100644
index 0000000000..c23d002501
--- /dev/null
+++ b/patches.drivers/crypto-qat-Fix-KASAN-stack-out-of-bounds-bug-in-adf_.patch
@@ -0,0 +1,233 @@
+From ba439a6cbfa2936a6713f64cb499de7943673fe3 Mon Sep 17 00:00:00 2001
+From: Waiman Long <longman@redhat.com>
+Date: Sat, 22 Sep 2018 20:41:55 -0400
+Subject: [PATCH] crypto: qat - Fix KASAN stack-out-of-bounds bug in adf_probe()
+Git-commit: ba439a6cbfa2936a6713f64cb499de7943673fe3
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+The following KASAN warning was printed when booting a 64-bit kernel
+on some systems with Intel CPUs:
+
+[ 44.512826] ==================================================================
+[ 44.520165] BUG: KASAN: stack-out-of-bounds in find_first_bit+0xb0/0xc0
+[ 44.526786] Read of size 8 at addr ffff88041e02fc50 by task kworker/0:2/124
+
+[ 44.535253] CPU: 0 PID: 124 Comm: kworker/0:2 Tainted: G X --------- --- 4.18.0-12.el8.x86_64+debug #1
+[ 44.545858] Hardware name: Intel Corporation PURLEY/PURLEY, BIOS BKVDTRL1.86B.0005.D08.1712070559 12/07/2017
+[ 44.555682] Workqueue: events work_for_cpu_fn
+[ 44.560043] Call Trace:
+[ 44.562502] dump_stack+0x9a/0xe9
+[ 44.565832] print_address_description+0x65/0x22e
+[ 44.570683] ? find_first_bit+0xb0/0xc0
+[ 44.570689] kasan_report.cold.6+0x92/0x19f
+[ 44.578726] find_first_bit+0xb0/0xc0
+[ 44.578737] adf_probe+0x9eb/0x19a0 [qat_c62x]
+[ 44.578751] ? adf_remove+0x110/0x110 [qat_c62x]
+[ 44.591490] ? mark_held_locks+0xc8/0x140
+[ 44.591498] ? _raw_spin_unlock+0x30/0x30
+[ 44.591505] ? trace_hardirqs_on_caller+0x381/0x570
+[ 44.604418] ? adf_remove+0x110/0x110 [qat_c62x]
+[ 44.604427] local_pci_probe+0xd4/0x180
+[ 44.604432] ? pci_device_shutdown+0x110/0x110
+[ 44.617386] work_for_cpu_fn+0x51/0xa0
+[ 44.621145] process_one_work+0x8fe/0x16e0
+[ 44.625263] ? pwq_dec_nr_in_flight+0x2d0/0x2d0
+[ 44.629799] ? lock_acquire+0x14c/0x400
+[ 44.633645] ? move_linked_works+0x12e/0x2a0
+[ 44.637928] worker_thread+0x536/0xb50
+[ 44.641690] ? __kthread_parkme+0xb6/0x180
+[ 44.645796] ? process_one_work+0x16e0/0x16e0
+[ 44.650160] kthread+0x30c/0x3d0
+[ 44.653400] ? kthread_create_worker_on_cpu+0xc0/0xc0
+[ 44.658457] ret_from_fork+0x3a/0x50
+
+[ 44.663557] The buggy address belongs to the page:
+[ 44.668350] page:ffffea0010780bc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
+[ 44.676356] flags: 0x17ffffc0000000()
+[ 44.680023] raw: 0017ffffc0000000 ffffea0010780bc8 ffffea0010780bc8 0000000000000000
+[ 44.687769] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
+[ 44.695510] page dumped because: kasan: bad access detected
+
+[ 44.702578] Memory state around the buggy address:
+[ 44.707372] ffff88041e02fb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 44.714593] ffff88041e02fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 44.721810] >ffff88041e02fc00: 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 f2 f2
+[ 44.729028] ^
+[ 44.734864] ffff88041e02fc80: f2 f2 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00
+[ 44.742082] ffff88041e02fd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 44.749299] ==================================================================
+
+Looking into the code:
+
+ int ret, bar_mask;
+ :
+ for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+
+It is casting a 32-bit integer pointer to a 64-bit unsigned long
+pointer. There are two problems here. First, the 32-bit pointer address
+may not be 64-bit aligned. Secondly, it is accessing an extra 4 bytes.
+
+This is fixed by changing the bar_mask type to unsigned long.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/qat/qat_c3xxx/adf_drv.c | 6 +++---
+ drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 6 +++---
+ drivers/crypto/qat/qat_c62x/adf_drv.c | 6 +++---
+ drivers/crypto/qat/qat_c62xvf/adf_drv.c | 6 +++---
+ drivers/crypto/qat/qat_dh895xcc/adf_drv.c | 6 +++---
+ drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 6 +++---
+ 6 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_c3xxx/adf_drv.c b/drivers/crypto/qat/qat_c3xxx/adf_drv.c
+index ba197f34c252..763c2166ee0e 100644
+--- a/drivers/crypto/qat/qat_c3xxx/adf_drv.c
++++ b/drivers/crypto/qat/qat_c3xxx/adf_drv.c
+@@ -123,7 +123,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ struct adf_hw_device_data *hw_data;
+ char name[ADF_DEVICE_NAME_LENGTH];
+ unsigned int i, bar_nr;
+- int ret, bar_mask;
++ unsigned long bar_mask;
++ int ret;
+
+ switch (ent->device) {
+ case ADF_C3XXX_PCI_DEVICE_ID:
+@@ -235,8 +236,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /* Find and map all the device's BARS */
+ i = 0;
+ bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+- ADF_PCI_MAX_BARS * 2) {
++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+
+ bar->base_addr = pci_resource_start(pdev, bar_nr);
+diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+index 24ec908eb26c..613c7d5644ce 100644
+--- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+@@ -125,7 +125,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ struct adf_hw_device_data *hw_data;
+ char name[ADF_DEVICE_NAME_LENGTH];
+ unsigned int i, bar_nr;
+- int ret, bar_mask;
++ unsigned long bar_mask;
++ int ret;
+
+ switch (ent->device) {
+ case ADF_C3XXXIOV_PCI_DEVICE_ID:
+@@ -215,8 +216,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /* Find and map all the device's BARS */
+ i = 0;
+ bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+- ADF_PCI_MAX_BARS * 2) {
++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+
+ bar->base_addr = pci_resource_start(pdev, bar_nr);
+diff --git a/drivers/crypto/qat/qat_c62x/adf_drv.c b/drivers/crypto/qat/qat_c62x/adf_drv.c
+index 59a5a0df50b6..9cb832963357 100644
+--- a/drivers/crypto/qat/qat_c62x/adf_drv.c
++++ b/drivers/crypto/qat/qat_c62x/adf_drv.c
+@@ -123,7 +123,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ struct adf_hw_device_data *hw_data;
+ char name[ADF_DEVICE_NAME_LENGTH];
+ unsigned int i, bar_nr;
+- int ret, bar_mask;
++ unsigned long bar_mask;
++ int ret;
+
+ switch (ent->device) {
+ case ADF_C62X_PCI_DEVICE_ID:
+@@ -235,8 +236,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /* Find and map all the device's BARS */
+ i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0;
+ bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+- ADF_PCI_MAX_BARS * 2) {
++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+
+ bar->base_addr = pci_resource_start(pdev, bar_nr);
+diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+index b9f3e0e4fde9..278452b8ef81 100644
+--- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+@@ -125,7 +125,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ struct adf_hw_device_data *hw_data;
+ char name[ADF_DEVICE_NAME_LENGTH];
+ unsigned int i, bar_nr;
+- int ret, bar_mask;
++ unsigned long bar_mask;
++ int ret;
+
+ switch (ent->device) {
+ case ADF_C62XIOV_PCI_DEVICE_ID:
+@@ -215,8 +216,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /* Find and map all the device's BARS */
+ i = 0;
+ bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+- ADF_PCI_MAX_BARS * 2) {
++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+
+ bar->base_addr = pci_resource_start(pdev, bar_nr);
+diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
+index be5c5a988ca5..3a9708ef4ce2 100644
+--- a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
++++ b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
+@@ -123,7 +123,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ struct adf_hw_device_data *hw_data;
+ char name[ADF_DEVICE_NAME_LENGTH];
+ unsigned int i, bar_nr;
+- int ret, bar_mask;
++ unsigned long bar_mask;
++ int ret;
+
+ switch (ent->device) {
+ case ADF_DH895XCC_PCI_DEVICE_ID:
+@@ -237,8 +238,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /* Find and map all the device's BARS */
+ i = 0;
+ bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+- ADF_PCI_MAX_BARS * 2) {
++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+
+ bar->base_addr = pci_resource_start(pdev, bar_nr);
+diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+index 26ab17bfc6da..3da0f951cb59 100644
+--- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+@@ -125,7 +125,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ struct adf_hw_device_data *hw_data;
+ char name[ADF_DEVICE_NAME_LENGTH];
+ unsigned int i, bar_nr;
+- int ret, bar_mask;
++ unsigned long bar_mask;
++ int ret;
+
+ switch (ent->device) {
+ case ADF_DH895XCCIOV_PCI_DEVICE_ID:
+@@ -215,8 +216,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /* Find and map all the device's BARS */
+ i = 0;
+ bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+- for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+- ADF_PCI_MAX_BARS * 2) {
++ for_each_set_bit(bar_nr, &bar_mask, ADF_PCI_MAX_BARS * 2) {
+ struct adf_bar *bar = &accel_pci_dev->pci_bars[i++];
+
+ bar->base_addr = pci_resource_start(pdev, bar_nr);
+--
+2.18.0
+
diff --git a/patches.drivers/drm-amdgpu-Pulling-old-prepare-and-submit-for-flip-b.patch b/patches.drivers/drm-amdgpu-Pulling-old-prepare-and-submit-for-flip-b.patch
new file mode 100644
index 0000000000..396c5454a6
--- /dev/null
+++ b/patches.drivers/drm-amdgpu-Pulling-old-prepare-and-submit-for-flip-b.patch
@@ -0,0 +1,226 @@
+From 9c5b2b0d409304c2e3c1f4d1c9bb4958e1d46f8f Mon Sep 17 00:00:00 2001
+From: Harry Wentland <harry.wentland@amd.com>
+Date: Wed, 13 Sep 2017 10:03:31 -0400
+Subject: [PATCH] drm/amdgpu: Pulling old prepare and submit for flip back
+Git-commit: 9c5b2b0d409304c2e3c1f4d1c9bb4958e1d46f8f
+Patch-mainline: v4.15-rc1
+References: bsc#1051510
+
+This is needed to ensure every single DC commit builds. Reverting
+this again when it's no longer needed by DC.
+
+This reverts commit 98da65d5e32583d89a1b1c760293b601816a98d3.
