Home Home > GIT Browse > vanilla
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2018-10-04 11:53:36 +0200
committerTakashi Iwai <tiwai@suse.de>2018-10-04 11:53:36 +0200
commit6856fb34009c9f476c01995ca8475d72f94aacb2 (patch)
tree9eb301e0e06e1639fea6d531ff1ac15e1cf3b45f
parentc5c071f3b121951edc3f356b693ffbc8ca419cc9 (diff)
parentfaef7958c539035f83d7e7ef5fdbc5e9ecedc0f8 (diff)
Merge branch 'SLE15' into openSUSE-15.0
-rw-r--r--patches.drivers/ALSA-bebob-fix-memory-leak-for-M-Audio-FW1814-and-Pr.patch54
-rw-r--r--patches.drivers/ALSA-bebob-use-address-returned-by-kmalloc-instead-o.patch89
-rw-r--r--patches.drivers/ALSA-emu10k1-fix-possible-info-leak-to-userspace-on-.patch40
-rw-r--r--patches.drivers/ALSA-fireworks-fix-memory-leak-of-response-buffer-at.patch38
-rw-r--r--patches.drivers/ALSA-hda-Add-AZX_DCAPS_PM_RUNTIME-for-AMD-Raven-Ridg.patch36
-rw-r--r--patches.drivers/ALSA-msnd-Fix-the-default-sample-sizes.patch37
-rw-r--r--patches.drivers/ALSA-pcm-Fix-snd_interval_refine-first-last-with-ope.patch71
-rw-r--r--patches.drivers/ALSA-usb-audio-Fix-multiple-definitions-in-AU0828_DE.patch42
-rw-r--r--patches.drivers/ASoC-cs4265-fix-MMTLR-Data-switch-control.patch41
-rw-r--r--patches.drivers/ASoC-dapm-Fix-potential-DAI-widget-pointer-deref-whe.patch43
-rw-r--r--patches.drivers/ASoC-rt5514-Add-the-I2S-ASRC-support.patch107
-rw-r--r--patches.drivers/ASoC-rt5514-Add-the-missing-register-in-the-readable.patch49
-rw-r--r--patches.drivers/ASoC-rt5514-Eliminate-the-noise-in-the-ASRC-case.patch48
-rw-r--r--patches.drivers/ASoC-rt5514-Fix-the-issue-of-the-delay-volume-applie.patch49
-rw-r--r--patches.drivers/Bluetooth-Add-a-new-Realtek-8723DE-ID-0bda-b009.patch64
-rw-r--r--patches.drivers/Bluetooth-Use-lock_sock_nested-in-bt_accept_enqueue.patch104
-rw-r--r--patches.drivers/HID-hid-ntrig-add-error-handling-for-sysfs_create_gr.patch37
-rw-r--r--patches.drivers/Input-elantech-enable-middle-button-of-touchpad-on-T.patch35
-rw-r--r--patches.drivers/NFC-Fix-possible-memory-corruption-when-handling-SHD.patch68
-rw-r--r--patches.drivers/ax88179_178a-Check-for-supported-Wake-on-LAN-modes.patch38
-rw-r--r--patches.drivers/cfg80211-reg-Init-wiphy_idx-in-regulatory_hint_core.patch40
-rw-r--r--patches.drivers/coresight-Handle-errors-in-finding-input-output-port.patch57
-rw-r--r--patches.drivers/crypto-sharah-Unregister-correct-algorithms-for-SAHA.patch49
-rw-r--r--patches.drivers/crypto-skcipher-Fix-Wstringop-truncation-warnings.patch72
-rw-r--r--patches.drivers/fbdev-Distinguish-between-interlaced-and-progressive.patch127
-rw-r--r--patches.drivers/fbdev-via-fix-defined-but-not-used-warning.patch46
-rw-r--r--patches.drivers/gpio-pxa-Fix-potential-NULL-dereference.patch49
-rw-r--r--patches.drivers/gpiolib-Mark-gpio_suffixes-array-with-__maybe_unused.patch50
-rw-r--r--patches.drivers/gpu-ipu-v3-csi-pass-back-mbus_code_to_bus_cfg-error-.patch87
-rw-r--r--patches.drivers/i2c-i801-Allow-ACPI-AML-access-I-O-ports-not-reserve.patch98
-rw-r--r--patches.drivers/input-rohm_bu21023-switch-to-i2c_lock_bus-.-I2C_LOCK.patch47
-rw-r--r--patches.drivers/intel_th-Fix-device-removal-logic.patch43
-rw-r--r--patches.drivers/lan78xx-Check-for-supported-Wake-on-LAN-modes.patch52
-rw-r--r--patches.drivers/mac80211-fix-pending-queue-hang-due-to-TX_DROP.patch56
-rw-r--r--patches.drivers/mac80211-restrict-delayed-tailroom-needed-decrement.patch144
-rw-r--r--patches.drivers/mei-bus-type-promotion-bug-in-mei_nfc_if_version.patch36
-rw-r--r--patches.drivers/mei-ignore-not-found-client-in-the-enumeration.patch63
-rw-r--r--patches.drivers/mfd-88pm860x-i2c-switch-to-i2c_lock_bus-.-I2C_LOCK_S.patch63
-rw-r--r--patches.drivers/mfd-ti_am335x_tscadc-Fix-struct-clk-memory-leak.patch65
-rw-r--r--patches.drivers/mmc-sdhci-do-not-try-to-use-3.3V-signaling-if-not-su.patch55
-rw-r--r--patches.drivers/mmc-sdhci-of-esdhc-set-proper-dma-mask-for-ls104x-ch.patch56
-rw-r--r--patches.drivers/parport-sunbpp-fix-error-return-code.patch48
-rw-r--r--patches.drivers/pinctrl-cannonlake-Fix-HOSTSW_OWN-register-offset-of.patch96
-rw-r--r--patches.drivers/platform-x86-alienware-wmi-Correct-a-memory-leak.patch34
-rw-r--r--patches.drivers/platform-x86-toshiba_acpi-Fix-defined-but-not-used-b.patch48
-rw-r--r--patches.drivers/r8152-Check-for-supported-Wake-on-LAN-Modes.patch38
-rw-r--r--patches.drivers/regulator-fix-crash-caused-by-null-driver-data.patch46
-rw-r--r--patches.drivers/smsc75xx-Check-for-Wake-on-LAN-modes.patch38
-rw-r--r--patches.drivers/smsc95xx-Check-for-Wake-on-LAN-modes.patch38
-rw-r--r--patches.drivers/sr9800-Check-for-supported-Wake-on-LAN-modes.patch38
-rw-r--r--patches.drivers/video-goldfishfb-fix-memory-leak-on-driver-remove.patch41
-rw-r--r--patches.drivers/wlcore-Add-missing-PM-call-for-wlcore_cmd_wait_for_e.patch59
-rw-r--r--patches.drivers/xhci-Fix-use-after-free-for-URB-cancellation-on-a-re.patch77
-rw-r--r--patches.fixes/btrfs-check-integrity-Fix-NULL-pointer-dereference-f.patch52
-rw-r--r--patches.fixes/btrfs-scrub-Don-t-use-inode-page-cache-in-scrub_hand.patch91
-rw-r--r--patches.fixes/btrfs-scrub-Don-t-use-inode-pages-for-device-replace.patch69
-rw-r--r--patches.fixes/x86-memory_failure-Introduce-set-clear-_mce_nospec.patch24
-rw-r--r--patches.suse/btrfs-tests-qgroup-Fix-wrong-tree-backref-level.patch54
-rw-r--r--series.conf57
59 files changed, 3392 insertions, 1 deletions
diff --git a/patches.drivers/ALSA-bebob-fix-memory-leak-for-M-Audio-FW1814-and-Pr.patch b/patches.drivers/ALSA-bebob-fix-memory-leak-for-M-Audio-FW1814-and-Pr.patch
new file mode 100644
index 0000000000..dc05ffa42c
--- /dev/null
+++ b/patches.drivers/ALSA-bebob-fix-memory-leak-for-M-Audio-FW1814-and-Pr.patch
@@ -0,0 +1,54 @@
+From b1fbebd4164b3d170ad916dcd692cf843c9c065d Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Mon, 17 Sep 2018 17:25:24 +0900
+Subject: [PATCH] ALSA: bebob: fix memory leak for M-Audio FW1814 and ProjectMix I/O at error path
+Git-commit: b1fbebd4164b3d170ad916dcd692cf843c9c065d
+Patch-mainline: v4.19-rc5
+References: bsc#1051510
+
+After allocating model-dependent data for M-Audio FW1814 and ProjectMix
+I/O, ALSA bebob driver has memory leak at error path.
+
+This commit releases the allocated data at the error path.
+
+Fixes: 04a2c73c97eb('ALSA: bebob: delayed registration of sound card')
+Cc: <stable@vger.kernel.org> # v4.7+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/firewire/bebob/bebob.c | 2 ++
+ sound/firewire/bebob/bebob_maudio.c | 4 ----
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
+index 730ea91d9be8..93676354f87f 100644
+--- a/sound/firewire/bebob/bebob.c
++++ b/sound/firewire/bebob/bebob.c
+@@ -263,6 +263,8 @@ do_registration(struct work_struct *work)
+ error:
+ mutex_unlock(&devices_mutex);
+ snd_bebob_stream_destroy_duplex(bebob);
++ kfree(bebob->maudio_special_quirk);
++ bebob->maudio_special_quirk = NULL;
+ snd_card_free(bebob->card);
+ dev_info(&bebob->unit->device,
+ "Sound card registration failed: %d\n", err);
+diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c
+index 0c5a4cbb99ba..c266997ad299 100644
+--- a/sound/firewire/bebob/bebob_maudio.c
++++ b/sound/firewire/bebob/bebob_maudio.c
+@@ -294,10 +294,6 @@ snd_bebob_maudio_special_discover(struct snd_bebob *bebob, bool is1814)
+ bebob->midi_output_ports = 2;
+ }
+ end:
+- if (err < 0) {
+- kfree(params);
+- bebob->maudio_special_quirk = NULL;
+- }
+ mutex_unlock(&bebob->mutex);
+ return err;
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-bebob-use-address-returned-by-kmalloc-instead-o.patch b/patches.drivers/ALSA-bebob-use-address-returned-by-kmalloc-instead-o.patch
new file mode 100644
index 0000000000..7d7f2c8ab7
--- /dev/null
+++ b/patches.drivers/ALSA-bebob-use-address-returned-by-kmalloc-instead-o.patch
@@ -0,0 +1,89 @@
+From 493626f2d87a74e6dbea1686499ed6e7e600484e Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sun, 9 Sep 2018 22:25:12 +0900
+Subject: [PATCH] ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping
+Git-commit: 493626f2d87a74e6dbea1686499ed6e7e600484e
+Patch-mainline: v4.19-rc5
+References: bsc#1051510
+
+When executing 'fw_run_transaction()' with 'TCODE_WRITE_BLOCK_REQUEST',
+an address of 'payload' argument is used for streaming DMA mapping by
+'firewire_ohci' module if 'size' argument is larger than 8 byte.
+Although in this case the address should not be on kernel stack, current
+implementation of ALSA bebob driver uses data in kernel stack for a cue
+to boot M-Audio devices. This often brings unexpected result, especially
+for a case of CONFIG_VMAP_STACK=y.
+
+This commit fixes the bug.
+
+Reference: https://bugzilla.kernel.org/show_bug.cgi?id=201021
+Reference: https://forum.manjaro.org/t/firewire-m-audio-410-driver-wont-load-firmware/51165
+Fixes: a2b2a7798fb6('ALSA: bebob: Send a cue to load firmware for M-Audio Firewire series')
+Cc: <stable@vger.kernel.org> # v3.16+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/firewire/bebob/bebob_maudio.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c
+index bd55620c6a47..0c5a4cbb99ba 100644
+--- a/sound/firewire/bebob/bebob_maudio.c
++++ b/sound/firewire/bebob/bebob_maudio.c
+@@ -96,17 +96,13 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
+ struct fw_device *device = fw_parent_device(unit);
+ int err, rcode;
+ u64 date;
+- __le32 cues[3] = {
+- cpu_to_le32(MAUDIO_BOOTLOADER_CUE1),
+- cpu_to_le32(MAUDIO_BOOTLOADER_CUE2),
+- cpu_to_le32(MAUDIO_BOOTLOADER_CUE3)
+- };
++ __le32 *cues;
+
+ /* check date of software used to build */
+ err = snd_bebob_read_block(unit, INFO_OFFSET_SW_DATE,
+ &date, sizeof(u64));
+ if (err < 0)
+- goto end;
++ return err;
+ /*
+ * firmware version 5058 or later has date later than "20070401", but
+ * 'date' is not null-terminated.
+@@ -114,20 +110,28 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
+ if (date < 0x3230303730343031LL) {
+ dev_err(&unit->device,
+ "Use firmware version 5058 or later\n");
+- err = -ENOSYS;
+- goto end;
++ return -ENXIO;
+ }
+
++ cues = kmalloc_array(3, sizeof(*cues), GFP_KERNEL);
++ if (!cues)
++ return -ENOMEM;
++
++ cues[0] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE1);
++ cues[1] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE2);
++ cues[2] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE3);
++
+ rcode = fw_run_transaction(device->card, TCODE_WRITE_BLOCK_REQUEST,
+ device->node_id, device->generation,
+ device->max_speed, BEBOB_ADDR_REG_REQ,
+- cues, sizeof(cues));
++ cues, 3 * sizeof(*cues));
++ kfree(cues);
+ if (rcode != RCODE_COMPLETE) {
+ dev_err(&unit->device,
+ "Failed to send a cue to load firmware\n");
+ err = -EIO;
+ }
+-end:
++
+ return err;
+ }
+
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-emu10k1-fix-possible-info-leak-to-userspace-on-.patch b/patches.drivers/ALSA-emu10k1-fix-possible-info-leak-to-userspace-on-.patch
new file mode 100644
index 0000000000..767a42268c
--- /dev/null
+++ b/patches.drivers/ALSA-emu10k1-fix-possible-info-leak-to-userspace-on-.patch
@@ -0,0 +1,40 @@
+From 49434c6c575d2008c0abbc93e615019f39e01252 Mon Sep 17 00:00:00 2001
+From: Willy Tarreau <w@1wt.eu>
+Date: Sat, 8 Sep 2018 08:12:21 +0200
+Subject: [PATCH] ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO
+Git-commit: 49434c6c575d2008c0abbc93e615019f39e01252
+Patch-mainline: v4.19-rc5
+References: bsc#1051510
+
+snd_emu10k1_fx8010_ioctl(SNDRV_EMU10K1_IOCTL_INFO) allocates
+memory using kmalloc() and partially fills it by calling
+snd_emu10k1_fx8010_info() before returning the resulting
+structure to userspace, leaving uninitialized holes. Let's
+just use kzalloc() here.
+
+Buglink: http://blog.infosectcbr.com.au/2018/09/linux-kernel-infoleaks.html
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Cc: Jann Horn <jannh@google.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/emu10k1/emufx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
+index 90713741c2dc..6ebe817801ea 100644
+--- a/sound/pci/emu10k1/emufx.c
++++ b/sound/pci/emu10k1/emufx.c
+@@ -2540,7 +2540,7 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un
+ emu->support_tlv = 1;
+ return put_user(SNDRV_EMU10K1_VERSION, (int __user *)argp);
+ case SNDRV_EMU10K1_IOCTL_INFO:
+- info = kmalloc(sizeof(*info), GFP_KERNEL);
++ info = kzalloc(sizeof(*info), GFP_KERNEL);
+ if (!info)
+ return -ENOMEM;
+ snd_emu10k1_fx8010_info(emu, info);
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-fireworks-fix-memory-leak-of-response-buffer-at.patch b/patches.drivers/ALSA-fireworks-fix-memory-leak-of-response-buffer-at.patch
new file mode 100644
index 0000000000..a8dba58aff
--- /dev/null
+++ b/patches.drivers/ALSA-fireworks-fix-memory-leak-of-response-buffer-at.patch
@@ -0,0 +1,38 @@
+From c3b55e2ec9c76e7a0de2a0b1dc851fdc9440385b Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Mon, 17 Sep 2018 17:26:41 +0900
+Subject: [PATCH] ALSA: fireworks: fix memory leak of response buffer at error path
+Git-commit: c3b55e2ec9c76e7a0de2a0b1dc851fdc9440385b
+Patch-mainline: v4.19-rc5
+References: bsc#1051510
+
+After allocating memory object for response buffer, ALSA fireworks
+driver has leak of the memory object at error path.
+
+This commit releases the object at the error path.
+
+Fixes: 7d3c1d5901aa('ALSA: fireworks: delayed registration of sound card')
+Cc: <stable@vger.kernel.org> # v4.7+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/firewire/fireworks/fireworks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c
+index 71a0613d3da0..f2d073365cf6 100644
+--- a/sound/firewire/fireworks/fireworks.c
++++ b/sound/firewire/fireworks/fireworks.c
+@@ -301,6 +301,8 @@ do_registration(struct work_struct *work)
+ snd_efw_transaction_remove_instance(efw);
+ snd_efw_stream_destroy_duplex(efw);
+ snd_card_free(efw->card);
++ kfree(efw->resp_buf);
++ efw->resp_buf = NULL;
+ dev_info(&efw->unit->device,
+ "Sound card registration failed: %d\n", err);
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-hda-Add-AZX_DCAPS_PM_RUNTIME-for-AMD-Raven-Ridg.patch b/patches.drivers/ALSA-hda-Add-AZX_DCAPS_PM_RUNTIME-for-AMD-Raven-Ridg.patch
new file mode 100644
index 0000000000..68e6715260
--- /dev/null
+++ b/patches.drivers/ALSA-hda-Add-AZX_DCAPS_PM_RUNTIME-for-AMD-Raven-Ridg.patch
@@ -0,0 +1,36 @@
+From 1adca4b0cd65c14cb8b8c9c257720385869c3d5f Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Thu, 28 Jun 2018 15:28:24 +0800
+Subject: [PATCH] ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge
+Git-commit: 1adca4b0cd65c14cb8b8c9c257720385869c3d5f
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+This patch can make audio controller in AMD Raven Ridge gets runtime
+suspended to D3, to save ~1W power when it's not in use.
+
+Cc: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 1ae1850b3bfd..a9b55d65f2bd 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2535,7 +2535,8 @@ static const struct pci_device_id azx_ids[] = {
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+ /* AMD Raven */
+ { PCI_DEVICE(0x1022, 0x15e3),
+- .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
++ AZX_DCAPS_PM_RUNTIME },
+ /* ATI HDMI */
+ { PCI_DEVICE(0x1002, 0x0002),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-msnd-Fix-the-default-sample-sizes.patch b/patches.drivers/ALSA-msnd-Fix-the-default-sample-sizes.patch
new file mode 100644
index 0000000000..94f8c40a66
--- /dev/null
+++ b/patches.drivers/ALSA-msnd-Fix-the-default-sample-sizes.patch
@@ -0,0 +1,37 @@
+From 7c500f9ea139d0c9b80fdea5a9c911db3166ea54 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 25 Jul 2018 23:00:48 +0200
+Subject: [PATCH] ALSA: msnd: Fix the default sample sizes
+Git-commit: 7c500f9ea139d0c9b80fdea5a9c911db3166ea54
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+The default sample sizes set by msnd driver are bogus; it sets ALSA
+PCM format, not the actual bit width.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/isa/msnd/msnd_pinnacle.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c
+index 642609f7eda9..7e3f52c8a6c6 100644
+--- a/sound/isa/msnd/msnd_pinnacle.c
++++ b/sound/isa/msnd/msnd_pinnacle.c
+@@ -82,10 +82,10 @@
+
+ static void set_default_audio_parameters(struct snd_msnd *chip)
+ {
+- chip->play_sample_size = DEFSAMPLESIZE;
++ chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE);
+ chip->play_sample_rate = DEFSAMPLERATE;
+ chip->play_channels = DEFCHANNELS;
+- chip->capture_sample_size = DEFSAMPLESIZE;
++ chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE);
+ chip->capture_sample_rate = DEFSAMPLERATE;
+ chip->capture_channels = DEFCHANNELS;
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-pcm-Fix-snd_interval_refine-first-last-with-ope.patch b/patches.drivers/ALSA-pcm-Fix-snd_interval_refine-first-last-with-ope.patch
new file mode 100644
index 0000000000..5d31693107
--- /dev/null
+++ b/patches.drivers/ALSA-pcm-Fix-snd_interval_refine-first-last-with-ope.patch
@@ -0,0 +1,71 @@
+From ff2d6acdf6f13d9f8fdcd890844c6d7535ac1f10 Mon Sep 17 00:00:00 2001
+From: Timo Wischer <twischer@de.adit-jv.com>
+Date: Tue, 10 Jul 2018 17:28:45 +0200
+Subject: [PATCH] ALSA: pcm: Fix snd_interval_refine first/last with open min/max
+Git-commit: ff2d6acdf6f13d9f8fdcd890844c6d7535ac1f10
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Without this commit the following intervals [x y), (x y) were be
+replaced to (y-1 y) by snd_interval_refine_last(). This was also done
+if y-1 is part of the previous interval.
+With this changes it will be replaced with [y-1 y) in case of y-1 is
+part of the previous interval. A similar behavior will be used for
+snd_interval_refine_first().
