Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-05-01 07:04:42 +0200
committerKernel Build Daemon <kbuild@suse.de>2019-05-01 07:04:42 +0200
commitd079bca3e881fe4c5f27eb4c34bba25630584110 (patch)
tree1d1b1861b1c19f76cdb67a33996d4739a812964e
parentba54d4e86741496490c4fb5457083dcad664bd00 (diff)
parente7a6da01478a537c85c992243879d4d45f9ffd0f (diff)
Merge branch 'SLE15' into SLE12-SP4
-rw-r--r--blacklist.conf5
-rw-r--r--patches.drivers/HID-i2c-hid-Ignore-input-report-if-there-s-no-data-p.patch58
-rw-r--r--patches.drivers/Input-synaptics-rmi4-write-config-register-values-to.patch38
-rw-r--r--patches.drivers/dmaengine-sh-rcar-dmac-With-cyclic-DMA-residue-0-is-.patch55
-rw-r--r--patches.drivers/iio-Fix-scan-mask-selection.patch48
-rw-r--r--patches.drivers/iio-adc-at91-disable-adc-channel-interrupt-in-timeou.patch73
-rw-r--r--patches.drivers/iio-dac-mcp4725-add-missing-powerdown-bits-in-store-.patch44
-rw-r--r--patches.drivers/iio-gyro-bmg160-Use-millidegrees-for-temperature-sca.patch49
-rw-r--r--patches.drivers/iio-gyro-mpu3050-fix-chip-ID-reading.patch53
-rw-r--r--patches.drivers/io-accel-kxcjk1013-restore-the-range-after-resume.patch39
-rw-r--r--patches.drivers/mmc-sdhci-Fix-data-command-CRC-error-handling.patch117
-rw-r--r--patches.drivers/mmc-sdhci-Handle-auto-command-errors.patch111
-rw-r--r--patches.drivers/mmc-sdhci-Rename-SDHCI_ACMD12_ERR-and-SDHCI_INT_ACMD.patch114
-rw-r--r--patches.drivers/staging-comedi-ni_usb6501-Fix-possible-double-free-o.patch49
-rw-r--r--patches.drivers/staging-comedi-ni_usb6501-Fix-use-of-uninitialized-m.patch117
-rw-r--r--patches.drivers/staging-comedi-vmk80xx-Fix-possible-double-free-of-u.patch49
-rw-r--r--patches.drivers/staging-comedi-vmk80xx-Fix-use-of-uninitialized-sema.patch114
-rw-r--r--patches.drivers/staging-iio-ad7192-Fix-ad7193-channel-address.patch41
-rw-r--r--patches.fixes/clk-x86-Add-system-specific-quirk-to-mark-clocks-as-.patch144
-rw-r--r--patches.fixes/crypto-crypto4xx-properly-set-IV-after-de-and-encryp.patch76
-rw-r--r--patches.fixes/device_cgroup-fix-RCU-imbalance-in-error-case.patch46
-rw-r--r--patches.fixes/mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch47
-rw-r--r--patches.fixes/mm-vmalloc-fix-size-check-for-remap_vmalloc_range_partial86
-rw-r--r--patches.fixes/vfs-avoid-problematic-remapping-requests-into-partia.patch94
-rw-r--r--patches.fixes/vfs-rename-clone_verify_area-to-remap_verify_area.patch68
-rw-r--r--patches.fixes/vfs-skip-zero-length-dedupe-requests.patch36
-rw-r--r--series.conf25
27 files changed, 1796 insertions, 0 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 209bf9418b..735a9b7d90 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -59,6 +59,11 @@ tools/testing/selftests/ # Selftests should be run from upstream
fs/f2fs/ # Not compiled, has some fatal flaws (see bsc#1109665)
security/smack # we don't enable Smack
+# Blacklisted CVE entries
+# -----------------------
+CVE-2018-16880 # bsc#1122767, needed only for SLE15-SP1+
+CVE-2019-9003 # bsc#1126704, needed only for SLE15-SP1+
+
# Blacklisted Commits
# -------------------
38cb266ad1a24e037220dc563ab46364595b17b6 # doc update
diff --git a/patches.drivers/HID-i2c-hid-Ignore-input-report-if-there-s-no-data-p.patch b/patches.drivers/HID-i2c-hid-Ignore-input-report-if-there-s-no-data-p.patch
new file mode 100644
index 0000000000..7a48e85e05
--- /dev/null
+++ b/patches.drivers/HID-i2c-hid-Ignore-input-report-if-there-s-no-data-p.patch
@@ -0,0 +1,58 @@
+From 1475af255e18f35dc46f8a7acc18354c73d45149 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Mon, 7 Jan 2019 15:24:29 +0800
+Subject: [PATCH] HID: i2c-hid: Ignore input report if there's no data present on Elan touchpanels
+Git-commit: 1475af255e18f35dc46f8a7acc18354c73d45149
+Patch-mainline: v5.1-rc1
+References: bsc#1133486
+
+While using Elan touchpads, the message floods:
+[ 136.138487] i2c_hid i2c-DELL08D6:00: i2c_hid_get_input: incomplete report (14/65535)
+
+Though the message flood is annoying, the device it self works without
+any issue. I suspect that the device in question takes too much time to
+pull the IRQ back to high after I2C host has done reading its data.
+
+Since the host receives all useful data, let's ignore the input report
+when there's no data.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/i2c-hid/i2c-hid.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -47,6 +47,7 @@
+ /* quirks to control the device */
+ #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV BIT(0)
+ #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(1)
++#define I2C_HID_QUIRK_BOGUS_IRQ BIT(4)
+
+ /* flags */
+ #define I2C_HID_STARTED 0
+@@ -171,6 +172,8 @@ static const struct i2c_hid_quirks {
+ I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
+ { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
+ I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
++ { USB_VENDOR_ID_ELAN, HID_ANY_ID,
++ I2C_HID_QUIRK_BOGUS_IRQ },
+ { 0, 0 }
+ };
+
+@@ -481,6 +484,12 @@ static void i2c_hid_get_input(struct i2c
+ return;
+ }
+
++ if (ihid->quirks & I2C_HID_QUIRK_BOGUS_IRQ && ret_size == 0xffff) {
++ dev_warn_once(&ihid->client->dev, "%s: IRQ triggered but "
++ "there's no data\n", __func__);
++ return;
++ }
++
+ if ((ret_size > size) || (ret_size < 2)) {
+ dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n",
+ __func__, size, ret_size);
diff --git a/patches.drivers/Input-synaptics-rmi4-write-config-register-values-to.patch b/patches.drivers/Input-synaptics-rmi4-write-config-register-values-to.patch
new file mode 100644
index 0000000000..95141c3326
--- /dev/null
+++ b/patches.drivers/Input-synaptics-rmi4-write-config-register-values-to.patch
@@ -0,0 +1,38 @@
+From 3a349763cf11e63534b8f2d302f2d0c790566497 Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Fri, 26 Apr 2019 17:22:01 -0700
+Subject: [PATCH] Input: synaptics-rmi4 - write config register values to the right offset
+Git-commit: 3a349763cf11e63534b8f2d302f2d0c790566497
+Patch-mainline: v5.1-rc7
+References: bsc#1051510
+
+Currently any changed config register values don't take effect, as the
+function to write them back is called with the wrong register offset.
+
+Fixes: ff8f83708b3e (Input: synaptics-rmi4 - add support for 2D sensors and F11)
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/rmi4/rmi_f11.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/rmi4/rmi_f11.c b/drivers/input/rmi4/rmi_f11.c
+index df64d6aed4f7..93901ebd122a 100644
+--- a/drivers/input/rmi4/rmi_f11.c
++++ b/drivers/input/rmi4/rmi_f11.c
+@@ -1230,7 +1230,7 @@ static int rmi_f11_initialize(struct rmi_function *fn)
+ }
+
+ rc = f11_write_control_regs(fn, &f11->sens_query,
+- &f11->dev_controls, fn->fd.query_base_addr);
++ &f11->dev_controls, fn->fd.control_base_addr);
+ if (rc)
+ dev_warn(&fn->dev, "Failed to write control registers\n");
+
+--
+2.16.4
+
diff --git a/patches.drivers/dmaengine-sh-rcar-dmac-With-cyclic-DMA-residue-0-is-.patch b/patches.drivers/dmaengine-sh-rcar-dmac-With-cyclic-DMA-residue-0-is-.patch
new file mode 100644
index 0000000000..05f5ae6158
--- /dev/null
+++ b/patches.drivers/dmaengine-sh-rcar-dmac-With-cyclic-DMA-residue-0-is-.patch
@@ -0,0 +1,55 @@
+From 907bd68a2edc491849e2fdcfe52c4596627bca94 Mon Sep 17 00:00:00 2001
+From: Dirk Behme <dirk.behme@de.bosch.com>
+Date: Fri, 12 Apr 2019 07:29:13 +0200
+Subject: [PATCH] dmaengine: sh: rcar-dmac: With cyclic DMA residue 0 is valid
+Git-commit: 907bd68a2edc491849e2fdcfe52c4596627bca94
+Patch-mainline: v5.1-rc7
+References: bsc#1051510
+
+Having a cyclic DMA, a residue 0 is not an indication of a completed
+DMA. In case of cyclic DMA make sure that dma_set_residue() is called
+and with this a residue of 0 is forwarded correctly to the caller.
+
+Fixes: 3544d2878817 ("dmaengine: rcar-dmac: use result of updated get_residue in tx_status")
+Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
+Signed-off-by: Achim Dahlhoff <Achim.Dahlhoff@de.bosch.com>
+Signed-off-by: Hiroyuki Yokoyama <hiroyuki.yokoyama.vx@renesas.com>
+Signed-off-by: Yao Lihua <ylhuajnu@outlook.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Cc: <stable@vger.kernel.org> # v4.8+
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/dma/sh/rcar-dmac.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
+index 2b4f25698169..54810ffd95e2 100644
+--- a/drivers/dma/sh/rcar-dmac.c
++++ b/drivers/dma/sh/rcar-dmac.c
+@@ -1368,6 +1368,7 @@ static enum dma_status rcar_dmac_tx_status(struct dma_chan *chan,
+ enum dma_status status;
+ unsigned long flags;
+ unsigned int residue;
++ bool cyclic;
+
+ status = dma_cookie_status(chan, cookie, txstate);
+ if (status == DMA_COMPLETE || !txstate)
+@@ -1375,10 +1376,11 @@ static enum dma_status rcar_dmac_tx_status(struct dma_chan *chan,
+
+ spin_lock_irqsave(&rchan->lock, flags);
+ residue = rcar_dmac_chan_get_residue(rchan, cookie);
++ cyclic = rchan->desc.running ? rchan->desc.running->cyclic : false;
+ spin_unlock_irqrestore(&rchan->lock, flags);
+
+ /* if there's no residue, the cookie is complete */
+- if (!residue)
++ if (!residue && !cyclic)
+ return DMA_COMPLETE;
+
+ dma_set_residue(txstate, residue);
+--
+2.16.4
+
diff --git a/patches.drivers/iio-Fix-scan-mask-selection.patch b/patches.drivers/iio-Fix-scan-mask-selection.patch
new file mode 100644
index 0000000000..d9bba0b0fe
--- /dev/null
+++ b/patches.drivers/iio-Fix-scan-mask-selection.patch
@@ -0,0 +1,48 @@
+From 20ea39ef9f2f911bd01c69519e7d69cfec79fde3 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Wed, 20 Feb 2019 17:11:32 +0200
+Subject: [PATCH] iio: Fix scan mask selection
+Git-commit: 20ea39ef9f2f911bd01c69519e7d69cfec79fde3
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+The trialmask is expected to have all bits set to 0 after allocation.