+
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 138 ++++++++++++++++----
+ drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h | 15 +++
+ 2 files changed, 124 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+index 6ad243293a78..e23b89cc6636 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+@@ -138,11 +138,52 @@ static void amdgpu_unpin_work_func(struct work_struct *__work)
+ kfree(work);
+ }
+
+-int amdgpu_crtc_page_flip_target(struct drm_crtc *crtc,
+- struct drm_framebuffer *fb,
+- struct drm_pending_vblank_event *event,
+- uint32_t page_flip_flags, uint32_t target,
+- struct drm_modeset_acquire_ctx *ctx)
++
++static void amdgpu_flip_work_cleanup(struct amdgpu_flip_work *work)
++{
++ int i;
++
++ amdgpu_bo_unref(&work->old_abo);
++ dma_fence_put(work->excl);
++ for (i = 0; i < work->shared_count; ++i)
++ dma_fence_put(work->shared[i]);
++ kfree(work->shared);
++ kfree(work);
++}
++
++static void amdgpu_flip_cleanup_unreserve(struct amdgpu_flip_work *work,
++ struct amdgpu_bo *new_abo)
++{
++ amdgpu_bo_unreserve(new_abo);
++ amdgpu_flip_work_cleanup(work);
++}
++
++static void amdgpu_flip_cleanup_unpin(struct amdgpu_flip_work *work,
++ struct amdgpu_bo *new_abo)
++{
++ if (unlikely(amdgpu_bo_unpin(new_abo) != 0))
++ DRM_ERROR("failed to unpin new abo in error path\n");
++ amdgpu_flip_cleanup_unreserve(work, new_abo);
++}
++
++void amdgpu_crtc_cleanup_flip_ctx(struct amdgpu_flip_work *work,
++ struct amdgpu_bo *new_abo)
++{
++ if (unlikely(amdgpu_bo_reserve(new_abo, true) != 0)) {
++ DRM_ERROR("failed to reserve new abo in error path\n");
++ amdgpu_flip_work_cleanup(work);
++ return;
++ }
++ amdgpu_flip_cleanup_unpin(work, new_abo);
++}
++
++int amdgpu_crtc_prepare_flip(struct drm_crtc *crtc,
++ struct drm_framebuffer *fb,
++ struct drm_pending_vblank_event *event,
++ uint32_t page_flip_flags,
++ uint32_t target,
++ struct amdgpu_flip_work **work_p,
++ struct amdgpu_bo **new_abo_p)
+ {
+ struct drm_device *dev = crtc->dev;
+ struct amdgpu_device *adev = dev->dev_private;
+@@ -155,7 +196,7 @@ int amdgpu_crtc_page_flip_target(struct drm_crtc *crtc,
+ unsigned long flags;
+ u64 tiling_flags;
+ u64 base;
+- int i, r;
++ int r;
+
+ work = kzalloc(sizeof *work, GFP_KERNEL);
+ if (work == NULL)
+@@ -216,41 +257,80 @@ int amdgpu_crtc_page_flip_target(struct drm_crtc *crtc,
+ spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
+ r = -EBUSY;
+ goto pflip_cleanup;
++
+ }
++ spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
++
++ *work_p = work;
++ *new_abo_p = new_abo;
++
++ return 0;
++
++pflip_cleanup:
++ amdgpu_crtc_cleanup_flip_ctx(work, new_abo);
++ return r;
++
++unpin:
++ amdgpu_flip_cleanup_unpin(work, new_abo);
++ return r;
++
++unreserve:
++ amdgpu_flip_cleanup_unreserve(work, new_abo);
++ return r;
+
++cleanup:
++ amdgpu_flip_work_cleanup(work);
++ return r;
++
++}
++
++void amdgpu_crtc_submit_flip(struct drm_crtc *crtc,
++ struct drm_framebuffer *fb,
++ struct amdgpu_flip_work *work,
++ struct amdgpu_bo *new_abo)
++{
++ unsigned long flags;
++ struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
++
++ spin_lock_irqsave(&crtc->dev->event_lock, flags);
+ amdgpu_crtc->pflip_status = AMDGPU_FLIP_PENDING;
+ amdgpu_crtc->pflip_works = work;
+
+-
+- DRM_DEBUG_DRIVER("crtc:%d[%p], pflip_stat:AMDGPU_FLIP_PENDING, work: %p,\n",
+- amdgpu_crtc->crtc_id, amdgpu_crtc, work);
+ /* update crtc fb */
+ crtc->primary->fb = fb;
+ spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
++
++ DRM_DEBUG_DRIVER(
++ "crtc:%d[%p], pflip_stat:AMDGPU_FLIP_PENDING, work: %p,\n",
++ amdgpu_crtc->crtc_id, amdgpu_crtc, work);
++
+ amdgpu_flip_work_func(&work->flip_work.work);
+- return 0;
++}
+
+-pflip_cleanup:
+- if (unlikely(amdgpu_bo_reserve(new_abo, false) != 0)) {
+- DRM_ERROR("failed to reserve new abo in error path\n");
+- goto cleanup;
+- }
+-unpin:
+- if (unlikely(amdgpu_bo_unpin(new_abo) != 0)) {
+- DRM_ERROR("failed to unpin new abo in error path\n");
+- }
+-unreserve:
+- amdgpu_bo_unreserve(new_abo);
++int amdgpu_crtc_page_flip_target(struct drm_crtc *crtc,
++ struct drm_framebuffer *fb,
++ struct drm_pending_vblank_event *event,
++ uint32_t page_flip_flags,
++ uint32_t target,
++ struct drm_modeset_acquire_ctx *ctx)
++{
++ struct amdgpu_bo *new_abo;
++ struct amdgpu_flip_work *work;
++ int r;
+
+-cleanup:
+- amdgpu_bo_unref(&work->old_abo);
+- dma_fence_put(work->excl);
+- for (i = 0; i < work->shared_count; ++i)
+- dma_fence_put(work->shared[i]);
+- kfree(work->shared);
+- kfree(work);
++ r = amdgpu_crtc_prepare_flip(crtc,
++ fb,
++ event,
++ page_flip_flags,
++ target,
++ &work,
++ &new_abo);
++ if (r)
++ return r;
+
+- return r;
++ amdgpu_crtc_submit_flip(crtc, fb, work, new_abo);
++
++ return 0;
+ }
+
+ int amdgpu_crtc_set_config(struct drm_mode_set *set,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+index 2af2678ddaf6..109a3833c3a8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h
+@@ -587,6 +587,21 @@ int amdgpu_crtc_page_flip_target(struct drm_crtc *crtc,
+ struct drm_pending_vblank_event *event,
+ uint32_t page_flip_flags, uint32_t target,
+ struct drm_modeset_acquire_ctx *ctx);
++void amdgpu_crtc_cleanup_flip_ctx(struct amdgpu_flip_work *work,
++ struct amdgpu_bo *new_abo);
++int amdgpu_crtc_prepare_flip(struct drm_crtc *crtc,
++ struct drm_framebuffer *fb,
++ struct drm_pending_vblank_event *event,
++ uint32_t page_flip_flags,
++ uint32_t target,
++ struct amdgpu_flip_work **work,
++ struct amdgpu_bo **new_abo);
++
++void amdgpu_crtc_submit_flip(struct drm_crtc *crtc,
++ struct drm_framebuffer *fb,
++ struct amdgpu_flip_work *work,
++ struct amdgpu_bo *new_abo);
++
+ extern const struct drm_mode_config_funcs amdgpu_mode_funcs;
+
+ #endif
+--
+2.18.0
+
diff --git a/patches.drivers/drm-amdgpu-add-another-ATPX-quirk-for-TOPAZ.patch b/patches.drivers/drm-amdgpu-add-another-ATPX-quirk-for-TOPAZ.patch
new file mode 100644
index 0000000000..1cc29ca8a9
--- /dev/null
+++ b/patches.drivers/drm-amdgpu-add-another-ATPX-quirk-for-TOPAZ.patch
@@ -0,0 +1,35 @@
+From b3fc2ab37e27f8d6588a4755382346ba2335a7c7 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 17 Jul 2018 10:52:29 -0500
+Subject: [PATCH] drm/amdgpu: add another ATPX quirk for TOPAZ
+Git-commit: b3fc2ab37e27f8d6588a4755382346ba2335a7c7
+Patch-mainline: v4.18-rc6
+References: bsc#1051510
+
+Needs ATPX rather than _PR3.
+
+Bug: https://bugzilla.kernel.org/show_bug.cgi?id=200517
+Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+index 9ab89371d9e8..ca8bf1c9a98e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+@@ -575,6 +575,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
+ { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
++ { 0x1002, 0x6900, 0x1025, 0x125A, AMDGPU_PX_QUIRK_FORCE_ATPX },
+ { 0, 0, 0, 0, 0 },
+ };
+
+--
+2.18.0
+
diff --git a/patches.drivers/drm-amdgpu-revert-fix-deadlock-of-reservation-betwee.patch b/patches.drivers/drm-amdgpu-revert-fix-deadlock-of-reservation-betwee.patch
new file mode 100644
index 0000000000..734c02a244
--- /dev/null
+++ b/patches.drivers/drm-amdgpu-revert-fix-deadlock-of-reservation-betwee.patch
@@ -0,0 +1,58 @@
+From 3d138c14c4174a2c80874a96935c87eee7c82ecf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Tue, 5 Sep 2017 15:10:50 +0200
+Subject: [PATCH] drm/amdgpu: revert "fix deadlock of reservation between cs and gpu reset v2"
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 3d138c14c4174a2c80874a96935c87eee7c82ecf
+No-fix: aa4ec7ce7ec52c7230cfa73b06d79288b45fe1c9
+Patch-mainline: v4.14-rc1
+References: bsc#1051510
+
+This reverts commit 10e709cb296c98424c03408d23e3addeddcd4088.
+
+The patch doesn't work at all:
+1. The CS can still be blocked because of amdgpu_ctx_add_fence().
+2. The order of submission isn't correct any more.
+3. We could end up using freed up memory because we now drop the
+ ctx reference to early.
+
+This needs to be fixed cleanly by doing the context handling after the BO
+handling, but this is a larger task just avoid the obvious crashes for now.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Monk Liu monk.liu@amd.com
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index baa90df90aea..ba10a83535d3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -1153,7 +1153,6 @@ static int amdgpu_cs_submit(struct amdgpu_cs_parser *p,
+ cs->out.handle = amdgpu_ctx_add_fence(p->ctx, ring, p->fence);
+ job->uf_sequence = cs->out.handle;
+ amdgpu_job_free_resources(job);
+- amdgpu_cs_parser_fini(p, 0, true);
+
+ trace_amdgpu_cs_ioctl(job);
+ amd_sched_entity_push_job(&job->base);
+@@ -1211,10 +1210,7 @@ int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ goto out;
+
+ r = amdgpu_cs_submit(&parser, cs);
+- if (r)
+- goto out;
+
+- return 0;
+ out:
+ amdgpu_cs_parser_fini(&parser, r, reserved_buffers);
+ return r;
+--
+2.18.0
+
diff --git a/patches.drivers/drm-nouveau-TBDdevinit-don-t-fail-when-PMU-PRE_OS-is.patch b/patches.drivers/drm-nouveau-TBDdevinit-don-t-fail-when-PMU-PRE_OS-is.patch
new file mode 100644
index 0000000000..5a8aead5c4
--- /dev/null
+++ b/patches.drivers/drm-nouveau-TBDdevinit-don-t-fail-when-PMU-PRE_OS-is.patch
@@ -0,0 +1,37 @@
+From 0a6986c6595e9afd20ff7280dab36431c1e467f8 Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 4 Sep 2018 15:56:57 +1000
+Subject: [PATCH] drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS
+Git-commit: 0a6986c6595e9afd20ff7280dab36431c1e467f8
+Patch-mainline: v4.19-rc4
+References: bsc#1051510
+
+This Falcon application doesn't appear to be present on some newer
+systems, so let's not fail init if we can't find it.
+
+Tbd: is there a way to determine whether it *should* be there?
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
+index b80618e35491..d65959ef0564 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/devinit/gm200.c
+@@ -158,7 +158,8 @@ gm200_devinit_post(struct nvkm_devinit *base, bool post)
+ }
+
+ /* load and execute some other ucode image (bios therm?) */
+- return pmu_load(init, 0x01, post, NULL, NULL);
++ pmu_load(init, 0x01, post, NULL, NULL);
++ return 0;
+ }
+
+ static const struct nvkm_devinit_func
+--
+2.18.0
+
diff --git a/patches.drivers/drm-nouveau-disp-fix-DP-disable-race.patch b/patches.drivers/drm-nouveau-disp-fix-DP-disable-race.patch
new file mode 100644
index 0000000000..e8909ca9ac
--- /dev/null
+++ b/patches.drivers/drm-nouveau-disp-fix-DP-disable-race.patch
@@ -0,0 +1,118 @@
+From e04cfdc9b7398c60dbc70212415ea63b6c6a93ae Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 4 Sep 2018 15:57:09 +1000
+Subject: [PATCH] drm/nouveau/disp: fix DP disable race
+Git-commit: e04cfdc9b7398c60dbc70212415ea63b6c6a93ae
+Patch-mainline: v4.19-rc4
+References: bsc#1051510
+
+If a HPD pulse signalling the need to retrain the link occurs between
+the KMS driver releasing the output and the supervisor interrupt that
+finishes the teardown, it was possible get a NULL-ptr deref.
+
+Avoid this by marking the link as inactive earlier.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c | 17 ++++++++++++-----
+ drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c | 6 +++---
+ drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c | 2 ++
+ drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h | 3 ++-
+ 4 files changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+index bb34ee77458e..5f301e632599 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+@@ -413,14 +413,10 @@ nvkm_dp_train(struct nvkm_dp *dp, u32 dataKBps)
+ }
+
+ static void
+-nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior)
++nvkm_dp_disable(struct nvkm_outp *outp, struct nvkm_ior *ior)
+ {
+ struct nvkm_dp *dp = nvkm_dp(outp);
+
+- /* Prevent link from being retrained if sink sends an IRQ. */
+- atomic_set(&dp->lt.done, 0);
+- ior->dp.nr = 0;
+-
+ /* Execute DisableLT script from DP Info Table. */
+ nvbios_init(&ior->disp->engine.subdev, dp->info.script[4],
+ init.outp = &dp->outp.info;
+@@ -429,6 +425,16 @@ nvkm_dp_release(struct nvkm_outp *outp, struct nvkm_ior *ior)
+ );
+ }
+
++static void
++nvkm_dp_release(struct nvkm_outp *outp)
++{
++ struct nvkm_dp *dp = nvkm_dp(outp);
++
++ /* Prevent link from being retrained if sink sends an IRQ. */
++ atomic_set(&dp->lt.done, 0);
++ dp->outp.ior->dp.nr = 0;
++}
++
+ static int
+ nvkm_dp_acquire(struct nvkm_outp *outp)
+ {
+@@ -607,6 +613,7 @@ nvkm_dp_func = {
+ .fini = nvkm_dp_fini,
+ .acquire = nvkm_dp_acquire,
+ .release = nvkm_dp_release,
++ .disable = nvkm_dp_disable,
+ };
+
+ static int
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+index f89c7b977aa5..def005dd5fda 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+@@ -501,11 +501,11 @@ nv50_disp_super_2_0(struct nv50_disp *disp, struct nvkm_head *head)
+ nv50_disp_super_ied_off(head, ior, 2);
+
+ /* If we're shutting down the OR's only active head, execute
+- * the output path's release function.
++ * the output path's disable function.