+
+This commit adapts the changes for alsa-lib of commit
+9bb985c ("pcm: snd_interval_refine_first/last: exclude value only if
+also excluded before")
+
+Signed-off-by: Timo Wischer <twischer@de.adit-jv.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/pcm_lib.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 5736860f325b..4e6110d778bd 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -627,27 +627,33 @@ EXPORT_SYMBOL(snd_interval_refine);
+
+ static int snd_interval_refine_first(struct snd_interval *i)
+ {
++ const unsigned int last_max = i->max;
++
+ if (snd_BUG_ON(snd_interval_empty(i)))
+ return -EINVAL;
+ if (snd_interval_single(i))
+ return 0;
+ i->max = i->min;
+- i->openmax = i->openmin;
+- if (i->openmax)
++ if (i->openmin)
+ i->max++;
++ /* only exclude max value if also excluded before refine */
++ i->openmax = (i->openmax && i->max >= last_max);
+ return 1;
+ }
+
+ static int snd_interval_refine_last(struct snd_interval *i)
+ {
++ const unsigned int last_min = i->min;
++
+ if (snd_BUG_ON(snd_interval_empty(i)))
+ return -EINVAL;
+ if (snd_interval_single(i))
+ return 0;
+ i->min = i->max;
+- i->openmin = i->openmax;
+- if (i->openmin)
++ if (i->openmax)
+ i->min--;
++ /* only exclude min value if also excluded before refine */
++ i->openmin = (i->openmin && i->min <= last_min);
+ return 1;
+ }
+
+--
+2.18.0
+
diff --git a/patches.drivers/ALSA-usb-audio-Fix-multiple-definitions-in-AU0828_DE.patch b/patches.drivers/ALSA-usb-audio-Fix-multiple-definitions-in-AU0828_DE.patch
new file mode 100644
index 0000000000..2a76d07237
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-Fix-multiple-definitions-in-AU0828_DE.patch
@@ -0,0 +1,42 @@
+From bd1cd0eb2ce9141100628d476ead4de485501b29 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 25 Jul 2018 23:00:46 +0200
+Subject: [PATCH] ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro
+Git-commit: bd1cd0eb2ce9141100628d476ead4de485501b29
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+AU0828_DEVICE() macro in quirks-table.h uses USB_DEVICE_VENDOR_SPEC()
+for expanding idVendor and idProduct fields. However, the latter
+macro adds also match_flags and bInterfaceClass, which are different
+from the values AU0828_DEVICE() macro sets after that.
+
+For fixing them, just expand idVendor and idProduct fields manually in
+AU0828_DEVICE().
+
+This fixes sparse warnings like:
+ sound/usb/quirks-table.h:2892:1: warning: Initializer entry defined twice
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/quirks-table.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 8aac48f9c322..08aa78007020 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2875,7 +2875,8 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ */
+
+ #define AU0828_DEVICE(vid, pid, vname, pname) { \
+- USB_DEVICE_VENDOR_SPEC(vid, pid), \
++ .idVendor = vid, \
++ .idProduct = pid, \
+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+ USB_DEVICE_ID_MATCH_INT_CLASS | \
+ USB_DEVICE_ID_MATCH_INT_SUBCLASS, \
+--
+2.18.0
+
diff --git a/patches.drivers/ASoC-cs4265-fix-MMTLR-Data-switch-control.patch b/patches.drivers/ASoC-cs4265-fix-MMTLR-Data-switch-control.patch
new file mode 100644
index 0000000000..f79c272996
--- /dev/null
+++ b/patches.drivers/ASoC-cs4265-fix-MMTLR-Data-switch-control.patch
@@ -0,0 +1,41 @@
+From 90a3b7f8aba3011badacd6d8121e03aa24ac79d1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=A9bastien=20Szymanski?= <sebastien.szymanski@armadeus.com>
+Date: Thu, 6 Sep 2018 11:16:00 +0200
+Subject: [PATCH] ASoC: cs4265: fix MMTLR Data switch control
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 90a3b7f8aba3011badacd6d8121e03aa24ac79d1
+Patch-mainline: v4.19-rc5
+References: bsc#1051510
+
+The MMTLR bit is in the CS4265_SPDIF_CTL2 register at address 0x12 bit 0
+and not at address 0x0 bit 1. Fix this.
+
+Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/cs4265.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
+index 275677de669f..407554175282 100644
+--- a/sound/soc/codecs/cs4265.c
++++ b/sound/soc/codecs/cs4265.c
+@@ -157,8 +157,8 @@ static const struct snd_kcontrol_new cs4265_snd_controls[] = {
+ SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2,
+ 3, 1, 0),
+ SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum),
+- SOC_SINGLE("MMTLR Data Switch", 0,
+- 1, 1, 0),
++ SOC_SINGLE("MMTLR Data Switch", CS4265_SPDIF_CTL2,
++ 0, 1, 0),
+ SOC_ENUM("Mono Channel Select", spdif_mono_select_enum),
+ SND_SOC_BYTES("C Data Buffer", CS4265_C_DATA_BUFF, 24),
+ };
+--
+2.18.0
+
diff --git a/patches.drivers/ASoC-dapm-Fix-potential-DAI-widget-pointer-deref-whe.patch b/patches.drivers/ASoC-dapm-Fix-potential-DAI-widget-pointer-deref-whe.patch
new file mode 100644
index 0000000000..eb0bcdef2e
--- /dev/null
+++ b/patches.drivers/ASoC-dapm-Fix-potential-DAI-widget-pointer-deref-whe.patch
@@ -0,0 +1,43 @@
+From e01b4f624278d5efe5fb5da585ca371947b16680 Mon Sep 17 00:00:00 2001
+From: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+Date: Thu, 14 Jun 2018 20:26:42 +0100
+Subject: [PATCH] ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs
+Git-commit: e01b4f624278d5efe5fb5da585ca371947b16680
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Sometime a component or topology may configure a DAI widget with no
+private data leading to a dev_dbg() dereferencne of this data.
+
+Fix this to check for non NULL private data and let users know if widget
+is missing DAI.
+
+Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/soc-dapm.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 36a39ba30226..8ede773b1db8 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -4073,6 +4073,13 @@ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card)
+ continue;
+ }
+
++ /* let users know there is no DAI to link */
++ if (!dai_w->priv) {
++ dev_dbg(card->dev, "dai widget %s has no DAI\n",
++ dai_w->name);
++ continue;
++ }
++
+ dai = dai_w->priv;
+
+ /* ...find all widgets with the same stream and link them */
+--
+2.18.0
+
diff --git a/patches.drivers/ASoC-rt5514-Add-the-I2S-ASRC-support.patch b/patches.drivers/ASoC-rt5514-Add-the-I2S-ASRC-support.patch
new file mode 100644
index 0000000000..60c839bb3b
--- /dev/null
+++ b/patches.drivers/ASoC-rt5514-Add-the-I2S-ASRC-support.patch
@@ -0,0 +1,107 @@
+From 1628ef89042fdb90aaea657942455e00e160174d Mon Sep 17 00:00:00 2001
+From: "oder_chiou@realtek.com" <oder_chiou@realtek.com>
+Date: Mon, 24 Jul 2017 15:34:23 +0800
+Subject: [PATCH] ASoC: rt5514: Add the I2S ASRC support
+Git-commit: 1628ef89042fdb90aaea657942455e00e160174d
+Patch-mainline: v4.14-rc1
+References: bsc#1051510
+
+The patch adds the I2S ASRC support.
+
+Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/rt5514.c | 19 +++++++++++++++++++
+ sound/soc/codecs/rt5514.h | 7 +++++++
+ 2 files changed, 26 insertions(+)
+
+--- a/sound/soc/codecs/rt5514.c
++++ b/sound/soc/codecs/rt5514.c
+@@ -62,6 +62,7 @@ static const struct reg_sequence rt5514_
+ {RT5514_SRC_CTRL, 0x44000eee},
+ {RT5514_ANA_CTRL_LDO10, 0x00028604},
+ {RT5514_ANA_CTRL_ADCFED, 0x00000800},
++ {RT5514_ASRC_IN_CTRL1, 0x00000003},
+ };
+
+ static const struct reg_default rt5514_reg[] = {
+@@ -499,6 +500,15 @@ static int rt5514_pre_event(struct snd_s
+ return 0;
+ }
+
++static int rt5514_i2s_use_asrc(struct snd_soc_dapm_widget *source,
++ struct snd_soc_dapm_widget *sink)
++{
++ struct snd_soc_codec *codec = snd_soc_dapm_to_codec(source->dapm);
++ struct rt5514_priv *rt5514 = snd_soc_codec_get_drvdata(codec);
++
++ return (rt5514->sysclk > rt5514->lrck * 384);
++}
++
+ static const struct snd_soc_dapm_widget rt5514_dapm_widgets[] = {
+ /* Input Lines */
+ SND_SOC_DAPM_INPUT("DMIC1L"),
+@@ -569,6 +579,10 @@ static const struct snd_soc_dapm_widget
+ RT5514_POW_PLL1_LDO_BIT, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("PLL1", RT5514_PWR_ANA2, RT5514_POW_PLL1_BIT, 0,
+ NULL, 0),
++ SND_SOC_DAPM_SUPPLY_S("ASRC AD1", 1, RT5514_CLK_CTRL2,
++ RT5514_CLK_AD0_ASRC_EN_BIT, 0, NULL, 0),
++ SND_SOC_DAPM_SUPPLY_S("ASRC AD2", 1, RT5514_CLK_CTRL2,
++ RT5514_CLK_AD1_ASRC_EN_BIT, 0, NULL, 0),
+
+ /* ADC Mux */
+ SND_SOC_DAPM_MUX("Stereo1 DMIC Mux", SND_SOC_NOPM, 0, 0,
+@@ -668,6 +682,7 @@ static const struct snd_soc_dapm_route r
+ { "Stereo1 ADC MIX", NULL, "Stereo1 ADC MIXR" },
+ { "Stereo1 ADC MIX", NULL, "adc stereo1 filter" },
+ { "adc stereo1 filter", NULL, "PLL1", rt5514_is_sys_clk_from_pll },
++ { "adc stereo1 filter", NULL, "ASRC AD1", rt5514_i2s_use_asrc },
+
+ { "Stereo2 DMIC Mux", "DMIC1", "DMIC1" },
+ { "Stereo2 DMIC Mux", "DMIC2", "DMIC2" },
+@@ -684,6 +699,7 @@ static const struct snd_soc_dapm_route r
+ { "Stereo2 ADC MIX", NULL, "Stereo2 ADC MIXR" },
+ { "Stereo2 ADC MIX", NULL, "adc stereo2 filter" },
+ { "adc stereo2 filter", NULL, "PLL1", rt5514_is_sys_clk_from_pll },
++ { "adc stereo2 filter", NULL, "ASRC AD2", rt5514_i2s_use_asrc },
+
+ { "AIF1TX", NULL, "Stereo1 ADC MIX"},
+ { "AIF1TX", NULL, "Stereo2 ADC MIX"},
+@@ -736,6 +752,9 @@ static int rt5514_hw_params(struct snd_p
+
+ regmap_update_bits(rt5514->regmap, RT5514_I2S_CTRL1, RT5514_I2S_DL_MASK,
+ val_len);
++ regmap_update_bits(rt5514->regmap, RT5514_CLK_CTRL1,
++ RT5514_CLK_AD_ANA1_SEL_MASK,
++ (pre_div + 1) << RT5514_CLK_AD_ANA1_SEL_SFT);
+ regmap_update_bits(rt5514->regmap, RT5514_CLK_CTRL2,
+ RT5514_CLK_SYS_DIV_OUT_MASK | RT5514_SEL_ADC_OSR_MASK,
+ pre_div << RT5514_CLK_SYS_DIV_OUT_SFT |
+--- a/sound/soc/codecs/rt5514.h
++++ b/sound/soc/codecs/rt5514.h
+@@ -37,6 +37,7 @@
+ #define RT5514_PLL3_CALIB_CTRL5 0x2124
+ #define RT5514_DELAY_BUF_CTRL1 0x2140
+ #define RT5514_DELAY_BUF_CTRL3 0x2148
++#define RT5514_ASRC_IN_CTRL1 0x2180
+ #define RT5514_DOWNFILTER0_CTRL1 0x2190
+ #define RT5514_DOWNFILTER0_CTRL2 0x2194
+ #define RT5514_DOWNFILTER0_CTRL3 0x2198
+@@ -179,8 +180,14 @@
+ #define RT5514_CLK_AD0_EN_BIT 23
+ #define RT5514_CLK_DMIC_OUT_SEL_MASK (0x7 << 8)
+ #define RT5514_CLK_DMIC_OUT_SEL_SFT 8
++#define RT5514_CLK_AD_ANA1_SEL_MASK (0xf << 0)
++#define RT5514_CLK_AD_ANA1_SEL_SFT 0
+
+ /* RT5514_CLK_CTRL2 (0x2108) */
++#define RT5514_CLK_AD1_ASRC_EN (0x1 << 17)
++#define RT5514_CLK_AD1_ASRC_EN_BIT 17
++#define RT5514_CLK_AD0_ASRC_EN (0x1 << 16)
++#define RT5514_CLK_AD0_ASRC_EN_BIT 16
+ #define RT5514_CLK_SYS_DIV_OUT_MASK (0x7 << 8)
+ #define RT5514_CLK_SYS_DIV_OUT_SFT 8
+ #define RT5514_SEL_ADC_OSR_MASK (0x7 << 4)
diff --git a/patches.drivers/ASoC-rt5514-Add-the-missing-register-in-the-readable.patch b/patches.drivers/ASoC-rt5514-Add-the-missing-register-in-the-readable.patch
new file mode 100644
index 0000000000..e134ad9dab
--- /dev/null
+++ b/patches.drivers/ASoC-rt5514-Add-the-missing-register-in-the-readable.patch
@@ -0,0 +1,49 @@
+From 5ef5ac8de125fe6b4b23293bee026ca7ea1529b9 Mon Sep 17 00:00:00 2001
+From: "oder_chiou@realtek.com" <oder_chiou@realtek.com>
+Date: Fri, 30 Mar 2018 15:41:55 +0800
+Subject: [PATCH] ASoC: rt5514: Add the missing register in the readable table
+Git-commit: 5ef5ac8de125fe6b4b23293bee026ca7ea1529b9
+Patch-mainline: v4.17-rc3
+References: bsc#1051510
+
+The patch adds the missing register in the readable table.
+
+Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/rt5514.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
+index e8a66b03faab..1570b91bf018 100644
+--- a/sound/soc/codecs/rt5514.c
++++ b/sound/soc/codecs/rt5514.c
+@@ -89,6 +89,7 @@ static const struct reg_default rt5514_reg[] = {
+ {RT5514_PLL3_CALIB_CTRL5, 0x40220012},
+ {RT5514_DELAY_BUF_CTRL1, 0x7fff006a},
+ {RT5514_DELAY_BUF_CTRL3, 0x00000000},
++ {RT5514_ASRC_IN_CTRL1, 0x00000003},
+ {RT5514_DOWNFILTER0_CTRL1, 0x00020c2f},
+ {RT5514_DOWNFILTER0_CTRL2, 0x00020c2f},
+ {RT5514_DOWNFILTER0_CTRL3, 0x10000362},
+@@ -181,6 +182,7 @@ static bool rt5514_readable_register(struct device *dev, unsigned int reg)
+ case RT5514_PLL3_CALIB_CTRL5:
+ case RT5514_DELAY_BUF_CTRL1:
+ case RT5514_DELAY_BUF_CTRL3:
++ case RT5514_ASRC_IN_CTRL1:
+ case RT5514_DOWNFILTER0_CTRL1:
+ case RT5514_DOWNFILTER0_CTRL2:
+ case RT5514_DOWNFILTER0_CTRL3:
+@@ -238,6 +240,7 @@ static bool rt5514_i2c_readable_register(struct device *dev,
+ case RT5514_DSP_MAPPING | RT5514_PLL3_CALIB_CTRL5:
+ case RT5514_DSP_MAPPING | RT5514_DELAY_BUF_CTRL1:
+ case RT5514_DSP_MAPPING | RT5514_DELAY_BUF_CTRL3:
++ case RT5514_DSP_MAPPING | RT5514_ASRC_IN_CTRL1:
+ case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL1:
+ case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL2:
+ case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL3:
+--
+2.18.0
+
diff --git a/patches.drivers/ASoC-rt5514-Eliminate-the-noise-in-the-ASRC-case.patch b/patches.drivers/ASoC-rt5514-Eliminate-the-noise-in-the-ASRC-case.patch
new file mode 100644
index 0000000000..a39bd9679e
--- /dev/null
+++ b/patches.drivers/ASoC-rt5514-Eliminate-the-noise-in-the-ASRC-case.patch
@@ -0,0 +1,48 @@
+From ade82fdbae6905e80f107596f2e0b4df84490d28 Mon Sep 17 00:00:00 2001
+From: "oder_chiou@realtek.com" <oder_chiou@realtek.com>
+Date: Wed, 9 Aug 2017 09:56:14 +0800
+Subject: [PATCH] ASoC: rt5514: Eliminate the noise in the ASRC case
+Git-commit: ade82fdbae6905e80f107596f2e0b4df84490d28
+Patch-mainline: v4.14-rc1
+References: bsc#1051510
+
+In the ASRC case, there is the noise if the clock is asynchronous with the
+LRCK. The default settings will eliminate the noise.
+
+Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/rt5514.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
+index 21cbb566c0d3..0eabe569ab73 100644
+--- a/sound/soc/codecs/rt5514.c
++++ b/sound/soc/codecs/rt5514.c
+@@ -64,6 +64,8 @@ static const struct reg_sequence rt5514_patch[] = {
+ {RT5514_ANA_CTRL_LDO10, 0x00028604},
+ {RT5514_ANA_CTRL_ADCFED, 0x00000800},
+ {RT5514_ASRC_IN_CTRL1, 0x00000003},
++ {RT5514_DOWNFILTER0_CTRL3, 0x10000362},
++ {RT5514_DOWNFILTER1_CTRL3, 0x10000362},
+ };
+
+ static const struct reg_default rt5514_reg[] = {
+@@ -89,10 +91,10 @@ static const struct reg_default rt5514_reg[] = {
+ {RT5514_DELAY_BUF_CTRL3, 0x00000000},
+ {RT5514_DOWNFILTER0_CTRL1, 0x00020c2f},
+ {RT5514_DOWNFILTER0_CTRL2, 0x00020c2f},
+- {RT5514_DOWNFILTER0_CTRL3, 0x00000362},
++ {RT5514_DOWNFILTER0_CTRL3, 0x10000362},
+ {RT5514_DOWNFILTER1_CTRL1, 0x00020c2f},
+ {RT5514_DOWNFILTER1_CTRL2, 0x00020c2f},
+- {RT5514_DOWNFILTER1_CTRL3, 0x00000362},
++ {RT5514_DOWNFILTER1_CTRL3, 0x10000362},
+ {RT5514_ANA_CTRL_LDO10, 0x00028604},
+ {RT5514_ANA_CTRL_LDO18_16, 0x02000345},
+ {RT5514_ANA_CTRL_ADC12, 0x0000a2a8},
+--
+2.18.0
+
diff --git a/patches.drivers/ASoC-rt5514-Fix-the-issue-of-the-delay-volume-applie.patch b/patches.drivers/ASoC-rt5514-Fix-the-issue-of-the-delay-volume-applie.patch
new file mode 100644
index 0000000000..8a0c909328
--- /dev/null
+++ b/patches.drivers/ASoC-rt5514-Fix-the-issue-of-the-delay-volume-applie.patch
@@ -0,0 +1,49 @@
+From d96f8bd28cd0bae3e6702ae90df593628ef6906f Mon Sep 17 00:00:00 2001
+From: Oder Chiou <oder_chiou@realtek.com>
+Date: Tue, 24 Jul 2018 15:49:23 +0800
+Subject: [PATCH] ASoC: rt5514: Fix the issue of the delay volume applied
+Git-commit: d96f8bd28cd0bae3e6702ae90df593628ef6906f
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+The patch fixes the issue of the delay volume applied.