+Currently kmalloc_array() is used which does not zero the memory and so
+random bits are set. This results in random channels being enabled when
+they shouldn't. Replace kmalloc_array() with kcalloc() which has the same
+interface but zeros the memory.
+
+Note the fix is actually required earlier than the below fixes tag, but
+will require a manual backport due to move from kmalloc to kmalloc_array.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Fixes commit 057ac1acdfc4 ("iio: Use kmalloc_array() in iio_scan_mask_set()").
+
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/industrialio-buffer.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
+index cd5bfe39591b..dadd921a4a30 100644
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -320,9 +320,8 @@ static int iio_scan_mask_set(struct iio_dev *indio_dev,
+ const unsigned long *mask;
+ unsigned long *trialmask;
+
+- trialmask = kmalloc_array(BITS_TO_LONGS(indio_dev->masklength),
+- sizeof(*trialmask),
+- GFP_KERNEL);
++ trialmask = kcalloc(BITS_TO_LONGS(indio_dev->masklength),
++ sizeof(*trialmask), GFP_KERNEL);
+ if (trialmask == NULL)
+ return -ENOMEM;
+ if (!indio_dev->masklength) {
+--
+2.16.4
+
diff --git a/patches.drivers/iio-adc-at91-disable-adc-channel-interrupt-in-timeou.patch b/patches.drivers/iio-adc-at91-disable-adc-channel-interrupt-in-timeou.patch
new file mode 100644
index 0000000000..47cd78a3fa
--- /dev/null
+++ b/patches.drivers/iio-adc-at91-disable-adc-channel-interrupt-in-timeou.patch
@@ -0,0 +1,73 @@
+From 09c6bdee51183a575bf7546890c8c137a75a2b44 Mon Sep 17 00:00:00 2001
+From: Georg Ottinger <g.ottinger@abatec.at>
+Date: Wed, 30 Jan 2019 14:42:02 +0100
+Subject: [PATCH] iio: adc: at91: disable adc channel interrupt in timeout case
+Git-commit: 09c6bdee51183a575bf7546890c8c137a75a2b44
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+Having a brief look at at91_adc_read_raw() it is obvious that in the case
+of a timeout the setting of AT91_ADC_CHDR and AT91_ADC_IDR registers is
+omitted. If 2 different channels are queried we can end up with a
+situation where two interrupts are enabled, but only one interrupt is
+cleared in the interrupt handler. Resulting in a interrupt loop and a
+system hang.
+
+Signed-off-by: Georg Ottinger <g.ottinger@abatec.at>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/adc/at91_adc.c | 28 +++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index 75d2f73582a3..596841a3c4db 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -704,23 +704,29 @@ static int at91_adc_read_raw(struct iio_dev *idev,
+ ret = wait_event_interruptible_timeout(st->wq_data_avail,
+ st->done,
+ msecs_to_jiffies(1000));
+- if (ret == 0)
+- ret = -ETIMEDOUT;
+- if (ret < 0) {
+- mutex_unlock(&st->lock);
+- return ret;
+- }
+-
+- *val = st->last_value;
+
++ /* Disable interrupts, regardless if adc conversion was
++ * successful or not
++ */
+ at91_adc_writel(st, AT91_ADC_CHDR,
+ AT91_ADC_CH(chan->channel));
+ at91_adc_writel(st, AT91_ADC_IDR, BIT(chan->channel));
+
+- st->last_value = 0;
+- st->done = false;
++ if (ret > 0) {
++ /* a valid conversion took place */
++ *val = st->last_value;
++ st->last_value = 0;
++ st->done = false;
++ ret = IIO_VAL_INT;
++ } else if (ret == 0) {
++ /* conversion timeout */
++ dev_err(&idev->dev, "ADC Channel %d timeout.\n",
++ chan->channel);
++ ret = -ETIMEDOUT;
++ }
++
+ mutex_unlock(&st->lock);
+- return IIO_VAL_INT;
++ return ret;
+
+ case IIO_CHAN_INFO_SCALE:
+ *val = st->vref_mv;
+--
+2.16.4
+
diff --git a/patches.drivers/iio-dac-mcp4725-add-missing-powerdown-bits-in-store-.patch b/patches.drivers/iio-dac-mcp4725-add-missing-powerdown-bits-in-store-.patch
new file mode 100644
index 0000000000..1ee35ab7f9
--- /dev/null
+++ b/patches.drivers/iio-dac-mcp4725-add-missing-powerdown-bits-in-store-.patch
@@ -0,0 +1,44 @@
+From 06003531502d06bc89d32528f6ec96bf978790f9 Mon Sep 17 00:00:00 2001
+From: Jean-Francois Dagenais <jeff.dagenais@gmail.com>
+Date: Wed, 6 Mar 2019 15:56:06 -0500
+Subject: [PATCH] iio: dac: mcp4725: add missing powerdown bits in store eeprom
+Git-commit: 06003531502d06bc89d32528f6ec96bf978790f9
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+When issuing the write DAC register and write eeprom command, the two
+powerdown bits (PD0 and PD1) are assumed by the chip to be present in
+the bytes sent. Leaving them at 0 implies "powerdown disabled" which is
+a different state that the current one. By adding the current state of
+the powerdown in the i2c write, the chip will correctly power-on exactly
+like as it is at the moment of store_eeprom call.
+
+This is documented in MCP4725's datasheet, FIGURE 6-2: "Write Commands
+for DAC Input Register and EEPROM" and MCP4726's datasheet, FIGURE 6-3:
+"Write All Memory Command".
+
+Signed-off-by: Jean-Francois Dagenais <jeff.dagenais@gmail.com>
+Acked-by: Peter Meerwald-Stadler <pmeerw@pmeerw.net>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/dac/mcp4725.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/iio/dac/mcp4725.c b/drivers/iio/dac/mcp4725.c
+index 6d71fd905e29..c701a45469f6 100644
+--- a/drivers/iio/dac/mcp4725.c
++++ b/drivers/iio/dac/mcp4725.c
+@@ -92,6 +92,7 @@ static ssize_t mcp4725_store_eeprom(struct device *dev,
+
+ inoutbuf[0] = 0x60; /* write EEPROM */
+ inoutbuf[0] |= data->ref_mode << 3;
++ inoutbuf[0] |= data->powerdown ? ((data->powerdown_mode + 1) << 1) : 0;
+ inoutbuf[1] = data->dac_value >> 4;
+ inoutbuf[2] = (data->dac_value & 0xf) << 4;
+
+--
+2.16.4
+
diff --git a/patches.drivers/iio-gyro-bmg160-Use-millidegrees-for-temperature-sca.patch b/patches.drivers/iio-gyro-bmg160-Use-millidegrees-for-temperature-sca.patch
new file mode 100644
index 0000000000..d491c0392b
--- /dev/null
+++ b/patches.drivers/iio-gyro-bmg160-Use-millidegrees-for-temperature-sca.patch
@@ -0,0 +1,49 @@
+From 40a7198a4a01037003c7ca714f0d048a61e729ac Mon Sep 17 00:00:00 2001
+From: Mike Looijmans <mike.looijmans@topic.nl>
+Date: Wed, 13 Feb 2019 08:41:47 +0100
+Subject: [PATCH] iio/gyro/bmg160: Use millidegrees for temperature scale
+Git-commit: 40a7198a4a01037003c7ca714f0d048a61e729ac
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+Standard unit for temperature is millidegrees Celcius, whereas this driver
+was reporting in degrees. Fix the scale factor in the driver.
+
+Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/gyro/bmg160_core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c
+index 63ca31628a93..92c07ab826eb 100644
+--- a/drivers/iio/gyro/bmg160_core.c
++++ b/drivers/iio/gyro/bmg160_core.c
+@@ -582,11 +582,10 @@ static int bmg160_read_raw(struct iio_dev *indio_dev,
+ case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY:
+ return bmg160_get_filter(data, val);
+ case IIO_CHAN_INFO_SCALE:
+- *val = 0;
+ switch (chan->type) {
+ case IIO_TEMP:
+- *val2 = 500000;
+- return IIO_VAL_INT_PLUS_MICRO;
++ *val = 500;
++ return IIO_VAL_INT;
+ case IIO_ANGL_VEL:
+ {
+ int i;
+@@ -594,6 +593,7 @@ static int bmg160_read_raw(struct iio_dev *indio_dev,
+ for (i = 0; i < ARRAY_SIZE(bmg160_scale_table); ++i) {
+ if (bmg160_scale_table[i].dps_range ==
+ data->dps_range) {
++ *val = 0;
+ *val2 = bmg160_scale_table[i].scale;
+ return IIO_VAL_INT_PLUS_MICRO;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/iio-gyro-mpu3050-fix-chip-ID-reading.patch b/patches.drivers/iio-gyro-mpu3050-fix-chip-ID-reading.patch
new file mode 100644
index 0000000000..ce26f59227
--- /dev/null
+++ b/patches.drivers/iio-gyro-mpu3050-fix-chip-ID-reading.patch
@@ -0,0 +1,53 @@
+From 409a51e0a4a5f908763191fae2c29008632eb712 Mon Sep 17 00:00:00 2001
+From: Sergey Larin <cerg2010cerg2010@mail.ru>
+Date: Sat, 2 Mar 2019 19:54:55 +0300
+Subject: [PATCH] iio: gyro: mpu3050: fix chip ID reading
+Git-commit: 409a51e0a4a5f908763191fae2c29008632eb712
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+According to the datasheet, the last bit of CHIP_ID register controls
+I2C bus, and the first one is unused. Handle this correctly.
+
+Note that there are chips out there that have a value such that
+the id check currently fails.
+
+Signed-off-by: Sergey Larin <cerg2010cerg2010@mail.ru>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/gyro/mpu3050-core.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/gyro/mpu3050-core.c b/drivers/iio/gyro/mpu3050-core.c
+index 77fac81a3adc..5ddebede31a6 100644
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -29,7 +29,8 @@
+
+ #include "mpu3050.h"
+
+-#define MPU3050_CHIP_ID 0x69
++#define MPU3050_CHIP_ID 0x68
++#define MPU3050_CHIP_ID_MASK 0x7E
+
+ /*
+ * Register map: anything suffixed *_H is a big-endian high byte and always
+@@ -1176,8 +1177,9 @@ int mpu3050_common_probe(struct device *dev,
+ goto err_power_down;
+ }
+
+- if (val != MPU3050_CHIP_ID) {
+- dev_err(dev, "unsupported chip id %02x\n", (u8)val);
++ if ((val & MPU3050_CHIP_ID_MASK) != MPU3050_CHIP_ID) {
++ dev_err(dev, "unsupported chip id %02x\n",
++ (u8)(val & MPU3050_CHIP_ID_MASK));
+ ret = -ENODEV;
+ goto err_power_down;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/io-accel-kxcjk1013-restore-the-range-after-resume.patch b/patches.drivers/io-accel-kxcjk1013-restore-the-range-after-resume.patch
new file mode 100644
index 0000000000..bb0ffa5bcb
--- /dev/null
+++ b/patches.drivers/io-accel-kxcjk1013-restore-the-range-after-resume.patch
@@ -0,0 +1,39 @@
+From fe2d3df639a7940a125a33d6460529b9689c5406 Mon Sep 17 00:00:00 2001
+From: "he, bo" <bo.he@intel.com>
+Date: Wed, 6 Mar 2019 10:32:20 +0800
+Subject: [PATCH] io: accel: kxcjk1013: restore the range after resume.