+ */
+ if (ior->arm.head == (1 << head->id)) {
+- if ((outp = ior->arm.outp) && outp->func->release)
+- outp->func->release(outp, ior);
++ if ((outp = ior->arm.outp) && outp->func->disable)
++ outp->func->disable(outp, ior);
+ }
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+index 4b6973f90309..9fcaf3147eb8 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+@@ -93,6 +93,8 @@ nvkm_outp_release(struct nvkm_outp *outp, u8 user)
+ if (ior) {
+ outp->acquired &= ~user;
+ if (!outp->acquired) {
++ if (outp->func->release && outp->ior)
++ outp->func->release(outp);
+ outp->ior->asy.outp = NULL;
+ outp->ior = NULL;
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
+index 776e36972daa..96272ecccb59 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
+@@ -40,7 +40,8 @@ struct nvkm_outp_func {
+ void (*init)(struct nvkm_outp *);
+ void (*fini)(struct nvkm_outp *);
+ int (*acquire)(struct nvkm_outp *);
+- void (*release)(struct nvkm_outp *, struct nvkm_ior *);
++ void (*release)(struct nvkm_outp *);
++ void (*disable)(struct nvkm_outp *, struct nvkm_ior *);
+ };
+
+ #define OUTP_MSG(o,l,f,a...) do { \
+--
+2.18.0
+
diff --git a/patches.drivers/floppy-Do-not-copy-a-kernel-pointer-to-user-memory-i.patch b/patches.drivers/floppy-Do-not-copy-a-kernel-pointer-to-user-memory-i.patch
new file mode 100644
index 0000000000..d855435cf6
--- /dev/null
+++ b/patches.drivers/floppy-Do-not-copy-a-kernel-pointer-to-user-memory-i.patch
@@ -0,0 +1,52 @@
+From 65eea8edc315589d6c993cf12dbb5d0e9ef1fe4e Mon Sep 17 00:00:00 2001
+From: Andy Whitcroft <apw@canonical.com>
+Date: Thu, 20 Sep 2018 09:09:48 -0600
+Subject: [PATCH] floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl
+Git-commit: 65eea8edc315589d6c993cf12dbb5d0e9ef1fe4e
+Patch-mainline: v4.19-rc5
+References: bsc#1051510
+
+The final field of a floppy_struct is the field "name", which is a pointer
+to a string in kernel memory. The kernel pointer should not be copied to
+user memory. The FDGETPRM ioctl copies a floppy_struct to user memory,
+including this "name" field. This pointer cannot be used by the user
+and it will leak a kernel address to user-space, which will reveal the
+location of kernel code and data and undermine KASLR protection.
+
+Model this code after the compat ioctl which copies the returned data
+to a previously cleared temporary structure on the stack (excluding the
+name pointer) and copy out to userspace from there. As we already have
+an inparam union with an appropriate member and that memory is already
+cleared even for read only calls make use of that as a temporary store.
+
+Based on an initial patch by Brian Belleville.
+
+CVE-2018-7755
+Signed-off-by: Andy Whitcroft <apw@canonical.com>
+
+Broke up long line.
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/block/floppy.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 48f622728ce6..f2b6f4da1034 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -3467,6 +3467,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
+ (struct floppy_struct **)&outparam);
+ if (ret)
+ return ret;
++ memcpy(&inparam.g, outparam,
++ offsetof(struct floppy_struct, name));
++ outparam = &inparam.g;
+ break;
+ case FDMSGON:
+ UDP->flags |= FTD_MSG;
+--
+2.18.0
+
diff --git a/patches.drivers/gpio-Fix-crash-due-to-registration-race.patch b/patches.drivers/gpio-Fix-crash-due-to-registration-race.patch
new file mode 100644
index 0000000000..4b6a5b5c89
--- /dev/null
+++ b/patches.drivers/gpio-Fix-crash-due-to-registration-race.patch
@@ -0,0 +1,72 @@
+From d49b48f088c323dbacae44dfbe56d9c985c8a2a1 Mon Sep 17 00:00:00 2001
+From: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Date: Fri, 31 Aug 2018 09:04:18 +0200
+Subject: [PATCH] gpio: Fix crash due to registration race
+Git-commit: d49b48f088c323dbacae44dfbe56d9c985c8a2a1
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+gpiochip_add_data_with_key() adds the gpiochip to the gpio_devices list
+before of_gpiochip_add() is called, but it's only the latter which sets
+the ->of_xlate function pointer. gpiochip_find() can be called by
+someone else between these two actions, and it can find the chip and
+call of_gpiochip_match_node_and_xlate() which leads to the following
+crash due to a NULL ->of_xlate().
+
+ Unhandled prefetch abort: page domain fault (0x01b) at 0x00000000
+ Modules linked in: leds_gpio(+) gpio_generic(+)
+ CPU: 0 PID: 830 Comm: insmod Not tainted 4.18.0+ #43
+ Hardware name: ARM-Versatile Express
+ PC is at (null)
+ LR is at of_gpiochip_match_node_and_xlate+0x2c/0x38
+ Process insmod (pid: 830, stack limit = 0x(ptrval))
+ (of_gpiochip_match_node_and_xlate) from (gpiochip_find+0x48/0x84)
+ (gpiochip_find) from (of_get_named_gpiod_flags+0xa8/0x238)
+ (of_get_named_gpiod_flags) from (gpiod_get_from_of_node+0x2c/0xc8)
+ (gpiod_get_from_of_node) from (devm_fwnode_get_index_gpiod_from_child+0xb8/0x144)
+ (devm_fwnode_get_index_gpiod_from_child) from (gpio_led_probe+0x208/0x3c4 [leds_gpio])
+ (gpio_led_probe [leds_gpio]) from (platform_drv_probe+0x48/0x9c)
+ (platform_drv_probe) from (really_probe+0x1d0/0x3d4)
+ (really_probe) from (driver_probe_device+0x78/0x1c0)
+ (driver_probe_device) from (__driver_attach+0x120/0x13c)
+ (__driver_attach) from (bus_for_each_dev+0x68/0xb4)
+ (bus_for_each_dev) from (bus_add_driver+0x1a8/0x268)
+ (bus_add_driver) from (driver_register+0x78/0x10c)
+ (driver_register) from (do_one_initcall+0x54/0x1fc)
+ (do_one_initcall) from (do_init_module+0x64/0x1f4)
+ (do_init_module) from (load_module+0x2198/0x26ac)
+ (load_module) from (sys_finit_module+0xe0/0x110)
+ (sys_finit_module) from (ret_fast_syscall+0x0/0x54)
+
+One way to fix this would be to rework the hairy registration sequence
+in gpiochip_add_data_with_key(), but since I'd probably introduce a
+couple of new bugs if I attempted that, simply add a check for a
+non-NULL of_xlate function pointer in
+of_gpiochip_match_node_and_xlate(). This works since the driver looking
+for the gpio will simply fail to find the gpio and defer its probe and
+be reprobed when the driver which is registering the gpiochip has fully
+completed its probe.
+
+Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpiolib-of.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index a4f1157d6aa0..d4e7a09598fa 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -31,6 +31,7 @@ static int of_gpiochip_match_node_and_xlate(struct gpio_chip *chip, void *data)
+ struct of_phandle_args *gpiospec = data;
+
+ return chip->gpiodev->dev.of_node == gpiospec->np &&
++ chip->of_xlate &&
+ chip->of_xlate(chip, gpiospec, NULL) >= 0;
+ }
+
+--
+2.18.0
+
diff --git a/patches.drivers/gpio-adp5588-Fix-sleep-in-atomic-context-bug.patch b/patches.drivers/gpio-adp5588-Fix-sleep-in-atomic-context-bug.patch
new file mode 100644
index 0000000000..5f9ca70fe5
--- /dev/null
+++ b/patches.drivers/gpio-adp5588-Fix-sleep-in-atomic-context-bug.patch
@@ -0,0 +1,80 @@
+From 6537886cdc9a637711fd6da980dbb87c2c87c9aa Mon Sep 17 00:00:00 2001
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Mon, 13 Aug 2018 15:57:44 +0200
+Subject: [PATCH] gpio: adp5588: Fix sleep-in-atomic-context bug
+Git-commit: 6537886cdc9a637711fd6da980dbb87c2c87c9aa
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+This fixes:
+[BUG] gpio: gpio-adp5588: A possible sleep-in-atomic-context bug
+ in adp5588_gpio_write()
+[BUG] gpio: gpio-adp5588: A possible sleep-in-atomic-context bug
+ in adp5588_gpio_direction_input()
+
+Reported-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpio-adp5588.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-adp5588.c b/drivers/gpio/gpio-adp5588.c
+index 3530ccd17e04..da9781a2ef4a 100644
+--- a/drivers/gpio/gpio-adp5588.c
++++ b/drivers/gpio/gpio-adp5588.c
+@@ -41,6 +41,8 @@ struct adp5588_gpio {
+ uint8_t int_en[3];
+ uint8_t irq_mask[3];
+ uint8_t irq_stat[3];
++ uint8_t int_input_en[3];
++ uint8_t int_lvl_cached[3];
+ };
+
+ static int adp5588_gpio_read(struct i2c_client *client, u8 reg)
+@@ -173,12 +175,28 @@ static void adp5588_irq_bus_sync_unlock(struct irq_data *d)
+ struct adp5588_gpio *dev = irq_data_get_irq_chip_data(d);
+ int i;
+
+- for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++)
++ for (i = 0; i <= ADP5588_BANK(ADP5588_MAXGPIO); i++) {
++ if (dev->int_input_en[i]) {
++ mutex_lock(&dev->lock);
++ dev->dir[i] &= ~dev->int_input_en[i];
++ dev->int_input_en[i] = 0;
++ adp5588_gpio_write(dev->client, GPIO_DIR1 + i,
++ dev->dir[i]);
++ mutex_unlock(&dev->lock);
++ }
++
++ if (dev->int_lvl_cached[i] != dev->int_lvl[i]) {
++ dev->int_lvl_cached[i] = dev->int_lvl[i];
++ adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + i,
++ dev->int_lvl[i]);
++ }
++
+ if (dev->int_en[i] ^ dev->irq_mask[i]) {
+ dev->int_en[i] = dev->irq_mask[i];
+ adp5588_gpio_write(dev->client, GPIO_INT_EN1 + i,
+ dev->int_en[i]);
+ }
++ }
+
+ mutex_unlock(&dev->irq_lock);
+ }
+@@ -221,9 +239,7 @@ static int adp5588_irq_set_type(struct irq_data *d, unsigned int type)
+ else
+ return -EINVAL;
+
+- adp5588_gpio_direction_input(&dev->gpio_chip, gpio);
+- adp5588_gpio_write(dev->client, GPIO_INT_LVL1 + bank,
+- dev->int_lvl[bank]);
++ dev->int_input_en[bank] |= bit;
+
+ return 0;
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/gpio-mb86s70-Revert-Return-error-if-requesting-an-al.patch b/patches.drivers/gpio-mb86s70-Revert-Return-error-if-requesting-an-al.patch
new file mode 100644
index 0000000000..191bd2673e
--- /dev/null
+++ b/patches.drivers/gpio-mb86s70-Revert-Return-error-if-requesting-an-al.patch
@@ -0,0 +1,47 @@
+From eb3288992864616b66e6442fecfba9e3474e42c5 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Fri, 27 Oct 2017 21:21:48 +0100
+Subject: [PATCH] gpio: mb86s70: Revert "Return error if requesting an already assigned gpio"
+Git-commit: eb3288992864616b66e6442fecfba9e3474e42c5
+Patch-mainline: v4.15-rc1
+References: bsc#1051510
+
+Commit fd9c963c5661 ("gpio: mb86s70: Return error if requesting an
+already assigned gpio") adds code that infers from the state of the
+GPIO Pin Function Register (PFR) whether a GPIO has been assigned
+already. This assumes that the pin functions are set to 'peripheral'
+when the driver is loaded, which is not guaranteed. Also, the GPIO
+layer is perfectly capable of keeping track of which GPIOs have been
+assigned already, so we shouldn't need this check in the first place.
+
+This reverts commit fd9c963c5661af3403e77e312c0d9941773b6c1b.
+
+Cc: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Acked-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpio-mb86s7x.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/gpio/gpio-mb86s7x.c b/drivers/gpio/gpio-mb86s7x.c
+index b140806bded3..3134c0d2bfe4 100644
+--- a/drivers/gpio/gpio-mb86s7x.c
++++ b/drivers/gpio/gpio-mb86s7x.c
+@@ -53,11 +53,6 @@ static int mb86s70_gpio_request(struct gpio_chip *gc, unsigned gpio)
+ spin_lock_irqsave(&gchip->lock, flags);
+
+ val = readl(gchip->base + PFR(gpio));
+- if (!(val & OFFSET(gpio))) {
+- spin_unlock_irqrestore(&gchip->lock, flags);
+- return -EINVAL;
+- }
+-
+ val &= ~OFFSET(gpio);
+ writel(val, gchip->base + PFR(gpio));
+
+--
+2.18.0
+
diff --git a/patches.drivers/gpiolib-acpi-Register-GpioInt-ACPI-event-handlers-fr.patch b/patches.drivers/gpiolib-acpi-Register-GpioInt-ACPI-event-handlers-fr.patch
new file mode 100644
index 0000000000..e6e984ba82
--- /dev/null
+++ b/patches.drivers/gpiolib-acpi-Register-GpioInt-ACPI-event-handlers-fr.patch
@@ -0,0 +1,201 @@
+From 78d3a92edbfb02e8cb83173cad84c3f2d5e1f070 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 14 Aug 2018 16:07:03 +0200
+Subject: [PATCH] gpiolib-acpi: Register GpioInt ACPI event handlers from a late_initcall
+Git-commit: 78d3a92edbfb02e8cb83173cad84c3f2d5e1f070
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+GpioInt ACPI event handlers may see there IRQ triggered immediately
+after requesting the IRQ (esp. level triggered ones). This means that they
+may run before any other (builtin) drivers have had a chance to register
+their OpRegion handlers, leading to errors like this:
+
+[ 1.133274] ACPI Error: No handler for Region [PMOP] ((____ptrval____)) [UserDefinedRegion] (20180531/evregion-132)
+[ 1.133286] ACPI Error: Region UserDefinedRegion (ID=141) has no handler (20180531/exfldio-265)
+[ 1.133297] ACPI Error: Method parse/execution failed \_SB.GPO2._L01, AE_NOT_EXIST (20180531/psparse-516)
+
+We already defer the manual initial trigger of edge triggered interrupts
+by running it from a late_initcall handler, this commit replaces this with
+deferring the entire acpi_gpiochip_request_interrupts() call till then,
+fixing the problem of some OpRegions not being registered yet.