+
+Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/rt5514.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
+index 1570b91bf018..dca82dd6e3bf 100644
+--- a/sound/soc/codecs/rt5514.c
++++ b/sound/soc/codecs/rt5514.c
+@@ -64,8 +64,8 @@ static const struct reg_sequence rt5514_patch[] = {
+ {RT5514_ANA_CTRL_LDO10, 0x00028604},
+ {RT5514_ANA_CTRL_ADCFED, 0x00000800},
+ {RT5514_ASRC_IN_CTRL1, 0x00000003},
+- {RT5514_DOWNFILTER0_CTRL3, 0x10000362},
+- {RT5514_DOWNFILTER1_CTRL3, 0x10000362},
++ {RT5514_DOWNFILTER0_CTRL3, 0x10000352},
++ {RT5514_DOWNFILTER1_CTRL3, 0x10000352},
+ };
+
+ static const struct reg_default rt5514_reg[] = {
+@@ -92,10 +92,10 @@ static const struct reg_default rt5514_reg[] = {
+ {RT5514_ASRC_IN_CTRL1, 0x00000003},
+ {RT5514_DOWNFILTER0_CTRL1, 0x00020c2f},
+ {RT5514_DOWNFILTER0_CTRL2, 0x00020c2f},
+- {RT5514_DOWNFILTER0_CTRL3, 0x10000362},
++ {RT5514_DOWNFILTER0_CTRL3, 0x10000352},
+ {RT5514_DOWNFILTER1_CTRL1, 0x00020c2f},
+ {RT5514_DOWNFILTER1_CTRL2, 0x00020c2f},
+- {RT5514_DOWNFILTER1_CTRL3, 0x10000362},
++ {RT5514_DOWNFILTER1_CTRL3, 0x10000352},
+ {RT5514_ANA_CTRL_LDO10, 0x00028604},
+ {RT5514_ANA_CTRL_LDO18_16, 0x02000345},
+ {RT5514_ANA_CTRL_ADC12, 0x0000a2a8},
+--
+2.18.0
+
diff --git a/patches.drivers/Bluetooth-Add-a-new-Realtek-8723DE-ID-0bda-b009.patch b/patches.drivers/Bluetooth-Add-a-new-Realtek-8723DE-ID-0bda-b009.patch
new file mode 100644
index 0000000000..6c8f1f6af7
--- /dev/null
+++ b/patches.drivers/Bluetooth-Add-a-new-Realtek-8723DE-ID-0bda-b009.patch
@@ -0,0 +1,64 @@
+From 45ae68b8cfc25bdbffc11248001c47ab1b76ff6e Mon Sep 17 00:00:00 2001
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+Date: Fri, 25 May 2018 17:54:52 +0800
+Subject: [PATCH] Bluetooth: Add a new Realtek 8723DE ID 0bda:b009
+Git-commit: 45ae68b8cfc25bdbffc11248001c47ab1b76ff6e
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Without this patch we cannot turn on the Bluethooth adapter on HP
+14-bs007la.
+
+T: Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 4 Spd=12 MxCh= 0
+D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0bda ProdID=b009 Rev= 2.00
+S: Manufacturer=Realtek
+S: Product=802.11n WLAN Adapter
+S: SerialNumber=00e04c000001
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/bluetooth/btusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index f73a27ea28cc..75947f04fc75 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -374,6 +374,7 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
+
+ /* Additional Realtek 8723DE Bluetooth devices */
++ { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
+
+ /* Additional Realtek 8821AE Bluetooth devices */
+--
+2.18.0
+
diff --git a/patches.drivers/Bluetooth-Use-lock_sock_nested-in-bt_accept_enqueue.patch b/patches.drivers/Bluetooth-Use-lock_sock_nested-in-bt_accept_enqueue.patch
new file mode 100644
index 0000000000..5df7625897
--- /dev/null
+++ b/patches.drivers/Bluetooth-Use-lock_sock_nested-in-bt_accept_enqueue.patch
@@ -0,0 +1,104 @@
+From b71c69c26b4916d11b8d403d8e667bbd191f1b8f Mon Sep 17 00:00:00 2001
+From: Philipp Puschmann <pp@emlix.com>
+Date: Tue, 17 Jul 2018 13:41:12 +0200
+Subject: [PATCH] Bluetooth: Use lock_sock_nested in bt_accept_enqueue
+Git-commit: b71c69c26b4916d11b8d403d8e667bbd191f1b8f
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Fixes this warning that was provoked by a pairing:
+
+[60258.016221] WARNING: possible recursive locking detected
+[60258.021558] 4.15.0-RD1812-BSP #1 Tainted: G O
+[60258.027146] --------------------------------------------
+[60258.032464] kworker/u5:0/70 is trying to acquire lock:
+[60258.037609] (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}, at: [<87759073>] bt_accept_enqueue+0x3c/0x74
+[60258.046863]
+[60258.046863] but task is already holding lock:
+[60258.052704] (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}, at: [<d22d7106>] l2cap_sock_new_connection_cb+0x1c/0x88
+[60258.062905]
+[60258.062905] other info that might help us debug this:
+[60258.069441] Possible unsafe locking scenario:
+[60258.069441]
+[60258.075368] CPU0
+[60258.077821] ----
+[60258.080272] lock(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP);
+[60258.085510] lock(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP);
+[60258.090748]
+[60258.090748] *** DEADLOCK ***
+[60258.090748]
+[60258.096676] May be due to missing lock nesting notation
+[60258.096676]
+[60258.103472] 5 locks held by kworker/u5:0/70:
+[60258.107747] #0: ((wq_completion)%shdev->name#2){+.+.}, at: [<9460d092>] process_one_work+0x130/0x4fc
+[60258.117263] #1: ((work_completion)(&hdev->rx_work)){+.+.}, at: [<9460d092>] process_one_work+0x130/0x4fc
+[60258.126942] #2: (&conn->chan_lock){+.+.}, at: [<7877c8c3>] l2cap_connect+0x80/0x4f8
+[60258.134806] #3: (&chan->lock/2){+.+.}, at: [<2e16c724>] l2cap_connect+0x8c/0x4f8
+[60258.142410] #4: (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}, at: [<d22d7106>] l2cap_sock_new_connection_cb+0x1c/0x88
+[60258.153043]
+[60258.153043] stack backtrace:
+[60258.157413] CPU: 1 PID: 70 Comm: kworker/u5:0 Tainted: G O 4.15.0-RD1812-BSP #1
+[60258.165945] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+[60258.172485] Workqueue: hci0 hci_rx_work
+[60258.176331] Backtrace:
+[60258.178797] [<8010c9fc>] (dump_backtrace) from [<8010ccbc>] (show_stack+0x18/0x1c)
+[60258.186379] r7:80e55fe4 r6:80e55fe4 r5:20050093 r4:00000000
+[60258.192058] [<8010cca4>] (show_stack) from [<809864e8>] (dump_stack+0xb0/0xdc)
+[60258.199301] [<80986438>] (dump_stack) from [<8016ecc8>] (__lock_acquire+0xffc/0x11d4)
+[60258.207144] r9:5e2bb019 r8:630f974c r7:ba8a5940 r6:ba8a5ed8 r5:815b5220 r4:80fa081c
+[60258.214901] [<8016dccc>] (__lock_acquire) from [<8016f620>] (lock_acquire+0x78/0x98)
+[60258.222655] r10:00000040 r9:00000040 r8:808729f0 r7:00000001 r6:00000000 r5:60050013
+[60258.230491] r4:00000000
+[60258.233045] [<8016f5a8>] (lock_acquire) from [<806ee974>] (lock_sock_nested+0x64/0x88)
+[60258.240970] r7:00000000 r6:b796e870 r5:00000001 r4:b796e800
+[60258.246643] [<806ee910>] (lock_sock_nested) from [<808729f0>] (bt_accept_enqueue+0x3c/0x74)
+[60258.255004] r8:00000001 r7:ba7d3c00 r6:ba7d3ea4 r5:ba7d2000 r4:b796e800
+[60258.261717] [<808729b4>] (bt_accept_enqueue) from [<808aa39c>] (l2cap_sock_new_connection_cb+0x68/0x88)
+[60258.271117] r5:b796e800 r4:ba7d2000
+[60258.274708] [<808aa334>] (l2cap_sock_new_connection_cb) from [<808a294c>] (l2cap_connect+0x190/0x4f8)
+[60258.283933] r5:00000001 r4:ba6dce00
+[60258.287524] [<808a27bc>] (l2cap_connect) from [<808a4a14>] (l2cap_recv_frame+0x744/0x2cf8)
+[60258.295800] r10:ba6dcf24 r9:00000004 r8:b78d8014 r7:00000004 r6:bb05d000 r5:00000004
+[60258.303635] r4:bb05d008
+[60258.306183] [<808a42d0>] (l2cap_recv_frame) from [<808a7808>] (l2cap_recv_acldata+0x210/0x214)
+[60258.314805] r10:b78e7800 r9:bb05d960 r8:00000001 r7:bb05d000 r6:0000000c r5:b7957a80
+[60258.322641] r4:ba6dce00
+[60258.325188] [<808a75f8>] (l2cap_recv_acldata) from [<8087630c>] (hci_rx_work+0x35c/0x4e8)
+[60258.333374] r6:80e5743c r5:bb05d7c8 r4:b7957a80
+[60258.338004] [<80875fb0>] (hci_rx_work) from [<8013dc7c>] (process_one_work+0x1a4/0x4fc)
+[60258.346018] r10:00000001 r9:00000000 r8:baabfef8 r7:ba997500 r6:baaba800 r5:baaa5d00
+[60258.353853] r4:bb05d7c8
+[60258.356401] [<8013dad8>] (process_one_work) from [<8013e028>] (worker_thread+0x54/0x5cc)
+[60258.364503] r10:baabe038 r9:baaba834 r8:80e05900 r7:00000088 r6:baaa5d18 r5:baaba800
+[60258.372338] r4:baaa5d00
+[60258.374888] [<8013dfd4>] (worker_thread) from [<801448f8>] (kthread+0x134/0x160)
+[60258.382295] r10:ba8310b8 r9:bb07dbfc r8:8013dfd4 r7:baaa5d00 r6:00000000 r5:baaa8ac0
+[60258.390130] r4:ba831080
+[60258.392682] [<801447c4>] (kthread) from [<801080b4>] (ret_from_fork+0x14/0x20)
+[60258.399915] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:801447c4
+[60258.407751] r4:baaa8ac0 r3:baabe000
+
+Signed-off-by: Philipp Puschmann <pp@emlix.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/bluetooth/af_bluetooth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
+index 3264e1873219..deacc52d7ff1 100644
+--- a/net/bluetooth/af_bluetooth.c
++++ b/net/bluetooth/af_bluetooth.c
+@@ -159,7 +159,7 @@ void bt_accept_enqueue(struct sock *parent, struct sock *sk)
+ BT_DBG("parent %p, sk %p", parent, sk);
+
+ sock_hold(sk);
+- lock_sock(sk);
++ lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+ list_add_tail(&bt_sk(sk)->accept_q, &bt_sk(parent)->accept_q);
+ bt_sk(sk)->parent = parent;
+ release_sock(sk);
+--
+2.18.0
+
diff --git a/patches.drivers/HID-hid-ntrig-add-error-handling-for-sysfs_create_gr.patch b/patches.drivers/HID-hid-ntrig-add-error-handling-for-sysfs_create_gr.patch
new file mode 100644
index 0000000000..4fb6a919de
--- /dev/null
+++ b/patches.drivers/HID-hid-ntrig-add-error-handling-for-sysfs_create_gr.patch
@@ -0,0 +1,37 @@
+From 44d4d51de9a3534a2b63d69efda02a10e66541e4 Mon Sep 17 00:00:00 2001
+From: Zhouyang Jia <jiazhouyang09@gmail.com>
+Date: Thu, 14 Jun 2018 21:37:17 +0800
+Subject: [PATCH] HID: hid-ntrig: add error handling for sysfs_create_group
+Git-commit: 44d4d51de9a3534a2b63d69efda02a10e66541e4
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+When sysfs_create_group fails, the lack of error-handling code may
+cause unexpected results.
+
+This patch adds error-handling code after calling sysfs_create_group.
+
+Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/hid-ntrig.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index 43b1c7234316..9bc6f4867cb3 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -955,6 +955,8 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
+
+ ret = sysfs_create_group(&hdev->dev.kobj,
+ &ntrig_attribute_group);
++ if (ret)
++ hid_err(hdev, "cannot create sysfs group\n");
+
+ return 0;
+ err_free:
+--
+2.18.0
+
diff --git a/patches.drivers/Input-elantech-enable-middle-button-of-touchpad-on-T.patch b/patches.drivers/Input-elantech-enable-middle-button-of-touchpad-on-T.patch
new file mode 100644
index 0000000000..dfa1d4f1b8
--- /dev/null
+++ b/patches.drivers/Input-elantech-enable-middle-button-of-touchpad-on-T.patch
@@ -0,0 +1,35 @@
+From 91a97507323e1ad4bfc10f4a5922e67cdaf8b3cd Mon Sep 17 00:00:00 2001
+From: Aaron Ma <aaron.ma@canonical.com>
+Date: Tue, 18 Sep 2018 09:32:22 -0700
+Subject: [PATCH] Input: elantech - enable middle button of touchpad on ThinkPad P72
+Git-commit: 91a97507323e1ad4bfc10f4a5922e67cdaf8b3cd
+Patch-mainline: v4.19-rc6
+References: bsc#1051510
+
+Adding 2 new touchpad IDs to support middle button support.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/mouse/elantech.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 44f57cf6675b..2d95e8d93cc7 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1178,6 +1178,8 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
+ static const char * const middle_button_pnp_ids[] = {
+ "LEN2131", /* ThinkPad P52 w/ NFC */
+ "LEN2132", /* ThinkPad P52 */
++ "LEN2133", /* ThinkPad P72 w/ NFC */
++ "LEN2134", /* ThinkPad P72 */
+ NULL
+ };
+
+--
+2.18.0
+
diff --git a/patches.drivers/NFC-Fix-possible-memory-corruption-when-handling-SHD.patch b/patches.drivers/NFC-Fix-possible-memory-corruption-when-handling-SHD.patch
new file mode 100644
index 0000000000..ceca5b8d52
--- /dev/null
+++ b/patches.drivers/NFC-Fix-possible-memory-corruption-when-handling-SHD.patch
@@ -0,0 +1,68 @@
+From 674d9de02aa7d521ebdf66c3958758bdd9c64e11 Mon Sep 17 00:00:00 2001
+From: Suren Baghdasaryan <surenb@google.com>
+Date: Mon, 17 Sep 2018 15:51:40 +0200
+Subject: [PATCH] NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
+Git-commit: 674d9de02aa7d521ebdf66c3958758bdd9c64e11
+Patch-mainline: v4.19-rc6
+References: bsc#1051510
+
+When handling SHDLC I-Frame commands "pipe" field used for indexing
+into an array should be checked before usage. If left unchecked it
+might access memory outside of the array of size NFC_HCI_MAX_PIPES(127).
+
+Malformed NFC HCI frames could be injected by a malicious NFC device
+communicating with the device being attacked (remote attack vector),
+or even by an attacker with physical access to the I2C bus such that
+they could influence the data transfers on that bus (local attack vector).
+skb->data is controlled by the attacker and has only been sanitized in
+the most trivial ways (CRC check), therefore we can consider the
+create_info struct and all of its members to tainted. 'create_info->pipe'
+with max value of 255 (uint8) is used to take an offset of the
+hdev->pipes array of 127 elements which can lead to OOB write.
+
+Cc: Samuel Ortiz <sameo@linux.intel.com>
+Cc: Allen Pais <allen.pais@oracle.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Suggested-by: Kevin Deus <kdeus@google.com>
+Signed-off-by: Suren Baghdasaryan <surenb@google.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/nfc/hci/core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
+index ac8030c4bcf8..19cb2e473ea6 100644
+--- a/net/nfc/hci/core.c
++++ b/net/nfc/hci/core.c
+@@ -209,6 +209,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+ }
+ create_info = (struct hci_create_pipe_resp *)skb->data;
+
++ if (create_info->pipe >= NFC_HCI_MAX_PIPES) {
++ status = NFC_HCI_ANY_E_NOK;
++ goto exit;
++ }
++
+ /* Save the new created pipe and bind with local gate,
+ * the description for skb->data[3] is destination gate id
+ * but since we received this cmd from host controller, we
+@@ -232,6 +237,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+ }
+ delete_info = (struct hci_delete_pipe_noti *)skb->data;
+
++ if (delete_info->pipe >= NFC_HCI_MAX_PIPES) {
++ status = NFC_HCI_ANY_E_NOK;
++ goto exit;
++ }
++
+ hdev->pipes[delete_info->pipe].gate = NFC_HCI_INVALID_GATE;
+ hdev->pipes[delete_info->pipe].dest_host = NFC_HCI_INVALID_HOST;
+ break;
+--
+2.18.0
+
diff --git a/patches.drivers/ax88179_178a-Check-for-supported-Wake-on-LAN-modes.patch b/patches.drivers/ax88179_178a-Check-for-supported-Wake-on-LAN-modes.patch
new file mode 100644
index 0000000000..cb1b2b59f6
--- /dev/null
+++ b/patches.drivers/ax88179_178a-Check-for-supported-Wake-on-LAN-modes.patch
@@ -0,0 +1,38 @@
+From 5ba6b4aa9a410c5e2c6417df52b5e2118ea9b467 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 28 Sep 2018 16:18:51 -0700
+Subject: [PATCH] ax88179_178a: Check for supported Wake-on-LAN modes
+Git-commit: 5ba6b4aa9a410c5e2c6417df52b5e2118ea9b467
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+The driver currently silently accepts unsupported Wake-on-LAN modes
+(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,
+which is confusing.
+
+Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/usb/ax88179_178a.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index 9e8ad372f419..2207f7a7d1ff 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -566,6 +566,9 @@ ax88179_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+ struct usbnet *dev = netdev_priv(net);
+ u8 opt = 0;
+
++ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC))
++ return -EINVAL;
++
+ if (wolinfo->wolopts & WAKE_PHY)
+ opt |= AX_MONITOR_MODE_RWLC;
+ if (wolinfo->wolopts & WAKE_MAGIC)
+--
+2.18.0
+
diff --git a/patches.drivers/cfg80211-reg-Init-wiphy_idx-in-regulatory_hint_core.patch b/patches.drivers/cfg80211-reg-Init-wiphy_idx-in-regulatory_hint_core.patch
new file mode 100644
index 0000000000..7f1f6f93a9
--- /dev/null
+++ b/patches.drivers/cfg80211-reg-Init-wiphy_idx-in-regulatory_hint_core.patch
@@ -0,0 +1,40 @@
+From 24f33e64fcd0d50a4b1a8e5b41bd0257aa66b0e8 Mon Sep 17 00:00:00 2001
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Date: Wed, 5 Sep 2018 08:06:12 +0300
+Subject: [PATCH] cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
+Git-commit: 24f33e64fcd0d50a4b1a8e5b41bd0257aa66b0e8
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+Core regulatory hints didn't set wiphy_idx to WIPHY_IDX_INVALID. Since
+the regulatory request is zeroed, wiphy_idx was always implicitly set to
+0. This resulted in updating only phy #0.
+Fix that.
+
+Fixes: 806a9e39670b ("cfg80211: make regulatory_request use wiphy_idx instead of wiphy")
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+[add fixes tag]
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/wireless/reg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 2f702adf2912..765dedb12361 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2867,6 +2867,7 @@ static int regulatory_hint_core(const char *alpha2)
+ request->alpha2[0] = alpha2[0];
+ request->alpha2[1] = alpha2[1];
+ request->initiator = NL80211_REGDOM_SET_BY_CORE;
++ request->wiphy_idx = WIPHY_IDX_INVALID;
+
+ queue_regulatory_request(request);
+
+--
+2.18.0
+
diff --git a/patches.drivers/coresight-Handle-errors-in-finding-input-output-port.patch b/patches.drivers/coresight-Handle-errors-in-finding-input-output-port.patch
new file mode 100644
index 0000000000..567eb2d80e
--- /dev/null
+++ b/patches.drivers/coresight-Handle-errors-in-finding-input-output-port.patch
@@ -0,0 +1,57 @@
+From fe470f5f7f684ed15bc49b6183a64237547910ff Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Wed, 11 Jul 2018 13:40:28 -0600
+Subject: [PATCH] coresight: Handle errors in finding input/output ports
+Git-commit: fe470f5f7f684ed15bc49b6183a64237547910ff
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+If we fail to find the input / output port for a LINK component
+while enabling a path, we should fail gracefully rather than
+assuming port "0".
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwtracing/coresight/coresight.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
+index 4969b329511c..7f2b478a048f 100644
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -107,7 +107,7 @@ static int coresight_find_link_inport(struct coresight_device *csdev,
+ dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n",
+ dev_name(&parent->dev), dev_name(&csdev->dev));
+
+- return 0;
++ return -ENODEV;
+ }
+
+ static int coresight_find_link_outport(struct coresight_device *csdev,
+@@ -125,7 +125,7 @@ static int coresight_find_link_outport(struct coresight_device *csdev,
+ dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n",
+ dev_name(&csdev->dev), dev_name(&child->dev));
+
+- return 0;
++ return -ENODEV;
+ }
+
+ static int coresight_enable_sink(struct coresight_device *csdev, u32 mode)
+@@ -178,6 +178,9 @@ static int coresight_enable_link(struct coresight_device *csdev,
+ else
+ refport = 0;
+
++ if (refport < 0)
++ return refport;
++
+ if (atomic_inc_return(&csdev->refcnt[refport]) == 1) {
+ if (link_ops(csdev)->enable) {
+ ret = link_ops(csdev)->enable(csdev, inport, outport);
+--
+2.18.0
+
diff --git a/patches.drivers/crypto-sharah-Unregister-correct-algorithms-for-SAHA.patch b/patches.drivers/crypto-sharah-Unregister-correct-algorithms-for-SAHA.patch
new file mode 100644
index 0000000000..ad3ad7c97c
--- /dev/null
+++ b/patches.drivers/crypto-sharah-Unregister-correct-algorithms-for-SAHA.patch
@@ -0,0 +1,49 @@
+From 0e7d4d932ffc23f75efb31a8c2ac2396c1b81c55 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
+Date: Sun, 15 Jul 2018 00:27:06 +0200
+Subject: [PATCH] crypto: sharah - Unregister correct algorithms for SAHARA 3
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 0e7d4d932ffc23f75efb31a8c2ac2396c1b81c55
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+This patch fixes two typos related to unregistering algorithms supported by
+SAHARAH 3. In sahara_register_algs the wrong algorithms are unregistered
+in case of an error. In sahara_unregister_algs the wrong array is used to
+determine the iteration count.