+Git-commit: fe2d3df639a7940a125a33d6460529b9689c5406
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+On some laptops, kxcjk1013 is powered off when system enters S3. We need
+restore the range regiter during resume. Otherwise, the sensor doesn't
+work properly after S3.
+
+Signed-off-by: he, bo <bo.he@intel.com>
+Signed-off-by: Chen, Hu <hu1.chen@intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/accel/kxcjk-1013.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
+index 7096e577b23f..50f3ff386bea 100644
+--- a/drivers/iio/accel/kxcjk-1013.c
++++ b/drivers/iio/accel/kxcjk-1013.c
+@@ -1437,6 +1437,8 @@ static int kxcjk1013_resume(struct device *dev)
+
+ mutex_lock(&data->mutex);
+ ret = kxcjk1013_set_mode(data, OPERATION);
++ if (ret == 0)
++ ret = kxcjk1013_set_range(data, data->range);
+ mutex_unlock(&data->mutex);
+
+ return ret;
+--
+2.16.4
+
diff --git a/patches.drivers/mmc-sdhci-Fix-data-command-CRC-error-handling.patch b/patches.drivers/mmc-sdhci-Fix-data-command-CRC-error-handling.patch
new file mode 100644
index 0000000000..6cab18b863
--- /dev/null
+++ b/patches.drivers/mmc-sdhci-Fix-data-command-CRC-error-handling.patch
@@ -0,0 +1,117 @@
+From 4bf780996669280171c9cd58196512849b93434e Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 15 Nov 2018 15:53:41 +0200
+Subject: [PATCH] mmc: sdhci: Fix data command CRC error handling
+Git-commit: 4bf780996669280171c9cd58196512849b93434e
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+Existing data command CRC error handling is non-standard and does not work
+with some Intel host controllers. Specifically, the assumption that the host
+controller will continue operating normally after the error interrupt,
+is not valid. Change the driver to handle the error in the same manner
+as a data CRC error, taking care to ensure that the data line reset is
+done for single or multi-block transfers, and it is done before
+unmapping DMA.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/sdhci.c | 40 +++++++++++++++-------------------------
+ 1 file changed, 15 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index ca87424c9c8a..2409b1fa0eb4 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1191,8 +1191,7 @@ static bool sdhci_needs_reset(struct sdhci_host *host, struct mmc_request *mrq)
+ return (!(host->flags & SDHCI_DEVICE_DEAD) &&
+ ((mrq->cmd && mrq->cmd->error) ||
+ (mrq->sbc && mrq->sbc->error) ||
+- (mrq->data && ((mrq->data->error && !mrq->data->stop) ||
+- (mrq->data->stop && mrq->data->stop->error))) ||
++ (mrq->data && mrq->data->stop && mrq->data->stop->error) ||
+ (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST)));
+ }
+
+@@ -1244,6 +1243,16 @@ static void sdhci_finish_data(struct sdhci_host *host)
+ host->data = NULL;
+ host->data_cmd = NULL;
+
++ /*
++ * The controller needs a reset of internal state machines upon error
++ * conditions.
++ */
++ if (data->error) {
++ if (!host->cmd || host->cmd == data_cmd)
++ sdhci_do_reset(host, SDHCI_RESET_CMD);
++ sdhci_do_reset(host, SDHCI_RESET_DATA);
++ }
++
+ if ((host->flags & (SDHCI_REQ_USE_DMA | SDHCI_USE_ADMA)) ==
+ (SDHCI_REQ_USE_DMA | SDHCI_USE_ADMA))
+ sdhci_adma_table_post(host, data);
+@@ -1268,17 +1277,6 @@ static void sdhci_finish_data(struct sdhci_host *host)
+ if (data->stop &&
+ (data->error ||
+ !data->mrq->sbc)) {
+-
+- /*
+- * The controller needs a reset of internal state machines
+- * upon error conditions.
+- */
+- if (data->error) {
+- if (!host->cmd || host->cmd == data_cmd)
+- sdhci_do_reset(host, SDHCI_RESET_CMD);
+- sdhci_do_reset(host, SDHCI_RESET_DATA);
+- }
+-
+ /*
+ * 'cap_cmd_during_tfr' request must not use the command line
+ * after mmc_command_done() has been called. It is upper layer's
+@@ -2757,7 +2755,7 @@ static void sdhci_timeout_data_timer(struct timer_list *t)
+ * *
+ \*****************************************************************************/
+
+-static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask)
++static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p)
+ {
+ if (!host->cmd) {
+ /*
+@@ -2780,20 +2778,12 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask)
+ else
+ host->cmd->error = -EILSEQ;
+
+- /*
+- * If this command initiates a data phase and a response
+- * CRC error is signalled, the card can start transferring
+- * data - the card may have received the command without
+- * error. We must not terminate the mmc_request early.
+- *
+- * If the card did not receive the command or returned an
+- * error which prevented it sending data, the data phase
+- * will time out.
+- */
++ /* Treat data command CRC error the same as data CRC error */
+ if (host->cmd->data &&
+ (intmask & (SDHCI_INT_CRC | SDHCI_INT_TIMEOUT)) ==
+ SDHCI_INT_CRC) {
+ host->cmd = NULL;
++ *intmask_p |= SDHCI_INT_DATA_CRC;
+ return;
+ }
+
+@@ -3021,7 +3011,7 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id)
+ }
+
+ if (intmask & SDHCI_INT_CMD_MASK)
+- sdhci_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK);
++ sdhci_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK, &intmask);
+
+ if (intmask & SDHCI_INT_DATA_MASK)
+ sdhci_data_irq(host, intmask & SDHCI_INT_DATA_MASK);
+--
+2.16.4
+
diff --git a/patches.drivers/mmc-sdhci-Handle-auto-command-errors.patch b/patches.drivers/mmc-sdhci-Handle-auto-command-errors.patch
new file mode 100644
index 0000000000..ad332346e9
--- /dev/null
+++ b/patches.drivers/mmc-sdhci-Handle-auto-command-errors.patch
@@ -0,0 +1,111 @@
+From af849c86109d79222e549826068bbf4e7f9a2472 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 15 Nov 2018 15:53:43 +0200
+Subject: [PATCH] mmc: sdhci: Handle auto-command errors
+Git-commit: af849c86109d79222e549826068bbf4e7f9a2472
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+If the host controller supports auto-commands then enable the auto-command
+error interrupt and handle it. In the case of auto-CMD23, the error is
+treated the same as manual CMD23 error. In the case of auto-CMD12,
+commands-during-transfer are not permitted, so the error handling is
+treated the same as a data error.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/sdhci.c | 35 +++++++++++++++++++++++++++++++++++
+ drivers/mmc/host/sdhci.h | 7 ++++++-
+ 2 files changed, 41 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 1b83bf6f7515..281683c93de6 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -933,6 +933,11 @@ static void sdhci_set_transfer_irqs(struct sdhci_host *host)
+ else
+ host->ier = (host->ier & ~dma_irqs) | pio_irqs;
+
++ if (host->flags & (SDHCI_AUTO_CMD23 | SDHCI_AUTO_CMD12))
++ host->ier |= SDHCI_INT_AUTO_CMD_ERR;
++ else
++ host->ier &= ~SDHCI_INT_AUTO_CMD_ERR;
++
+ sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
+ sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
+ }
+@@ -2757,6 +2762,21 @@ static void sdhci_timeout_data_timer(struct timer_list *t)
+
+ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p)
+ {
++ /* Handle auto-CMD12 error */
++ if (intmask & SDHCI_INT_AUTO_CMD_ERR && host->data_cmd) {
++ struct mmc_request *mrq = host->data_cmd->mrq;
++ u16 auto_cmd_status = sdhci_readw(host, SDHCI_AUTO_CMD_STATUS);
++ int data_err_bit = (auto_cmd_status & SDHCI_AUTO_CMD_TIMEOUT) ?
++ SDHCI_INT_DATA_TIMEOUT :
++ SDHCI_INT_DATA_CRC;
++
++ /* Treat auto-CMD12 error the same as data error */
++ if (!mrq->sbc && (host->flags & SDHCI_AUTO_CMD12)) {
++ *intmask_p |= data_err_bit;
++ return;
++ }
++ }
++
+ if (!host->cmd) {
+ /*
+ * SDHCI recovers from errors by resetting the cmd and data
+@@ -2791,6 +2811,21 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p)
+ return;
+ }
+
++ /* Handle auto-CMD23 error */
++ if (intmask & SDHCI_INT_AUTO_CMD_ERR) {
++ struct mmc_request *mrq = host->cmd->mrq;
++ u16 auto_cmd_status = sdhci_readw(host, SDHCI_AUTO_CMD_STATUS);
++ int err = (auto_cmd_status & SDHCI_AUTO_CMD_TIMEOUT) ?