+
+Note that this removes the need to have a list of edge triggered handlers
+which need to run, since the entire acpi_gpiochip_request_interrupts() call
+is now delayed, acpi_gpiochip_request_interrupt() can call these directly
+now.
+
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpiolib-acpi.c | 84 +++++++++++++++++++++++++-------------------
+ 1 file changed, 49 insertions(+), 35 deletions(-)
+
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -25,7 +25,6 @@
+
+ struct acpi_gpio_event {
+ struct list_head node;
+- struct list_head initial_sync_list;
+ acpi_handle handle;
+ unsigned int pin;
+ unsigned int irq;
+@@ -49,10 +48,19 @@ struct acpi_gpio_chip {
+ struct mutex conn_lock;
+ struct gpio_chip *chip;
+ struct list_head events;
++ struct list_head deferred_req_irqs_list_entry;
+ };
+
+-static LIST_HEAD(acpi_gpio_initial_sync_list);
+-static DEFINE_MUTEX(acpi_gpio_initial_sync_list_lock);
++/*
++ * For gpiochips which call acpi_gpiochip_request_interrupts() before late_init
++ * (so builtin drivers) we register the ACPI GpioInt event handlers from a
++ * late_initcall_sync handler, so that other builtin drivers can register their
++ * OpRegions before the event handlers can run. This list contains gpiochips
++ * for which the acpi_gpiochip_request_interrupts() has been deferred.
++ */
++static DEFINE_MUTEX(acpi_gpio_deferred_req_irqs_lock);
++static LIST_HEAD(acpi_gpio_deferred_req_irqs_list);
++static bool acpi_gpio_deferred_req_irqs_done;
+
+ static int acpi_gpiochip_find(struct gpio_chip *gc, void *data)
+ {
+@@ -146,21 +154,6 @@ static struct gpio_desc *acpi_get_gpiod(
+ return gpiochip_get_desc(chip, offset);
+ }
+
+-static void acpi_gpio_add_to_initial_sync_list(struct acpi_gpio_event *event)
+-{
+- mutex_lock(&acpi_gpio_initial_sync_list_lock);
+- list_add(&event->initial_sync_list, &acpi_gpio_initial_sync_list);
+- mutex_unlock(&acpi_gpio_initial_sync_list_lock);
+-}
+-
+-static void acpi_gpio_del_from_initial_sync_list(struct acpi_gpio_event *event)
+-{
+- mutex_lock(&acpi_gpio_initial_sync_list_lock);
+- if (!list_empty(&event->initial_sync_list))
+- list_del_init(&event->initial_sync_list);
+- mutex_unlock(&acpi_gpio_initial_sync_list_lock);
+-}
+-
+ static irqreturn_t acpi_gpio_irq_handler(int irq, void *data)
+ {
+ struct acpi_gpio_event *event = data;
+@@ -277,7 +270,6 @@ static acpi_status acpi_gpiochip_request
+ event->irq = irq;
+ event->pin = pin;
+ event->desc = desc;
+- INIT_LIST_HEAD(&event->initial_sync_list);
+
+ ret = request_threaded_irq(event->irq, NULL, handler, irqflags,
+ "ACPI:Event", event);
+@@ -299,10 +291,9 @@ static acpi_status acpi_gpiochip_request
+ * may refer to OperationRegions from other (builtin) drivers which
+ * may be probed after us.
+ */
+- if (handler == acpi_gpio_irq_handler &&
+- (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
+- ((irqflags & IRQF_TRIGGER_FALLING) && value == 0)))
+- acpi_gpio_add_to_initial_sync_list(event);
++ if (((irqflags & IRQF_TRIGGER_RISING) && value == 1) ||
++ ((irqflags & IRQF_TRIGGER_FALLING) && value == 0))
++ handler(event->irq, event);
+
+ return AE_OK;
+
+@@ -331,6 +322,7 @@ void acpi_gpiochip_request_interrupts(st
+ struct acpi_gpio_chip *acpi_gpio;
+ acpi_handle handle;
+ acpi_status status;
++ bool defer;
+
+ if (!chip->parent || !chip->to_irq)
+ return;
+@@ -343,6 +335,16 @@ void acpi_gpiochip_request_interrupts(st
+ if (ACPI_FAILURE(status))
+ return;
+
++ mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
++ defer = !acpi_gpio_deferred_req_irqs_done;
++ if (defer)
++ list_add(&acpi_gpio->deferred_req_irqs_list_entry,
++ &acpi_gpio_deferred_req_irqs_list);
++ mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
++
++ if (defer)
++ return;
++
+ acpi_walk_resources(handle, "_AEI",
+ acpi_gpiochip_request_interrupt, acpi_gpio);
+ }
+@@ -373,11 +375,14 @@ void acpi_gpiochip_free_interrupts(struc
+ if (ACPI_FAILURE(status))
+ return;
+
++ mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
++ if (!list_empty(&acpi_gpio->deferred_req_irqs_list_entry))
++ list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
++ mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
++
+ list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
+ struct gpio_desc *desc;
+
+- acpi_gpio_del_from_initial_sync_list(event);
+-
+ if (irqd_is_wakeup_set(irq_get_irq_data(event->irq)))
+ disable_irq_wake(event->irq);
+
+@@ -1031,6 +1036,7 @@ void acpi_gpiochip_add(struct gpio_chip
+
+ acpi_gpio->chip = chip;
+ INIT_LIST_HEAD(&acpi_gpio->events);
++ INIT_LIST_HEAD(&acpi_gpio->deferred_req_irqs_list_entry);
+
+ status = acpi_attach_data(handle, acpi_gpio_chip_dh, acpi_gpio);
+ if (ACPI_FAILURE(status)) {
+@@ -1208,20 +1214,28 @@ bool acpi_can_fallback_to_crs(struct acp
+ strcmp(lookup->con_id, con_id) == 0));
+ }
+
+-/* Sync the initial state of handlers after all builtin drivers have probed */
+-static int acpi_gpio_initial_sync(void)
++/* Run deferred acpi_gpiochip_request_interrupts() */
++static int acpi_gpio_handle_deferred_request_interrupts(void)
+ {
+- struct acpi_gpio_event *event, *ep;
++ struct acpi_gpio_chip *acpi_gpio, *tmp;
++
++ mutex_lock(&acpi_gpio_deferred_req_irqs_lock);
++ list_for_each_entry_safe(acpi_gpio, tmp,
++ &acpi_gpio_deferred_req_irqs_list,
++ deferred_req_irqs_list_entry) {
++ acpi_handle handle;
+
+- mutex_lock(&acpi_gpio_initial_sync_list_lock);
+- list_for_each_entry_safe(event, ep, &acpi_gpio_initial_sync_list,
+- initial_sync_list) {
+- acpi_evaluate_object(event->handle, NULL, NULL, NULL);
+- list_del_init(&event->initial_sync_list);
++ handle = ACPI_HANDLE(acpi_gpio->chip->parent);
++ acpi_walk_resources(handle, "_AEI",
++ acpi_gpiochip_request_interrupt, acpi_gpio);
++
++ list_del_init(&acpi_gpio->deferred_req_irqs_list_entry);
+ }
+- mutex_unlock(&acpi_gpio_initial_sync_list_lock);
++
++ acpi_gpio_deferred_req_irqs_done = true;
++ mutex_unlock(&acpi_gpio_deferred_req_irqs_lock);
+
+ return 0;
+ }
+ /* We must use _sync so that this runs after the first deferred_probe run */
+-late_initcall_sync(acpi_gpio_initial_sync);
++late_initcall_sync(acpi_gpio_handle_deferred_request_interrupts);
diff --git a/patches.drivers/hwmon-adt7475-Make-adt7475_read_word-return-errors.patch b/patches.drivers/hwmon-adt7475-Make-adt7475_read_word-return-errors.patch
new file mode 100644
index 0000000000..d44b51fabf
--- /dev/null
+++ b/patches.drivers/hwmon-adt7475-Make-adt7475_read_word-return-errors.patch
@@ -0,0 +1,51 @@
+From f196dec6d50abb2e65fb54a0621b2f1b4d922995 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 14 Aug 2018 13:07:47 +0300
+Subject: [PATCH] hwmon: (adt7475) Make adt7475_read_word() return errors
+Git-commit: f196dec6d50abb2e65fb54a0621b2f1b4d922995
+Patch-mainline: v4.19-rc2
+References: bsc#1051510
+
+The adt7475_read_word() function was meant to return negative error
+codes on failure.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Tokunori Ikegami <ikegami@allied-telesis.co.jp>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwmon/adt7475.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c
+index 16045149f3db..f4c7516eb989 100644
+--- a/drivers/hwmon/adt7475.c
++++ b/drivers/hwmon/adt7475.c
+@@ -302,14 +302,18 @@ static inline u16 volt2reg(int channel, long volt, u8 bypass_attn)
+ return clamp_val(reg, 0, 1023) & (0xff << 2);
+ }
+
+-static u16 adt7475_read_word(struct i2c_client *client, int reg)
++static int adt7475_read_word(struct i2c_client *client, int reg)
+ {
+- u16 val;
++ int val1, val2;
+
+- val = i2c_smbus_read_byte_data(client, reg);
+- val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8);
++ val1 = i2c_smbus_read_byte_data(client, reg);
++ if (val1 < 0)
++ return val1;
++ val2 = i2c_smbus_read_byte_data(client, reg + 1);
++ if (val2 < 0)
++ return val2;
+
+- return val;
++ return val1 | (val2 << 8);
+ }
+
+ static void adt7475_write_word(struct i2c_client *client, int reg, u16 val)
+--
+2.18.0
+
diff --git a/patches.drivers/hwmon-ina2xx-fix-sysfs-shunt-resistor-read-access.patch b/patches.drivers/hwmon-ina2xx-fix-sysfs-shunt-resistor-read-access.patch
new file mode 100644
index 0000000000..689e0fc2e4
--- /dev/null
+++ b/patches.drivers/hwmon-ina2xx-fix-sysfs-shunt-resistor-read-access.patch
@@ -0,0 +1,90 @@
+From 3ad867001c91657c46dcf6656d52eb6080286fd5 Mon Sep 17 00:00:00 2001
+From: Lothar Felten <lothar.felten@gmail.com>
+Date: Tue, 14 Aug 2018 09:09:37 +0200
+Subject: [PATCH] hwmon: (ina2xx) fix sysfs shunt resistor read access
+Git-commit: 3ad867001c91657c46dcf6656d52eb6080286fd5
+Patch-mainline: v4.19-rc2
+References: bsc#1051510
+
+fix the sysfs shunt resistor read access: return the shunt resistor
+value, not the calibration register contents.
+
+update email address
+
+Signed-off-by: Lothar Felten <lothar.felten@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ Documentation/hwmon/ina2xx | 2 +-
+ drivers/hwmon/ina2xx.c | 13 +++++++++++--
+ include/linux/platform_data/ina2xx.h | 2 +-
+ 3 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/Documentation/hwmon/ina2xx b/Documentation/hwmon/ina2xx
+index 72d16f08e431..b8df81f6d6bc 100644
+--- a/Documentation/hwmon/ina2xx
++++ b/Documentation/hwmon/ina2xx
+@@ -32,7 +32,7 @@ Supported chips:
+ Datasheet: Publicly available at the Texas Instruments website
+ http://www.ti.com/
+
+-Author: Lothar Felten <l-felten@ti.com>
++Author: Lothar Felten <lothar.felten@gmail.com>
+
+ Description
+ -----------
+diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
+index e9e6aeabbf84..71d3445ba869 100644
+--- a/drivers/hwmon/ina2xx.c
++++ b/drivers/hwmon/ina2xx.c
+@@ -17,7 +17,7 @@
+ * Bi-directional Current/Power Monitor with I2C Interface
+ * Datasheet: http://www.ti.com/product/ina230
+ *
+- * Copyright (C) 2012 Lothar Felten <l-felten@ti.com>
++ * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com>
+ * Thanks to Jan Volkering
+ *
+ * This program is free software; you can redistribute it and/or modify
+@@ -329,6 +329,15 @@ static int ina2xx_set_shunt(struct ina2xx_data *data, long val)
+ return 0;
+ }
+
++static ssize_t ina2xx_show_shunt(struct device *dev,
++ struct device_attribute *da,
++ char *buf)
++{
++ struct ina2xx_data *data = dev_get_drvdata(dev);
++
++ return snprintf(buf, PAGE_SIZE, "%li\n", data->rshunt);
++}
++
+ static ssize_t ina2xx_store_shunt(struct device *dev,
+ struct device_attribute *da,
+ const char *buf, size_t count)
+@@ -403,7 +412,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL,
+
+ /* shunt resistance */
+ static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR,
+- ina2xx_show_value, ina2xx_store_shunt,
++ ina2xx_show_shunt, ina2xx_store_shunt,
+ INA2XX_CALIBRATION);
+
+ /* update interval (ina226 only) */
+diff --git a/include/linux/platform_data/ina2xx.h b/include/linux/platform_data/ina2xx.h
+index 9abc0ca7259b..9f0aa1b48c78 100644
+--- a/include/linux/platform_data/ina2xx.h
++++ b/include/linux/platform_data/ina2xx.h
+@@ -1,7 +1,7 @@
+ /*
+ * Driver for Texas Instruments INA219, INA226 power monitor chips
+ *
+- * Copyright (C) 2012 Lothar Felten <l-felten@ti.com>
++ * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+--
+2.18.0
+
diff --git a/patches.drivers/media-videobuf-dma-sg-Fix-dma_-sync-unmap-_sg-calls.patch b/patches.drivers/media-videobuf-dma-sg-Fix-dma_-sync-unmap-_sg-calls.patch
new file mode 100644
index 0000000000..1bdae01e45
--- /dev/null
+++ b/patches.drivers/media-videobuf-dma-sg-Fix-dma_-sync-unmap-_sg-calls.patch
@@ -0,0 +1,56 @@
+From 4573027b67cbf51a1b4363e0e75437491c5279d9 Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Mon, 30 Apr 2018 12:56:28 -0400
+Subject: [PATCH] media: videobuf-dma-sg: Fix dma_{sync,unmap}_sg() calls
+Git-commit: 4573027b67cbf51a1b4363e0e75437491c5279d9
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+This reverts commit fc7f8fd42c2b934ac348995e0c530c917fc277d5.