+
+Signed-off-by: Michael Müller <michael@fds-team.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/sahara.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 4379f016fbee..e7540a5b8197 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -1349,7 +1349,7 @@ static int sahara_register_algs(struct sahara_dev *dev)
+
+ err_sha_v3_algs:
+ for (j = 0; j < k; j++)
+- crypto_unregister_ahash(&sha_v4_algs[j]);
++ crypto_unregister_ahash(&sha_v3_algs[j]);
+
+ err_aes_algs:
+ for (j = 0; j < i; j++)
+@@ -1365,7 +1365,7 @@ static void sahara_unregister_algs(struct sahara_dev *dev)
+ for (i = 0; i < ARRAY_SIZE(aes_algs); i++)
+ crypto_unregister_alg(&aes_algs[i]);
+
+- for (i = 0; i < ARRAY_SIZE(sha_v4_algs); i++)
++ for (i = 0; i < ARRAY_SIZE(sha_v3_algs); i++)
+ crypto_unregister_ahash(&sha_v3_algs[i]);
+
+ if (dev->version > SAHARA_VERSION_3)
+--
+2.18.0
+
diff --git a/patches.drivers/crypto-skcipher-Fix-Wstringop-truncation-warnings.patch b/patches.drivers/crypto-skcipher-Fix-Wstringop-truncation-warnings.patch
new file mode 100644
index 0000000000..40b9c04c90
--- /dev/null
+++ b/patches.drivers/crypto-skcipher-Fix-Wstringop-truncation-warnings.patch
@@ -0,0 +1,72 @@
+From cefd769fd0192c84d638f66da202459ed8ad63ba Mon Sep 17 00:00:00 2001
+From: Stafford Horne <shorne@gmail.com>
+Date: Mon, 25 Jun 2018 21:45:37 +0900
+Subject: [PATCH] crypto: skcipher - Fix -Wstringop-truncation warnings
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: cefd769fd0192c84d638f66da202459ed8ad63ba
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+As of GCC 9.0.0 the build is reporting warnings like:
+
+ crypto/ablkcipher.c: In function ‘crypto_ablkcipher_report’:
+ crypto/ablkcipher.c:374:2: warning: ‘strncpy’ specified bound 64 equals destination size [-Wstringop-truncation]
+ strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<default>",
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ sizeof(rblkcipher.geniv));
+ ~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This means the strnycpy might create a non null terminated string. Fix this by
+explicitly performing '\0' termination.
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Max Filippov <jcmvbkbc@gmail.com>
+Cc: Eric Biggers <ebiggers3@gmail.com>
+Cc: Nick Desaulniers <nick.desaulniers@gmail.com>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ crypto/ablkcipher.c | 2 ++
+ crypto/blkcipher.c | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
+index d880a4897159..1edb5000d783 100644
+--- a/crypto/ablkcipher.c
++++ b/crypto/ablkcipher.c
+@@ -373,6 +373,7 @@ static int crypto_ablkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ strncpy(rblkcipher.type, "ablkcipher", sizeof(rblkcipher.type));
+ strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<default>",
+ sizeof(rblkcipher.geniv));
++ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
+
+ rblkcipher.blocksize = alg->cra_blocksize;
+ rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
+@@ -447,6 +448,7 @@ static int crypto_givcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ strncpy(rblkcipher.type, "givcipher", sizeof(rblkcipher.type));
+ strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<built-in>",
+ sizeof(rblkcipher.geniv));
++ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
+
+ rblkcipher.blocksize = alg->cra_blocksize;
+ rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
+diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
+index 01c0d4aa2563..dd4dcab3766a 100644
+--- a/crypto/blkcipher.c
++++ b/crypto/blkcipher.c
+@@ -512,6 +512,7 @@ static int crypto_blkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ strncpy(rblkcipher.type, "blkcipher", sizeof(rblkcipher.type));
+ strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "<default>",
+ sizeof(rblkcipher.geniv));
++ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
+
+ rblkcipher.blocksize = alg->cra_blocksize;
+ rblkcipher.min_keysize = alg->cra_blkcipher.min_keysize;
+--
+2.18.0
+
diff --git a/patches.drivers/fbdev-Distinguish-between-interlaced-and-progressive.patch b/patches.drivers/fbdev-Distinguish-between-interlaced-and-progressive.patch
new file mode 100644
index 0000000000..6ad8ea7027
--- /dev/null
+++ b/patches.drivers/fbdev-Distinguish-between-interlaced-and-progressive.patch
@@ -0,0 +1,127 @@
+From 1ba0a59cea41ea05fda92daaf2a2958a2246b9cf Mon Sep 17 00:00:00 2001
+From: Fredrik Noring <noring@nocrew.org>
+Date: Tue, 24 Jul 2018 19:11:24 +0200
+Subject: [PATCH] fbdev: Distinguish between interlaced and progressive modes
+Git-commit: 1ba0a59cea41ea05fda92daaf2a2958a2246b9cf
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+I discovered the problem when developing a frame buffer driver for the
+PlayStation 2 (not yet merged), using the following video modes for the
+PlayStation 3 in drivers/video/fbdev/ps3fb.c:
+
+ }, {
+ /* 1080if */
+ "1080if", 50, 1920, 1080, 13468, 148, 484, 36, 4, 88, 5,
+ FB_SYNC_BROADCAST, FB_VMODE_INTERLACED
+ }, {
+ /* 1080pf */
+ "1080pf", 50, 1920, 1080, 6734, 148, 484, 36, 4, 88, 5,
+ FB_SYNC_BROADCAST, FB_VMODE_NONINTERLACED
+ },
+
+In ps3fb_probe, the mode_option module parameter is used with fb_find_mode
+but it can only select the interlaced variant of 1920x1080 since the loop
+matching the modes does not take the difference between interlaced and
+progressive modes into account.
+
+In short, without the patch, progressive 1920x1080 cannot be chosen as a
+mode_option parameter since fb_find_mode (falsely) thinks interlace is a
+perfect match.
+
+Signed-off-by: Fredrik Noring <noring@nocrew.org>
+Cc: "Maciej W. Rozycki" <macro@linux-mips.org>
+[b.zolnierkie: updated patch description]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/video/fbdev/core/modedb.c | 41 ++++++++++++++++++++++---------
+ 1 file changed, 30 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c
+index 2510fa728d77..de119f11b78f 100644
+--- a/drivers/video/fbdev/core/modedb.c
++++ b/drivers/video/fbdev/core/modedb.c
+@@ -644,7 +644,7 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info,
+ *
+ * Valid mode specifiers for @mode_option:
+ *
+- * <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][m] or
++ * <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][p][m] or
+ * <name>[-<bpp>][@<refresh>]
+ *
+ * with <xres>, <yres>, <bpp> and <refresh> decimal numbers and
+@@ -653,10 +653,10 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info,
+ * If 'M' is present after yres (and before refresh/bpp if present),
+ * the function will compute the timings using VESA(tm) Coordinated
+ * Video Timings (CVT). If 'R' is present after 'M', will compute with
+- * reduced blanking (for flatpanels). If 'i' is present, compute
+- * interlaced mode. If 'm' is present, add margins equal to 1.8%
+- * of xres rounded down to 8 pixels, and 1.8% of yres. The char
+- * 'i' and 'm' must be after 'M' and 'R'. Example:
++ * reduced blanking (for flatpanels). If 'i' or 'p' are present, compute
++ * interlaced or progressive mode. If 'm' is present, add margins equal
++ * to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars
++ * 'i', 'p' and 'm' must be after 'M' and 'R'. Example:
+ *
+ * 1024x768MR-8@60m - Reduced blank with margins at 60Hz.
+ *
+@@ -697,7 +697,8 @@ int fb_find_mode(struct fb_var_screeninfo *var,
+ unsigned int namelen = strlen(name);
+ int res_specified = 0, bpp_specified = 0, refresh_specified = 0;
+ unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0;
+- int yres_specified = 0, cvt = 0, rb = 0, interlace = 0;
++ int yres_specified = 0, cvt = 0, rb = 0;
++ int interlace_specified = 0, interlace = 0;
+ int margins = 0;
+ u32 best, diff, tdiff;
+
+@@ -748,9 +749,17 @@ int fb_find_mode(struct fb_var_screeninfo *var,
+ if (!cvt)
+ margins = 1;
+ break;
++ case 'p':
++ if (!cvt) {
++ interlace = 0;
++ interlace_specified = 1;
++ }
++ break;
+ case 'i':
+- if (!cvt)
++ if (!cvt) {
+ interlace = 1;
++ interlace_specified = 1;
++ }
+ break;
+ default:
+ goto done;
+@@ -819,11 +828,21 @@ int fb_find_mode(struct fb_var_screeninfo *var,
+ if ((name_matches(db[i], name, namelen) ||
+ (res_specified && res_matches(db[i], xres, yres))) &&
+ !fb_try_mode(var, info, &db[i], bpp)) {
+- if (refresh_specified && db[i].refresh == refresh)
+- return 1;
++ const int db_interlace = (db[i].vmode &
++ FB_VMODE_INTERLACED ? 1 : 0);
++ int score = abs(db[i].refresh - refresh);
++
++ if (interlace_specified)
++ score += abs(db_interlace - interlace);
++
++ if (!interlace_specified ||
++ db_interlace == interlace)
++ if (refresh_specified &&
++ db[i].refresh == refresh)
++ return 1;
+
+- if (abs(db[i].refresh - refresh) < diff) {
+- diff = abs(db[i].refresh - refresh);
++ if (score < diff) {
++ diff = score;
+ best = i;
+ }
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/fbdev-via-fix-defined-but-not-used-warning.patch b/patches.drivers/fbdev-via-fix-defined-but-not-used-warning.patch
new file mode 100644
index 0000000000..591124960a
--- /dev/null
+++ b/patches.drivers/fbdev-via-fix-defined-but-not-used-warning.patch
@@ -0,0 +1,46 @@
+From b6566b47a67e07fdca44cf51abb14e2fbe17d3eb Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Tue, 24 Jul 2018 19:11:27 +0200
+Subject: [PATCH] fbdev/via: fix defined but not used warning
+Git-commit: b6566b47a67e07fdca44cf51abb14e2fbe17d3eb
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Fix a build warning in viafbdev.c when CONFIG_PROC_FS is not enabled
+by marking the unused function as __maybe_unused.
+
+../drivers/video/fbdev/via/viafbdev.c:1471:12: warning: 'viafb_sup_odev_proc_show' defined but not used [-Wunused-function]
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/video/fbdev/via/viafbdev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
+index d2f785068ef4..7bb7e90b8f00 100644
+--- a/drivers/video/fbdev/via/viafbdev.c
++++ b/drivers/video/fbdev/via/viafbdev.c
+@@ -19,6 +19,7 @@
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
++#include <linux/compiler.h>
+ #include <linux/module.h>
+ #include <linux/seq_file.h>
+ #include <linux/slab.h>
+@@ -1468,7 +1469,7 @@ static const struct file_operations viafb_vt1636_proc_fops = {
+
+ #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */
+
+-static int viafb_sup_odev_proc_show(struct seq_file *m, void *v)
++static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v)
+ {
+ via_odev_to_seq(m, supported_odev_map[
+ viaparinfo->shared->chip_info.gfx_chip_name]);
+--
+2.18.0
+
diff --git a/patches.drivers/gpio-pxa-Fix-potential-NULL-dereference.patch b/patches.drivers/gpio-pxa-Fix-potential-NULL-dereference.patch
new file mode 100644
index 0000000000..80ccd51511
--- /dev/null
+++ b/patches.drivers/gpio-pxa-Fix-potential-NULL-dereference.patch
@@ -0,0 +1,49 @@
+From 9506755633d0b32ef76f67c345000178e9b0dfc4 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Wed, 11 Jul 2018 13:19:38 +0000
+Subject: [PATCH] gpio: pxa: Fix potential NULL dereference
+Git-commit: 9506755633d0b32ef76f67c345000178e9b0dfc4
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+platform_get_resource() may fail and return NULL, so we should
+better check it's return value to avoid a NULL pointer dereference
+a bit later in the code.
+
+This is detected by Coccinelle semantic patch.
+
+@@
+expression pdev, res, n, t, e, e1, e2;
+@@
+
+res = platform_get_resource(pdev, t, n);
++ if (!res)
++ return -EINVAL;
+... when != res == NULL
+e = devm_ioremap(e1, res->start, e2);
+
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpio-pxa.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
+index 1e66f808051c..0d09a4fcef49 100644
+--- a/drivers/gpio/gpio-pxa.c
++++ b/drivers/gpio/gpio-pxa.c
+@@ -646,6 +646,8 @@ static int pxa_gpio_probe(struct platform_device *pdev)
+ pchip->irq0 = irq0;
+ pchip->irq1 = irq1;
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res)
++ return -EINVAL;
+ gpio_reg_base = devm_ioremap(&pdev->dev, res->start,
+ resource_size(res));
+ if (!gpio_reg_base)
+--
+2.18.0
+
diff --git a/patches.drivers/gpiolib-Mark-gpio_suffixes-array-with-__maybe_unused.patch b/patches.drivers/gpiolib-Mark-gpio_suffixes-array-with-__maybe_unused.patch
new file mode 100644
index 0000000000..14dca31e79
--- /dev/null
+++ b/patches.drivers/gpiolib-Mark-gpio_suffixes-array-with-__maybe_unused.patch
@@ -0,0 +1,50 @@
+From b23ec59926faf05b0c43680d05671c484e810ac4 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Mon, 9 Jul 2018 21:47:27 +0300
+Subject: [PATCH] gpiolib: Mark gpio_suffixes array with __maybe_unused
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: b23ec59926faf05b0c43680d05671c484e810ac4
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Since we put static variable to a header file it's copied to each module
+that includes the header. But not all of them are actually used it.
+
+Mark gpio_suffixes array with __maybe_unused to hide a compiler warning:
+
+In file included from
+drivers/gpio/gpiolib-legacy.c:6:0:
+drivers/gpio/gpiolib.h:95:27: warning: ‘gpio_suffixes’ defined but not used [-Wunused-const-variable=]
+ static const char * const gpio_suffixes[] = { "gpios", "gpio" };
+ ^~~~~~~~~~~~~
+In file included from drivers/gpio/gpiolib-devprop.c:17:0:
+drivers/gpio/gpiolib.h:95:27: warning: ‘gpio_suffixes’ defined but not used [-Wunused-const-variable=]
+ static const char * const gpio_suffixes[] = { "gpios", "gpio" };
+ ^~~~~~~~~~~~~
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpiolib.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
+index 1a8e20363861..a7e49fef73d4 100644
+--- a/drivers/gpio/gpiolib.h
++++ b/drivers/gpio/gpiolib.h
+@@ -92,7 +92,7 @@ struct acpi_gpio_info {
+ };
+
+ /* gpio suffixes used for ACPI and device tree lookup */
+-static const char * const gpio_suffixes[] = { "gpios", "gpio" };
++static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" };
+
+ #ifdef CONFIG_OF_GPIO
+ struct gpio_desc *of_find_gpio(struct device *dev,
+--
+2.18.0
+
diff --git a/patches.drivers/gpu-ipu-v3-csi-pass-back-mbus_code_to_bus_cfg-error-.patch b/patches.drivers/gpu-ipu-v3-csi-pass-back-mbus_code_to_bus_cfg-error-.patch
new file mode 100644
index 0000000000..71481095f5
--- /dev/null
+++ b/patches.drivers/gpu-ipu-v3-csi-pass-back-mbus_code_to_bus_cfg-error-.patch
@@ -0,0 +1,87 @@
+From d36d0e6309dd8137cf438cbb680e72eb63c81425 Mon Sep 17 00:00:00 2001
+From: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
+Date: Thu, 3 May 2018 18:29:36 +0200
+Subject: [PATCH] gpu: ipu-v3: csi: pass back mbus_code_to_bus_cfg error codes
+Git-commit: d36d0e6309dd8137cf438cbb680e72eb63c81425
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+mbus_code_to_bus_cfg() can fail on unknown mbus codes; pass back the
+error to the caller.
+
+Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
+Signed-off-by: Jan Luebbe <jlu@pengutronix.de>
+[p.zabel@pengutronix.de - renamed rc to ret for consistency]
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/ipu-v3/ipu-csi.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-csi.c b/drivers/gpu/ipu-v3/ipu-csi.c
+index 813a3199aa84..27262748a549 100644
+--- a/drivers/gpu/ipu-v3/ipu-csi.c
++++ b/drivers/gpu/ipu-v3/ipu-csi.c
+@@ -324,13 +324,17 @@ static int mbus_code_to_bus_cfg(struct ipu_csi_bus_config *cfg, u32 mbus_code)
+ /*
+ * Fill a CSI bus config struct from mbus_config and mbus_framefmt.
+ */
+-static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
++static int fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
+ struct v4l2_mbus_config *mbus_cfg,
+ struct v4l2_mbus_framefmt *mbus_fmt)
+ {
++ int ret;
++
+ memset(csicfg, 0, sizeof(*csicfg));
+
+- mbus_code_to_bus_cfg(csicfg, mbus_fmt->code);
++ ret = mbus_code_to_bus_cfg(csicfg, mbus_fmt->code);
++ if (ret < 0)
++ return ret;
+
+ switch (mbus_cfg->type) {
+ case V4L2_MBUS_PARALLEL:
+@@ -362,6 +366,8 @@ static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg,
+ /* will never get here, keep compiler quiet */
+ break;
+ }
++
++ return 0;
+ }
+
+ int ipu_csi_init_interface(struct ipu_csi *csi,
+@@ -371,8 +377,11 @@ int ipu_csi_init_interface(struct ipu_csi *csi,
+ struct ipu_csi_bus_config cfg;
+ unsigned long flags;
+ u32 width, height, data = 0;
++ int ret;
+
+- fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt);
++ ret = fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt);
++ if (ret < 0)
++ return ret;
+
+ /* set default sensor frame width and height */
+ width = mbus_fmt->width;
+@@ -593,11 +602,14 @@ int ipu_csi_set_mipi_datatype(struct ipu_csi *csi, u32 vc,
+ struct ipu_csi_bus_config cfg;
+ unsigned long flags;
+ u32 temp;
++ int ret;
+
+ if (vc > 3)
+ return -EINVAL;
+
+- mbus_code_to_bus_cfg(&cfg, mbus_fmt->code);
++ ret = mbus_code_to_bus_cfg(&cfg, mbus_fmt->code);
++ if (ret < 0)
++ return ret;
+
+ spin_lock_irqsave(&csi->lock, flags);
+
+--
+2.18.0
+
diff --git a/patches.drivers/i2c-i801-Allow-ACPI-AML-access-I-O-ports-not-reserve.patch b/patches.drivers/i2c-i801-Allow-ACPI-AML-access-I-O-ports-not-reserve.patch
new file mode 100644
index 0000000000..dfc35213b7
--- /dev/null
+++ b/patches.drivers/i2c-i801-Allow-ACPI-AML-access-I-O-ports-not-reserve.patch
@@ -0,0 +1,98 @@
+From 7fd6d98b89f382d414e1db528e29a67bbd749457 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Thu, 30 Aug 2018 11:50:13 +0300
+Subject: [PATCH] i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus
+Git-commit: 7fd6d98b89f382d414e1db528e29a67bbd749457
+Patch-mainline: v4.19-rc2
+References: bsc#1051510
+
+Commit 7ae81952cda ("i2c: i801: Allow ACPI SystemIO OpRegion to conflict
+with PCI BAR") made it possible for AML code to access SMBus I/O ports
+by installing custom SystemIO OpRegion handler and blocking i80i driver
+access upon first AML read/write to this OpRegion.
+
+However, while ThinkPad T560 does have SystemIO OpRegion declared under
+the SMBus device, it does not access any of the SMBus registers:
+
+ Device (SMBU)
+ {
+ ...
+
+ OperationRegion (SMBP, PCI_Config, 0x50, 0x04)
+ Field (SMBP, DWordAcc, NoLock, Preserve)
+ {
+ , 5,
+ TCOB, 11,
+ Offset (0x04)
+ }
+
+ Name (TCBV, 0x00)
+ Method (TCBS, 0, NotSerialized)
+ {
+ If ((TCBV == 0x00))
+ {
+ TCBV = (\_SB.PCI0.SMBU.TCOB << 0x05)
+ }
+
+ Return (TCBV) /* \_SB_.PCI0.SMBU.TCBV */
+ }
+
+ OperationRegion (TCBA, SystemIO, TCBS (), 0x10)
+ Field (TCBA, ByteAcc, NoLock, Preserve)
+ {
+ Offset (0x04),
+ , 9,
+ CPSC, 1
+ }
+ }
+
+Problem with the current approach is that it blocks all I/O port access
+and because this system has touchpad connected to the SMBus controller
+after first AML access (happens during suspend/resume cycle) the
+touchpad fails to work anymore.
+
+Fix this so that we allow ACPI AML I/O port access if it does not touch
+the region reserved for the SMBus.