++ -ETIMEDOUT :
++ -EILSEQ;
++
++ if (mrq->sbc && (host->flags & SDHCI_AUTO_CMD23)) {
++ mrq->sbc->error = err;
++ sdhci_finish_mrq(host, mrq);
++ return;
++ }
++ }
++
+ if (intmask & SDHCI_INT_RESPONSE)
+ sdhci_finish_command(host);
+ }
+diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
+index dee0656cb64c..a306d2fa972f 100644
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -153,7 +153,8 @@
+ #define SDHCI_INT_ERROR_MASK 0xFFFF8000
+
+ #define SDHCI_INT_CMD_MASK (SDHCI_INT_RESPONSE | SDHCI_INT_TIMEOUT | \
+- SDHCI_INT_CRC | SDHCI_INT_END_BIT | SDHCI_INT_INDEX)
++ SDHCI_INT_CRC | SDHCI_INT_END_BIT | SDHCI_INT_INDEX | \
++ SDHCI_INT_AUTO_CMD_ERR)
+ #define SDHCI_INT_DATA_MASK (SDHCI_INT_DATA_END | SDHCI_INT_DMA_END | \
+ SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL | \
+ SDHCI_INT_DATA_TIMEOUT | SDHCI_INT_DATA_CRC | \
+@@ -169,6 +170,10 @@
+ #define SDHCI_CQE_INT_MASK (SDHCI_CQE_INT_ERR_MASK | SDHCI_INT_CQE)
+
+ #define SDHCI_AUTO_CMD_STATUS 0x3C
++#define SDHCI_AUTO_CMD_TIMEOUT 0x00000002
++#define SDHCI_AUTO_CMD_CRC 0x00000004
++#define SDHCI_AUTO_CMD_END_BIT 0x00000008
++#define SDHCI_AUTO_CMD_INDEX 0x00000010
+
+ #define SDHCI_HOST_CONTROL2 0x3E
+ #define SDHCI_CTRL_UHS_MASK 0x0007
+--
+2.16.4
+
diff --git a/patches.drivers/mmc-sdhci-Rename-SDHCI_ACMD12_ERR-and-SDHCI_INT_ACMD.patch b/patches.drivers/mmc-sdhci-Rename-SDHCI_ACMD12_ERR-and-SDHCI_INT_ACMD.patch
new file mode 100644
index 0000000000..9ef0becc56
--- /dev/null
+++ b/patches.drivers/mmc-sdhci-Rename-SDHCI_ACMD12_ERR-and-SDHCI_INT_ACMD.patch
@@ -0,0 +1,114 @@
+From 869f8a69bb3a4aec4eb914a330d4ba53a9eed495 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 15 Nov 2018 15:53:42 +0200
+Subject: [PATCH] mmc: sdhci: Rename SDHCI_ACMD12_ERR and SDHCI_INT_ACMD12ERR
+Git-commit: 869f8a69bb3a4aec4eb914a330d4ba53a9eed495
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+The SDHCI_ACMD12_ERR register is used for auto-CMD23 and auto-CMD12
+errors, as is the SDHCI_INT_ACMD12ERR interrupt bit. Rename them to
+SDHCI_AUTO_CMD_STATUS and SDHCI_INT_AUTO_CMD_ERR respectively.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/sdhci-esdhc-imx.c | 12 ++++++------
+ drivers/mmc/host/sdhci.c | 4 ++--
+ drivers/mmc/host/sdhci.h | 4 ++--
+ 3 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index f44e49014a44..3f62dae0afa5 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -429,7 +429,7 @@ static u16 esdhc_readw_le(struct sdhci_host *host, int reg)
+ val = readl(host->ioaddr + ESDHC_MIX_CTRL);
+ else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING)
+ /* the std tuning bits is in ACMD12_ERR for imx6sl */
+- val = readl(host->ioaddr + SDHCI_ACMD12_ERR);
++ val = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ }
+
+ if (val & ESDHC_MIX_CTRL_EXE_TUNE)
+@@ -494,7 +494,7 @@ static void esdhc_writew_le(struct sdhci_host *host, u16 val, int reg)
+ }
+ writel(new_val , host->ioaddr + ESDHC_MIX_CTRL);
+ } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
+- u32 v = readl(host->ioaddr + SDHCI_ACMD12_ERR);
++ u32 v = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ u32 m = readl(host->ioaddr + ESDHC_MIX_CTRL);
+ if (val & SDHCI_CTRL_TUNED_CLK) {
+ v |= ESDHC_MIX_CTRL_SMPCLK_SEL;
+@@ -512,7 +512,7 @@ static void esdhc_writew_le(struct sdhci_host *host, u16 val, int reg)
+ v &= ~ESDHC_MIX_CTRL_EXE_TUNE;
+ }
+
+- writel(v, host->ioaddr + SDHCI_ACMD12_ERR);
++ writel(v, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ writel(m, host->ioaddr + ESDHC_MIX_CTRL);
+ }
+ return;
+@@ -957,9 +957,9 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
+ writel(ctrl, host->ioaddr + ESDHC_MIX_CTRL);
+ writel(0, host->ioaddr + ESDHC_TUNE_CTRL_STATUS);
+ } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
+- ctrl = readl(host->ioaddr + SDHCI_ACMD12_ERR);
++ ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL;
+- writel(ctrl, host->ioaddr + SDHCI_ACMD12_ERR);
++ writel(ctrl, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ }
+ }
+ }
+@@ -1317,7 +1317,7 @@ static int sdhci_esdhc_imx_probe(struct platform_device *pdev)
+
+ /* clear tuning bits in case ROM has set it already */
+ writel(0x0, host->ioaddr + ESDHC_MIX_CTRL);
+- writel(0x0, host->ioaddr + SDHCI_ACMD12_ERR);
++ writel(0x0, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+ writel(0x0, host->ioaddr + ESDHC_TUNE_CTRL_STATUS);
+ }
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 2409b1fa0eb4..1b83bf6f7515 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -82,8 +82,8 @@ void sdhci_dumpregs(struct sdhci_host *host)
+ SDHCI_DUMP("Int enab: 0x%08x | Sig enab: 0x%08x\n",
+ sdhci_readl(host, SDHCI_INT_ENABLE),
+ sdhci_readl(host, SDHCI_SIGNAL_ENABLE));
+- SDHCI_DUMP("AC12 err: 0x%08x | Slot int: 0x%08x\n",
+- sdhci_readw(host, SDHCI_ACMD12_ERR),
++ SDHCI_DUMP("ACmd stat: 0x%08x | Slot int: 0x%08x\n",
++ sdhci_readw(host, SDHCI_AUTO_CMD_STATUS),
+ sdhci_readw(host, SDHCI_SLOT_INT_STATUS));
+ SDHCI_DUMP("Caps: 0x%08x | Caps_1: 0x%08x\n",
+ sdhci_readl(host, SDHCI_CAPABILITIES),
+diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
+index b001cf4d3d7e..dee0656cb64c 100644
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -146,7 +146,7 @@
+ #define SDHCI_INT_DATA_CRC 0x00200000
+ #define SDHCI_INT_DATA_END_BIT 0x00400000
+ #define SDHCI_INT_BUS_POWER 0x00800000
+-#define SDHCI_INT_ACMD12ERR 0x01000000
++#define SDHCI_INT_AUTO_CMD_ERR 0x01000000
+ #define SDHCI_INT_ADMA_ERROR 0x02000000
+
+ #define SDHCI_INT_NORMAL_MASK 0x00007FFF
+@@ -168,7 +168,7 @@
+
+ #define SDHCI_CQE_INT_MASK (SDHCI_CQE_INT_ERR_MASK | SDHCI_INT_CQE)
+
+-#define SDHCI_ACMD12_ERR 0x3C
++#define SDHCI_AUTO_CMD_STATUS 0x3C
+
+ #define SDHCI_HOST_CONTROL2 0x3E
+ #define SDHCI_CTRL_UHS_MASK 0x0007
+--
+2.16.4
+
diff --git a/patches.drivers/staging-comedi-ni_usb6501-Fix-possible-double-free-o.patch b/patches.drivers/staging-comedi-ni_usb6501-Fix-possible-double-free-o.patch
new file mode 100644
index 0000000000..87ebd35fea
--- /dev/null
+++ b/patches.drivers/staging-comedi-ni_usb6501-Fix-possible-double-free-o.patch
@@ -0,0 +1,49 @@
+From af4b54a2e5ba18259ff9aac445bf546dd60d037e Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Mon, 15 Apr 2019 12:43:02 +0100
+Subject: [PATCH] staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf
+Git-commit: af4b54a2e5ba18259ff9aac445bf546dd60d037e
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+`ni6501_alloc_usb_buffers()` is called from `ni6501_auto_attach()` to
+allocate RX and TX buffers for USB transfers. It allocates
+`devpriv->usb_rx_buf` followed by `devpriv->usb_tx_buf`. If the
+allocation of `devpriv->usb_tx_buf` fails, it frees
+`devpriv->usb_rx_buf`, leaving the pointer set dangling, and returns an
+error. Later, `ni6501_detach()` will be called from the core comedi
+module code to clean up. `ni6501_detach()` also frees both
+`devpriv->usb_rx_buf` and `devpriv->usb_tx_buf`, but
+`devpriv->usb_rx_buf` may have already beed freed, leading to a
+double-free error. Fix it bu removing the call to
+`kfree(devpriv->usb_rx_buf)` from `ni6501_alloc_usb_buffers()`, relying
+on `ni6501_detach()` to free the memory.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/staging/comedi/drivers/ni_usb6501.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c
+index ed5e42655821..1bb1cb651349 100644
+--- a/drivers/staging/comedi/drivers/ni_usb6501.c
++++ b/drivers/staging/comedi/drivers/ni_usb6501.c
+@@ -463,10 +463,8 @@ static int ni6501_alloc_usb_buffers(struct comedi_device *dev)
+
+ size = usb_endpoint_maxp(devpriv->ep_tx);
+ devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
+- if (!devpriv->usb_tx_buf) {
+- kfree(devpriv->usb_rx_buf);
++ if (!devpriv->usb_tx_buf)
+ return -ENOMEM;
+- }
+
+ return 0;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/staging-comedi-ni_usb6501-Fix-use-of-uninitialized-m.patch b/patches.drivers/staging-comedi-ni_usb6501-Fix-use-of-uninitialized-m.patch
new file mode 100644
index 0000000000..d53e67d439
--- /dev/null
+++ b/patches.drivers/staging-comedi-ni_usb6501-Fix-use-of-uninitialized-m.patch
@@ -0,0 +1,117 @@
+From 660cf4ce9d0f3497cc7456eaa6d74c8b71d6282c Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Mon, 15 Apr 2019 12:43:01 +0100
+Subject: [PATCH] staging: comedi: ni_usb6501: Fix use of uninitialized mutex
+Git-commit: 660cf4ce9d0f3497cc7456eaa6d74c8b71d6282c
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+If `ni6501_auto_attach()` returns an error, the core comedi module code
+will call `ni6501_detach()` to clean up. If `ni6501_auto_attach()`
+successfully allocated the comedi device private data, `ni6501_detach()`
+assumes that a `struct mutex mut` contained in the private data has been
+initialized and uses it. Unfortunately, there are a couple of places
+where `ni6501_auto_attach()` can return an error after allocating the
+device private data but before initializing the mutex, so this
+assumption is invalid. Fix it by initializing the mutex just after
+allocating the private data in `ni6501_auto_attach()` before any other
+errors can be retturned. Also move the call to `usb_set_intfdata()`
+just to keep the code a bit neater (either position for the call is
+fine).
+
+I believe this was the cause of the following syzbot crash report
+<https://syzkaller.appspot.com/bug?extid=cf4f2b6c24aff0a3edf6>:
+
+usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
+usb 1-1: config 0 descriptor??
+usb 1-1: string descriptor 0 read error: -71
+comedi comedi0: Wrong number of endpoints
+ni6501 1-1:0.233: driver 'ni6501' failed to auto-configure device.
+Info: trying to register non-static key.
+the code is fine but needs lockdep annotation.
+turning off the locking correctness validator.