+
+Whilst the rationale for the above commit was in general correct, i.e.
+that users *consuming* the DMA addresses should rely on sglen rather
+than num_pages, it has always been the case that the DMA API itself
+still requires that dma_{sync,unmap}_sg() are called with the original
+number of entries as passed to dma_map_sg(), not the number of mapped
+entries it returned. Thus the particular changes made in that patch
+were erroneous.
+
+At worst this might lead to data loss at the tail end of mapped buffers
+on non-coherent hardware, while at best it's an example of incorrect
+DMA API usage which has proven to mislead readers.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/v4l2-core/videobuf-dma-sg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/videobuf-dma-sg.c b/drivers/media/v4l2-core/videobuf-dma-sg.c
+index eb3e2acf26a7..87b16773f326 100644
+--- a/drivers/media/v4l2-core/videobuf-dma-sg.c
++++ b/drivers/media/v4l2-core/videobuf-dma-sg.c
+@@ -334,7 +334,7 @@ int videobuf_dma_unmap(struct device *dev, struct videobuf_dmabuf *dma)
+ if (!dma->sglen)
+ return 0;
+
+- dma_unmap_sg(dev, dma->sglist, dma->sglen, dma->direction);
++ dma_unmap_sg(dev, dma->sglist, dma->nr_pages, dma->direction);
+
+ vfree(dma->sglist);
+ dma->sglist = NULL;
+@@ -581,7 +581,7 @@ static int __videobuf_sync(struct videobuf_queue *q,
+ MAGIC_CHECK(mem->dma.magic, MAGIC_DMABUF);
+
+ dma_sync_sg_for_cpu(q->dev, mem->dma.sglist,
+- mem->dma.sglen, mem->dma.direction);
++ mem->dma.nr_pages, mem->dma.direction);
+
+ return 0;
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch b/patches.drivers/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch
new file mode 100644
index 0000000000..9f3aa1b003
--- /dev/null
+++ b/patches.drivers/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch
@@ -0,0 +1,57 @@
+From f8c095f679625a26efc7bb1b8c4b3c6fcaef4633 Mon Sep 17 00:00:00 2001
+From: Ganapathi Bhat <gbhat@marvell.com>
+Date: Fri, 1 Jun 2018 16:11:20 +0530
+Subject: [PATCH] mwifiex: handle race during mwifiex_usb_disconnect
+Git-commit: f8c095f679625a26efc7bb1b8c4b3c6fcaef4633
+Patch-mainline: v4.18-rc6
+References: bsc#1051510
+
+Race condition is observed during rmmod of mwifiex_usb:
+
+1. The rmmod thread will call mwifiex_usb_disconnect(), download
+ SHUTDOWN command and do wait_event_interruptible_timeout(),
+ waiting for response.
+
+2. The main thread will handle the response and will do a
+ wake_up_interruptible(), unblocking rmmod thread.
+
+3. On getting unblocked, rmmod thread will make rx_cmd.urb = NULL in
+ mwifiex_usb_free().
+
+4. The main thread will try to resubmit rx_cmd.urb in
+ mwifiex_usb_submit_rx_urb(), which is NULL.
+
+To fix this, move mwifiex_usb_free() from mwifiex_usb_disconnect
+to mwifiex_unregister_dev(). Function mwifiex_unregister_dev() is
+called after flushing the command and RX work queues.
+
+Suggested-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/marvell/mwifiex/usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/usb.c
++++ b/drivers/net/wireless/marvell/mwifiex/usb.c
+@@ -642,8 +642,6 @@ static void mwifiex_usb_disconnect(struc
+ MWIFIEX_FUNC_SHUTDOWN);
+ }
+
+- mwifiex_usb_free(card);
+-
+ mwifiex_dbg(adapter, FATAL,
+ "%s: removing card\n", __func__);
+ mwifiex_remove_card(adapter);
+@@ -992,6 +990,8 @@ static void mwifiex_unregister_dev(struc
+ {
+ struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
+
++ mwifiex_usb_free(card);
++
+ card->adapter = NULL;
+ }
+
diff --git a/patches.drivers/revert-iommu-io-pgtable-avoid-redundant-tlb-syncs b/patches.drivers/revert-iommu-io-pgtable-avoid-redundant-tlb-syncs
new file mode 100644
index 0000000000..56fe5739ce
--- /dev/null
+++ b/patches.drivers/revert-iommu-io-pgtable-avoid-redundant-tlb-syncs
@@ -0,0 +1,73 @@
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Thu, 6 Jul 2017 17:55:31 +0100
+Subject: Revert "iommu/io-pgtable: Avoid redundant TLB syncs"
+Git-commit: 2984f7f3bb5a82df763c2d81444573ed86f36eb8
+Patch-mainline: v4.13-rc4
+References: bsc#1106237
+
+The tlb_sync_pending flag was necessary for correctness in the Mediatek
+M4U driver, but since it offered a small theoretical optimisation for
+all io-pgtable users it was implemented as a high-level thing. However,
+now that some users may not be using a synchronising lock, there are
+several ways this flag can go wrong for them, and at worst it could
+result in incorrect behaviour.
+
+Since we've addressed the correctness issue within the Mediatek driver
+itself, and fixing the optimisation aspect to be concurrency-safe would
+be quite a headache (and impose extra overhead on every operation for
+the sake of slightly helping one case which will virtually never happen
+in typical usage), let's just retire it.
+
+This reverts commit 88492a4700360a086e55d8874ad786105a5e8b0f.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/io-pgtable.h | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/iommu/io-pgtable.h b/drivers/iommu/io-pgtable.h
+index 524263a7ae6f..a3e667077b14 100644
+--- a/drivers/iommu/io-pgtable.h
++++ b/drivers/iommu/io-pgtable.h
+@@ -158,14 +158,12 @@ void free_io_pgtable_ops(struct io_pgtable_ops *ops);
+ * @fmt: The page table format.
+ * @cookie: An opaque token provided by the IOMMU driver and passed back to
+ * any callback routines.
+- * @tlb_sync_pending: Private flag for optimising out redundant syncs.
+ * @cfg: A copy of the page table configuration.
+ * @ops: The page table operations in use for this set of page tables.
+ */
+ struct io_pgtable {
+ enum io_pgtable_fmt fmt;
+ void *cookie;
+- bool tlb_sync_pending;
+ struct io_pgtable_cfg cfg;
+ struct io_pgtable_ops ops;
+ };
+@@ -175,22 +173,17 @@ struct io_pgtable {
+ static inline void io_pgtable_tlb_flush_all(struct io_pgtable *iop)
+ {
+ iop->cfg.tlb->tlb_flush_all(iop->cookie);
+- iop->tlb_sync_pending = true;
+ }
+
+ static inline void io_pgtable_tlb_add_flush(struct io_pgtable *iop,
+ unsigned long iova, size_t size, size_t granule, bool leaf)
+ {
+ iop->cfg.tlb->tlb_add_flush(iova, size, granule, leaf, iop->cookie);
+- iop->tlb_sync_pending = true;
+ }
+
+ static inline void io_pgtable_tlb_sync(struct io_pgtable *iop)
+ {
+- if (iop->tlb_sync_pending) {
+- iop->cfg.tlb->tlb_sync(iop->cookie);
+- iop->tlb_sync_pending = false;
+- }
++ iop->cfg.tlb->tlb_sync(iop->cookie);
+ }
+
+ /**
+
diff --git a/patches.fixes/mac80211-Fix-station-bandwidth-setting-after-channel.patch b/patches.fixes/mac80211-Fix-station-bandwidth-setting-after-channel.patch
new file mode 100644
index 0000000000..1aed1de629
--- /dev/null
+++ b/patches.fixes/mac80211-Fix-station-bandwidth-setting-after-channel.patch
@@ -0,0 +1,108 @@
+From 0007e94355fdb71a1cf5dba0754155cba08f0666 Mon Sep 17 00:00:00 2001
+From: Ilan Peer <ilan.peer@intel.com>
+Date: Fri, 31 Aug 2018 11:31:10 +0300
+Subject: [PATCH] mac80211: Fix station bandwidth setting after channel switch
+Git-commit: 0007e94355fdb71a1cf5dba0754155cba08f0666
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+When performing a channel switch flow for a managed interface, the
+flow did not update the bandwidth of the AP station and the rate
+scale algorithm. In case of a channel width downgrade, this would
+result with the rate scale algorithm using a bandwidth that does not
+match the interface channel configuration.
+
+Fix this by updating the AP station bandwidth and rate scaling algorithm
+before the actual channel change in case of a bandwidth downgrade, or
+after the actual channel change in case of a bandwidth upgrade.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/mlme.c | 53 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 53 insertions(+)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index a59187c016e0..22b699460176 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -978,6 +978,10 @@ static void ieee80211_chswitch_work(struct work_struct *work)
+ */
+
+ if (sdata->reserved_chanctx) {
++ struct ieee80211_supported_band *sband = NULL;
++ struct sta_info *mgd_sta = NULL;
++ enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;
++
+ /*
+ * with multi-vif csa driver may call ieee80211_csa_finish()
+ * many times while waiting for other interfaces to use their
+@@ -986,6 +990,48 @@ static void ieee80211_chswitch_work(struct work_struct *work)
+ if (sdata->reserved_ready)
+ goto out;
+
++ if (sdata->vif.bss_conf.chandef.width !=
++ sdata->csa_chandef.width) {
++ /*
++ * For managed interface, we need to also update the AP
++ * station bandwidth and align the rate scale algorithm
++ * on the bandwidth change. Here we only consider the
++ * bandwidth of the new channel definition (as channel
++ * switch flow does not have the full HT/VHT/HE
++ * information), assuming that if additional changes are
++ * required they would be done as part of the processing
++ * of the next beacon from the AP.
++ */
++ switch (sdata->csa_chandef.width) {
++ case NL80211_CHAN_WIDTH_20_NOHT:
++ case NL80211_CHAN_WIDTH_20:
++ default:
++ bw = IEEE80211_STA_RX_BW_20;
++ break;
++ case NL80211_CHAN_WIDTH_40:
++ bw = IEEE80211_STA_RX_BW_40;
++ break;
++ case NL80211_CHAN_WIDTH_80:
++ bw = IEEE80211_STA_RX_BW_80;
++ break;
++ case NL80211_CHAN_WIDTH_80P80:
++ case NL80211_CHAN_WIDTH_160:
++ bw = IEEE80211_STA_RX_BW_160;
++ break;
++ }
++
++ mgd_sta = sta_info_get(sdata, ifmgd->bssid);
++ sband =
++ local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
++ }
++
++ if (sdata->vif.bss_conf.chandef.width >
++ sdata->csa_chandef.width) {
++ mgd_sta->sta.bandwidth = bw;
++ rate_control_rate_update(local, sband, mgd_sta,
++ IEEE80211_RC_BW_CHANGED);
++ }
++
+ ret = ieee80211_vif_use_reserved_context(sdata);
+ if (ret) {
+ sdata_info(sdata,
+@@ -996,6 +1042,13 @@ static void ieee80211_chswitch_work(struct work_struct *work)
+ goto out;
+ }
+
++ if (sdata->vif.bss_conf.chandef.width <
++ sdata->csa_chandef.width) {
++ mgd_sta->sta.bandwidth = bw;
++ rate_control_rate_update(local, sband, mgd_sta,
++ IEEE80211_RC_BW_CHANGED);
++ }
++
+ goto out;
+ }
+
+--
+2.18.0
+
diff --git a/patches.fixes/mac80211-Run-TXQ-teardown-code-before-de-registering.patch b/patches.fixes/mac80211-Run-TXQ-teardown-code-before-de-registering.patch
new file mode 100644
index 0000000000..2990a6b12f
--- /dev/null
+++ b/patches.fixes/mac80211-Run-TXQ-teardown-code-before-de-registering.patch
@@ -0,0 +1,50 @@
+From 77cfaf52eca5cac30ed029507e0cab065f888995 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@toke.dk>
+Date: Mon, 13 Aug 2018 14:16:25 +0200
+Subject: [PATCH] mac80211: Run TXQ teardown code before de-registering interfaces
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 77cfaf52eca5cac30ed029507e0cab065f888995
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+The TXQ teardown code can reference the vif data structures that are
+stored in the netdev private memory area if there are still packets on
+the queue when it is being freed. Since the TXQ teardown code is run
+after the netdevs are freed, this can lead to a use-after-free. Fix this
+by moving the TXQ teardown code to earlier in ieee80211_unregister_hw().
+
+Reported-by: Ben Greear <greearb@candelatech.com>
+Tested-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index fb73451ed85e..0358f20b675f 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1182,6 +1182,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
+ #if IS_ENABLED(CONFIG_IPV6)
+ unregister_inet6addr_notifier(&local->ifa6_notifier);
+ #endif
++ ieee80211_txq_teardown_flows(local);
+
+ rtnl_lock();
+
+@@ -1210,7 +1211,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
+ skb_queue_purge(&local->skb_queue);
+ skb_queue_purge(&local->skb_queue_unreliable);
+ skb_queue_purge(&local->skb_queue_tdls_chsw);
+- ieee80211_txq_teardown_flows(local);
+
+ destroy_workqueue(local->workqueue);
+ wiphy_unregister(local->hw.wiphy);
+--
+2.18.0
+
diff --git a/patches.fixes/mac80211-correct-use-of-IEEE80211_VHT_CAP_RXSTBC_X.patch b/patches.fixes/mac80211-correct-use-of-IEEE80211_VHT_CAP_RXSTBC_X.patch
new file mode 100644
index 0000000000..1b5f4a41a7
--- /dev/null
+++ b/patches.fixes/mac80211-correct-use-of-IEEE80211_VHT_CAP_RXSTBC_X.patch
@@ -0,0 +1,41 @@
+From 67d1ba8a6dc83d90cd58b89fa6cbf9ae35a0cf7f Mon Sep 17 00:00:00 2001
+From: Danek Duvall <duvall@comfychair.org>
+Date: Wed, 22 Aug 2018 16:01:04 -0700
+Subject: [PATCH] mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X
+Git-commit: 67d1ba8a6dc83d90cd58b89fa6cbf9ae35a0cf7f
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+The mod mask for VHT capabilities intends to say that you can override
+the number of STBC receive streams, and it does, but only by accident.
+The IEEE80211_VHT_CAP_RXSTBC_X aren't bits to be set, but values (albeit
+left-shifted). ORing the bits together gets the right answer, but we
+should use the _MASK macro here instead.
+
+Signed-off-by: Danek Duvall <duvall@comfychair.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/main.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 0358f20b675f..27cd64acaf00 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -470,10 +470,7 @@ static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = {
+ cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC |
+ IEEE80211_VHT_CAP_SHORT_GI_80 |
+ IEEE80211_VHT_CAP_SHORT_GI_160 |
+- IEEE80211_VHT_CAP_RXSTBC_1 |
+- IEEE80211_VHT_CAP_RXSTBC_2 |
+- IEEE80211_VHT_CAP_RXSTBC_3 |
+- IEEE80211_VHT_CAP_RXSTBC_4 |
++ IEEE80211_VHT_CAP_RXSTBC_MASK |
+ IEEE80211_VHT_CAP_TXSTBC |
+ IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
+ IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+--
+2.18.0
+
diff --git a/patches.fixes/mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch b/patches.fixes/mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
new file mode 100644
index 0000000000..1c75aaf786
--- /dev/null
+++ b/patches.fixes/mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
@@ -0,0 +1,50 @@
+From 1eb507903665442360a959136dfa3234c43db085 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Date: Wed, 29 Aug 2018 21:03:25 +0200
+Subject: [PATCH] mac80211: do not convert to A-MSDU if frag/subframe limited
+Git-commit: 1eb507903665442360a959136dfa3234c43db085
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+Do not start to aggregate packets in a A-MSDU frame (converting the
+first subframe to A-MSDU, adding the header) if max_tx_fragments or
+max_amsdu_subframes limits are already exceeded by it. In particular,
+this happens when drivers set the limit to 1 to avoid A-MSDUs at all.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+[reword commit message to be more precise]
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/tx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 667a73d6eb5c..1aac5e3c7eee 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3208,9 +3208,6 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
+ if (skb->len + head->len > max_amsdu_len)
+ goto out;
+
+- if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
+- goto out;
+-
+ nfrags = 1 + skb_shinfo(skb)->nr_frags;
+ nfrags += 1 + skb_shinfo(head)->nr_frags;
+ frag_tail = &skb_shinfo(head)->frag_list;
+@@ -3226,6 +3223,9 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
+ if (max_frags && nfrags > max_frags)
+ goto out;
+
++ if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
++ goto out;
++
+ /*
+ * Pad out the previous subframe to a multiple of 4 by adding the
+ * padding to the next one, that's being added. Note that head->len
+--
+2.18.0
+
diff --git a/patches.fixes/mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch b/patches.fixes/mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
new file mode 100644
index 0000000000..a4a9f813a0
--- /dev/null
+++ b/patches.fixes/mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
@@ -0,0 +1,91 @@
+From 6c18b27d6e5c6a7206364eae2b47bc8d8b2fa68f Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Fri, 31 Aug 2018 11:31:12 +0300
+Subject: [PATCH] mac80211: don't Tx a deauth frame if the AP forbade Tx
+Git-commit: 6c18b27d6e5c6a7206364eae2b47bc8d8b2fa68f
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+If the driver fails to properly prepare for the channel
+switch, mac80211 will disconnect. If the CSA IE had mode
+set to 1, it means that the clients are not allowed to send
+any Tx on the current channel, and that includes the
+deauthentication frame.
+
+Make sure that we don't send the deauthentication frame in
+this case.
+
+In iwlwifi, this caused a failure to flush queues since the
+firmware already closed the queues after having parsed the
+CSA IE. Then mac80211 would wait until the deauthentication
+frame would go out (drv_flush(drop=false)) and that would
+never happen.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/mlme.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 22b699460176..b046bf95eb3c 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1270,6 +1270,16 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+ cbss->beacon_interval));
+ return;
+ drop_connection:
++ /*
++ * This is just so that the disconnect flow will know that
++ * we were trying to switch channel and failed. In case the
++ * mode is 1 (we are not allowed to Tx), we will know not to
++ * send a deauthentication frame. Those two fields will be
++ * reset when the disconnection worker runs.
++ */
++ sdata->vif.csa_active = true;
++ sdata->csa_block_tx = csa_ie.mode;
++
+ ieee80211_queue_work(&local->hw, &ifmgd->csa_connection_drop_work);
+ mutex_unlock(&local->chanctx_mtx);
+ mutex_unlock(&local->mtx);
+@@ -2453,6 +2463,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+ u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
++ bool tx;
+
+ sdata_lock(sdata);
+ if (!ifmgd->associated) {
+@@ -2460,6 +2471,8 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
+ return;
+ }
+
++ tx = !sdata->csa_block_tx;
++
+ /* AP is probably out of range (or not reachable for another reason) so
+ * remove the bss struct for that AP.
+ */
+@@ -2467,7 +2480,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
+
+ ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+ WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+- true, frame_buf);
++ tx, frame_buf);
+ mutex_lock(&local->mtx);
+ sdata->vif.csa_active = false;
+ ifmgd->csa_waiting_bcn = false;
+@@ -2478,7 +2491,7 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
+ }
+ mutex_unlock(&local->mtx);
+
+- ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), true,
++ ieee80211_report_disconnect(sdata, frame_buf, sizeof(frame_buf), tx,
+ WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
+
+ sdata_unlock(sdata);
+--
+2.18.0
+
diff --git a/patches.fixes/mac80211-fix-a-race-between-restart-and-CSA-flows.patch b/patches.fixes/mac80211-fix-a-race-between-restart-and-CSA-flows.patch
new file mode 100644
index 0000000000..906fccdb44
--- /dev/null
+++ b/patches.fixes/mac80211-fix-a-race-between-restart-and-CSA-flows.patch
@@ -0,0 +1,100 @@
+From f3ffb6c3a28963657eb8b02a795d75f2ebbd5ef4 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Fri, 31 Aug 2018 11:31:06 +0300
+Subject: [PATCH] mac80211: fix a race between restart and CSA flows
+Git-commit: f3ffb6c3a28963657eb8b02a795d75f2ebbd5ef4
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+We hit a problem with iwlwifi that was caused by a bug in
+mac80211. A bug in iwlwifi caused the firwmare to crash in
+certain cases in channel switch. Because of that bug,
+drv_pre_channel_switch would fail and trigger the restart
+flow.
+Now we had the hw restart worker which runs on the system's
+workqueue and the csa_connection_drop_work worker that runs
+on mac80211's workqueue that can run together. This is
+obviously problematic since the restart work wants to
+reconfigure the connection, while the csa_connection_drop_work
+worker does the exact opposite: it tries to disconnect.
+
+Fix this by cancelling the csa_connection_drop_work worker
+in the restart worker.
+
+Note that this can sound racy: we could have:
+
+driver iface_work CSA_work restart_work
+
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
++++++++++++++++++++++++++++++++++++++++++++++
+ |
+ <--drv_cs ---|
+<FW CRASH!>
+-CS FAILED-->
+ | |
+ | cancel_work(CSA)
+ schedule |
+ CSA work |
+ | |
+ Race between those 2
+
+But this is not possible because we flush the workqueue
+in the restart worker before we cancel the CSA worker.
+That would be bullet proof if we could guarantee that
+we schedule the CSA worker only from the iface_work
+which runs on the workqueue (and not on the system's
+workqueue), but unfortunately we do have an instance
+in which we schedule the CSA work outside the context
+of the workqueue (ieee80211_chswitch_done).
+
+Note also that we should probably cancel other workers
+like beacon_connection_loss_work and possibly others
+for different types of interfaces, at the very least,
+IBSS should suffer from the exact same problem, but for
+now, do the minimum to fix the actual bug that was actually
+experienced and reproduced.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/mac80211/main.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 27cd64acaf00..66cbddd65b47 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -255,8 +255,27 @@ static void ieee80211_restart_work(struct work_struct *work)
+
+ flush_work(&local->radar_detected_work);
+ rtnl_lock();
+- list_for_each_entry(sdata, &local->interfaces, list)
++ list_for_each_entry(sdata, &local->interfaces, list) {
++ /*
++ * XXX: there may be more work for other vif types and even
++ * for station mode: a good thing would be to run most of
++ * the iface type's dependent _stop (ieee80211_mg_stop,
++ * ieee80211_ibss_stop) etc...
++ * For now, fix only the specific bug that was seen: race
++ * between csa_connection_drop_work and us.
++ */
++ if (sdata->vif.type == NL80211_IFTYPE_STATION) {
++ /*
++ * This worker is scheduled from the iface worker that
++ * runs on mac80211's workqueue, so we can't be
++ * scheduling this worker after the cancel right here.
++ * The exception is ieee80211_chswitch_done.
++ * Then we can have a race...
++ */
++ cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
++ }
+ flush_delayed_work(&sdata->dec_tailroom_needed_wk);
++ }
+ ieee80211_scan_cancel(local);
+
+ /* make sure any new ROC will consider local->in_reconfig */
+--
+2.18.0
+
diff --git a/patches.fixes/mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch b/patches.fixes/mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
new file mode 100644
index 0000000000..460a95368b
--- /dev/null
+++ b/patches.fixes/mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
@@ -0,0 +1,40 @@
+From 1f631c3201fe5491808df143d8fcba81b3197ffd Mon Sep 17 00:00:00 2001
+From: Yuan-Chi Pang <fu3mo6goo@gmail.com>
+Date: Wed, 29 Aug 2018 09:30:08 +0800
+Subject: [PATCH] mac80211: mesh: fix HWMP sequence numbering to follow standard
+Git-commit: 1f631c3201fe5491808df143d8fcba81b3197ffd
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+IEEE 802.11-2016 14.10.8.3 HWMP sequence numbering says:
+If it is a target mesh STA, it shall update its own HWMP SN to
+maximum (current HWMP SN, target HWMP SN in the PREQ element) + 1
+immediately before it generates a PREP element in response to a
+PREQ element.
+
+Signed-off-by: Yuan-Chi Pang <fu3mo6goo@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/mesh_hwmp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index 35ad3983ae4b..daf9db3c8f24 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -572,6 +572,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
+ forward = false;
+ reply = true;
+ target_metric = 0;
++
++ if (SN_GT(target_sn, ifmsh->sn))
++ ifmsh->sn = target_sn;
++
+ if (time_after(jiffies, ifmsh->last_sn_update +
+ net_traversal_jiffies(sdata)) ||
+ time_before(jiffies, ifmsh->last_sn_update)) {
+--
+2.18.0
+
diff --git a/patches.fixes/mac80211-shorten-the-IBSS-debug-messages.patch b/patches.fixes/mac80211-shorten-the-IBSS-debug-messages.patch
new file mode 100644
index 0000000000..7c2d3974c9
--- /dev/null
+++ b/patches.fixes/mac80211-shorten-the-IBSS-debug-messages.patch
@@ -0,0 +1,82 @@
+From c6e57b3896fc76299913b8cfd82d853bee8a2c84 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Fri, 31 Aug 2018 11:31:13 +0300
+Subject: [PATCH] mac80211: shorten the IBSS debug messages
+Git-commit: c6e57b3896fc76299913b8cfd82d853bee8a2c84
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+When tracing is enabled, all the debug messages are recorded and must
+not exceed MAX_MSG_LEN (100) columns. Longer debug messages grant the
+user with:
+
+Warning: CPU: 3 PID: 32642 at /tmp/wifi-core-20180806094828/src/iwlwifi-stack-dev/net/mac80211/./trace_msg.h:32 trace_event_raw_event_mac80211_msg_event+0xab/0xc0 [mac80211]
+Workqueue: phy1 ieee80211_iface_work [mac80211] RIP: 0010:trace_event_raw_event_mac80211_msg_event+0xab/0xc0 [mac80211] Call Trace: __sdata_dbg+0xbd/0x120 [mac80211] ieee80211_ibss_rx_queued_mgmt+0x15f/0x510 [mac80211] ieee80211_iface_work+0x21d/0x320 [mac80211]
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/ibss.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index 6449a1c2283b..f0f5fedb8caa 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -947,8 +947,8 @@ static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
+ if (len < IEEE80211_DEAUTH_FRAME_LEN)
+ return;
+
+- ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
+- mgmt->sa, mgmt->da, mgmt->bssid, reason);
++ ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
++ ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason);
+ sta_info_destroy_addr(sdata, mgmt->sa);
+ }
+
+@@ -966,9 +966,9 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
+ auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
+ auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
+
+- ibss_dbg(sdata,
+- "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
+- mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
++ ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
++ ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n",
++ mgmt->bssid, auth_transaction);
+
+ if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
+ return;
+@@ -1175,10 +1175,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
+ rx_timestamp = drv_get_tsf(local, sdata);
+ }
+
+- ibss_dbg(sdata,
+- "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
++ ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n",
+ mgmt->sa, mgmt->bssid,
+- (unsigned long long)rx_timestamp,
++ (unsigned long long)rx_timestamp);
++ ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n",
+ (unsigned long long)beacon_timestamp,
+ (unsigned long long)(rx_timestamp - beacon_timestamp),
+ jiffies);
+@@ -1537,9 +1537,9 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
+
+ tx_last_beacon = drv_tx_last_beacon(local);
+
+- ibss_dbg(sdata,
+- "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
+- mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
++ ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
++ ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n",
++ mgmt->bssid, tx_last_beacon);
+
+ if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
+ return;
+--
+2.18.0
+
diff --git a/patches.fixes/mac80211_hwsim-correct-use-of-IEEE80211_VHT_CAP_RXST.patch b/patches.fixes/mac80211_hwsim-correct-use-of-IEEE80211_VHT_CAP_RXST.patch
new file mode 100644
index 0000000000..8c2bb7ba02
--- /dev/null
+++ b/patches.fixes/mac80211_hwsim-correct-use-of-IEEE80211_VHT_CAP_RXST.patch
@@ -0,0 +1,39 @@
+From d7c863a2f65e48f442379f4ee1846d52e0c5d24d Mon Sep 17 00:00:00 2001
+From: Danek Duvall <duvall@comfychair.org>
+Date: Wed, 22 Aug 2018 16:01:05 -0700
+Subject: [PATCH] mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X
+Git-commit: d7c863a2f65e48f442379f4ee1846d52e0c5d24d
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+The mac80211_hwsim driver intends to say that it supports up to four
+STBC receive streams, but instead it ends up saying something undefined.
+The IEEE80211_VHT_CAP_RXSTBC_X macros aren't independent bits that can
+be ORed together, but values. In this case, _4 is the appropriate one
+to use.
+
+Signed-off-by: Danek Duvall <duvall@comfychair.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/mac80211_hwsim.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index fe1b0108f06d..7d0b460868f9 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -2699,9 +2699,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
+ IEEE80211_VHT_CAP_SHORT_GI_80 |
+ IEEE80211_VHT_CAP_SHORT_GI_160 |
+ IEEE80211_VHT_CAP_TXSTBC |
+- IEEE80211_VHT_CAP_RXSTBC_1 |
+- IEEE80211_VHT_CAP_RXSTBC_2 |
+- IEEE80211_VHT_CAP_RXSTBC_3 |
+ IEEE80211_VHT_CAP_RXSTBC_4 |
+ IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
+ sband->vht_cap.vht_mcs.rx_mcs_map =
+--
+2.18.0
+
diff --git a/patches.fixes/mac80211_hwsim-require-at-least-one-channel.patch b/patches.fixes/mac80211_hwsim-require-at-least-one-channel.patch
new file mode 100644
index 0000000000..7f29be3aaa
--- /dev/null
+++ b/patches.fixes/mac80211_hwsim-require-at-least-one-channel.patch
@@ -0,0 +1,39 @@
+From 484004339d4514fde425f6e8a9f6a6cc979bb0c3 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 15 Aug 2018 18:17:03 +0200
+Subject: [PATCH] mac80211_hwsim: require at least one channel
+Git-commit: 484004339d4514fde425f6e8a9f6a6cc979bb0c3
+Patch-mainline: v4.19-rc3
+References: bsc#1051510
+
+Syzbot continues to try to create mac80211_hwsim radios, and
+manages to pass parameters that are later checked with WARN_ON
+in cfg80211 - catch another one in hwsim directly.
+
+Reported-by: syzbot+2a12f11c306afe871c1f@syzkaller.appspotmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/mac80211_hwsim.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 18e819d964f1..fe1b0108f06d 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3194,6 +3194,11 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ if (info->attrs[HWSIM_ATTR_CHANNELS])
+ param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
+
++ if (param.channels < 1) {
++ GENL_SET_ERR_MSG(info, "must have at least one channel");
++ return -EINVAL;
++ }
++
+ if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) {
+ GENL_SET_ERR_MSG(info, "too many channels specified");
+ return -EINVAL;
+--
+2.18.0
+
diff --git a/patches.arch/x86-hyperv-check-for-required-priviliges-in-hyperv_init b/patches.suse/msft-hv-1588-x86-hyperv-Check-for-required-priviliges-in-hyperv_i.patch
index 972c06b0fb..972c06b0fb 100644
--- a/patches.arch/x86-hyperv-check-for-required-priviliges-in-hyperv_init
+++ b/patches.suse/msft-hv-1588-x86-hyperv-Check-for-required-priviliges-in-hyperv_i.patch
diff --git a/patches.arch/x86-delay-skip-of-emulated-hypercall-instruction b/patches.suse/msft-hv-1677-x86-Delay-skip-of-emulated-hypercall-instruction.patch
index 3f46969432..3f46969432 100644
--- a/patches.arch/x86-delay-skip-of-emulated-hypercall-instruction
+++ b/patches.suse/msft-hv-1677-x86-Delay-skip-of-emulated-hypercall-instruction.patch
diff --git a/patches.arch/kvm-x86-fix-ud-address-of-failed-hyper-v-hypercalls b/patches.suse/msft-hv-1696-KVM-x86-fix-UD-address-of-failed-Hyper-V-hypercalls.patch
index 46bd70818f..46bd70818f 100644
--- a/patches.arch/kvm-x86-fix-ud-address-of-failed-hyper-v-hypercalls
+++ b/patches.suse/msft-hv-1696-KVM-x86-fix-UD-address-of-failed-Hyper-V-hypercalls.patch
diff --git a/series.conf b/series.conf
index db3922e132..0827503b90 100644
--- a/series.conf
+++ b/series.conf
@@ -4052,6 +4052,7 @@
patches.arch/powerpc-mm-Fix-pmd-pte_devmap-on-non-leaf-entries.patch
patches.arch/powerpc-perf-POWER9-PMU-stops-after-idle-workaround.patch
patches.arch/iommu-arm-smmu-Reintroduce-locking-around-TLB-sync-o.patch
+ patches.drivers/revert-iommu-io-pgtable-avoid-redundant-tlb-syncs
patches.drivers/iommu-amd-fix-schedule-while-atomic-bug-in-initialization-code
patches.drivers/ASoC-samsung-odroid-Fix-EPLL-frequency-values
patches.suse/0060-libceph-make-encode_request_-work-with-r_mempool-requests.patch
@@ -5374,6 +5375,7 @@
patches.drivers/pinctrl-intel-Add-Intel-Lewisburg-GPIO-support.patch
patches.drivers/pinctrl-intel-Read-back-TX-buffer-state
patches.drivers/pinctrl-uniphier-fix-members-of-rmii-group-for-Pro4
+ patches.drivers/Revert-pinctrl-sunxi-Don-t-enforce-bias-disable-for-.patch
patches.drivers/0006-gpio-Add-gpio-driver-support-for-ThunderX-and-OCTEON.patch
patches.drivers/gpio-brcmstb-check-return-value-of-gpiochip_irqchip_
patches.drivers/0001-cpufreq-remove-setting-of-policy-cpu-in-policy-cpus-.patch
@@ -6794,6 +6796,7 @@
patches.suse/kvm-nVMX-Remove-nested_vmx_succeed-after-successful-.patch
patches.suse/kvm-vmx-Handle-VMLAUNCH-VMRESUME-failure-properly.patch
patches.suse/kvm-nVMX-Handle-deferred-early-VMLAUNCH-VMRESUME-fai.patch
+ patches.drivers/drm-amdgpu-revert-fix-deadlock-of-reservation-betwee.patch
patches.drivers/Input-ucb1400_ts-fix-suspend-and-resume-handling.patch
patches.drivers/Input-xpad-validate-USB-endpoint-type-during-probe
patches.drivers/Input-i8042-add-Gigabyte-P57-to-the-keyboard-reset-t
@@ -7896,6 +7899,7 @@
patches.fixes/x86-platform-uv-add-check-of-tsc-state-set-by-uv-bio.patch
patches.fixes/x86-tsc-make-config_x86_tsc-n-build-work-again.patch
patches.suse/x86-CPU-Avoid-unnecessary-IPIs-in-arch_freq_get_on_cpu.patch
+ patches.drivers/PM-Domains-Fix-genpd-to-deal-with-drivers-returning-.patch
patches.fixes/cpuidle-fix-broadcast-control-when-broadcast-can-not-be-entered.patch
patches.fixes/cpufreq-schedutil-Reset-cached_raw_freq-when-not-in-sync-with-next_freq.patch
patches.drivers/PM-OPP-Move-error-message-to-debug-level
@@ -8483,6 +8487,7 @@
patches.drivers/gpio-brcmstb-release-the-bgpio-lock-during-irq-handl
patches.drivers/gpio-brcmstb-switch-to-handle_level_irq-flow
patches.drivers/gpio-brcmstb-correct-the-configuration-of-level-inte
+ patches.drivers/gpio-mb86s70-Revert-Return-error-if-requesting-an-al.patch
patches.drivers/0001-ACPI-APD-Add-clock-frequency-for-ThunderX2-I2C-contr.patch
patches.drivers/0003-i2c-xlp9xx-Get-clock-frequency-with-clk-API.patch
patches.drivers/0004-i2c-xlp9xx-Handle-I2C_M_RECV_LEN-in-msg-flags.patch
@@ -9983,6 +9988,7 @@
patches.drivers/thermal-drivers-hisi-Simplify-the-temperature-step-c
patches.drivers/thermal-drivers-hisi-Fix-multiple-alarm-interrupts-f
patches.drivers/thermal-drivers-step_wise-Fix-temperature-regulation
+ patches.drivers/drm-amdgpu-Pulling-old-prepare-and-submit-for-flip-b.patch
patches.drivers/PM-runtime-Drop-children-check-from-__pm_runtime_set
patches.drivers/dynamic-debug-howto-fix-optional-omitted-ending-line
patches.suse/0001-lib-int_sqrt-optimize-small-argument.patch
@@ -11830,6 +11836,7 @@