+
+Fixes: 7ae81952cda ("i2c: i801: Allow ACPI SystemIO OpRegion to conflict with PCI BAR")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=200737
+Reported-by: Yussuf Khalil <dev@pp3345.net>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/i2c/busses/i2c-i801.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 941c223f6491..04b60a349d7e 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -1415,6 +1415,13 @@ static void i801_add_tco(struct i801_priv *priv)
+ }
+
+ #ifdef CONFIG_ACPI
++static bool i801_acpi_is_smbus_ioport(const struct i801_priv *priv,
++ acpi_physical_address address)
++{
++ return address >= priv->smba &&
++ address <= pci_resource_end(priv->pci_dev, SMBBAR);
++}
++
+ static acpi_status
+ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
+ u64 *value, void *handler_context, void *region_context)
+@@ -1430,7 +1437,7 @@ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
+ */
+ mutex_lock(&priv->acpi_lock);
+
+- if (!priv->acpi_reserved) {
++ if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) {
+ priv->acpi_reserved = true;
+
+ dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n");
+--
+2.18.0
+
diff --git a/patches.drivers/input-rohm_bu21023-switch-to-i2c_lock_bus-.-I2C_LOCK.patch b/patches.drivers/input-rohm_bu21023-switch-to-i2c_lock_bus-.-I2C_LOCK.patch
new file mode 100644
index 0000000000..da730f4163
--- /dev/null
+++ b/patches.drivers/input-rohm_bu21023-switch-to-i2c_lock_bus-.-I2C_LOCK.patch
@@ -0,0 +1,47 @@
+From 193c2a07cfaacb9249ab0e3d34bce32490879355 Mon Sep 17 00:00:00 2001
+From: Peter Rosin <peda@axentia.se>
+Date: Wed, 20 Jun 2018 07:17:56 +0200
+Subject: [PATCH] input: rohm_bu21023: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
+Git-commit: 193c2a07cfaacb9249ab0e3d34bce32490879355
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Locking the root adapter for __i2c_transfer will deadlock if the
+device sits behind a mux-locked I2C mux. Switch to the finer-grained
+i2c_lock_bus with the I2C_LOCK_SEGMENT flag. If the device does not
+sit behind a mux-locked mux, the two locking variants are equivalent.
+
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/touchscreen/rohm_bu21023.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/touchscreen/rohm_bu21023.c b/drivers/input/touchscreen/rohm_bu21023.c
+index bda0500c9b57..714affdd742f 100644
+--- a/drivers/input/touchscreen/rohm_bu21023.c
++++ b/drivers/input/touchscreen/rohm_bu21023.c
+@@ -304,7 +304,7 @@ static int rohm_i2c_burst_read(struct i2c_client *client, u8 start, void *buf,
+ msg[1].len = len;
+ msg[1].buf = buf;
+
+- i2c_lock_adapter(adap);
++ i2c_lock_bus(adap, I2C_LOCK_SEGMENT);
+
+ for (i = 0; i < 2; i++) {
+ if (__i2c_transfer(adap, &msg[i], 1) < 0) {
+@@ -313,7 +313,7 @@ static int rohm_i2c_burst_read(struct i2c_client *client, u8 start, void *buf,
+ }
+ }
+
+- i2c_unlock_adapter(adap);
++ i2c_unlock_bus(adap, I2C_LOCK_SEGMENT);
+
+ return ret;
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/intel_th-Fix-device-removal-logic.patch b/patches.drivers/intel_th-Fix-device-removal-logic.patch
new file mode 100644
index 0000000000..e7c14f9022
--- /dev/null
+++ b/patches.drivers/intel_th-Fix-device-removal-logic.patch
@@ -0,0 +1,43 @@
+From 8801922cd94c918e4dc3a108ecaa500c4d40583f Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Tue, 18 Sep 2018 16:10:47 +0300
+Subject: [PATCH] intel_th: Fix device removal logic
+Git-commit: 8801922cd94c918e4dc3a108ecaa500c4d40583f
+Patch-mainline: v4.19-rc6
+References: bsc#1051510
+
+Commit a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices")
+brings in new subdevice addition/removal logic that's broken for "host
+Mode": the SWITCH device has no children to begin with, which is not
+handled in the code. This results in a null dereference bug later down
+the path.
+
+This patch fixes the subdevice removal code to handle host mode correctly.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices")
+Cc: stable@vger.kernel.org # v4.14+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwtracing/intel_th/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
+index da962aa2cef5..4e70ecee2103 100644
+--- a/drivers/hwtracing/intel_th/core.c
++++ b/drivers/hwtracing/intel_th/core.c
+@@ -139,7 +139,8 @@ static int intel_th_remove(struct device *dev)
+ th->thdev[i] = NULL;
+ }
+
+- th->num_thdevs = lowest;
++ if (lowest >= 0)
++ th->num_thdevs = lowest;
+ }
+
+ if (thdrv->attr_group)
+--
+2.18.0
+
diff --git a/patches.drivers/lan78xx-Check-for-supported-Wake-on-LAN-modes.patch b/patches.drivers/lan78xx-Check-for-supported-Wake-on-LAN-modes.patch
new file mode 100644
index 0000000000..e2b823a11c
--- /dev/null
+++ b/patches.drivers/lan78xx-Check-for-supported-Wake-on-LAN-modes.patch
@@ -0,0 +1,52 @@
+From eb9ad088f96653a26b340f7c447c44cf023d5cdc Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 28 Sep 2018 16:18:52 -0700
+Subject: [PATCH] lan78xx: Check for supported Wake-on-LAN modes
+Git-commit: eb9ad088f96653a26b340f7c447c44cf023d5cdc
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+The driver supports a fair amount of Wake-on-LAN modes, but is not
+checking that the user specified one that is supported.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Woojung Huh <Woojung.Huh@Microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/usb/lan78xx.c | 17 ++++-------------
+ 1 file changed, 4 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index a9991c5f4736..c3c9ba44e2a1 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1401,19 +1401,10 @@ static int lan78xx_set_wol(struct net_device *netdev,
+ if (ret < 0)
+ return ret;
+
+- pdata->wol = 0;
+- if (wol->wolopts & WAKE_UCAST)
+- pdata->wol |= WAKE_UCAST;
+- if (wol->wolopts & WAKE_MCAST)
+- pdata->wol |= WAKE_MCAST;
+- if (wol->wolopts & WAKE_BCAST)
+- pdata->wol |= WAKE_BCAST;
+- if (wol->wolopts & WAKE_MAGIC)
+- pdata->wol |= WAKE_MAGIC;
+- if (wol->wolopts & WAKE_PHY)
+- pdata->wol |= WAKE_PHY;
+- if (wol->wolopts & WAKE_ARP)
+- pdata->wol |= WAKE_ARP;
++ if (wol->wolopts & ~WAKE_ALL)
++ return -EINVAL;
++
++ pdata->wol = wol->wolopts;
+
+ device_set_wakeup_enable(&dev->udev->dev, (bool)wol->wolopts);
+
+--
+2.18.0
+
diff --git a/patches.drivers/mac80211-fix-pending-queue-hang-due-to-TX_DROP.patch b/patches.drivers/mac80211-fix-pending-queue-hang-due-to-TX_DROP.patch
new file mode 100644
index 0000000000..d8f8abc3f0
--- /dev/null
+++ b/patches.drivers/mac80211-fix-pending-queue-hang-due-to-TX_DROP.patch
@@ -0,0 +1,56 @@
+From 6eae4a6c2be387fec41b0d2782c4fffb57159498 Mon Sep 17 00:00:00 2001
+From: Bob Copeland <me@bobcopeland.com>
+Date: Wed, 5 Sep 2018 06:22:59 -0400
+Subject: [PATCH] mac80211: fix pending queue hang due to TX_DROP
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 6eae4a6c2be387fec41b0d2782c4fffb57159498
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+In our environment running lots of mesh nodes, we are seeing the
+pending queue hang periodically, with the debugfs queues file showing
+lines such as:
+
+ 00: 0x00000000/348
+
+i.e. there are a large number of frames but no stop reason set.
+
+One way this could happen is if queue processing from the pending
+tasklet exited early without processing all frames, and without having
+some future event (incoming frame, stop reason flag, ...) to reschedule
+it.
+
+Exactly this can occur today if ieee80211_tx() returns false due to
+packet drops or power-save buffering in the tx handlers. In the
+past, this function would return true in such cases, and the change
+to false doesn't seem to be intentional. Fix this case by reverting
+to the previous behavior.
+
+Fixes: bb42f2d13ffc ("mac80211: Move reorder-sensitive TX handlers to after TXQ dequeue")
+Signed-off-by: Bob Copeland <bobcopeland@fb.com>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 131542513c8f..25ba24bef8f5 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1894,7 +1894,7 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
+ sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
+
+ if (invoke_tx_handlers_early(&tx))
+- return false;
++ return true;
+
+ if (ieee80211_queue_skb(local, sdata, tx.sta, tx.skb))
+ return true;
+--
+2.18.0
+
diff --git a/patches.drivers/mac80211-restrict-delayed-tailroom-needed-decrement.patch b/patches.drivers/mac80211-restrict-delayed-tailroom-needed-decrement.patch
new file mode 100644
index 0000000000..ea77a56980
--- /dev/null
+++ b/patches.drivers/mac80211-restrict-delayed-tailroom-needed-decrement.patch
@@ -0,0 +1,144 @@
+From 133bf90dbb8b873286f8ec2e81ba26e863114b8c Mon Sep 17 00:00:00 2001
+From: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Date: Tue, 10 Jul 2018 16:48:27 +0530
+Subject: [PATCH] mac80211: restrict delayed tailroom needed decrement
+Git-commit: 133bf90dbb8b873286f8ec2e81ba26e863114b8c
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+As explained in ieee80211_delayed_tailroom_dec(), during roam,
+keys of the old AP will be destroyed and new keys will be
+installed. Deletion of the old key causes
+crypto_tx_tailroom_needed_cnt to go from 1 to 0 and the new key
+installation causes a transition from 0 to 1.
+
+Whenever crypto_tx_tailroom_needed_cnt transitions from 0 to 1,
+we invoke synchronize_net(); the reason for doing this is to avoid
+a race in the TX path as explained in increment_tailroom_need_count().
+This synchronize_net() operation can be slow and can affect the station
+roam time. To avoid this, decrementing the crypto_tx_tailroom_needed_cnt
+is delayed for a while so that upon installation of new key the
+transition would be from 1 to 2 instead of 0 to 1 and thereby
+improving the roam time.
+
+This is all correct for a STA iftype, but deferring the tailroom_needed
+decrement for other iftypes may be unnecessary.
+
+For example, let's consider the case of a 4-addr client connecting to
+an AP for which AP_VLAN interface is also created, let the initial
+value for tailroom_needed on the AP be 1.
+
+* 4-addr client connects to the AP (AP: tailroom_needed = 1)
+* AP will clear old keys, delay decrement of tailroom_needed count
+* AP_VLAN is created, it takes the tailroom count from master
+ (AP_VLAN: tailroom_needed = 1, AP: tailroom_needed = 1)
+* Install new key for the station, assume key is plumbed in the HW,
+ there won't be any change in tailroom_needed count on AP iface
+* Delayed decrement of tailroom_needed count on AP
+ (AP: tailroom_needed = 0, AP_VLAN: tailroom_needed = 1)
+
+Because of the delayed decrement on AP iface, tailroom_needed count goes
+out of sync between AP(master iface) and AP_VLAN(slave iface) and
+there would be unnecessary tailroom created for the packets going
+through AP_VLAN iface.
+
+Also, WARN_ONs were observed while trying to bring down the AP_VLAN
+Interface:
+(warn_slowpath_common) (warn_slowpath_null+0x18/0x20)
+(warn_slowpath_null) (ieee80211_free_keys+0x114/0x1e4)
+(ieee80211_free_keys) (ieee80211_del_virtual_monitor+0x51c/0x850)
+(ieee80211_del_virtual_monitor) (ieee80211_stop+0x30/0x3c)
+(ieee80211_stop) (__dev_close_many+0x94/0xb8)
+(__dev_close_many) (dev_close_many+0x5c/0xc8)
+
+Restricting delayed decrement to station interface alone fixes the problem
+and it makes sense to do so because delayed decrement is done to improve
+roam time which is applicable only for client devices.
+
+Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/cfg.c | 2 +-
+ net/mac80211/key.c | 24 +++++++++++++++---------
+ 2 files changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 02f3672e7b5e..d25da0e66da1 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -495,7 +495,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+ goto out_unlock;
+ }
+
+- ieee80211_key_free(key, true);
++ ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION);
+
+ ret = 0;
+ out_unlock:
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index ee0d0cc8dc3b..c054ac85793c 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -656,11 +656,15 @@ int ieee80211_key_link(struct ieee80211_key *key,
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_key *old_key;
+- int idx, ret;
+- bool pairwise;
+-
+- pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
+- idx = key->conf.keyidx;
++ int idx = key->conf.keyidx;
++ bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
++ /*
++ * We want to delay tailroom updates only for station - in that
++ * case it helps roaming speed, but in other cases it hurts and
++ * can cause warnings to appear.
++ */
++ bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION;
++ int ret;
+
+ mutex_lock(&sdata->local->key_mtx);
+
+@@ -688,14 +692,14 @@ int ieee80211_key_link(struct ieee80211_key *key,
+ increment_tailroom_need_count(sdata);
+
+ ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
+- ieee80211_key_destroy(old_key, true);
++ ieee80211_key_destroy(old_key, delay_tailroom);
+
+ ieee80211_debugfs_key_add(key);
+
+ if (!local->wowlan) {
+ ret = ieee80211_key_enable_hw_accel(key);
+ if (ret)
+- ieee80211_key_free(key, true);
++ ieee80211_key_free(key, delay_tailroom);
+ } else {
+ ret = 0;
+ }
+@@ -930,7 +934,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
+ ieee80211_key_replace(key->sdata, key->sta,
+ key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
+ key, NULL);
+- __ieee80211_key_destroy(key, true);
++ __ieee80211_key_destroy(key, key->sdata->vif.type ==
++ NL80211_IFTYPE_STATION);
+ }
+
+ for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+@@ -940,7 +945,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
+ ieee80211_key_replace(key->sdata, key->sta,
+ key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
+ key, NULL);
+- __ieee80211_key_destroy(key, true);
++ __ieee80211_key_destroy(key, key->sdata->vif.type ==
++ NL80211_IFTYPE_STATION);
+ }
+
+ mutex_unlock(&local->key_mtx);
+--
+2.18.0
+
diff --git a/patches.drivers/mei-bus-type-promotion-bug-in-mei_nfc_if_version.patch b/patches.drivers/mei-bus-type-promotion-bug-in-mei_nfc_if_version.patch
new file mode 100644
index 0000000000..3d31d8fe14
--- /dev/null
+++ b/patches.drivers/mei-bus-type-promotion-bug-in-mei_nfc_if_version.patch
@@ -0,0 +1,36 @@
+From b40b3e9358fbafff6a4ba0f4b9658f6617146f9c Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 11 Jul 2018 15:29:31 +0300
+Subject: [PATCH] mei: bus: type promotion bug in mei_nfc_if_version()
+Git-commit: b40b3e9358fbafff6a4ba0f4b9658f6617146f9c
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+We accidentally removed the check for negative returns
+without considering the issue of type promotion.
+The "if_version_length" variable is type size_t so if __mei_cl_recv()
+returns a negative then "bytes_recv" is type promoted
+to a high positive value and treated as success.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 582ab27a063a ("mei: bus: fix received data size check in NFC fixup")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/misc/mei/bus-fixup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/mei/bus-fixup.c
++++ b/drivers/misc/mei/bus-fixup.c
+@@ -267,7 +267,7 @@ static int mei_nfc_if_version(struct mei
+
+ ret = 0;
+ bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length, 0);
+- if (bytes_recv < if_version_length) {
++ if (bytes_recv < 0 || bytes_recv < if_version_length) {
+ dev_err(bus->dev, "Could not read IF version\n");
+ ret = -EIO;
+ goto err;
diff --git a/patches.drivers/mei-ignore-not-found-client-in-the-enumeration.patch b/patches.drivers/mei-ignore-not-found-client-in-the-enumeration.patch
new file mode 100644
index 0000000000..0775cc41e0
--- /dev/null
+++ b/patches.drivers/mei-ignore-not-found-client-in-the-enumeration.patch
@@ -0,0 +1,63 @@
+From 8d2d8935d30cc2acc57a3196dc10dfa8d5cbcdab Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Mon, 6 Aug 2018 17:47:33 +0300
+Subject: [PATCH] mei: ignore not found client in the enumeration
+Git-commit: 8d2d8935d30cc2acc57a3196dc10dfa8d5cbcdab
+Patch-mainline: v4.19-rc4
+References: bsc#1051510
+
+Some of the ME clients are available only for BIOS operation and are
+removed during hand off to an OS. However the removal is not instant.
+A client may be visible on the client list when the mei driver requests
+for enumeration, while the subsequent request for properties will be
+answered with client not found error value. The default behavior
+for an error is to perform client reset while this error is harmless and
+the link reset should be prevented. This issue started to be visible due to
+suspend/resume timing changes. Currently reported only on the Haswell
+based system.
+
+Fixes:
+[33.564957] mei_me 0000:00:16.0: hbm: properties response: wrong status = 1 CLIENT_NOT_FOUND
+[33.564978] mei_me 0000:00:16.0: mei_irq_read_handler ret = -71.
+[33.565270] mei_me 0000:00:16.0: unexpected reset: dev_state = INIT_CLIENTS fw status = 1E000255 60002306 00000200 00004401 00000000 00000010
+
+Cc: <stable@vger.kernel.org>
+Reported-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/misc/mei/hbm.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
+index 09e233d4c0de..e56f3e72d57a 100644
+--- a/drivers/misc/mei/hbm.c
++++ b/drivers/misc/mei/hbm.c
+@@ -1161,15 +1161,18 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
+
+ props_res = (struct hbm_props_response *)mei_msg;
+
+- if (props_res->status) {
++ if (props_res->status == MEI_HBMS_CLIENT_NOT_FOUND) {
++ dev_dbg(dev->dev, "hbm: properties response: %d CLIENT_NOT_FOUND\n",
++ props_res->me_addr);
++ } else if (props_res->status) {
+ dev_err(dev->dev, "hbm: properties response: wrong status = %d %s\n",
+ props_res->status,
+ mei_hbm_status_str(props_res->status));
+ return -EPROTO;
++ } else {
++ mei_hbm_me_cl_add(dev, props_res);
+ }
+
+- mei_hbm_me_cl_add(dev, props_res);
+-
+ /* request property for the next client */
+ if (mei_hbm_prop_req(dev, props_res->me_addr + 1))
+ return -EIO;
+--
+2.18.0
+
diff --git a/patches.drivers/mfd-88pm860x-i2c-switch-to-i2c_lock_bus-.-I2C_LOCK_S.patch b/patches.drivers/mfd-88pm860x-i2c-switch-to-i2c_lock_bus-.-I2C_LOCK_S.patch
new file mode 100644
index 0000000000..c16be30620
--- /dev/null
+++ b/patches.drivers/mfd-88pm860x-i2c-switch-to-i2c_lock_bus-.-I2C_LOCK_S.patch
@@ -0,0 +1,63 @@
+From 8c8f74f327a76604a499fad8c54c15e1c0ee8051 Mon Sep 17 00:00:00 2001
+From: Peter Rosin <peda@axentia.se>
+Date: Wed, 20 Jun 2018 07:18:02 +0200
+Subject: [PATCH] mfd: 88pm860x-i2c: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT)
+Git-commit: 8c8f74f327a76604a499fad8c54c15e1c0ee8051
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Locking the root adapter for __i2c_transfer will deadlock if the
+device sits behind a mux-locked I2C mux. Switch to the finer-grained
+i2c_lock_bus with the I2C_LOCK_SEGMENT flag. If the device does not
+sit behind a mux-locked mux, the two locking variants are equivalent.
+
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Acked-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mfd/88pm860x-i2c.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mfd/88pm860x-i2c.c b/drivers/mfd/88pm860x-i2c.c
+index 84e313107233..7b9052ea7413 100644
+--- a/drivers/mfd/88pm860x-i2c.c
++++ b/drivers/mfd/88pm860x-i2c.c
+@@ -146,14 +146,14 @@ int pm860x_page_reg_write(struct i2c_client *i2c, int reg,
+ unsigned char zero;
+ int ret;
+
+- i2c_lock_adapter(i2c->adapter);
++ i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ read_device(i2c, 0xFA, 0, &zero);
+ read_device(i2c, 0xFB, 0, &zero);
+ read_device(i2c, 0xFF, 0, &zero);
+ ret = write_device(i2c, reg, 1, &data);
+ read_device(i2c, 0xFE, 0, &zero);
+ read_device(i2c, 0xFC, 0, &zero);
+- i2c_unlock_adapter(i2c->adapter);
++ i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ return ret;
+ }
+ EXPORT_SYMBOL(pm860x_page_reg_write);
+@@ -164,14 +164,14 @@ int pm860x_page_bulk_read(struct i2c_client *i2c, int reg,
+ unsigned char zero = 0;
+ int ret;
+
+- i2c_lock_adapter(i2c->adapter);
++ i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ read_device(i2c, 0xfa, 0, &zero);
+ read_device(i2c, 0xfb, 0, &zero);
+ read_device(i2c, 0xff, 0, &zero);
+ ret = read_device(i2c, reg, count, buf);
+ read_device(i2c, 0xFE, 0, &zero);
+ read_device(i2c, 0xFC, 0, &zero);
+- i2c_unlock_adapter(i2c->adapter);
++ i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT);
+ return ret;
+ }
+ EXPORT_SYMBOL(pm860x_page_bulk_read);
+--
+2.18.0
+
diff --git a/patches.drivers/mfd-ti_am335x_tscadc-Fix-struct-clk-memory-leak.patch b/patches.drivers/mfd-ti_am335x_tscadc-Fix-struct-clk-memory-leak.patch
new file mode 100644
index 0000000000..f5836913a9
--- /dev/null
+++ b/patches.drivers/mfd-ti_am335x_tscadc-Fix-struct-clk-memory-leak.patch
@@ -0,0 +1,65 @@
+From c2b1509c77a99a0dcea0a9051ca743cb88385f50 Mon Sep 17 00:00:00 2001
+From: Zumeng Chen <zumeng.chen@gmail.com>
+Date: Wed, 4 Jul 2018 12:35:29 +0800
+Subject: [PATCH] mfd: ti_am335x_tscadc: Fix struct clk memory leak
+Git-commit: c2b1509c77a99a0dcea0a9051ca743cb88385f50
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Use devm_elk_get() to let Linux manage struct clk memory to avoid the following
+memory leakage report:
+
+unreferenced object 0xdd75efc0 (size 64):
+ comm "systemd-udevd", pid 186, jiffies 4294945126 (age 1195.750s)
+ hex dump (first 32 bytes):
+ 61 64 63 5f 74 73 63 5f 66 63 6b 00 00 00 00 00 adc_tsc_fck.....
+ 00 00 00 00 92 03 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<c0a15260>] kmemleak_alloc+0x40/0x74
+ [<c0287a10>] __kmalloc_track_caller+0x198/0x388
+ [<c0255610>] kstrdup+0x40/0x5c
+ [<c025565c>] kstrdup_const+0x30/0x3c
+ [<c0636630>] __clk_create_clk+0x60/0xac
+ [<c0630918>] clk_get_sys+0x74/0x144
+ [<c0630cdc>] clk_get+0x5c/0x68
+ [<bf0ac540>] ti_tscadc_probe+0x260/0x468 [ti_am335x_tscadc]
+ [<c06f3c0c>] platform_drv_probe+0x60/0xac
+ [<c06f1abc>] driver_probe_device+0x214/0x2dc
+ [<c06f1c18>] __driver_attach+0x94/0xc0
+ [<c06efe2c>] bus_for_each_dev+0x90/0xa0
+ [<c06f1470>] driver_attach+0x28/0x30
+ [<c06f1030>] bus_add_driver+0x184/0x1ec
+ [<c06f2b74>] driver_register+0xb0/0xf0
+ [<c06f3b4c>] __platform_driver_register+0x40/0x54
+
+Signed-off-by: Zumeng Chen <zumeng.chen@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mfd/ti_am335x_tscadc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c
+index 47012c0899cd..7a30546880a4 100644
+--- a/drivers/mfd/ti_am335x_tscadc.c
++++ b/drivers/mfd/ti_am335x_tscadc.c
+@@ -209,14 +209,13 @@ static int ti_tscadc_probe(struct platform_device *pdev)
+ * The TSC_ADC_SS controller design assumes the OCP clock is
+ * at least 6x faster than the ADC clock.
+ */
+- clk = clk_get(&pdev->dev, "adc_tsc_fck");
++ clk = devm_clk_get(&pdev->dev, "adc_tsc_fck");
+ if (IS_ERR(clk)) {
+ dev_err(&pdev->dev, "failed to get TSC fck\n");
+ err = PTR_ERR(clk);
+ goto err_disable_clk;
+ }
+ clock_rate = clk_get_rate(clk);
+- clk_put(clk);
+ tscadc->clk_div = clock_rate / ADC_CLK;
+
+ /* TSCADC_CLKDIV needs to be configured to the value minus 1 */
+--
+2.18.0
+
diff --git a/patches.drivers/mmc-sdhci-do-not-try-to-use-3.3V-signaling-if-not-su.patch b/patches.drivers/mmc-sdhci-do-not-try-to-use-3.3V-signaling-if-not-su.patch
new file mode 100644
index 0000000000..e11555fdd7
--- /dev/null
+++ b/patches.drivers/mmc-sdhci-do-not-try-to-use-3.3V-signaling-if-not-su.patch
@@ -0,0 +1,55 @@
+From 1b5190c2e74c47ebe4bcecf7a072358ad9f1feaa Mon Sep 17 00:00:00 2001
+From: Stefan Agner <stefan@agner.ch>
+Date: Thu, 5 Jul 2018 14:18:19 +0200
+Subject: [PATCH] mmc: sdhci: do not try to use 3.3V signaling if not supported
+Git-commit: 1b5190c2e74c47ebe4bcecf7a072358ad9f1feaa
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+For eMMC devices it is valid to only support 1.8V signaling. When
+vqmmc is set to a fixed 1.8V regulator the stack tries to set 3.3V
+initially and prints the following warning:
+ mmc1: Switching to 3.3V signalling voltage failed
+
+Clear the MMC_SIGNAL_VOLTAGE_330 flag in case 3.3V is signaling is
+not available. This prevents the stack from even trying to use
+3.3V signaling and avoids the above warning.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/sdhci.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 1c828e0e9905..a7b5602ef6f7 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3734,14 +3734,21 @@ int sdhci_setup_host(struct sdhci_host *host)
+ mmc_gpio_get_cd(host->mmc) < 0)
+ mmc->caps |= MMC_CAP_NEEDS_POLL;
+
+- /* If vqmmc regulator and no 1.8V signalling, then there's no UHS */
+ if (!IS_ERR(mmc->supply.vqmmc)) {
+ ret = regulator_enable(mmc->supply.vqmmc);
++
++ /* If vqmmc provides no 1.8V signalling, then there's no UHS */
+ if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 1700000,
+ 1950000))
+ host->caps1 &= ~(SDHCI_SUPPORT_SDR104 |
+ SDHCI_SUPPORT_SDR50 |
+ SDHCI_SUPPORT_DDR50);
++
++ /* In eMMC case vqmmc might be a fixed 1.8V regulator */
++ if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 2700000,
++ 3600000))
++ host->flags &= ~SDHCI_SIGNALING_330;
++
+ if (ret) {
+ pr_warn("%s: Failed to enable vqmmc regulator: %d\n",
+ mmc_hostname(mmc), ret);
+--
+2.18.0
+
diff --git a/patches.drivers/mmc-sdhci-of-esdhc-set-proper-dma-mask-for-ls104x-ch.patch b/patches.drivers/mmc-sdhci-of-esdhc-set-proper-dma-mask-for-ls104x-ch.patch
new file mode 100644
index 0000000000..7e364feeae
--- /dev/null
+++ b/patches.drivers/mmc-sdhci-of-esdhc-set-proper-dma-mask-for-ls104x-ch.patch
@@ -0,0 +1,56 @@
+From 5552d7ad596c3fea953f40fef74170ce0760c04d Mon Sep 17 00:00:00 2001
+From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Date: Wed, 4 Jul 2018 14:34:20 +0300
+Subject: [PATCH] mmc: sdhci-of-esdhc: set proper dma mask for ls104x chips
+Git-commit: 5552d7ad596c3fea953f40fef74170ce0760c04d
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+SDHCI controller in ls1043a and ls1046a generate 40-bit wide addresses
+when doing DMA. Make sure that the corresponding dma mask is correctly
+configured.
+
+Context: when enabling smmu on these chips the following problem is
+Encountered: the smmu input address size is 48 bits so the dma mappings
+for sdhci end up 48-bit wide. However, on these chips sdhci only use
+40-bits of that address size when doing dma.
+So you end up with a 48-bit address translation in smmu but the device
+generates transactions with clipped 40-bit addresses, thus smmu context
+faults are triggered. Setting up the correct dma mask fixes this
+situation.
+
+Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/sdhci-of-esdhc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index c9685c6e4395..9cb7554a463d 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -22,6 +22,7 @@
+ #include <linux/sys_soc.h>
+ #include <linux/clk.h>
+ #include <linux/ktime.h>
++#include <linux/dma-mapping.h>
+ #include <linux/mmc/host.h>
+ #include "sdhci-pltfm.h"
+ #include "sdhci-esdhc.h"
+@@ -472,6 +473,11 @@ static void esdhc_of_adma_workaround(struct sdhci_host *host, u32 intmask)
+ static int esdhc_of_enable_dma(struct sdhci_host *host)
+ {
+ u32 value;
++ struct device *dev = mmc_dev(host->mmc);
++
++ if (of_device_is_compatible(dev->of_node, "fsl,ls1043a-esdhc") ||
++ of_device_is_compatible(dev->of_node, "fsl,ls1046a-esdhc"))
++ dma_set_mask_and_coherent(dev, DMA_BIT_MASK(40));
+
+ value = sdhci_readl(host, ESDHC_DMA_SYSCTL);
+ value |= ESDHC_DMA_SNOOP;
+--
+2.18.0
+
diff --git a/patches.drivers/parport-sunbpp-fix-error-return-code.patch b/patches.drivers/parport-sunbpp-fix-error-return-code.patch
new file mode 100644
index 0000000000..76c055299b
--- /dev/null
+++ b/patches.drivers/parport-sunbpp-fix-error-return-code.patch
@@ -0,0 +1,48 @@
+From faa1a47388b33623e4d504c23569188907b039a0 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Thu, 12 Jul 2018 22:29:55 +0100
+Subject: [PATCH] parport: sunbpp: fix error return code
+Git-commit: faa1a47388b33623e4d504c23569188907b039a0
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Return an error code on failure. Change leading spaces to tab on the
+first if.
+
+Problem found using Coccinelle.
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/parport/parport_sunbpp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c
+index 01cf1c1a841a..8de329546b82 100644
+--- a/drivers/parport/parport_sunbpp.c
++++ b/drivers/parport/parport_sunbpp.c
+@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_device *op)
+
+ ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations),
+ GFP_KERNEL);
+- if (!ops)
++ if (!ops) {
++ err = -ENOMEM;
+ goto out_unmap;
++ }
+
+ dprintk(("register_port\n"));
+- if (!(p = parport_register_port((unsigned long)base, irq, dma, ops)))
++ if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) {
++ err = -ENOMEM;
+ goto out_free_ops;
++ }
+
+ p->size = size;
+ p->dev = &op->dev;
+--
+2.18.0
+
diff --git a/patches.drivers/pinctrl-cannonlake-Fix-HOSTSW_OWN-register-offset-of.patch b/patches.drivers/pinctrl-cannonlake-Fix-HOSTSW_OWN-register-offset-of.patch
new file mode 100644
index 0000000000..04e5ce33e9
--- /dev/null
+++ b/patches.drivers/pinctrl-cannonlake-Fix-HOSTSW_OWN-register-offset-of.patch
@@ -0,0 +1,96 @@
+From e50d95e2ad1266f8d3fcdf0724f03dbdffd400aa Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Mon, 24 Sep 2018 17:32:11 +0300
+Subject: [PATCH] pinctrl: cannonlake: Fix HOSTSW_OWN register offset of H variant
+Git-commit: e50d95e2ad1266f8d3fcdf0724f03dbdffd400aa
+Patch-mainline: v4.19-rc6
+References: bsc#1051510
+
+It turns out the HOSTSW_OWN register offset is different between LP and
+H variants. The latter should use 0xc0 instead so fix that.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=199911
+Fixes: a663ccf0fea1 ("pinctrl: intel: Add Intel Cannon Lake PCH-H pin controller support")
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pinctrl/intel/pinctrl-cannonlake.c | 33 +++++++++++++++++------------
+ 1 file changed, 20 insertions(+), 13 deletions(-)
+
+--- a/drivers/pinctrl/intel/pinctrl-cannonlake.c
++++ b/drivers/pinctrl/intel/pinctrl-cannonlake.c
+@@ -18,10 +18,11 @@
+
+ #include "pinctrl-intel.h"
+
+-#define CNL_PAD_OWN 0x020
+-#define CNL_PADCFGLOCK 0x080
+-#define CNL_HOSTSW_OWN 0x0b0
+-#define CNL_GPI_IE 0x120
++#define CNL_PAD_OWN 0x020
++#define CNL_PADCFGLOCK 0x080
++#define CNL_LP_HOSTSW_OWN 0x0b0
++#define CNL_H_HOSTSW_OWN 0x0c0
++#define CNL_GPI_IE 0x120
+
+ #define CNL_GPP(r, s, e) \
+ { \
+@@ -30,12 +31,12 @@
+ .size = ((e) - (s) + 1), \
+ }
+
+-#define CNL_COMMUNITY(b, s, e, g) \
++#define CNL_COMMUNITY(b, s, e, o, g) \
+ { \
+ .barno = (b), \
+ .padown_offset = CNL_PAD_OWN, \
+ .padcfglock_offset = CNL_PADCFGLOCK, \
+- .hostown_offset = CNL_HOSTSW_OWN, \
++ .hostown_offset = (o), \
+ .ie_offset = CNL_GPI_IE, \
+ .pin_base = (s), \
+ .npins = ((e) - (s) + 1), \
+@@ -43,6 +44,12 @@
+ .ngpps = ARRAY_SIZE(g), \
+ }
+
++#define CNLLP_COMMUNITY(b, s, e, g) \
++ CNL_COMMUNITY(b, s, e, CNL_LP_HOSTSW_OWN, g)
++
++#define CNLH_COMMUNITY(b, s, e, g) \
++ CNL_COMMUNITY(b, s, e, CNL_H_HOSTSW_OWN, g)
++
+ /* Cannon Lake-H */
+ static const struct pinctrl_pin_desc cnlh_pins[] = {
+ /* GPP_A */
+@@ -442,10 +449,10 @@ static const struct intel_function cnlh_
+ };
+
+ static const struct intel_community cnlh_communities[] = {
+- CNL_COMMUNITY(0, 0, 50, cnlh_community0_gpps),
+- CNL_COMMUNITY(1, 51, 154, cnlh_community1_gpps),
+- CNL_COMMUNITY(2, 155, 248, cnlh_community3_gpps),
+- CNL_COMMUNITY(3, 249, 298, cnlh_community4_gpps),
++ CNLH_COMMUNITY(0, 0, 50, cnlh_community0_gpps),
++ CNLH_COMMUNITY(1, 51, 154, cnlh_community1_gpps),
++ CNLH_COMMUNITY(2, 155, 248, cnlh_community3_gpps),
++ CNLH_COMMUNITY(3, 249, 298, cnlh_community4_gpps),
+ };
+
+ static const struct intel_pinctrl_soc_data cnlh_soc_data = {
+@@ -803,9 +810,9 @@ static const struct intel_padgroup cnllp
+ };
+
+ static const struct intel_community cnllp_communities[] = {
+- CNL_COMMUNITY(0, 0, 67, cnllp_community0_gpps),
+- CNL_COMMUNITY(1, 68, 180, cnllp_community1_gpps),
+- CNL_COMMUNITY(2, 181, 243, cnllp_community4_gpps),
++ CNLLP_COMMUNITY(0, 0, 67, cnllp_community0_gpps),
++ CNLLP_COMMUNITY(1, 68, 180, cnllp_community1_gpps),
++ CNLLP_COMMUNITY(2, 181, 243, cnllp_community4_gpps),
+ };
+
+ static const struct intel_pinctrl_soc_data cnllp_soc_data = {
diff --git a/patches.drivers/platform-x86-alienware-wmi-Correct-a-memory-leak.patch b/patches.drivers/platform-x86-alienware-wmi-Correct-a-memory-leak.patch
new file mode 100644
index 0000000000..5e9f5a9035
--- /dev/null
+++ b/patches.drivers/platform-x86-alienware-wmi-Correct-a-memory-leak.patch
@@ -0,0 +1,34 @@
+From ff0e9f26288d2daee4950f42b37a3d3d30d36ec1 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@dell.com>
+Date: Mon, 10 Sep 2018 13:01:53 -0500
+Subject: [PATCH] platform/x86: alienware-wmi: Correct a memory leak
+Git-commit: ff0e9f26288d2daee4950f42b37a3d3d30d36ec1
+Patch-mainline: v4.19-rc5
+References: bsc#1051510
+
+An ACPI buffer that was allocated was not being freed after use.
+
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/alienware-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index d975462a4c57..f10af5c383c5 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -536,6 +536,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
+ if (obj && obj->type == ACPI_TYPE_INTEGER)
+ *out_data = (u32) obj->integer.value;
+ }
++ kfree(output.pointer);
+ return status;
+
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/platform-x86-toshiba_acpi-Fix-defined-but-not-used-b.patch b/patches.drivers/platform-x86-toshiba_acpi-Fix-defined-but-not-used-b.patch
new file mode 100644
index 0000000000..7ae9fd33d1
--- /dev/null
+++ b/patches.drivers/platform-x86-toshiba_acpi-Fix-defined-but-not-used-b.patch
@@ -0,0 +1,48 @@
+From c2e2a618eb7104e18fdcf739d4d911563812a81c Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Fri, 6 Jul 2018 20:53:09 -0700
+Subject: [PATCH] platform/x86: toshiba_acpi: Fix defined but not used build warnings
+Git-commit: c2e2a618eb7104e18fdcf739d4d911563812a81c
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Fix a build warning in toshiba_acpi.c when CONFIG_PROC_FS is not enabled
+by marking the unused function as __maybe_unused.
+
+../drivers/platform/x86/toshiba_acpi.c:1685:12: warning: 'version_proc_show' defined but not used [-Wunused-function]
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Azael Avalos <coproscefalo@gmail.com>
+Cc: platform-driver-x86@vger.kernel.org
+Cc: Andy Shevchenko <andy@infradead.org>
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/toshiba_acpi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
+index e7186b1f3229..e366977bda41 100644
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -34,6 +34,7 @@
+ #define TOSHIBA_ACPI_VERSION "0.24"
+ #define PROC_INTERFACE_VERSION 1
+
++#include <linux/compiler.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+@@ -1682,7 +1683,7 @@ static const struct file_operations keys_proc_fops = {
+ .write = keys_proc_write,
+ };
+
+-static int version_proc_show(struct seq_file *m, void *v)
++static int __maybe_unused version_proc_show(struct seq_file *m, void *v)
+ {
+ seq_printf(m, "driver: %s\n", TOSHIBA_ACPI_VERSION);
+ seq_printf(m, "proc_interface: %d\n", PROC_INTERFACE_VERSION);
+--
+2.18.0
+
diff --git a/patches.drivers/r8152-Check-for-supported-Wake-on-LAN-Modes.patch b/patches.drivers/r8152-Check-for-supported-Wake-on-LAN-Modes.patch
new file mode 100644
index 0000000000..13e3570c3e
--- /dev/null
+++ b/patches.drivers/r8152-Check-for-supported-Wake-on-LAN-Modes.patch
@@ -0,0 +1,38 @@
+From f2750df1548bd8a2b060eb609fc43ca82811af4c Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 28 Sep 2018 16:18:54 -0700
+Subject: [PATCH] r8152: Check for supported Wake-on-LAN Modes
+Git-commit: f2750df1548bd8a2b060eb609fc43ca82811af4c
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+The driver does not check for Wake-on-LAN modes specified by an user,
+but will conditionally set the device as wake-up enabled or not based on
+that, which could be a very confusing user experience.
+
+Fixes: 21ff2e8976b1 ("r8152: support WOL")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/usb/r8152.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 2cd71bdb6484..f1b5201cc320 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -4506,6 +4506,9 @@ static int rtl8152_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+ if (!rtl_can_wakeup(tp))
+ return -EOPNOTSUPP;
+
++ if (wol->wolopts & ~WAKE_ANY)
++ return -EINVAL;
++
+ ret = usb_autopm_get_interface(tp->intf);
+ if (ret < 0)
+ goto out_set_wol;
+--
+2.18.0
+
diff --git a/patches.drivers/regulator-fix-crash-caused-by-null-driver-data.patch b/patches.drivers/regulator-fix-crash-caused-by-null-driver-data.patch
new file mode 100644
index 0000000000..4e03dc6e27
--- /dev/null
+++ b/patches.drivers/regulator-fix-crash-caused-by-null-driver-data.patch
@@ -0,0 +1,46 @@
+From fb6de923ca3358a91525552b4907d4cb38730bdd Mon Sep 17 00:00:00 2001
+From: Yu Zhao <yuzhao@google.com>
+Date: Wed, 19 Sep 2018 15:30:51 -0600
+Subject: [PATCH] regulator: fix crash caused by null driver data
+Git-commit: fb6de923ca3358a91525552b4907d4cb38730bdd
+Patch-mainline: v4.19-rc6
+References: bsc#1051510
+
+dev_set_drvdata() needs to be called before device_register()
+exposes device to userspace. Otherwise kernel crashes after it
+gets null pointer from dev_get_drvdata() when userspace tries
+to access sysfs entries.
+
+[Removed backtrace for length -- broonie]
+
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/regulator/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 90215f57270f..9577d8941846 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4395,13 +4395,13 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ !rdev->desc->fixed_uV)
+ rdev->is_switch = true;
+
++ dev_set_drvdata(&rdev->dev, rdev);
+ ret = device_register(&rdev->dev);
+ if (ret != 0) {
+ put_device(&rdev->dev);
+ goto unset_supplies;
+ }
+
+- dev_set_drvdata(&rdev->dev, rdev);
+ rdev_init_debugfs(rdev);
+
+ /* try to resolve regulators supply since a new one was registered */
+--
+2.18.0
+
diff --git a/patches.drivers/smsc75xx-Check-for-Wake-on-LAN-modes.patch b/patches.drivers/smsc75xx-Check-for-Wake-on-LAN-modes.patch
new file mode 100644
index 0000000000..9f518a49eb
--- /dev/null
+++ b/patches.drivers/smsc75xx-Check-for-Wake-on-LAN-modes.patch
@@ -0,0 +1,38 @@
+From 9c734b2769a73eea2e9e9767c0e0bf839ff23679 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 28 Sep 2018 16:18:55 -0700
+Subject: [PATCH] smsc75xx: Check for Wake-on-LAN modes
+Git-commit: 9c734b2769a73eea2e9e9767c0e0bf839ff23679
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+The driver does not check for Wake-on-LAN modes specified by an user,
+but will conditionally set the device as wake-up enabled or not based on
+that, which could be a very confusing user experience.
+
+Fixes: 6c636503260d ("smsc75xx: add wol magic packet support")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/usb/smsc75xx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index 05553d252446..e5a4cbb366dc 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -731,6 +731,9 @@ static int smsc75xx_ethtool_set_wol(struct net_device *net,
+ struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
+ int ret;
+
++ if (wolinfo->wolopts & ~SUPPORTED_WAKE)
++ return -EINVAL;
++
+ pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE;
+
+ ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts);
+--
+2.18.0
+
diff --git a/patches.drivers/smsc95xx-Check-for-Wake-on-LAN-modes.patch b/patches.drivers/smsc95xx-Check-for-Wake-on-LAN-modes.patch
new file mode 100644
index 0000000000..c70414bc3f
--- /dev/null
+++ b/patches.drivers/smsc95xx-Check-for-Wake-on-LAN-modes.patch
@@ -0,0 +1,38 @@
+From c530c471ba37bdd9fe1c7185b01455c00ae606fb Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 28 Sep 2018 16:18:56 -0700
+Subject: [PATCH] smsc95xx: Check for Wake-on-LAN modes
+Git-commit: c530c471ba37bdd9fe1c7185b01455c00ae606fb
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+The driver does not check for Wake-on-LAN modes specified by an user,
+but will conditionally set the device as wake-up enabled or not based on
+that, which could be a very confusing user experience.
+
+Fixes: e0e474a83c18 ("smsc95xx: add wol magic packet support")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/usb/smsc95xx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
+index 06b4d290784d..262e7a3c23cb 100644
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -774,6 +774,9 @@ static int smsc95xx_ethtool_set_wol(struct net_device *net,
+ struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+ int ret;
+
++ if (wolinfo->wolopts & ~SUPPORTED_WAKE)
++ return -EINVAL;
++
+ pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE;
+
+ ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts);
+--
+2.18.0
+
diff --git a/patches.drivers/sr9800-Check-for-supported-Wake-on-LAN-modes.patch b/patches.drivers/sr9800-Check-for-supported-Wake-on-LAN-modes.patch
new file mode 100644
index 0000000000..1e7e0b7522
--- /dev/null
+++ b/patches.drivers/sr9800-Check-for-supported-Wake-on-LAN-modes.patch
@@ -0,0 +1,38 @@
+From c5cb93e994ffb43b7b3b1ff10b9f928f54574a36 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 28 Sep 2018 16:18:53 -0700
+Subject: [PATCH] sr9800: Check for supported Wake-on-LAN modes
+Git-commit: c5cb93e994ffb43b7b3b1ff10b9f928f54574a36
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+The driver currently silently accepts unsupported Wake-on-LAN modes
+(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,
+which is confusing.
+
+Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/usb/sr9800.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
+index 9277a0f228df..35f39f23d881 100644
+--- a/drivers/net/usb/sr9800.c
++++ b/drivers/net/usb/sr9800.c
+@@ -421,6 +421,9 @@ sr_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+ struct usbnet *dev = netdev_priv(net);
+ u8 opt = 0;
+
++ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC))
++ return -EINVAL;
++
+ if (wolinfo->wolopts & WAKE_PHY)
+ opt |= SR_MONITOR_LINK;
+ if (wolinfo->wolopts & WAKE_MAGIC)
+--
+2.18.0
+
diff --git a/patches.drivers/video-goldfishfb-fix-memory-leak-on-driver-remove.patch b/patches.drivers/video-goldfishfb-fix-memory-leak-on-driver-remove.patch
new file mode 100644
index 0000000000..ff5b49aad9
--- /dev/null
+++ b/patches.drivers/video-goldfishfb-fix-memory-leak-on-driver-remove.patch
@@ -0,0 +1,41 @@
+From 5958fde72d04e7b8c6de3669d1f794a90997e3eb Mon Sep 17 00:00:00 2001
+From: Anton Vasilyev <vasilyev@ispras.ru>
+Date: Tue, 24 Jul 2018 19:11:27 +0200
+Subject: [PATCH] video: goldfishfb: fix memory leak on driver remove
+Git-commit: 5958fde72d04e7b8c6de3669d1f794a90997e3eb
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+goldfish_fb_probe() allocates memory for fb, but goldfish_fb_remove() does
+not have deallocation of fb, which leads to memory leak on probe/remove.
+
+The patch adds deallocation into goldfish_fb_remove().
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
+Cc: Aleksandar Markovic <aleksandar.markovic@mips.com>
+Cc: Miodrag Dinic <miodrag.dinic@mips.com>
+Cc: Goran Ferenc <goran.ferenc@mips.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/video/fbdev/goldfishfb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c
+index 3a9e5f1b758e..4377e3442638 100644
+--- a/drivers/video/fbdev/goldfishfb.c
++++ b/drivers/video/fbdev/goldfishfb.c
+@@ -304,6 +304,7 @@ static int goldfish_fb_remove(struct platform_device *pdev)
+ dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base,
+ fb->fb.fix.smem_start);
+ iounmap(fb->reg_base);
++ kfree(fb);
+ return 0;
+ }
+
+--
+2.18.0
+
diff --git a/patches.drivers/wlcore-Add-missing-PM-call-for-wlcore_cmd_wait_for_e.patch b/patches.drivers/wlcore-Add-missing-PM-call-for-wlcore_cmd_wait_for_e.patch
new file mode 100644
index 0000000000..0119cb0ad6
--- /dev/null
+++ b/patches.drivers/wlcore-Add-missing-PM-call-for-wlcore_cmd_wait_for_e.patch
@@ -0,0 +1,59 @@
+From 4ec7cece87b3ed21ffcd407c62fb2f151a366bc1 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Tue, 19 Jun 2018 02:43:35 -0700
+Subject: [PATCH] wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()
+Git-commit: 4ec7cece87b3ed21ffcd407c62fb2f151a366bc1
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Otherwise we can get:
+
+Warning: CPU: 0 PID: 55 at drivers/net/wireless/ti/wlcore/io.h:84
+
+I've only seen this few times with the runtime PM patches enabled
+so this one is probably not needed before that. This seems to
+work currently based on the current PM implementation timer. Let's
+apply this separately though in case others are hitting this issue.
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ti/wlcore/cmd.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
+index 761cf8573a80..f48c3f62966d 100644
+--- a/drivers/net/wireless/ti/wlcore/cmd.c
++++ b/drivers/net/wireless/ti/wlcore/cmd.c
+@@ -35,6 +35,7 @@
+ #include "wl12xx_80211.h"
+ #include "cmd.h"
+ #include "event.h"
++#include "ps.h"
+ #include "tx.h"
+ #include "hw_ops.h"
+
+@@ -191,6 +192,10 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
+
+ timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT);
+
++ ret = wl1271_ps_elp_wakeup(wl);
++ if (ret < 0)
++ return ret;
++
+ do {
+ if (time_after(jiffies, timeout_time)) {
+ wl1271_debug(DEBUG_CMD, "timeout waiting for event %d",
+@@ -222,6 +227,7 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
+ } while (!event);
+
+ out:
++ wl1271_ps_elp_sleep(wl);
+ kfree(events_vector);
+ return ret;
+ }
+--
+2.18.0
+
diff --git a/patches.drivers/xhci-Fix-use-after-free-for-URB-cancellation-on-a-re.patch b/patches.drivers/xhci-Fix-use-after-free-for-URB-cancellation-on-a-re.patch
new file mode 100644
index 0000000000..a8f8bac2e9
--- /dev/null
+++ b/patches.drivers/xhci-Fix-use-after-free-for-URB-cancellation-on-a-re.patch
@@ -0,0 +1,77 @@
+From 4937213ba7fafa13f30496b3965ffe93970d8b53 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 31 Aug 2018 17:24:43 +0300
+Subject: [PATCH] xhci: Fix use after free for URB cancellation on a reallocated endpoint
+Git-commit: 4937213ba7fafa13f30496b3965ffe93970d8b53
+Patch-mainline: v4.19-rc4
+References: bsc#1051510
+
+Make sure the cancelled URB is on the current endpoint ring.
+
+If the endpoint ring has been reallocated since the URB was enqueued
+then the URB may contain TD and TRB pointers to a already freed ring.
+In this the case return the URB without touching any of the freed ring
+structure data.
+
+Don't try to stop the ring. It would be useless.
+
+This can occur if endpoint is not flushed before it is dropped and
+re-added, which is the case in usb_set_interface() as xhci does
+things in an odd order.
+
+Cc: <stable@vger.kernel.org>
+Tested-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/host/xhci.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -47,6 +47,21 @@ static unsigned int quirks;
+ module_param(quirks, uint, S_IRUGO);
+ MODULE_PARM_DESC(quirks, "Bit flags for quirks to be enabled as default");
+
++static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring)
++{
++ struct xhci_segment *seg = ring->first_seg;
++
++ if (!td || !td->start_seg)
++ return false;
++ do {
++ if (seg == td->start_seg)
++ return true;
++ seg = seg->next;
++ } while (seg && seg != ring->first_seg);
++
++ return false;
++}
++
+ /* TODO: copied from ehci-hcd.c - can this be refactored? */
+ /*
+ * xhci_handshake - spin reading hc until handshake completes or fails
+@@ -1511,6 +1526,21 @@ static int xhci_urb_dequeue(struct usb_h
+ goto done;
+ }
+
++ /*
++ * check ring is not re-allocated since URB was enqueued. If it is, then
++ * make sure none of the ring related pointers in this URB private data
++ * are touched, such as td_list, otherwise we overwrite freed data
++ */
++ if (!td_on_ring(&urb_priv->td[0], ep_ring)) {
++ xhci_err(xhci, "Canceled URB td not found on endpoint ring");
++ for (i = urb_priv->num_tds_done; i < urb_priv->num_tds; i++) {
++ td = &urb_priv->td[i];
++ if (!list_empty(&td->cancelled_td_list))
++ list_del_init(&td->cancelled_td_list);
++ }
++ goto err_giveback;
++ }
++
+ if (xhci->xhc_state & XHCI_STATE_HALTED) {
+ xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ "HC halted, freeing TD manually.");
diff --git a/patches.fixes/btrfs-check-integrity-Fix-NULL-pointer-dereference-f.patch b/patches.fixes/btrfs-check-integrity-Fix-NULL-pointer-dereference-f.patch
new file mode 100644
index 0000000000..b684b1c0c8
--- /dev/null
+++ b/patches.fixes/btrfs-check-integrity-Fix-NULL-pointer-dereference-f.patch
@@ -0,0 +1,52 @@
+From 9912bbf6440ba0555e91d3306520da01872c7c1d Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Patch-mainline: v4.19-rc1
+Git-commit: 9912bbf6440ba0555e91d3306520da01872c7c1d
+References: bsc#1107947
+Date: Wed, 20 Jun 2018 15:38:58 +0800
+Subject: [PATCH] btrfs: check-integrity: Fix NULL pointer dereference for
+ degraded mount
+
+Commit f8f84b2dfda5 ("btrfs: index check-integrity state hash by a dev_t")
+changed how btrfsic indexes device state.
+
+Now we need to access device->bdev->bd_dev, while for degraded mount
+it's completely possible to have device->bdev as NULL, thus it will
+trigger a NULL pointer dereference at mount time.
+
+Fix it by checking if the device is degraded before accessing
+device->bdev->bd_dev.
+
+There are a lot of other places accessing device->bdev->bd_dev, however
+the other call sites have either checked device->bdev, or the
+device->bdev is passed from btrfsic_map_block(), so it won't cause harm.
+
+Fixes: f8f84b2dfda5 ("btrfs: index check-integrity state hash by a dev_t")
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/check-integrity.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
+index a3fdb4fe967d..daf45472bef9 100644
+--- a/fs/btrfs/check-integrity.c
++++ b/fs/btrfs/check-integrity.c
+@@ -1539,7 +1539,12 @@ static int btrfsic_map_block(struct btrfsic_state *state, u64 bytenr, u32 len,
+ }
+
+ device = multi->stripes[0].dev;
+- block_ctx_out->dev = btrfsic_dev_state_lookup(device->bdev->bd_dev);
++ if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state) ||
++ !device->bdev || !device->name)
++ block_ctx_out->dev = NULL;
++ else
++ block_ctx_out->dev = btrfsic_dev_state_lookup(
++ device->bdev->bd_dev);
+ block_ctx_out->dev_bytenr = multi->stripes[0].physical;
+ block_ctx_out->start = bytenr;
+ block_ctx_out->len = len;
+--
+2.19.0
+
diff --git a/patches.fixes/btrfs-scrub-Don-t-use-inode-page-cache-in-scrub_hand.patch b/patches.fixes/btrfs-scrub-Don-t-use-inode-page-cache-in-scrub_hand.patch
new file mode 100644
index 0000000000..c0d68e1ba4
--- /dev/null
+++ b/patches.fixes/btrfs-scrub-Don-t-use-inode-page-cache-in-scrub_hand.patch
@@ -0,0 +1,91 @@
+From 665d4953cde6d9e75c62a07ec8f4f8fd7d396ade Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Wed, 11 Jul 2018 13:41:21 +0800
+Patch-mainline: v4.18-rc6
+Git-commit: 665d4953cde6d9e75c62a07ec8f4f8fd7d396ade
+References: follow up for bsc#1108096
+Subject: [PATCH] btrfs: scrub: Don't use inode page cache in
+ scrub_handle_errored_block()
+
+In commit ac0b4145d662 ("btrfs: scrub: Don't use inode pages for device
+replace") we removed the branch of copy_nocow_pages() to avoid
+corruption for compressed nodatasum extents.
+
+However above commit only solves the problem in scrub_extent(), if
+during scrub_pages() we failed to read some pages,
+sctx->no_io_error_seen will be non-zero and we go to fixup function
+scrub_handle_errored_block().
+
+In scrub_handle_errored_block(), for sctx without csum (no matter if
+we're doing replace or scrub) we go to scrub_fixup_nodatasum() routine,
+which does the similar thing with copy_nocow_pages(), but does it
+without the extra check in copy_nocow_pages() routine.
+
+So for test cases like btrfs/100, where we emulate read errors during
+replace/scrub, we could corrupt compressed extent data again.
+
+This patch will fix it just by avoiding any "optimization" for
+nodatasum, just falls back to the normal fixup routine by try read from
+any good copy.
+
+This also solves WARN_ON() or dead lock caused by lame backref iteration
+in scrub_fixup_nodatasum() routine.
+
+The deadlock or WARN_ON() won't be triggered before commit ac0b4145d662
+("btrfs: scrub: Don't use inode pages for device replace") since
+copy_nocow_pages() have better locking and extra check for data extent,
+and it's already doing the fixup work by try to read data from any good
+copy, so it won't go scrub_fixup_nodatasum() anyway.
+
+This patch disables the faulty code and will be removed completely in a
+followup patch.
+
+Fixes: ac0b4145d662 ("btrfs: scrub: Don't use inode pages for device replace")
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/scrub.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index 572306036477..6702896cdb8f 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -1151,11 +1151,6 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
+ return ret;
+ }
+
+- if (sctx->is_dev_replace && !is_metadata && !have_csum) {
+- sblocks_for_recheck = NULL;
+- goto nodatasum_case;
+- }
+-
+ /*
+ * read all mirrors one after the other. This includes to
+ * re-read the extent or metadata block that failed (that was
+@@ -1268,13 +1263,19 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check)
+ goto out;
+ }
+
+- if (!is_metadata && !have_csum) {
++ /*
++ * NOTE: Even for nodatasum case, it's still possible that it's a
++ * compressed data extent, thus scrub_fixup_nodatasum(), which write
++ * inode page cache onto disk, could cause serious data corruption.
++ *
++ * So here we could only read from disk, and hope our recovery could
++ * reach disk before the newer write.
++ */
++ if (0 && !is_metadata && !have_csum) {
+ struct scrub_fixup_nodatasum *fixup_nodatasum;
+
+ WARN_ON(sctx->is_dev_replace);
+
+-nodatasum_case:
+-
+ /*
+ * !is_metadata and !have_csum, this means that the data
+ * might not be COWed, that it might be modified
+--
+2.19.0
+
diff --git a/patches.fixes/btrfs-scrub-Don-t-use-inode-pages-for-device-replace.patch b/patches.fixes/btrfs-scrub-Don-t-use-inode-pages-for-device-replace.patch
new file mode 100644
index 0000000000..6167f87fca
--- /dev/null
+++ b/patches.fixes/btrfs-scrub-Don-t-use-inode-pages-for-device-replace.patch
@@ -0,0 +1,69 @@
+From ac0b4145d662a3b9e34085dea460fb06ede9b69b Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Tue, 5 Jun 2018 12:36:56 +0800
+Patch-mainline: v4.18-rc1
+Git-commit: ac0b4145d662a3b9e34085dea460fb06ede9b69b
+References: follow up for bsc#1108096
+Subject: [PATCH] btrfs: scrub: Don't use inode pages for device replace
+
+[BUG]
+Btrfs can create compressed extent without checksum (even though it
+shouldn't), and if we then try to replace device containing such extent,
+the result device will contain all the uncompressed data instead of the
+compressed one.
+
+Test case already submitted to fstests:
+https://patchwork.kernel.org/patch/10442353/
+
+[CAUSE]
+When handling compressed extent without checksum, device replace will
+goe into copy_nocow_pages() function.
+
+In that function, btrfs will get all inodes referring to this data
+extents and then use find_or_create_page() to get pages direct from that
+inode.
+
+The problem here is, pages directly from inode are always uncompressed.
+And for compressed data extent, they mismatch with on-disk data.
+Thus this leads to corrupted compressed data extent written to replace
+device.
+
+[FIX]
+In this attempt, we could just remove the "optimization" branch, and let
+unified scrub_pages() to handle it.
+
+Although scrub_pages() won't bother reusing page cache, it will be a
+little slower, but it does the correct csum checking and won't cause
+such data corruption caused by "optimization".
+
+Note about the fix: this is the minimal fix that can be backported to
+older stable trees without conflicts. The whole callchain from
+copy_nocow_pages() can be deleted, and will be in followup patches.
+
+Fixes: ff023aac3119 ("Btrfs: add code to scrub to copy read data to another disk")
+CC: stable@vger.kernel.org # 4.4+
+Reported-by: James Harvey <jamespharvey20@gmail.com>
+Reviewed-by: James Harvey <jamespharvey20@gmail.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+[ remove code removal, add note why ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/scrub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index a59005862010..572306036477 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -2799,7 +2799,7 @@ static int scrub_extent(struct scrub_ctx *sctx, struct map_lookup *map,
+ have_csum = scrub_find_csum(sctx, logical, csum);
+ if (have_csum == 0)
+ ++sctx->stat.no_csum;
+- if (sctx->is_dev_replace && !have_csum) {
++ if (0 && sctx->is_dev_replace && !have_csum) {
+ ret = copy_nocow_pages(sctx, logical, l,
+ mirror_num,
+ physical_for_dev_replace);
+--
+2.19.0
+
diff --git a/patches.fixes/x86-memory_failure-Introduce-set-clear-_mce_nospec.patch b/patches.fixes/x86-memory_failure-Introduce-set-clear-_mce_nospec.patch
index 57939b93a6..45f15180f6 100644
--- a/patches.fixes/x86-memory_failure-Introduce-set-clear-_mce_nospec.patch
+++ b/patches.fixes/x86-memory_failure-Introduce-set-clear-_mce_nospec.patch
@@ -35,12 +35,34 @@ Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Acked-by: Jan Kara <jack@suse.cz>
---
+ arch/arm/include/asm/set_memory.h | 3 +
+ arch/s390/include/asm/set_memory.h | 3 +
arch/x86/include/asm/set_memory.h | 44 +++++++++++++++++++++++++++
arch/x86/kernel/cpu/mcheck/mce-internal.h | 15 ---------
arch/x86/kernel/cpu/mcheck/mce.c | 48 +-----------------------------
include/asm-generic/set_memory.h | 4 ++
- 4 files changed, 50 insertions(+), 61 deletions(-)
+ 6 files changed, 56 insertions(+), 61 deletions(-)
+--- a/arch/arm/include/asm/set_memory.h
++++ b/arch/arm/include/asm/set_memory.h
+@@ -29,4 +29,7 @@ static inline void set_kernel_text_rw(vo
+ static inline void set_kernel_text_ro(void) { }
+ #endif
+
++#define set_mce_nospec(pfn) (0)
++#define clear_mce_nospec(pfn) (0)
++
+ #endif
+--- a/arch/s390/include/asm/set_memory.h
++++ b/arch/s390/include/asm/set_memory.h
+@@ -28,4 +28,7 @@ static inline int set_memory_x(unsigned
+ return __set_memory(addr, numpages, SET_MEMORY_X);
+ }
+
++#define set_mce_nospec(pfn) (0)
++#define clear_mce_nospec(pfn) (0)
++
+ #endif
--- a/arch/x86/include/asm/set_memory.h
+++ b/arch/x86/include/asm/set_memory.h
@@ -87,4 +87,48 @@ extern int kernel_set_to_readonly;
diff --git a/patches.suse/btrfs-tests-qgroup-Fix-wrong-tree-backref-level.patch b/patches.suse/btrfs-tests-qgroup-Fix-wrong-tree-backref-level.patch
new file mode 100644
index 0000000000..19b606b20f
--- /dev/null
+++ b/patches.suse/btrfs-tests-qgroup-Fix-wrong-tree-backref-level.patch
@@ -0,0 +1,54 @@
+From 3c0efdf03b2d127f0e40e30db4e7aa0429b1b79a Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Tue, 27 Mar 2018 20:44:18 +0800
+Patch-mainline: v4.17-rc1
+Git-commit: 3c0efdf03b2d127f0e40e30db4e7aa0429b1b79a
+References: bsc#1107928
+Subject: [PATCH] btrfs: tests/qgroup: Fix wrong tree backref level
+
+The extent tree of the test fs is like the following:
+
+ BTRFS info (device (null)): leaf 16327509003777336587 total ptrs 1 free space 3919
+ item 0 key (4096 168 4096) itemoff 3944 itemsize 51
+ extent refs 1 gen 1 flags 2
+ tree block key (68719476736 0 0) level 1
+ ^^^^^^^
+ ref#0: tree block backref root 5
+
+And it's using an empty tree for fs tree, so there is no way that its
+level can be 1.
+
+For REAL (created by mkfs) fs tree backref with no skinny metadata, the
+result should look like:
+
+ item 3 key (30408704 EXTENT_ITEM 4096) itemoff 3845 itemsize 51
+ refs 1 gen 4 flags TREE_BLOCK
+ tree block key (256 INODE_ITEM 0) level 0
+ ^^^^^^^
+ tree block backref root 5
+
+Fix the level to 0, so it won't break later tree level checker.
+
+Fixes: faa2dbf004e8 ("Btrfs: add sanity tests for new qgroup accounting code")
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/tests/qgroup-tests.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c
+index 90204b166643..160eb2fba726 100644
+--- a/fs/btrfs/tests/qgroup-tests.c
++++ b/fs/btrfs/tests/qgroup-tests.c
+@@ -63,7 +63,7 @@ static int insert_normal_tree_ref(struct btrfs_root *root, u64 bytenr,
+ btrfs_set_extent_generation(leaf, item, 1);
+ btrfs_set_extent_flags(leaf, item, BTRFS_EXTENT_FLAG_TREE_BLOCK);
+ block_info = (struct btrfs_tree_block_info *)(item + 1);
+- btrfs_set_tree_block_level(leaf, block_info, 1);
++ btrfs_set_tree_block_level(leaf, block_info, 0);
+ iref = (struct btrfs_extent_inline_ref *)(block_info + 1);
+ if (parent > 0) {
+ btrfs_set_extent_inline_ref_type(leaf, iref,
+--
+2.19.0
+
diff --git a/series.conf b/series.conf
index 41d005288a..d090abba9f 100644
--- a/series.conf
+++ b/series.conf
@@ -6191,6 +6191,8 @@
patches.drivers/ASoC-mediatek-Fix-an-error-checking-code
patches.drivers/ASoC-rsnd-move-rsnd_ssi_config_init-execute-conditio.patch
patches.drivers/ASoC-rockchip-Correct-dmic-delay-property-name
+ patches.drivers/ASoC-rt5514-Add-the-I2S-ASRC-support.patch
+ patches.drivers/ASoC-rt5514-Eliminate-the-noise-in-the-ASRC-case.patch
patches.drivers/ASoC-samsung-Fix-possible-double-iounmap-on-s3c24xx-
patches.drivers/ASoC-samsung-odroid-Drop-requirement-of-clocks-in-th
patches.drivers/ALSA-hda-Fix-forget-to-free-resource-in-error-handli
@@ -15107,6 +15109,7 @@
patches.drivers/ASoC-rsnd-mark-PM-functions-__maybe_unused
patches.drivers/ASoC-topology-fix-some-tiny-memory-leaks
patches.drivers/ASoC-adau17x1-Handling-of-DSP_RUN-register-during-fw
+ patches.drivers/ASoC-rt5514-Add-the-missing-register-in-the-readable.patch
patches.drivers/ASoC-topology-Fix-bugs-of-freeing-soc-topology
patches.drivers/ASoC-topology-Check-widget-kcontrols-before-deref
patches.drivers/ALSA-hda-Skip-jack-and-others-for-non-existing-PCM-s
@@ -16942,8 +16945,14 @@
patches.drivers/ALSA-hda-Turn-CX8200-into-D3-as-well-upon-reboot
patches.drivers/ALSA-hda-Sleep-for-10ms-after-entering-D3-on-Conexan
patches.drivers/ALSA-hda-Correct-Asrock-B85M-ITX-power_save-blacklis
+ patches.drivers/ALSA-hda-Add-AZX_DCAPS_PM_RUNTIME-for-AMD-Raven-Ridg.patch
patches.drivers/ALSA-snd-aoa-add-of_node_put-in-error-path
+ patches.drivers/ALSA-pcm-Fix-snd_interval_refine-first-last-with-ope.patch
+ patches.drivers/ALSA-usb-audio-Fix-multiple-definitions-in-AU0828_DE.patch
+ patches.drivers/ALSA-msnd-Fix-the-default-sample-sizes.patch
+ patches.drivers/ASoC-dapm-Fix-potential-DAI-widget-pointer-deref-whe.patch
patches.drivers/ASoC-dpcm-don-t-merge-format-from-invalid-codec-dai
+ patches.drivers/ASoC-rt5514-Fix-the-issue-of-the-delay-volume-applie.patch
patches.drivers/ASoC-es7134-remove-64kHz-rate-from-the-supported-rat
patches.drivers/ASoC-rsnd-cmd-Add-missing-newline-to-debug-message
patches.drivers/ASoC-zte-Fix-incorrect-PCM-format-bit-usages
@@ -16979,9 +16988,11 @@
patches.drivers/net-hns3-Standardize-the-handle-of-return-value.patch
patches.fixes/xen-netfront-fix-queue-name-setting.patch
patches.fixes/wan-fsl_ucc_hdlc-use-IS_ERR_VALUE-to-check-return-va.patch
+ patches.drivers/wlcore-Add-missing-PM-call-for-wlcore_cmd_wait_for_e.patch
patches.drivers/brcmsmac-fix-wrap-around-in-conversion-from-constant
patches.drivers/rndis_wlan-potential-buffer-overflow-in-rndis_wlan_a
patches.drivers/libertas-fix-suspend-and-resume-for-SDIO-connected-c
+ patches.drivers/mac80211-restrict-delayed-tailroom-needed-decrement.patch
patches.drivers/ixgbe-Reorder-Tx-Rx-shutdown-to-reduce-time-needed-t.patch
patches.drivers/ixgbe-Refactor-queue-disable-logic-to-take-completio.patch
patches.suse/net-ethernet-mvneta-Fix-napi-structure-mixup-on-arma.patch
@@ -16994,7 +17005,9 @@
patches.drivers/net-hns3-Fix-MSIX-allocation-issue-for-VF.patch
patches.fixes/ip-discard-IPv4-datagrams-with-overlapping-segments.patch
patches.fixes/ipv6-defrag-drop-non-last-frags-smaller-than-min-mtu.patch
+ patches.drivers/Bluetooth-Add-a-new-Realtek-8723DE-ID-0bda-b009.patch
patches.drivers/Bluetooth-avoid-killing-an-already-killed-socket
+ patches.drivers/Bluetooth-Use-lock_sock_nested-in-bt_accept_enqueue.patch
patches.drivers/Bluetooth-hidp-Fix-handling-of-strncpy-for-hid-name-.patch
patches.drivers/Bluetooth-hidp-buffer-overflow-in-hidp_process_repor
patches.drivers/Bluetooth-h5-Fix-missing-dependency-on-BT_HCIUART_SE.patch
@@ -17022,8 +17035,10 @@
patches.suse/msft-hv-1749-hv-netvsc-Fix-NULL-dereference-at-single-queue-mode-.patch
patches.drivers/crypto-vmac-require-a-block-cipher-with-128-bit-bloc
patches.drivers/crypto-vmac-separate-tfm-and-request-context
+ patches.drivers/crypto-skcipher-Fix-Wstringop-truncation-warnings.patch
patches.drivers/crypto-x86-sha256-mb-fix-digest-copy-in-sha256_mb_mg
patches.drivers/crypto-ccp-Fix-command-completion-detection-race
+ patches.drivers/crypto-sharah-Unregister-correct-algorithms-for-SAHA.patch
patches.drivers/crypto-skcipher-fix-aligning-block-size-in-skcipher_
patches.drivers/crypto-skcipher-fix-crash-flushing-dcache-in-error-p
patches.drivers/crypto-blkcipher-fix-crash-flushing-dcache-in-error-
@@ -17036,6 +17051,7 @@
patches.drivers/drm-i915-aml-Introducing-Amber-Lake-platform
patches.drivers/drm-panel-type-promotion-bug-in-s6e8aa0_read_mtp_id
patches.drivers/drm-i915-Nuke-the-LVDS-lid-notifier
+ patches.drivers/gpu-ipu-v3-csi-pass-back-mbus_code_to_bus_cfg-error-.patch
patches.drivers/drm-amdgpu-Fix-RLC-safe-mode-test-in-gfx_v9_0_enter_.patch
patches.drivers/udl-kms-change-down_interruptible-to-down
patches.drivers/udl-kms-handle-allocation-failure
@@ -17054,6 +17070,8 @@
patches.drivers/EDAC-Fix-memleak-in-module-init-error-path.patch
patches.drivers/EDAC-i7core-Fix-memleaks-and-use-after-free-on-probe.patch
patches.drivers/gpio-Fix-wrong-rounding-in-gpio-menz127
+ patches.drivers/gpiolib-Mark-gpio_suffixes-array-with-__maybe_unused.patch
+ patches.drivers/gpio-pxa-Fix-potential-NULL-dereference.patch
patches.drivers/gpio-ml-ioh-Fix-buffer-underwrite-on-probe-error-pat.patch
patches.drivers/clk-meson-gxbb-remove-HHI_GEN_CLK_CTNL-duplicate-def
patches.drivers/clk-rockchip-fix-clk_i2sout-parent-selection-bits-on
@@ -17237,10 +17255,15 @@
patches.suse/msft-hv-1721-Drivers-hv-vmbus-Fix-the-offer_in_progress-in-vmbus_.patch
patches.suse/msft-hv-1724-Tools-hv-vss-fix-loop-device-detection.patch
patches.fixes/vmci-type-promotion-bug-in-qp_host_get_user_memory.patch
+ patches.drivers/mei-bus-type-promotion-bug-in-mei_nfc_if_version.patch
patches.drivers/mei-don-t-update-offset-in-write
+ patches.drivers/coresight-Handle-errors-in-finding-input-output-port.patch
patches.drivers/coresight-tpiu-Fix-disabling-timeouts.patch
+ patches.drivers/parport-sunbpp-fix-error-return-code.patch
patches.drivers/extcon-Release-locking-when-sending-the-notification
patches.drivers/uio-potential-double-frees-if-__uio_register_device-
+ patches.drivers/mmc-sdhci-of-esdhc-set-proper-dma-mask-for-ls104x-ch.patch
+ patches.drivers/mmc-sdhci-do-not-try-to-use-3.3V-signaling-if-not-su.patch
patches.drivers/mmc-tegra-prevent-HS200-on-Tegra-3
patches.drivers/dmaengine-hsu-Support-dmaengine_terminate_sync
patches.drivers/dmaengine-idma64-Support-dmaengine_terminate_sync
@@ -17254,7 +17277,9 @@
patches.drivers/EDAC-Add-missing-MEM_LRDDR4-entry-in-edac_mem_types.patch
patches.drivers/mfd-intel-lpss-Add-Ice-Lake-PCI-IDs.patch
patches.drivers/mfd-arizona-Don-t-use-regmap_read_poll_timeout
+ patches.drivers/mfd-ti_am335x_tscadc-Fix-struct-clk-memory-leak.patch
patches.drivers/mfd-sm501-Set-coherent_dma_mask-when-creating-subdev
+ patches.drivers/HID-hid-ntrig-add-error-handling-for-sysfs_create_gr.patch
patches.suse/livepatch-validate-module-old-func-name-length.patch
patches.suse/livepatch-remove-reliable-stacktrace-check-in-klp_try_switch_task.patch
patches.fixes/ceph-fix-incorrect-use-of-strncpy.patch
@@ -17270,6 +17295,8 @@
patches.fixes/uprobes-Use-synchronize_rcu-not-synchronize_sched.patch
patches.drivers/i2c-i801-Consolidate-chipset-names-in-documentation-.patch
patches.drivers/i2c-i801-Add-support-for-Intel-Ice-Lake.patch
+ patches.drivers/input-rohm_bu21023-switch-to-i2c_lock_bus-.-I2C_LOCK.patch
+ patches.drivers/mfd-88pm860x-i2c-switch-to-i2c_lock_bus-.-I2C_LOCK_S.patch
patches.drivers/i2c-imx-Fix-race-condition-in-dma-read
patches.drivers/i2c-core-ACPI-Properly-set-status-byte-to-0-for-mult.patch
patches.drivers/power-remove-possible-deadlock-when-unregistering-po
@@ -17293,12 +17320,16 @@
patches.arch/kvm-x86-svm-call-x86_spec_ctrl_set_guest-host-with-interrupts-disabled.patch
patches.drivers/platform-x86-ideapad-laptop-Apply-no_hw_rfkill-to-Y2
patches.drivers/platform-x86-thinkpad_acpi-Proper-model-release-matc
+ patches.drivers/platform-x86-toshiba_acpi-Fix-defined-but-not-used-b.patch
patches.drivers/platform-x86-asus-nb-wmi-Add-keymap-entry-for-lid-fl.patch
patches.arch/ARM-hisi-fix-error-handling-and-missing-of_node_put.patch
patches.arch/ARM-hisi-handle-of_iomap-and-fix-missing-of_node_put.patch
patches.arch/ARM-imx-flag-failure-of-of_iomap.patch
patches.drivers/IB-hfi1-Invalid-NUMA-node-information-can-cause-a-di.patch
+ patches.drivers/fbdev-Distinguish-between-interlaced-and-progressive.patch
patches.drivers/video-fbdev-pxafb-clear-allocated-memory-for-video-m
+ patches.drivers/video-goldfishfb-fix-memory-leak-on-driver-remove.patch
+ patches.drivers/fbdev-via-fix-defined-but-not-used-warning.patch
patches.drivers/fbdev-omapfb-off-by-one-in-omapfb_register_client
patches.drivers/fb-fix-lost-console-when-the-user-unplugs-a-USB-adap.patch
patches.drivers/udlfb-set-optimal-write-delay.patch
@@ -17361,6 +17392,7 @@
patches.fixes/nvme-pci-add-a-memory-barrier-to-nvme_dbbuf_update_a.patch
patches.drivers/PM-clk-signedness-bug-in-of_pm_clk_add_clks
patches.drivers/drm-i915-Increase-LSPCON-timeout
+ patches.drivers/i2c-i801-Allow-ACPI-AML-access-I-O-ports-not-reserve.patch
patches.suse/watchdog-Mark-watchdog-touch-functions-as-notrace.patch
patches.arch/x86-spectre-add-missing-family-6-check-to-microcode-check.patch
patches.arch/x86-entry-64-wipe-kasan-stack-shadow-before-rewind_stack_do_exit
@@ -17413,6 +17445,8 @@
patches.drivers/pstore-Fix-incorrect-persistent-ram-buffer-mapping.patch
patches.drivers/drm-i915-gvt-Fix-the-incorrect-length-of-child_devic.patch
patches.drivers/drm-i915-overlay-Allocate-physical-registers-from-st.patch
+ patches.drivers/mei-ignore-not-found-client-in-the-enumeration.patch
+ patches.drivers/xhci-Fix-use-after-free-for-URB-cancellation-on-a-re.patch
patches.drivers/usb-Don-t-die-twice-if-PCI-xhci-host-is-not-respondi.patch
patches.drivers/USB-serial-io_ti-fix-array-underflow-in-completion-h.patch
patches.drivers/USB-serial-ti_usb_3410_5052-fix-array-underflow-in-c.patch
@@ -17424,28 +17458,47 @@
patches.fixes/xen-netfront-dont-bug-in-case-of-too-many-frags.patch
patches.suse/net-rtnl_configure_link-fix-dev-flags-changes-arg-to.patch
patches.drivers/bnxt_en-Fix-VF-mac-address-regression.patch
+ patches.drivers/platform-x86-alienware-wmi-Correct-a-memory-leak.patch
+ patches.drivers/ALSA-bebob-use-address-returned-by-kmalloc-instead-o.patch
patches.drivers/ALSA-fireface-fix-memory-leak-in-ff400_switch_fetchi.patch
+ patches.drivers/ALSA-emu10k1-fix-possible-info-leak-to-userspace-on-.patch
patches.drivers/ALSA-firewire-digi00x-fix-memory-leak-of-private-dat.patch
patches.drivers/ALSA-firewire-tascam-fix-memory-leak-of-private-data.patch
patches.drivers/ALSA-oxfw-fix-memory-leak-of-private-data.patch
+ patches.drivers/ALSA-bebob-fix-memory-leak-for-M-Audio-FW1814-and-Pr.patch
patches.drivers/ALSA-oxfw-fix-memory-leak-for-model-dependent-data-a.patch
patches.drivers/ALSA-oxfw-fix-memory-leak-of-discovered-stream-forma.patch
+ patches.drivers/ALSA-fireworks-fix-memory-leak-of-response-buffer-at.patch
patches.drivers/ASoC-rsnd-fixup-not-to-call-clk_get-set-under-non-at.patch
+ patches.drivers/ASoC-cs4265-fix-MMTLR-Data-switch-control.patch
patches.drivers/drm-vc4-Fix-the-no-scaling-case-on-multi-planar-YUV-.patch
patches.drivers/drm-i915-gvt-request-srcu_read_lock-before-checking-.patch
patches.drivers/drm-i915-gvt-clear-ggtt-entries-when-destroy-vgpu.patch
patches.arch/x86-mm-expand-static-page-table-for-fixmap-space
+ patches.drivers/NFC-Fix-possible-memory-corruption-when-handling-SHD.patch
+ patches.drivers/intel_th-Fix-device-removal-logic.patch
patches.drivers/scsi-target-iscsi-use-hex2bin-instead-of-a-re-implementation
patches.drivers/scsi-target-iscsi-use-bin2hex-instead-of-a-re-implementation
patches.drivers/scsi-ipr-System-hung-while-dlpar-adding-primary-ipr-.patch
patches.fixes/device-dax-Add-missing-address_space_operations.patch
patches.drivers/iommu-amd-return-devid-as-alias-for-acpi-hid-devices
+ patches.drivers/pinctrl-cannonlake-Fix-HOSTSW_OWN-register-offset-of.patch
patches.arch/powerpc-Avoid-code-patching-freed-init-sections.patch
patches.arch/powerpc-pkeys-Fix-reading-of-ibm-processor-storage-k.patch
patches.arch/powerpc-tm-Fix-userspace-r13-corruption.patch
patches.arch/powerpc-tm-Avoid-possible-userspace-r1-corruption-on.patch
patches.arch/powerpc-numa-Use-associativity-if-VPHN-hcall-is-succ.patch
+ patches.drivers/regulator-fix-crash-caused-by-null-driver-data.patch
+ patches.drivers/Input-elantech-enable-middle-button-of-touchpad-on-T.patch
patches.arch/x86-boot-fix-kexec-booting-failure-in-the-sev-bit-detection-code.patch
+ patches.drivers/cfg80211-reg-Init-wiphy_idx-in-regulatory_hint_core.patch
+ patches.drivers/mac80211-fix-pending-queue-hang-due-to-TX_DROP.patch
+ patches.drivers/ax88179_178a-Check-for-supported-Wake-on-LAN-modes.patch
+ patches.drivers/lan78xx-Check-for-supported-Wake-on-LAN-modes.patch
+ patches.drivers/sr9800-Check-for-supported-Wake-on-LAN-modes.patch
+ patches.drivers/r8152-Check-for-supported-Wake-on-LAN-Modes.patch
+ patches.drivers/smsc75xx-Check-for-Wake-on-LAN-modes.patch
+ patches.drivers/smsc95xx-Check-for-Wake-on-LAN-modes.patch
# jejb/scsi for-next
patches.drivers/scsi-qla2xxx-Fix-process-response-queue-for-ISP26XX-.patch
@@ -17823,6 +17876,10 @@
patches.suse/reiserfs-mark-read-write-mode-unsupported.patch
patches.fixes/get_fs_type-Validate-fs-type-string-argument.patch
patches.fixes/btrfs-fix-error-handling-in-btrfs_dev_replace_start.patch
+ patches.suse/btrfs-tests-qgroup-Fix-wrong-tree-backref-level.patch
+ patches.fixes/btrfs-check-integrity-Fix-NULL-pointer-dereference-f.patch
+ patches.fixes/btrfs-scrub-Don-t-use-inode-pages-for-device-replace.patch
+ patches.fixes/btrfs-scrub-Don-t-use-inode-page-cache-in-scrub_hand.patch
patches.suse/0001-btrfs-Refactor-check_leaf-function-for-later-expansi.patch
patches.suse/0002-btrfs-Check-if-item-pointer-overlaps-with-the-item-i.patch