+Cpu: 0 PID: 585 Comm: kworker/0:3 Not tainted 5.1.0-rc4-319354-g9a33b36 #3
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Workqueue: usb_hub_wq hub_event
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xe8/0x16e lib/dump_stack.c:113
+ assign_lock_key kernel/locking/lockdep.c:786 [inline]
+ register_lock_class+0x11b8/0x1250 kernel/locking/lockdep.c:1095
+ __lock_acquire+0xfb/0x37c0 kernel/locking/lockdep.c:3582
+ lock_acquire+0x10d/0x2f0 kernel/locking/lockdep.c:4211
+ __mutex_lock_common kernel/locking/mutex.c:925 [inline]
+ __mutex_lock+0xfe/0x12b0 kernel/locking/mutex.c:1072
+ ni6501_detach+0x5b/0x110 drivers/staging/comedi/drivers/ni_usb6501.c:567
+ comedi_device_detach+0xed/0x800 drivers/staging/comedi/drivers.c:204
+ comedi_device_cleanup.part.0+0x68/0x140 drivers/staging/comedi/comedi_fops.c:156
+ comedi_device_cleanup drivers/staging/comedi/comedi_fops.c:187 [inline]
+ comedi_free_board_dev.part.0+0x16/0x90 drivers/staging/comedi/comedi_fops.c:190
+ comedi_free_board_dev drivers/staging/comedi/comedi_fops.c:189 [inline]
+ comedi_release_hardware_device+0x111/0x140 drivers/staging/comedi/comedi_fops.c:2880
+ comedi_auto_config.cold+0x124/0x1b0 drivers/staging/comedi/drivers.c:1068
+ usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361
+ really_probe+0x2da/0xb10 drivers/base/dd.c:509
+ driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
+ __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
+ bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
+ __device_attach+0x223/0x3a0 drivers/base/dd.c:844
+ bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
+ device_add+0xad2/0x16e0 drivers/base/core.c:2106
+ usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021
+ generic_probe+0xa2/0xda drivers/usb/core/generic.c:210
+ usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266
+ really_probe+0x2da/0xb10 drivers/base/dd.c:509
+ driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
+ __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
+ bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
+ __device_attach+0x223/0x3a0 drivers/base/dd.c:844
+ bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
+ device_add+0xad2/0x16e0 drivers/base/core.c:2106
+ usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534
+ hub_port_connect drivers/usb/core/hub.c:5089 [inline]
+ hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
+ port_event drivers/usb/core/hub.c:5350 [inline]
+ hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432
+ process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
+ worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
+ kthread+0x313/0x420 kernel/kthread.c:253
+ ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
+
+Reported-by: syzbot+cf4f2b6c24aff0a3edf6@syzkaller.appspotmail.com
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/staging/comedi/drivers/ni_usb6501.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c
+index 808ed92ed66f..ed5e42655821 100644
+--- a/drivers/staging/comedi/drivers/ni_usb6501.c
++++ b/drivers/staging/comedi/drivers/ni_usb6501.c
+@@ -518,6 +518,9 @@ static int ni6501_auto_attach(struct comedi_device *dev,
+ if (!devpriv)
+ return -ENOMEM;
+
++ mutex_init(&devpriv->mut);
++ usb_set_intfdata(intf, devpriv);
++
+ ret = ni6501_find_endpoints(dev);
+ if (ret)
+ return ret;
+@@ -526,9 +529,6 @@ static int ni6501_auto_attach(struct comedi_device *dev,
+ if (ret)
+ return ret;
+
+- mutex_init(&devpriv->mut);
+- usb_set_intfdata(intf, devpriv);
+-
+ ret = comedi_alloc_subdevices(dev, 2);
+ if (ret)
+ return ret;
+--
+2.16.4
+
diff --git a/patches.drivers/staging-comedi-vmk80xx-Fix-possible-double-free-of-u.patch b/patches.drivers/staging-comedi-vmk80xx-Fix-possible-double-free-of-u.patch
new file mode 100644
index 0000000000..4e132a43a6
--- /dev/null
+++ b/patches.drivers/staging-comedi-vmk80xx-Fix-possible-double-free-of-u.patch
@@ -0,0 +1,49 @@
+From 663d294b4768bfd89e529e069bffa544a830b5bf Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Mon, 15 Apr 2019 12:52:30 +0100
+Subject: [PATCH] staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf
+Git-commit: 663d294b4768bfd89e529e069bffa544a830b5bf
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+`vmk80xx_alloc_usb_buffers()` is called from `vmk80xx_auto_attach()` to
+allocate RX and TX buffers for USB transfers. It allocates
+`devpriv->usb_rx_buf` followed by `devpriv->usb_tx_buf`. If the
+allocation of `devpriv->usb_tx_buf` fails, it frees
+`devpriv->usb_rx_buf`, leaving the pointer set dangling, and returns an
+error. Later, `vmk80xx_detach()` will be called from the core comedi
+module code to clean up. `vmk80xx_detach()` also frees both
+`devpriv->usb_rx_buf` and `devpriv->usb_tx_buf`, but
+`devpriv->usb_rx_buf` may have already been freed, leading to a
+double-free error. Fix it by removing the call to
+`kfree(devpriv->usb_rx_buf)` from `vmk80xx_alloc_usb_buffers()`, relying
+on `vmk80xx_detach()` to free the memory.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/staging/comedi/drivers/vmk80xx.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
+index b035d662390b..65dc6c51037e 100644
+--- a/drivers/staging/comedi/drivers/vmk80xx.c
++++ b/drivers/staging/comedi/drivers/vmk80xx.c
+@@ -682,10 +682,8 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
+
+ size = usb_endpoint_maxp(devpriv->ep_tx);
+ devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
+- if (!devpriv->usb_tx_buf) {
+- kfree(devpriv->usb_rx_buf);
++ if (!devpriv->usb_tx_buf)
+ return -ENOMEM;
+- }
+
+ return 0;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/staging-comedi-vmk80xx-Fix-use-of-uninitialized-sema.patch b/patches.drivers/staging-comedi-vmk80xx-Fix-use-of-uninitialized-sema.patch
new file mode 100644
index 0000000000..e33dfb5e35
--- /dev/null
+++ b/patches.drivers/staging-comedi-vmk80xx-Fix-use-of-uninitialized-sema.patch
@@ -0,0 +1,114 @@
+From 08b7c2f9208f0e2a32159e4e7a4831b7adb10a3e Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Mon, 15 Apr 2019 12:10:14 +0100
+Subject: [PATCH] staging: comedi: vmk80xx: Fix use of uninitialized semaphore
+Git-commit: 08b7c2f9208f0e2a32159e4e7a4831b7adb10a3e
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+If `vmk80xx_auto_attach()` returns an error, the core comedi module code
+will call `vmk80xx_detach()` to clean up. If `vmk80xx_auto_attach()`
+successfully allocated the comedi device private data,
+`vmk80xx_detach()` assumes that a `struct semaphore limit_sem` contained
+in the private data has been initialized and uses it. Unfortunately,
+there are a couple of places where `vmk80xx_auto_attach()` can return an
+error after allocating the device private data but before initializing
+the semaphore, so this assumption is invalid. Fix it by initializing
+the semaphore just after allocating the private data in
+`vmk80xx_auto_attach()` before any other errors can be returned.
+
+I believe this was the cause of the following syzbot crash report
+<https://syzkaller.appspot.com/bug?extid=54c2f58f15fe6876b6ad>:
+
+usb 1-1: config 0 has no interface number 0
+usb 1-1: New USB device found, idVendor=10cf, idProduct=8068, bcdDevice=e6.8d
+usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
+usb 1-1: config 0 descriptor??
+vmk80xx 1-1:0.117: driver 'vmk80xx' failed to auto-configure device.
+Info: trying to register non-static key.
+the code is fine but needs lockdep annotation.
+turning off the locking correctness validator.
+Cpu: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.1.0-rc4-319354-g9a33b36 #3
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Workqueue: usb_hub_wq hub_event
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xe8/0x16e lib/dump_stack.c:113
+ assign_lock_key kernel/locking/lockdep.c:786 [inline]
+ register_lock_class+0x11b8/0x1250 kernel/locking/lockdep.c:1095
+ __lock_acquire+0xfb/0x37c0 kernel/locking/lockdep.c:3582
+ lock_acquire+0x10d/0x2f0 kernel/locking/lockdep.c:4211
+ __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
+ _raw_spin_lock_irqsave+0x44/0x60 kernel/locking/spinlock.c:152
+ down+0x12/0x80 kernel/locking/semaphore.c:58
+ vmk80xx_detach+0x59/0x100 drivers/staging/comedi/drivers/vmk80xx.c:829
+ comedi_device_detach+0xed/0x800 drivers/staging/comedi/drivers.c:204
+ comedi_device_cleanup.part.0+0x68/0x140 drivers/staging/comedi/comedi_fops.c:156
+ comedi_device_cleanup drivers/staging/comedi/comedi_fops.c:187 [inline]
+ comedi_free_board_dev.part.0+0x16/0x90 drivers/staging/comedi/comedi_fops.c:190
+ comedi_free_board_dev drivers/staging/comedi/comedi_fops.c:189 [inline]
+ comedi_release_hardware_device+0x111/0x140 drivers/staging/comedi/comedi_fops.c:2880
+ comedi_auto_config.cold+0x124/0x1b0 drivers/staging/comedi/drivers.c:1068
+ usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361
+ really_probe+0x2da/0xb10 drivers/base/dd.c:509
+ driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
+ __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
+ bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
+ __device_attach+0x223/0x3a0 drivers/base/dd.c:844
+ bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
+ device_add+0xad2/0x16e0 drivers/base/core.c:2106
+ usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021
+ generic_probe+0xa2/0xda drivers/usb/core/generic.c:210
+ usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266
+ really_probe+0x2da/0xb10 drivers/base/dd.c:509
+ driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
+ __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
+ bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
+ __device_attach+0x223/0x3a0 drivers/base/dd.c:844
+ bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
+ device_add+0xad2/0x16e0 drivers/base/core.c:2106
+ usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534
+ hub_port_connect drivers/usb/core/hub.c:5089 [inline]
+ hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
+ port_event drivers/usb/core/hub.c:5350 [inline]
+ hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432
+ process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
+ worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
+ kthread+0x313/0x420 kernel/kthread.c:253
+ ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
+
+Reported-by: syzbot+54c2f58f15fe6876b6ad@syzkaller.appspotmail.com
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/staging/comedi/drivers/vmk80xx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
+index 6234b649d887..b035d662390b 100644
+--- a/drivers/staging/comedi/drivers/vmk80xx.c
++++ b/drivers/staging/comedi/drivers/vmk80xx.c
+@@ -800,6 +800,8 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
+
+ devpriv->model = board->model;
+
++ sema_init(&devpriv->limit_sem, 8);
++
+ ret = vmk80xx_find_usb_endpoints(dev);
+ if (ret)
+ return ret;
+@@ -808,8 +810,6 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
+ if (ret)
+ return ret;
+
+- sema_init(&devpriv->limit_sem, 8);
+-
+ usb_set_intfdata(intf, devpriv);
+
+ if (devpriv->model == VMK8055_MODEL)
+--
+2.16.4
+
diff --git a/patches.drivers/staging-iio-ad7192-Fix-ad7193-channel-address.patch b/patches.drivers/staging-iio-ad7192-Fix-ad7193-channel-address.patch
new file mode 100644
index 0000000000..b39fa178d5
--- /dev/null
+++ b/patches.drivers/staging-iio-ad7192-Fix-ad7193-channel-address.patch
@@ -0,0 +1,41 @@
+From 7ce0f216221856a17fc4934b39284678a5fef2e9 Mon Sep 17 00:00:00 2001
+From: Mircea Caprioru <mircea.caprioru@analog.com>
+Date: Wed, 20 Feb 2019 13:08:20 +0200
+Subject: [PATCH] staging: iio: ad7192: Fix ad7193 channel address
+Git-commit: 7ce0f216221856a17fc4934b39284678a5fef2e9
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+This patch fixes the differential channels addresses for the ad7193.