patches.drivers/RDMA-mlx5-Avoid-memory-leak-in-case-of-XRCD-dealloc-.patch
patches.drivers/gpio-iop-add-missing-MODULE_DESCRIPTION-AUTHOR-LICEN
patches.drivers/gpio-ath79-add-missing-MODULE_DESCRIPTION-LICENSE
+ patches.drivers/Revert-gpio-set-up-initial-state-from-.get_direction.patch
patches.drivers/gpio-label-descriptors-using-the-device-name
patches.drivers/0008-gpio-thunderx-fix-error-return-code-in-thunderx_gpio.patch
patches.drivers/gpio-stmpe-i2c-transfer-are-forbiden-in-atomic-conte
@@ -13195,7 +13202,7 @@
patches.suse/KVM-s390-diagnoses-are-instructions-as-well.patch
patches.suse/KVM-s390-add-vcpu-stat-counters-for-many-instruction.patch
patches.fixes/x86-kvm-vmx-do-not-use-vm-exit-instruction-length-fo.patch
- patches.arch/x86-hyperv-check-for-required-priviliges-in-hyperv_init
+ patches.suse/msft-hv-1588-x86-hyperv-Check-for-required-priviliges-in-hyperv_i.patch
patches.arch/KVM-PPC-Book3S-HV-Make-sure-we-don-t-re-enter-guest-.patch
patches.arch/KVM-PPC-Book3S-HV-Enable-use-of-the-new-XIVE-single-.patch
patches.arch/KVM-PPC-Book3S-HV-Drop-locks-before-reading-guest-me.patch
@@ -14357,6 +14364,7 @@
patches.drivers/rtlwifi-rtl8192cu-Remove-variable-self-assignment-in
patches.drivers/rtl8187-Fix-NULL-pointer-dereference-in-priv-conf_mu
patches.drivers/mt7601u-let-mac80211-validate-rx-CCMP-PN
+ patches.drivers/Revert-mwifiex-fix-incorrect-ht-capability-problem.patch
patches.drivers/ethernet-Use-octal-not-symbolic-permissions.patch
patches.drivers/net-hns3-fix-for-returning-wrong-value-problem-in-hn.patch
patches.drivers/net-hns3-fix-for-returning-wrong-value-problem-in-hn-da44a00f.patch
@@ -15531,7 +15539,7 @@
patches.drivers/ALSA-hda-Add-Lenovo-C50-All-in-one-to-the-power_save
patches.drivers/ALSA-usb-mixer-volume-quirk-for-CM102-A-102S
patches.drivers/ALSA-hda-realtek-Clevo-P950ER-ALC1220-Fixup
- patches.arch/x86-delay-skip-of-emulated-hypercall-instruction
+ patches.suse/msft-hv-1677-x86-Delay-skip-of-emulated-hypercall-instruction.patch
patches.drivers/drm-Match-sysfs-name-in-link-removal-to-link-creatio
patches.drivers/drm-dumb-buffers-Integer-overflow-in-drm_mode_create
patches.drivers/drm-vmwgfx-Set-dmabuf_size-when-vmw_dmabuf_init-is-s
@@ -15680,7 +15688,7 @@
patches.suse/kernel-sys.c-fix-potential-Spectre-v1-issue.patch
patches.arch/x86-kvm-fix-lapic-timer-drift-when-guest-uses-periodic-mode
patches.arch/kvm-x86-update-cpuid-properly-when-cr4-osxave-or-cr4-pke-is-changed
- patches.arch/kvm-x86-fix-ud-address-of-failed-hyper-v-hypercalls
+ patches.suse/msft-hv-1696-KVM-x86-fix-UD-address-of-failed-Hyper-V-hypercalls.patch
patches.suse/0001-tracing-Make-the-snapshot-trigger-work-with-instance.patch
patches.fixes/afs-Fix-directory-permissions-check.patch
patches.drivers/Input-synaptics-Lenovo-Carbon-X1-Gen5-2017-devices-s
@@ -15876,6 +15884,7 @@
patches.drivers/drm-Add-aspect-ratio-parsing-in-DRM-layer
patches.drivers/drm-Add-and-handle-new-aspect-ratios-in-DRM-layer
patches.drivers/drm-i915-Don-t-request-a-bug-report-for-unsafe-modul
+ patches.drivers/Revert-drm-i915-gvt-set-max-priority-for-gvt-context.patch
patches.drivers/drm-amdgpu-Add-APU-support-in-vi_set_uvd_clocks
patches.drivers/drm-amdgpu-Add-APU-support-in-vi_set_vce_clocks
patches.drivers/drm-amdgpu-Remove-VRAM-from-shared-bo-domains
@@ -16290,6 +16299,7 @@
patches.drivers/media-cx231xx-Add-support-for-AverMedia-DVD-EZMaker-
patches.drivers/media-siano-get-rid-of-__le32-__le16-cast-warnings
patches.drivers/media-cx88-Get-rid-of-spurious-call-to-cx8800_start_
+ patches.drivers/media-videobuf-dma-sg-Fix-dma_-sync-unmap-_sg-calls.patch
patches.drivers/media-saa7164-Fix-driver-name-in-debug-output
patches.drivers/media-media-device-fix-ioctl-function-types
patches.drivers/media-rcar_jpu-Add-missing-clk_disable_unprepare-on-
@@ -16670,6 +16680,7 @@
patches.fixes/rbd-flush-rbd_dev-watch_dwork-after-watch-is-unregistered.patch
patches.fixes/mm-fix-devmem_is_allowed-for-sub-page-System-RAM-int.patch
patches.suse/mremap-Remove-LATENCY_LIMIT-from-mremap-to-reduce-the-number-of-TLB-shootdowns.patch
+ patches.drivers/Revert-drm-amdgpu-Add-an-ATPX-quirk-for-hybrid-lapto.patch
patches.drivers/ALSA-fm801-add-error-handling-for-snd_ctl_add
patches.drivers/ALSA-emu10k1-add-error-handling-for-snd_ctl_add
patches.drivers/ALSA-hda-add-dock-and-led-support-for-HP-EliteBook-830
@@ -16940,6 +16951,8 @@
patches.arch/kvmclock-fix-tsc-calibration-for-nested-guests
patches.drivers/rtlwifi-Fix-kernel-Oops-Fw-download-fail
patches.drivers/brcmfmac-stop-watchdog-before-detach-and-free-everyt
+ patches.drivers/Revert-mwifiex-handle-race-during-mwifiex_usb_discon.patch
+ patches.drivers/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch
patches.drivers/rtlwifi-rtl8821ae-fix-firmware-is-not-ready-to-run
patches.drivers/ath10k-update-the-phymode-along-with-bandwidth-chang
patches.suse/gen_stats-Fix-netlink-stats-dumping-in-the-presence-.patch
@@ -16998,6 +17011,7 @@
patches.fixes/pci-designware-fix-i-o-space-page-leak
patches.suse/PCI-aardvark-Fix-I-O-space-page-leak.patch
patches.fixes/pci-faraday-fix-i-o-space-page-leak
+ patches.drivers/drm-amdgpu-add-another-ATPX-quirk-for-TOPAZ.patch
patches.drivers/drm-nouveau-gem-off-by-one-bugs-in-nouveau_gem_pushb
patches.drivers/drm-nouveau-Use-drm_connector_list_iter_-for-iterati
patches.drivers/drm-nouveau-Avoid-looping-through-fake-MST-connector
@@ -17391,6 +17405,7 @@
patches.drivers/crypto-blkcipher-fix-crash-flushing-dcache-in-error-
patches.fixes/crypto-ablkcipher-fix-crash-flushing-dcache-in-error.patch
patches.drivers/crypto-ccp-Check-for-NULL-PSP-pointer-at-module-unlo
+ patches.drivers/Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-eDP
patches.drivers/drm-fb-helper-Fix-typo-on-kerneldoc
patches.drivers/drm-rockchip-lvds-add-missing-of_node_put
patches.drivers/drm-i915-Only-show-debug-for-state-changes-when-bann
@@ -17782,6 +17797,8 @@
patches.drivers/crypto-caam-qi-fix-error-path-in-xts-setkey.patch
patches.drivers/crypto-vmx-Fix-sleep-in-atomic-bugs.patch
patches.fixes/crypto-cavium-nitrox-fix-for-command-corruption-in-q.patch
+ patches.drivers/hwmon-ina2xx-fix-sysfs-shunt-resistor-read-access.patch
+ patches.drivers/hwmon-adt7475-Make-adt7475_read_word-return-errors.patch
patches.drivers/cdrom-Fix-info-leak-OOB-read-in-cdrom_ioctl_drive_st
patches.fixes/nvme-pci-add-a-memory-barrier-to-nvme_dbbuf_update_a.patch
patches.drivers/PM-clk-signedness-bug-in-of_pm_clk_add_clks
@@ -17804,14 +17821,28 @@
patches.drivers/r8169-add-support-for-NCube-8168-network-card.patch
patches.drivers/bnxt_en-Clean-up-unused-functions.patch
patches.drivers/bnxt_en-Do-not-adjust-max_cp_rings-by-the-ones-used-.patch
+ patches.fixes/mac80211-Run-TXQ-teardown-code-before-de-registering.patch
+ patches.fixes/mac80211_hwsim-require-at-least-one-channel.patch
+ patches.fixes/mac80211-correct-use-of-IEEE80211_VHT_CAP_RXSTBC_X.patch
+ patches.fixes/mac80211_hwsim-correct-use-of-IEEE80211_VHT_CAP_RXST.patch
+ patches.fixes/mac80211-mesh-fix-HWMP-sequence-numbering-to-follow-.patch
patches.drivers/mac80211-avoid-kernel-panic-when-building-AMSDU-from
patches.drivers/cfg80211-nl80211_update_ft_ies-to-validate-NL80211_A
+ patches.fixes/mac80211-do-not-convert-to-A-MSDU-if-frag-subframe-l.patch
patches.drivers/mac80211-always-account-for-A-MSDU-header-changes
patches.drivers/mac80211-fix-an-off-by-one-issue-in-A-MSDU-max_subfr
+ patches.drivers/cfg80211-fix-a-type-issue-in-ieee80211_chandef_to_op.patch
+ patches.fixes/mac80211-fix-a-race-between-restart-and-CSA-flows.patch
+ patches.fixes/mac80211-Fix-station-bandwidth-setting-after-channel.patch
+ patches.fixes/mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
+ patches.fixes/mac80211-shorten-the-IBSS-debug-messages.patch
patches.fixes/mm-hugetlb-filter-out-hugetlb-pages-if-hugepage-migration-is-not-supported.patch
patches.fixes/scsi-lpfc-Correct-MDS-diag-and-nvmet-configuration.patch
patches.drivers/scsi-hpsa-limit-transfer-length-to-1mb-not-512kb.patch
+ patches.drivers/gpio-adp5588-Fix-sleep-in-atomic-context-bug.patch
patches.drivers/gpiolib-acpi-Switch-to-cansleep-version-of-GPIO-libr.patch
+ patches.drivers/gpiolib-acpi-Register-GpioInt-ACPI-event-handlers-fr.patch
+ patches.drivers/gpio-Fix-crash-due-to-registration-race.patch
patches.suse/btrfs-sync-log-after-logging-new-name.patch
patches.suse/btrfs-fix-data-corruption-when-deduplicating-between.patch
patches.drivers/ALSA-hda-Fix-cancel_work_sync-stall-from-jackpoll-wo.patch
@@ -17832,6 +17863,8 @@
patches.arch/x86-process-don-t-mix-user-kernel-regs-in-64bit-_show_regs
patches.drivers/IB-ipoib-Avoid-a-race-condition-between-start_xmit-a.patch
patches.drivers/bnxt_re-Fix-couple-of-memory-leaks-that-could-lead-t.patch
+ patches.drivers/HID-add-support-for-Apple-Magic-Keyboards.patch
+ patches.drivers/HID-hid-saitek-Add-device-ID-for-RAT-7-Contagion.patch
patches.drivers/scsi-qedi-add-the-crc-size-within-iscsi-nvm-image
patches.drivers/be2net-Fix-memory-leak-in-be_cmd_get_profile_config.patch
patches.drivers/net-ena-fix-surprise-unplug-NULL-dereference-kernel-.patch
@@ -17847,6 +17880,8 @@
patches.drivers/drm-nouveau-Fix-deadlocks-in-nouveau_connector_detec.patch
patches.drivers/drm-nouveau-drm-nouveau-Prevent-handling-ACPI-HPD-ev.patch
patches.drivers/drm-nouveau-drm-nouveau-Don-t-forget-to-cancel-hpd_w.patch
+ patches.drivers/drm-nouveau-TBDdevinit-don-t-fail-when-PMU-PRE_OS-is.patch
+ patches.drivers/drm-nouveau-disp-fix-DP-disable-race.patch
patches.drivers/Revert-PCI-Add-ACS-quirk-for-Intel-300-series
patches.arch/s390-sles15-15-04-crypto-paes-fix.patch
patches.drivers/mmc-omap_hsmmc-fix-wakeirq-handling-on-removal.patch
@@ -17895,6 +17930,7 @@
patches.drivers/drm-i915-gvt-request-srcu_read_lock-before-checking-.patch
patches.drivers/drm-i915-gvt-clear-ggtt-entries-when-destroy-vgpu.patch
patches.drivers/drm-amdgpu-add-new-polaris-pci-id.patch
+ patches.drivers/floppy-Do-not-copy-a-kernel-pointer-to-user-memory-i.patch
patches.fixes/ubifs-Check-for-name-being-NULL-while-mounting.patch
patches.fixes/Revert-ubifs-xattr-Don-t-operate-on-deleted-inodes.patch
patches.arch/x86-mm-expand-static-page-table-for-fixmap-space
@@ -17958,9 +17994,12 @@
patches.drivers/0001-drm-i915-Handle-incomplete-Z_FINISH-for-compressed-e.patch
patches.arch/ARM-8799-1-mm-fix-pci_ioremap_io-offset-check.patch
patches.fixes/crypto-caam-jr-fix-ablkcipher_edesc-pointer-arithmet.patch
+ patches.drivers/crypto-mxs-dcp-Fix-wait-logic-on-chan-threads.patch
+ patches.drivers/crypto-qat-Fix-KASAN-stack-out-of-bounds-bug-in-adf_.patch
patches.arch/kvm-nvmx-do-not-expose-mpx-vmx-controls-when-guest-mpx-disabled
patches.arch/kvm-x86-do-not-use-kvm_x86_ops-mpx_supported-directly
patches.drivers/iommu-amd-clear-memory-encryption-mask-from-physical-address
+ patches.drivers/ALSA-hda-realtek-Cannot-adjust-speaker-s-volume-on-D.patch
patches.arch/x86-vdso-fix-asm-constraints-on-vdso-syscall-fallbacks
patches.arch/x86-vdso-fix-vdso-syscall-fallback-asm-constraint-regression
patches.fixes/PM-core-Clear-the-direct_complete-flag-on-errors.patch
@@ -18470,7 +18509,6 @@
# DRM/Video
########################################################
patches.suse/drm-i915-Disable-tv-output-on-i9x5gm
- patches.drivers/Revert-drm-i915-edp-Allow-alternate-fixed-mode-for-eDP
patches.drivers/drm-mgag200-Add-doublescan-and-interlace-support.patch
patches.drivers/drm-mgag200-Add-additional-limits-for-certain-G200-variants.patch