+
+Signed-off-by: Mircea Caprioru <mircea.caprioru@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/staging/iio/adc/ad7192.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
+index acdbc07fd259..2fc8bc22b57b 100644
+--- a/drivers/staging/iio/adc/ad7192.c
++++ b/drivers/staging/iio/adc/ad7192.c
+@@ -109,10 +109,10 @@
+ #define AD7192_CH_AIN3 BIT(6) /* AIN3 - AINCOM */
+ #define AD7192_CH_AIN4 BIT(7) /* AIN4 - AINCOM */
+
+-#define AD7193_CH_AIN1P_AIN2M 0x000 /* AIN1(+) - AIN2(-) */
+-#define AD7193_CH_AIN3P_AIN4M 0x001 /* AIN3(+) - AIN4(-) */
+-#define AD7193_CH_AIN5P_AIN6M 0x002 /* AIN5(+) - AIN6(-) */
+-#define AD7193_CH_AIN7P_AIN8M 0x004 /* AIN7(+) - AIN8(-) */
++#define AD7193_CH_AIN1P_AIN2M 0x001 /* AIN1(+) - AIN2(-) */
++#define AD7193_CH_AIN3P_AIN4M 0x002 /* AIN3(+) - AIN4(-) */
++#define AD7193_CH_AIN5P_AIN6M 0x004 /* AIN5(+) - AIN6(-) */
++#define AD7193_CH_AIN7P_AIN8M 0x008 /* AIN7(+) - AIN8(-) */
+ #define AD7193_CH_TEMP 0x100 /* Temp senseor */
+ #define AD7193_CH_AIN2P_AIN2M 0x200 /* AIN2(+) - AIN2(-) */
+ #define AD7193_CH_AIN1 0x401 /* AIN1 - AINCOM */
+--
+2.16.4
+
diff --git a/patches.fixes/clk-x86-Add-system-specific-quirk-to-mark-clocks-as-.patch b/patches.fixes/clk-x86-Add-system-specific-quirk-to-mark-clocks-as-.patch
new file mode 100644
index 0000000000..840980addb
--- /dev/null
+++ b/patches.fixes/clk-x86-Add-system-specific-quirk-to-mark-clocks-as-.patch
@@ -0,0 +1,144 @@
+From 7c2e07130090ae001a97a6b65597830d6815e93e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20M=C3=BCller?= <dave.mueller@gmx.ch>
+Date: Mon, 8 Apr 2019 15:33:54 +0200
+Subject: [PATCH] clk: x86: Add system specific quirk to mark clocks as critical
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 7c2e07130090ae001a97a6b65597830d6815e93e
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+Since commit 648e921888ad ("clk: x86: Stop marking clocks as
+CLK_IS_CRITICAL"), the pmc_plt_clocks of the Bay Trail SoC are
+unconditionally gated off. Unfortunately this will break systems where these
+clocks are used for external purposes beyond the kernel's knowledge. Fix it
+by implementing a system specific quirk to mark the necessary pmc_plt_clks as
+critical.
+
+Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
+Signed-off-by: David Müller <dave.mueller@gmx.ch>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/x86/clk-pmc-atom.c | 14 +++++++++++---
+ drivers/platform/x86/pmc_atom.c | 21 +++++++++++++++++++++
+ include/linux/platform_data/x86/clk-pmc-atom.h | 3 +++
+ 3 files changed, 35 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/x86/clk-pmc-atom.c b/drivers/clk/x86/clk-pmc-atom.c
+index d977193842df..19174835693b 100644
+--- a/drivers/clk/x86/clk-pmc-atom.c
++++ b/drivers/clk/x86/clk-pmc-atom.c
+@@ -165,7 +165,7 @@ static const struct clk_ops plt_clk_ops = {
+ };
+
+ static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
+- void __iomem *base,
++ const struct pmc_clk_data *pmc_data,
+ const char **parent_names,
+ int num_parents)
+ {
+@@ -184,9 +184,17 @@ static struct clk_plt *plt_clk_register(struct platform_device *pdev, int id,
+ init.num_parents = num_parents;
+
+ pclk->hw.init = &init;
+- pclk->reg = base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
++ pclk->reg = pmc_data->base + PMC_CLK_CTL_OFFSET + id * PMC_CLK_CTL_SIZE;
+ spin_lock_init(&pclk->lock);
+
++ /*
++ * On some systems, the pmc_plt_clocks already enabled by the
++ * firmware are being marked as critical to avoid them being
++ * gated by the clock framework.
++ */
++ if (pmc_data->critical && plt_clk_is_enabled(&pclk->hw))
++ init.flags |= CLK_IS_CRITICAL;
++
+ ret = devm_clk_hw_register(&pdev->dev, &pclk->hw);
+ if (ret) {
+ pclk = ERR_PTR(ret);
+@@ -332,7 +340,7 @@ static int plt_clk_probe(struct platform_device *pdev)
+ return PTR_ERR(parent_names);
+
+ for (i = 0; i < PMC_CLK_NUM; i++) {
+- data->clks[i] = plt_clk_register(pdev, i, pmc_data->base,
++ data->clks[i] = plt_clk_register(pdev, i, pmc_data,
+ parent_names, data->nparents);
+ if (IS_ERR(data->clks[i])) {
+ err = PTR_ERR(data->clks[i]);
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index 8f018b3f3cd4..eaec2d306481 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -17,6 +17,7 @@
+
+ #include <linux/debugfs.h>
+ #include <linux/device.h>
++#include <linux/dmi.h>
+ #include <linux/init.h>
+ #include <linux/io.h>
+ #include <linux/platform_data/x86/clk-pmc-atom.h>
+@@ -391,11 +392,27 @@ static int pmc_dbgfs_register(struct pmc_dev *pmc)
+ }
+ #endif /* CONFIG_DEBUG_FS */
+
++/*
++ * Some systems need one or more of their pmc_plt_clks to be
++ * marked as critical.
++ */
++static const struct dmi_system_id critclk_systems[] __initconst = {
++ {
++ .ident = "MPL CEC1x",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MPL AG"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "CEC10 Family"),
++ },
++ },
++ { /*sentinel*/ }
++};
++
+ static int pmc_setup_clks(struct pci_dev *pdev, void __iomem *pmc_regmap,
+ const struct pmc_data *pmc_data)
+ {
+ struct platform_device *clkdev;
+ struct pmc_clk_data *clk_data;
++ const struct dmi_system_id *d = dmi_first_match(critclk_systems);
+
+ clk_data = kzalloc(sizeof(*clk_data), GFP_KERNEL);
+ if (!clk_data)
+@@ -403,6 +420,10 @@ static int pmc_setup_clks(struct pci_dev *pdev, void __iomem *pmc_regmap,
+
+ clk_data->base = pmc_regmap; /* offset is added by client */
+ clk_data->clks = pmc_data->clks;
++ if (d) {
++ clk_data->critical = true;
++ pr_info("%s critclks quirk enabled\n", d->ident);
++ }
+
+ clkdev = platform_device_register_data(&pdev->dev, "clk-pmc-atom",
+ PLATFORM_DEVID_NONE,
+diff --git a/include/linux/platform_data/x86/clk-pmc-atom.h b/include/linux/platform_data/x86/clk-pmc-atom.h
+index 3ab892208343..7a37ac27d0fb 100644
+--- a/include/linux/platform_data/x86/clk-pmc-atom.h
++++ b/include/linux/platform_data/x86/clk-pmc-atom.h
+@@ -35,10 +35,13 @@ struct pmc_clk {
+ *
+ * @base: PMC clock register base offset
+ * @clks: pointer to set of registered clocks, typically 0..5
++ * @critical: flag to indicate if firmware enabled pmc_plt_clks
++ * should be marked as critial or not
+ */
+ struct pmc_clk_data {
+ void __iomem *base;
+ const struct pmc_clk *clks;
++ bool critical;
+ };
+
+ #endif /* __PLATFORM_DATA_X86_CLK_PMC_ATOM_H */
+--
+2.16.4
+
diff --git a/patches.fixes/crypto-crypto4xx-properly-set-IV-after-de-and-encryp.patch b/patches.fixes/crypto-crypto4xx-properly-set-IV-after-de-and-encryp.patch
new file mode 100644
index 0000000000..ac469c354c
--- /dev/null
+++ b/patches.fixes/crypto-crypto4xx-properly-set-IV-after-de-and-encryp.patch
@@ -0,0 +1,76 @@
+From fc340115ffb8235c1bbd200c28855e6373d0dd1a Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Thu, 19 Apr 2018 18:41:55 +0200
+Subject: [PATCH] crypto: crypto4xx - properly set IV after de- and encrypt
+Git-commit: fc340115ffb8235c1bbd200c28855e6373d0dd1a
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+This patch fixes cts(cbc(aes)) test when cbc-aes-ppc4xx is used.
+Alg: skcipher: Test 1 failed (invalid result) on encryption for cts(cbc-aes-ppc4xx)
+00000000: 4b 10 75 fc 2f 14 1b 6a 27 35 37 33 d1 b7 70 05
+00000010: 97
+Alg: skcipher: Failed to load transform for cts(cbc(aes)): -2
+
+The CTS cipher mode expect the IV (req->iv) of skcipher_request
+to contain the last ciphertext block after the {en,de}crypt
+operation is complete.
+
+Fix this issue for the AMCC Crypto4xx hardware engine.
+The tcrypt test case for cts(cbc(aes)) is now correctly passed.
+
+name : cts(cbc(aes))
+driver : cts(cbc-aes-ppc4xx)
+module : cts
+priority : 300
+refcnt : 1
+selftest : passed
+internal : no
+type : skcipher
+async : yes
+blocksize : 16
+min keysize : 16
+max keysize : 32
+ivsize : 16
+chunksize : 16
+walksize : 16
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/amcc/crypto4xx_alg.c | 3 ++-
+ drivers/crypto/amcc/crypto4xx_core.c | 9 +++++++++
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/crypto/amcc/crypto4xx_alg.c
++++ b/drivers/crypto/amcc/crypto4xx_alg.c
+@@ -138,7 +138,8 @@ static int crypto4xx_setkey_aes(struct c
+ sa = (struct dynamic_sa_ctl *) ctx->sa_in;
+ ctx->hash_final = 0;
+
+- set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, SA_NOT_SAVE_IV,
++ set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, (cm == CRYPTO_MODE_CBC ?
++ SA_SAVE_IV : SA_NOT_SAVE_IV),
+ SA_LOAD_HASH_FROM_SA, SA_LOAD_IV_FROM_STATE,
+ SA_NO_HEADER_PROC, SA_HASH_ALG_NULL,
+ SA_CIPHER_ALG_AES, SA_PAD_TYPE_ZERO,
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -645,6 +645,15 @@ static u32 crypto4xx_ablkcipher_done(str
+ addr = dma_map_page(dev->core_dev->device, sg_page(dst),
+ dst->offset, dst->length, DMA_FROM_DEVICE);
+ }
++
++ if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) {
++ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
++
++ crypto4xx_memcpy_from_le32((u32 *)req->iv,
++ pd_uinfo->sr_va->save_iv,
++ crypto_skcipher_ivsize(skcipher));
++ }
++
+ crypto4xx_ret_sg_desc(dev, pd_uinfo);
+ if (ablk_req->base.complete != NULL)
+ ablk_req->base.complete(&ablk_req->base, 0);
diff --git a/patches.fixes/device_cgroup-fix-RCU-imbalance-in-error-case.patch b/patches.fixes/device_cgroup-fix-RCU-imbalance-in-error-case.patch
new file mode 100644
index 0000000000..a5664b1a05
--- /dev/null
+++ b/patches.fixes/device_cgroup-fix-RCU-imbalance-in-error-case.patch
@@ -0,0 +1,46 @@
+From 0fcc4c8c044e117ac126ab6df4138ea9a67fa2a9 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Tue, 19 Mar 2019 02:36:59 +0100
+Subject: [PATCH] device_cgroup: fix RCU imbalance in error case
+Git-commit: 0fcc4c8c044e117ac126ab6df4138ea9a67fa2a9
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+When dev_exception_add() returns an error (due to a failed memory
+allocation), make sure that we move the RCU preemption count back to where
+it was before we were called. We dropped the RCU read lock inside the loop
+body, so we can't just "break".
+
+sparse complains about this, too:
+
+$ make -s C=2 security/device_cgroup.o
+./include/linux/rcupdate.h:647:9: warning: context imbalance in
+'propagate_exception' - unexpected unlock
+
+Fixes: d591fb56618f ("device_cgroup: simplify cgroup tree walk in propagate_exception()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jann Horn <jannh@google.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ security/device_cgroup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/device_cgroup.c b/security/device_cgroup.c
+index cd97929fac66..dc28914fa72e 100644
+--- a/security/device_cgroup.c
++++ b/security/device_cgroup.c
+@@ -560,7 +560,7 @@ static int propagate_exception(struct dev_cgroup *devcg_root,
+ devcg->behavior == DEVCG_DEFAULT_ALLOW) {
+ rc = dev_exception_add(devcg, ex);
+ if (rc)
+- break;
++ return rc;
+ } else {
+ /*
+ * in the other possible cases:
+--
+2.16.4
+
diff --git a/patches.fixes/mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch b/patches.fixes/mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch
new file mode 100644
index 0000000000..12d8b121bc
--- /dev/null
+++ b/patches.fixes/mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch
@@ -0,0 +1,47 @@
+From 4856bfd230985e43e84c26473c91028ff0a533bd Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 1 Mar 2019 14:48:37 +0100
+Subject: [PATCH] mac80211: do not call driver wake_tx_queue op during reconfig
+Git-commit: 4856bfd230985e43e84c26473c91028ff0a533bd
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+There are several scenarios in which mac80211 can call drv_wake_tx_queue
+after ieee80211_restart_hw has been called and has not yet completed.
+Driver private structs are considered uninitialized until mac80211 has
+uploaded the vifs, stations and keys again, so using private tx queue
+data during that time is not safe.
+
+The driver can also not rely on drv_reconfig_complete to figure out when
+it is safe to accept drv_wake_tx_queue calls again, because it is only
+called after all tx queues are woken again.
+
+To fix this, bail out early in drv_wake_tx_queue if local->in_reconfig
+is set.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/driver-ops.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
+index 28d022a3eee3..ae4f0be3b393 100644
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1195,6 +1195,9 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local,
+ {
+ struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif);
+
++ if (local->in_reconfig)
++ return;
++
+ if (!check_sdata_in_driver(sdata))
+ return;
+
+--
+2.16.4
+
diff --git a/patches.fixes/mm-vmalloc-fix-size-check-for-remap_vmalloc_range_partial b/patches.fixes/mm-vmalloc-fix-size-check-for-remap_vmalloc_range_partial
new file mode 100644
index 0000000000..5468982e1a
--- /dev/null
+++ b/patches.fixes/mm-vmalloc-fix-size-check-for-remap_vmalloc_range_partial
@@ -0,0 +1,86 @@
+From: Roman Penyaev <rpenyaev@suse.de>
+Date: Tue, 5 Mar 2019 15:43:20 -0800
+Subject: mm/vmalloc: fix size check for remap_vmalloc_range_partial()
+Git-commit: 401592d2e095947344e10ec0623adbcd58934dd4
+Patch-mainline: v5.1-rc1
+References: bsc#1133825
+
+When VM_NO_GUARD is not set area->size includes adjacent guard page,
+thus for correct size checking get_vm_area_size() should be used, but
+not area->size.
+
+This fixes possible kernel oops when userspace tries to mmap an area on
+1 page bigger than was allocated by vmalloc_user() call: the size check
+inside remap_vmalloc_range_partial() accounts non-existing guard page
+also, so check successfully passes but vmalloc_to_page() returns NULL
+(guard page does not physically exist).
+
+The following code pattern example should trigger an oops:
+
+ static int oops_mmap(struct file *file, struct vm_area_struct *vma)
+ {
+ void *mem;
+
+ mem = vmalloc_user(4096);
+ BUG_ON(!mem);
+ /* Do not care about mem leak */
+
+ return remap_vmalloc_range(vma, mem, 0);
+ }
+
+And userspace simply mmaps size + PAGE_SIZE:
+
+ mmap(NULL, 8192, PROT_WRITE|PROT_READ, MAP_PRIVATE, fd, 0);
+
+Possible candidates for oops which do not have any explicit size
+checks:
+
+ *** drivers/media/usb/stkwebcam/stk-webcam.c:
+ v4l_stk_mmap[789] ret = remap_vmalloc_range(vma, sbuf->buffer, 0);
+
+Or the following one:
+
+ *** drivers/video/fbdev/core/fbmem.c
+ static int
+ fb_mmap(struct file *file, struct vm_area_struct * vma)
+ ...
+ res = fb->fb_mmap(info, vma);
+
+Where fb_mmap callback calls remap_vmalloc_range() directly without any
+explicit checks:
+
+ *** drivers/video/fbdev/vfb.c
+ static int vfb_mmap(struct fb_info *info,
+ struct vm_area_struct *vma)
+ {
+ return remap_vmalloc_range(vma, (void *)info->fix.smem_start, vma->vm_pgoff);
+ }
+
+Link: http://lkml.kernel.org/r/20190103145954.16942-2-rpenyaev@suse.de
+Signed-off-by: Roman Penyaev <rpenyaev@suse.de>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: Joe Perches <joe@perches.com>
+Cc: "Luis R. Rodriguez" <mcgrof@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ mm/vmalloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index cb827624c006..421ae07ffb37 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -2249,7 +2249,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
+ if (!(area->flags & VM_USERMAP))
+ return -EINVAL;
+
+- if (kaddr + size > area->addr + area->size)
++ if (kaddr + size > area->addr + get_vm_area_size(area))
+ return -EINVAL;
+
+ do {
+
diff --git a/patches.fixes/vfs-avoid-problematic-remapping-requests-into-partia.patch b/patches.fixes/vfs-avoid-problematic-remapping-requests-into-partia.patch
new file mode 100644
index 0000000000..e5dd44050e
--- /dev/null
+++ b/patches.fixes/vfs-avoid-problematic-remapping-requests-into-partia.patch
@@ -0,0 +1,94 @@
+From 07d19dc9fbe9128378b9e226abe886fd8fd473df Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Tue, 30 Oct 2018 10:40:55 +1100
+Subject: [PATCH] vfs: avoid problematic remapping requests into partial EOF
+ block
+Git-commit: 07d19dc9fbe9128378b9e226abe886fd8fd473df
+Patch-mainline: v4.20-rc1
+References: bsc#1133850, bsc#1132219
+
+A deduplication data corruption is exposed in XFS and btrfs. It is
+caused by extending the block match range to include the partial EOF
+block, but then allowing unknown data beyond EOF to be considered a
+"match" to data in the destination file because the comparison is only
+made to the end of the source file. This corrupts the destination file
+when the source extent is shared with it.
+
+The VFS remapping prep functions only support whole block dedupe, but
+we still need to appear to support whole file dedupe correctly. Hence
+if the dedupe request includes the last block of the souce file, don't
+include it in the actual dedupe operation. If the rest of the range
+dedupes successfully, then reject the entire request. A subsequent
+patch will enable us to shorten dedupe requests correctly.
+
+When reflinking sub-file ranges, a data corruption can occur when the
+source file range includes a partial EOF block. This shares the unknown
+data beyond EOF into the second file at a position inside EOF, exposing
+stale data in the second file.
+
+If the reflink request includes the last block of the souce file, only
+proceed with the reflink operation if it lands at or past the
+destination file's current EOF. If it lands within the destination file
+EOF, reject the entire request with -EINVAL and make the caller go the
+hard way. A subsequent patch will enable us to shorten reflink requests
+correctly.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Acked-by: Anthony Iliopoulos <ailiopoulos@suse.com>
+
+---
+ fs/read_write.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -1716,6 +1716,34 @@
+
+ return security_file_permission(file, write ? MAY_WRITE : MAY_READ);
+ }
++/*
++ * Ensure that we don't remap a partial EOF block in the middle of something
++ * else. Assume that the offsets have already been checked for block
++ * alignment.
++ *
++ * For deduplication we always scale down to the previous block because we
++ * can't meaningfully compare post-EOF contents.
++ *
++ * For clone we only link a partial EOF block above the destination file's EOF.
++ */
++static int generic_remap_check_len(struct inode *inode_in,
++ struct inode *inode_out,
++ loff_t pos_out,
++ u64 *len,
++ bool is_dedupe)
++{
++ u64 blkmask = i_blocksize(inode_in) - 1;
++
++ if ((*len & blkmask) == 0)
++ return 0;
++
++ if (is_dedupe)
++ *len &= ~blkmask;
++ else if (pos_out + *len < i_size_read(inode_out))
++ return -EINVAL;
++
++ return 0;
++}
+
+ /*
+ * Check that the two inodes are eligible for cloning, the ranges make
+@@ -1821,6 +1849,11 @@
+ return -EBADE;
+ }
+
++ ret = generic_remap_check_len(inode_in, inode_out, pos_out, len,
++ is_dedupe);
++ if (ret)
++ return ret;
++
+ return 1;
+ }
+ EXPORT_SYMBOL(vfs_clone_file_prep_inodes);
+
diff --git a/patches.fixes/vfs-rename-clone_verify_area-to-remap_verify_area.patch b/patches.fixes/vfs-rename-clone_verify_area-to-remap_verify_area.patch
new file mode 100644
index 0000000000..31b80f9257
--- /dev/null
+++ b/patches.fixes/vfs-rename-clone_verify_area-to-remap_verify_area.patch
@@ -0,0 +1,68 @@
+From 6095028b455d775e369ae27875f698ff0f6fdeb8 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Tue, 30 Oct 2018 10:41:14 +1100
+Subject: [PATCH] vfs: rename clone_verify_area to remap_verify_area
+Git-commit: 6095028b455d775e369ae27875f698ff0f6fdeb8
+Patch-mainline: v4.20-rc1
+References: bsc#1133852, bsc#1132219
+
+Since we use clone_verify_area for both clone and dedupe range checks,
+rename the function to make it clear that it's for both.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Acked-by: Anthony Iliopoulos <ailiopoulos@suse.com>
+
+---
+ fs/read_write.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/read_write.c b/fs/read_write.c
+index aca75a97a695..734c5661fb69 100644
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -1686,7 +1686,7 @@ SYSCALL_DEFINE6(copy_file_range, int, fd_in, loff_t __user *, off_in,
+ return ret;
+ }
+
+-static int clone_verify_area(struct file *file, loff_t pos, u64 len, bool write)
++static int remap_verify_area(struct file *file, loff_t pos, u64 len, bool write)
+ {
+ struct inode *inode = file_inode(file);
+
+@@ -1852,11 +1852,11 @@ int do_clone_file_range(struct file *file_in, loff_t pos_in,
+ if (!file_in->f_op->clone_file_range)
+ return -EOPNOTSUPP;
+
+- ret = clone_verify_area(file_in, pos_in, len, false);
++ ret = remap_verify_area(file_in, pos_in, len, false);
+ if (ret)
+ return ret;
+
+- ret = clone_verify_area(file_out, pos_out, len, true);
++ ret = remap_verify_area(file_out, pos_out, len, true);
+ if (ret)
+ return ret;
+
+@@ -1989,7 +1989,7 @@ int vfs_dedupe_file_range_one(struct file *src_file, loff_t src_pos,
+ if (ret)
+ return ret;
+
+- ret = clone_verify_area(dst_file, dst_pos, len, true);
++ ret = remap_verify_area(dst_file, dst_pos, len, true);
+ if (ret < 0)
+ goto out_drop_write;
+
+@@ -2051,7 +2051,7 @@ int vfs_dedupe_file_range(struct file *file, struct file_dedupe_range *same)
+ if (!S_ISREG(src->i_mode))
+ goto out;
+
+- ret = clone_verify_area(file, off, len, false);
++ ret = remap_verify_area(file, off, len, false);
+ if (ret < 0)
+ goto out;
+ ret = 0;
+--
+2.16.4
+
diff --git a/patches.fixes/vfs-skip-zero-length-dedupe-requests.patch b/patches.fixes/vfs-skip-zero-length-dedupe-requests.patch
new file mode 100644
index 0000000000..d1763f1833
--- /dev/null
+++ b/patches.fixes/vfs-skip-zero-length-dedupe-requests.patch
@@ -0,0 +1,36 @@
+From 9aae20500d9cd3e7d55d0536d359bdd1c869db89 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Tue, 30 Oct 2018 10:41:01 +1100
+Subject: [PATCH] vfs: skip zero-length dedupe requests
+Git-commit: 9aae20500d9cd3e7d55d0536d359bdd1c869db89
+Patch-mainline: v4.20-rc1
+References: bsc#1133851, bsc#1132219
+
+Don't bother calling the filesystem for a zero-length dedupe request;
+we can return zero and exit.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Acked-by: Anthony Iliopoulos <ailiopoulos@suse.com>
+
+---
+ fs/read_write.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -2031,6 +2031,11 @@
+ if (!dst_file->f_op->dedupe_file_range)
+ goto out_drop_write;
+
++ if (len == 0) {
++ ret = 0;
++ goto out_drop_write;
++ }
++
+ ret = dst_file->f_op->dedupe_file_range(src_file, src_pos,
+ len, dst_file, dst_pos);
+ out_drop_write:
+
diff --git a/series.conf b/series.conf
index 4b33e61685..68863e9ea8 100644
--- a/series.conf
+++ b/series.conf
@@ -16551,6 +16551,7 @@
patches.drivers/0005-crypto-cavium-Fix-smp_processor_id-warnings.patch
patches.drivers/crypto-caam-strip-input-zeros-from-RSA-input-buffer
patches.drivers/crypto-omap-sham-fix-memleak
+ patches.fixes/crypto-crypto4xx-properly-set-IV-after-de-and-encryp.patch
patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-ini
patches.drivers/crypto-vmx-Remove-overly-verbose-printk-from-AES-XTS
patches.drivers/crypto-clarify-licensing-of-OpenSSL-asm-code.patch
@@ -19949,6 +19950,9 @@
patches.fixes/vfs-dedupe-should-return-EPERM-if-permission-is-not-.patch
patches.fixes/vfs-vfs_clone_file_prep_inodes-should-return-EINVAL-.patch
patches.fixes/vfs-exit-early-from-zero-length-remap-operations.patch
+ patches.fixes/vfs-avoid-problematic-remapping-requests-into-partia.patch
+ patches.fixes/vfs-skip-zero-length-dedupe-requests.patch
+ patches.fixes/vfs-rename-clone_verify_area-to-remap_verify_area.patch
patches.fixes/xfs-fix-pagecache-truncation-prior-to-reflink.patch
patches.fixes/xfs-clean-up-xfs_reflink_remap_blocks-call-site.patch
patches.drm/drm-edid-Add-6-bpc-quirk-for-BOE-panel.patch
@@ -20680,6 +20684,9 @@
patches.arch/s390-sles15sp1-00-12-56-mlx4-trigger-IB-events-needed-by-SMC.patch
patches.suse/0001-dm-do-not-allow-readahead-to-limit-IO-size.patch
patches.drivers/mmc-atmel-mci-do-not-assume-idle-after-atmci_request.patch
+ patches.drivers/mmc-sdhci-Fix-data-command-CRC-error-handling.patch
+ patches.drivers/mmc-sdhci-Rename-SDHCI_ACMD12_ERR-and-SDHCI_INT_ACMD.patch
+ patches.drivers/mmc-sdhci-Handle-auto-command-errors.patch
patches.drivers/mmc-bcm2835-reset-host-on-timeout.patch
patches.drivers/mmc-bcm2835-Recover-from-MMC_SEND_EXT_CSD.patch
patches.drivers/memstick-Prevent-memstick-host-from-getting-runtime-.patch
@@ -21297,6 +21304,7 @@
patches.arch/x86-cpu-amd-set-the-cpb-bit-unconditionally-on-f17h.patch
patches.drivers/soc-tegra-fuse-Fix-illegal-free-of-IO-base-address.patch
patches.drivers/soc-qcom-gsbi-Fix-error-handling-in-gsbi_probe.patch
+ patches.fixes/mm-vmalloc-fix-size-check-for-remap_vmalloc_range_partial
patches.arch/intel_idle-add-support-for-Jacobsville.patch
patches.arch/powercap-intel_rapl-add-support-for-Jacobsville.patch
patches.drivers/cpufreq-tegra124-add-missing-of_node_put.patch
@@ -21407,6 +21415,7 @@
patches.suse/livepatch-proper-error-handling-in-the-shadow-variables-selftest.patch
patches.suse/livepatch-module-coming-and-going-callbacks-can-proceed-with-all-listed-patches.patch
patches.drivers/HID-intel-ish-ipc-handle-PIMR-before-ish_wakeup-also.patch
+ patches.drivers/HID-i2c-hid-Ignore-input-report-if-there-s-no-data-p.patch
patches.drivers/HID-intel-ish-hid-avoid-binding-wrong-ishtp_cl_devic.patch
patches.arch/x86-mce-amd-edac-mce_amd-add-new-mp5-nbio-and-pcie-smca-bank-types.patch
patches.arch/x86-mce-amd-edac-mce_amd-add-new-mcatypes-for-cs-psp-and-smu-units.patch
@@ -21719,16 +21728,30 @@
patches.arch/powerpc-vdso32-fix-CLOCK_MONOTONIC-on-PPC64.patch
patches.drivers/PCI-Add-function-1-DMA-alias-quirk-for-Marvell-9170-.patch
patches.fixes/0001-PCI-pciehp-Ignore-Link-State-Changes-after-powering-.patch
+ patches.fixes/clk-x86-Add-system-specific-quirk-to-mark-clocks-as-.patch
patches.arch/svm-avic-fix-invalidate-logical-apic-id-entry
+ patches.fixes/mac80211-do-not-call-driver-wake_tx_queue-op-during-.patch
patches.drivers/ibmvnic-Enable-GRO.patch
patches.drivers/ibmvnic-Fix-netdev-feature-clobbering-during-a-reset.patch
patches.fixes/0001-net-bridge-multicast-use-rcu-to-access-port-list-fro.patch
patches.fixes/0001-net-bridge-fix-per-port-af_packet-sockets.patch
patches.fixes/crypto-x86-poly1305-fix-overflow-during-partial-redu.patch
patches.drivers/Input-snvs_pwrkey-initialize-necessary-driver-data-b.patch
+ patches.drivers/iio-gyro-bmg160-Use-millidegrees-for-temperature-sca.patch
+ patches.drivers/staging-iio-ad7192-Fix-ad7193-channel-address.patch
+ patches.drivers/iio-Fix-scan-mask-selection.patch
+ patches.drivers/iio-gyro-mpu3050-fix-chip-ID-reading.patch
+ patches.drivers/iio-adc-at91-disable-adc-channel-interrupt-in-timeou.patch
+ patches.drivers/io-accel-kxcjk1013-restore-the-range-after-resume.patch
+ patches.drivers/iio-dac-mcp4725-add-missing-powerdown-bits-in-store-.patch
patches.drivers/iio-cros_ec-Fix-the-maths-for-gyro-scale-calculation.patch
patches.drivers/iio-ad_sigma_delta-select-channel-when-reading-regis.patch
patches.drivers/iio-core-fix-a-possible-circular-locking-dependency.patch
+ patches.drivers/staging-comedi-vmk80xx-Fix-use-of-uninitialized-sema.patch
+ patches.drivers/staging-comedi-vmk80xx-Fix-possible-double-free-of-u.patch
+ patches.drivers/staging-comedi-ni_usb6501-Fix-use-of-uninitialized-m.patch
+ patches.drivers/staging-comedi-ni_usb6501-Fix-possible-double-free-o.patch
+ patches.fixes/device_cgroup-fix-RCU-imbalance-in-error-case.patch
patches.arch/x86-speculation-prevent-deadlock-on-ssb_state-lock.patch
patches.drivers/ALSA-hda-Initialize-power_state-field-properly.patch
patches.drivers/ALSA-info-Fix-racy-addition-deletion-of-nodes.patch
@@ -21742,6 +21765,8 @@
patches.drm/0001-drm-sun4i-Unbind-components-before-releasing-DRM-and.patch
patches.suse/tracing-fix-buffer_ref-pipe-ops.patch
patches.suse/tracing-fix-a-memory-leak-by-early-error-exit-in-trace_pid_write.patch
+ patches.drivers/Input-synaptics-rmi4-write-config-register-values-to.patch
+ patches.drivers/dmaengine-sh-rcar-dmac-With-cyclic-DMA-residue-0-is-.patch
# davem/net-next
patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch