kernel: bump 4.19 to 4.19.90

Refreshed all patches.

Remove upstreamed:
- 010-dmaengine-dw-dmac-implement-dma-prot.patch
- 950-0148-Increase-firmware-call-buffer-size-to-48-bytes.patch
- 950-0206-Mailbox-firmware-calls-now-use-kmalloc-2749.patch
- 402-leds-trigger-netdev-fix-handling-on-interface-rename.patch

Fixes:
- CVE-2019-19332

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
[Add 010-dt-bindings-dmaengine-dw-dmac-add-protection-control.patch]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

18 files changed, 44 insertions, 161 deletions

diff --git a/target/linux/brcm2708/patches-4.19/950-0034-amba_pl011-Don-t-use-DT-aliases-for-numbering.patch b/target/linux/brcm2708/patches-4.19/950-0034-amba_pl011-Don-t-use-DT-aliases-for-numbering.patch
index 8b70d80e15..61ab7095fb 100644
--- a/target/linux/brcm2708/patches-4.19/950-0034-amba_pl011-Don-t-use-DT-aliases-for-numbering.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0034-amba_pl011-Don-t-use-DT-aliases-for-numbering.patch
@@ -14,7 +14,7 @@ use the same logic.
 
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -2578,7 +2578,12 @@ static int pl011_setup_port(struct devic
+@@ -2576,7 +2576,12 @@ static int pl011_setup_port(struct devic
  	if (IS_ERR(base))
  		return PTR_ERR(base);
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0035-amba_pl011-Round-input-clock-up.patch b/target/linux/brcm2708/patches-4.19/950-0035-amba_pl011-Round-input-clock-up.patch
index 82ef72b280..d5e9f3174c 100644
--- a/target/linux/brcm2708/patches-4.19/950-0035-amba_pl011-Round-input-clock-up.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0035-amba_pl011-Round-input-clock-up.patch
@@ -26,7 +26,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -1652,6 +1652,23 @@ static void pl011_put_poll_char(struct u
+@@ -1650,6 +1650,23 @@ static void pl011_put_poll_char(struct u
  
  #endif /* CONFIG_CONSOLE_POLL */
  
@@ -50,7 +50,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  static int pl011_hwinit(struct uart_port *port)
  {
  	struct uart_amba_port *uap =
-@@ -1668,7 +1685,7 @@ static int pl011_hwinit(struct uart_port
+@@ -1666,7 +1683,7 @@ static int pl011_hwinit(struct uart_port
  	if (retval)
  		return retval;
  
@@ -59,7 +59,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  	/* Clear pending error and receive interrupts */
  	pl011_write(UART011_OEIS | UART011_BEIS | UART011_PEIS |
-@@ -2324,7 +2341,7 @@ static int __init pl011_console_setup(st
+@@ -2322,7 +2339,7 @@ static int __init pl011_console_setup(st
  			plat->init();
  	}
  
@@ -68,7 +68,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  	if (uap->vendor->fixed_options) {
  		baud = uap->fixed_baud;
-@@ -2509,6 +2526,7 @@ static struct uart_driver amba_reg = {
+@@ -2507,6 +2524,7 @@ static struct uart_driver amba_reg = {
  	.cons			= AMBA_CONSOLE,
  };
  
@@ -76,7 +76,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  static int pl011_probe_dt_alias(int index, struct device *dev)
  {
  	struct device_node *np;
-@@ -2540,6 +2558,7 @@ static int pl011_probe_dt_alias(int inde
+@@ -2538,6 +2556,7 @@ static int pl011_probe_dt_alias(int inde
  
  	return ret;
  }
diff --git a/target/linux/brcm2708/patches-4.19/950-0036-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch b/target/linux/brcm2708/patches-4.19/950-0036-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch
index 7fdedd2bff..eef29187ae 100644
--- a/target/linux/brcm2708/patches-4.19/950-0036-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0036-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch
@@ -17,7 +17,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -1385,6 +1385,7 @@ static bool pl011_tx_char(struct uart_am
+@@ -1383,6 +1383,7 @@ static bool pl011_tx_char(struct uart_am
  		return false; /* unable to transmit character */
  
  	pl011_write(c, uap, REG_DR);
diff --git a/target/linux/brcm2708/patches-4.19/950-0037-amba_pl011-Add-cts-event-workaround-DT-property.patch b/target/linux/brcm2708/patches-4.19/950-0037-amba_pl011-Add-cts-event-workaround-DT-property.patch
index c23f6dd6c3..e5a3c39b3f 100644
--- a/target/linux/brcm2708/patches-4.19/950-0037-amba_pl011-Add-cts-event-workaround-DT-property.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0037-amba_pl011-Add-cts-event-workaround-DT-property.patch
@@ -33,7 +33,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -2661,6 +2661,11 @@ static int pl011_probe(struct amba_devic
+@@ -2659,6 +2659,11 @@ static int pl011_probe(struct amba_devic
  	if (IS_ERR(uap->clk))
  		return PTR_ERR(uap->clk);
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0055-firmware-bcm2835-Support-ARCH_BCM270x.patch b/target/linux/brcm2708/patches-4.19/950-0055-firmware-bcm2835-Support-ARCH_BCM270x.patch
index 3cba92983b..a47be248a2 100644
--- a/target/linux/brcm2708/patches-4.19/950-0055-firmware-bcm2835-Support-ARCH_BCM270x.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0055-firmware-bcm2835-Support-ARCH_BCM270x.patch
@@ -27,7 +27,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
 
 --- a/drivers/firmware/raspberrypi.c
 +++ b/drivers/firmware/raspberrypi.c
-@@ -32,6 +32,8 @@ struct rpi_firmware {
+@@ -31,6 +31,8 @@ struct rpi_firmware {
  	u32 enabled;
  };
  
@@ -36,7 +36,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
  static DEFINE_MUTEX(transaction_lock);
  
  static void response_callback(struct mbox_client *cl, void *msg)
-@@ -229,6 +231,7 @@ static int rpi_firmware_probe(struct pla
+@@ -230,6 +232,7 @@ static int rpi_firmware_probe(struct pla
  	init_completion(&fw->c);
  
  	platform_set_drvdata(pdev, fw);
@@ -44,7 +44,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
  
  	rpi_firmware_print_firmware_revision(fw);
  	rpi_register_hwmon_driver(dev, fw);
-@@ -243,6 +246,7 @@ static int rpi_firmware_remove(struct pl
+@@ -244,6 +247,7 @@ static int rpi_firmware_remove(struct pl
  	platform_device_unregister(rpi_hwmon);
  	rpi_hwmon = NULL;
  	mbox_free_channel(fw->chan);
@@ -52,7 +52,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
  
  	return 0;
  }
-@@ -255,7 +259,7 @@ static int rpi_firmware_remove(struct pl
+@@ -256,7 +260,7 @@ static int rpi_firmware_remove(struct pl
   */
  struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
  {
@@ -61,7 +61,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
  
  	if (!pdev)
  		return NULL;
-@@ -278,7 +282,18 @@ static struct platform_driver rpi_firmwa
+@@ -279,7 +283,18 @@ static struct platform_driver rpi_firmwa
  	.probe		= rpi_firmware_probe,
  	.remove		= rpi_firmware_remove,
  };
diff --git a/target/linux/brcm2708/patches-4.19/950-0057-BCM2708-Add-core-Device-Tree-support.patch b/target/linux/brcm2708/patches-4.19/950-0057-BCM2708-Add-core-Device-Tree-support.patch
index fd251d6f8f..f2ad9710fd 100644
--- a/target/linux/brcm2708/patches-4.19/950-0057-BCM2708-Add-core-Device-Tree-support.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0057-BCM2708-Add-core-Device-Tree-support.patch
@@ -15890,7 +15890,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	-Wno-avoid_unnecessary_addr_size \
  	-Wno-alias_paths \
  	-Wno-graph_child_address \
-@@ -292,6 +293,18 @@ cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \
+@@ -293,6 +294,18 @@ cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \
  $(obj)/%.dtb: $(src)/%.dts $(DTC) FORCE
  	$(call if_changed_dep,dtc)
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0062-Improve-__copy_to_user-and-__copy_from_user-performa.patch b/target/linux/brcm2708/patches-4.19/950-0062-Improve-__copy_to_user-and-__copy_from_user-performa.patch
index 0c3634d0c8..4335ff9560 100644
--- a/target/linux/brcm2708/patches-4.19/950-0062-Improve-__copy_to_user-and-__copy_from_user-performa.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0062-Improve-__copy_to_user-and-__copy_from_user-performa.patch
@@ -56,7 +56,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  #endif
 --- a/arch/arm/include/asm/uaccess.h
 +++ b/arch/arm/include/asm/uaccess.h
-@@ -496,6 +496,9 @@ do {									\
+@@ -514,6 +514,9 @@ do {									\
  extern unsigned long __must_check
  arm_copy_from_user(void *to, const void __user *from, unsigned long n);
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0110-raspberrypi-firmware-Export-the-general-transaction-.patch b/target/linux/brcm2708/patches-4.19/950-0110-raspberrypi-firmware-Export-the-general-transaction-.patch
index 9f5405334d..945ba536eb 100644
--- a/target/linux/brcm2708/patches-4.19/950-0110-raspberrypi-firmware-Export-the-general-transaction-.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0110-raspberrypi-firmware-Export-the-general-transaction-.patch
@@ -13,7 +13,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
 
 --- a/drivers/firmware/raspberrypi.c
 +++ b/drivers/firmware/raspberrypi.c
-@@ -46,7 +46,7 @@ static void response_callback(struct mbo
+@@ -45,7 +45,7 @@ static void response_callback(struct mbo
   * Sends a request to the firmware through the BCM2835 mailbox driver,
   * and synchronously waits for the reply.
   */
@@ -22,7 +22,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
  rpi_firmware_transaction(struct rpi_firmware *fw, u32 chan, u32 data)
  {
  	u32 message = MBOX_MSG(chan, data);
-@@ -67,6 +67,7 @@ rpi_firmware_transaction(struct rpi_firm
+@@ -66,6 +66,7 @@ rpi_firmware_transaction(struct rpi_firm
  
  	return ret;
  }
diff --git a/target/linux/brcm2708/patches-4.19/950-0131-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch b/target/linux/brcm2708/patches-4.19/950-0131-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch
index 34d2a8a241..ffe679fcf2 100644
--- a/target/linux/brcm2708/patches-4.19/950-0131-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0131-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch
@@ -18,10 +18,10 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  #include <linux/of_platform.h>
  #include <linux/platform_device.h>
 +#include <linux/reboot.h>
+ #include <linux/slab.h>
  #include <soc/bcm2835/raspberrypi-firmware.h>
  
- #define MBOX_MSG(chan, data28)		(((data28) & ~0xf) | ((chan) & 0xf))
-@@ -174,6 +175,26 @@ int rpi_firmware_property(struct rpi_fir
+@@ -175,6 +176,26 @@ int rpi_firmware_property(struct rpi_fir
  }
  EXPORT_SYMBOL_GPL(rpi_firmware_property);
  
@@ -48,7 +48,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  static void
  rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
  {
-@@ -284,15 +305,32 @@ static struct platform_driver rpi_firmwa
+@@ -285,15 +306,32 @@ static struct platform_driver rpi_firmwa
  	.remove		= rpi_firmware_remove,
  };
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0147-firmware-raspberrypi-Add-backward-compatible-get_thr.patch b/target/linux/brcm2708/patches-4.19/950-0147-firmware-raspberrypi-Add-backward-compatible-get_thr.patch
index dea72e690e..1a74f9c1fa 100644
--- a/target/linux/brcm2708/patches-4.19/950-0147-firmware-raspberrypi-Add-backward-compatible-get_thr.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0147-firmware-raspberrypi-Add-backward-compatible-get_thr.patch
@@ -16,7 +16,7 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
 
 --- a/drivers/firmware/raspberrypi.c
 +++ b/drivers/firmware/raspberrypi.c
-@@ -31,6 +31,7 @@ struct rpi_firmware {
+@@ -30,6 +30,7 @@ struct rpi_firmware {
  	struct mbox_chan *chan; /* The property channel. */
  	struct completion c;
  	u32 enabled;
@@ -24,9 +24,9 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
  };
  
  static struct platform_device *g_pdev;
-@@ -171,6 +172,12 @@ int rpi_firmware_property(struct rpi_fir
- 	       data + sizeof(struct rpi_firmware_property_tag_header),
- 	       buf_size);
+@@ -172,6 +173,12 @@ int rpi_firmware_property(struct rpi_fir
+ 
+ 	kfree(data);
  
 +	if ((tag == RPI_FIRMWARE_GET_THROTTLED) &&
 +	     memcmp(&fw->get_throttled, tag_data, sizeof(fw->get_throttled))) {
@@ -37,7 +37,7 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
  	return ret;
  }
  EXPORT_SYMBOL_GPL(rpi_firmware_property);
-@@ -195,6 +202,27 @@ static int rpi_firmware_notify_reboot(st
+@@ -196,6 +203,27 @@ static int rpi_firmware_notify_reboot(st
  	return 0;
  }
  
@@ -65,7 +65,7 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
  static void
  rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
  {
-@@ -227,6 +255,11 @@ rpi_register_hwmon_driver(struct device
+@@ -228,6 +256,11 @@ rpi_register_hwmon_driver(struct device
  
  	rpi_hwmon = platform_device_register_data(dev, "raspberrypi-hwmon",
  						  -1, NULL, 0);
diff --git a/target/linux/brcm2708/patches-4.19/950-0148-Increase-firmware-call-buffer-size-to-48-bytes.patch b/target/linux/brcm2708/patches-4.19/950-0148-Increase-firmware-call-buffer-size-to-48-bytes.patch
deleted file mode 100644
index 99e1679cdf..0000000000
--- a/target/linux/brcm2708/patches-4.19/950-0148-Increase-firmware-call-buffer-size-to-48-bytes.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 3118f1a2f29ae802a334963c2aded87d60bddd56 Mon Sep 17 00:00:00 2001
-From: James Hughes <james.hughes@raspberrypi.org>
-Date: Wed, 31 Oct 2018 13:00:46 +0000
-Subject: [PATCH 148/806] Increase firmware call buffer size to 48 bytes
-
-An assumption was made in commit a1547e0bc that 32 bytes
-would be enough data buffer size for all firmware calls. However,
-the axi performance monitor driver uses a call with 44 bytes
-(RPI_FIRMWARE_GET_PERIPH_REG) to get the VC registers values.
-
-Increase value to 48 to take this in to account.
-
-Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
----
- drivers/firmware/raspberrypi.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/firmware/raspberrypi.c
-+++ b/drivers/firmware/raspberrypi.c
-@@ -22,7 +22,7 @@
- #define MBOX_DATA28(msg)		((msg) & ~0xf)
- #define MBOX_CHAN_PROPERTY		8
- 
--#define MAX_RPI_FW_PROP_BUF_SIZE	32
-+#define MAX_RPI_FW_PROP_BUF_SIZE	48
- 
- static struct platform_device *rpi_hwmon;
- 
diff --git a/target/linux/brcm2708/patches-4.19/950-0206-Mailbox-firmware-calls-now-use-kmalloc-2749.patch b/target/linux/brcm2708/patches-4.19/950-0206-Mailbox-firmware-calls-now-use-kmalloc-2749.patch
deleted file mode 100644
index aeb74b0741..0000000000
--- a/target/linux/brcm2708/patches-4.19/950-0206-Mailbox-firmware-calls-now-use-kmalloc-2749.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From 01995961823e4185f687c02cf326d78ba1b6b7bf Mon Sep 17 00:00:00 2001
-From: James Hughes <JamesH65@users.noreply.github.com>
-Date: Tue, 13 Nov 2018 17:27:00 +0000
-Subject: [PATCH 206/806] Mailbox firmware calls now use kmalloc (#2749)
-
-A previous change moved away from variable stack
-allocation of a data buffer to a fixed maximum size.
-However, some mailbox calls use larger data buffers
-than the maximum allowed. This change moves from
-stack storage to kmalloc to ensure all sizes are
-catered for.
-
-Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
----
- drivers/firmware/raspberrypi.c | 35 +++++++++++++++++-----------------
- 1 file changed, 18 insertions(+), 17 deletions(-)
-
---- a/drivers/firmware/raspberrypi.c
-+++ b/drivers/firmware/raspberrypi.c
-@@ -15,6 +15,7 @@
- #include <linux/of_platform.h>
- #include <linux/platform_device.h>
- #include <linux/reboot.h>
-+#include <linux/slab.h>
- #include <soc/bcm2835/raspberrypi-firmware.h>
- 
- #define MBOX_MSG(chan, data28)		(((data28) & ~0xf) | ((chan) & 0xf))
-@@ -22,8 +23,6 @@
- #define MBOX_DATA28(msg)		((msg) & ~0xf)
- #define MBOX_CHAN_PROPERTY		8
- 
--#define MAX_RPI_FW_PROP_BUF_SIZE	48
--
- static struct platform_device *rpi_hwmon;
- 
- struct rpi_firmware {
-@@ -149,28 +148,28 @@ EXPORT_SYMBOL_GPL(rpi_firmware_property_
- int rpi_firmware_property(struct rpi_firmware *fw,
- 			  u32 tag, void *tag_data, size_t buf_size)
- {
--	/* Single tags are very small (generally 8 bytes), so the
--	 * stack should be safe.
--	 */
--	u8 data[sizeof(struct rpi_firmware_property_tag_header) +
--		MAX_RPI_FW_PROP_BUF_SIZE];
--	struct rpi_firmware_property_tag_header *header =
--		(struct rpi_firmware_property_tag_header *)data;
- 	int ret;
-+	struct rpi_firmware_property_tag_header *header;
- 
--	if (WARN_ON(buf_size > sizeof(data) - sizeof(*header)))
--		return -EINVAL;
-+	/* Some mailboxes can use over 1k bytes. Rather than checking
-+	 * size and using stack or kmalloc depending on requirements,
-+	 * just use kmalloc. Mailboxes don't get called enough to worry
-+	 * too much about the time taken in the allocation.
-+	 */
-+	void *data = kmalloc(sizeof(*header) + buf_size, GFP_KERNEL);
- 
-+	if (!data)
-+		return -ENOMEM;
-+
-+	header = data;
- 	header->tag = tag;
- 	header->buf_size = buf_size;
- 	header->req_resp_size = 0;
--	memcpy(data + sizeof(struct rpi_firmware_property_tag_header),
--	       tag_data, buf_size);
-+	memcpy(data + sizeof(*header), tag_data, buf_size);
- 
--	ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));
--	memcpy(tag_data,
--	       data + sizeof(struct rpi_firmware_property_tag_header),
--	       buf_size);
-+	ret = rpi_firmware_property_list(fw, data, buf_size + sizeof(*header));
-+
-+	memcpy(tag_data, data + sizeof(*header), buf_size);
- 
- 	if ((tag == RPI_FIRMWARE_GET_THROTTLED) &&
- 	     memcmp(&fw->get_throttled, tag_data, sizeof(fw->get_throttled))) {
-@@ -178,6 +177,8 @@ int rpi_firmware_property(struct rpi_fir
- 		sysfs_notify(&fw->cl.dev->kobj, NULL, "get_throttled");
- 	}
- 
-+	kfree(data);
-+
- 	return ret;
- }
- EXPORT_SYMBOL_GPL(rpi_firmware_property);
diff --git a/target/linux/brcm2708/patches-4.19/950-0519-tty-amba-pl011-allow-shared-interrupt.patch b/target/linux/brcm2708/patches-4.19/950-0519-tty-amba-pl011-allow-shared-interrupt.patch
index ae9036755f..7d79ed0f05 100644
--- a/target/linux/brcm2708/patches-4.19/950-0519-tty-amba-pl011-allow-shared-interrupt.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0519-tty-amba-pl011-allow-shared-interrupt.patch
@@ -16,7 +16,7 @@ Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
 
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -1735,7 +1735,8 @@ static int pl011_allocate_irq(struct uar
+@@ -1733,7 +1733,8 @@ static int pl011_allocate_irq(struct uar
  {
  	pl011_write(uap->im, uap, REG_IMSC);
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0548-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.mousep.patch b/target/linux/brcm2708/patches-4.19/950-0548-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.mousep.patch
index d5e37d87db..bd332715fc 100644
--- a/target/linux/brcm2708/patches-4.19/950-0548-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.mousep.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0548-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.mousep.patch
@@ -20,7 +20,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -1428,6 +1428,87 @@ command_cleanup:
+@@ -1425,6 +1425,87 @@ command_cleanup:
  }
  
  /*
@@ -108,7 +108,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
   * non-error returns are a promise to giveback() the urb later
   * we drop ownership so next owner (or urb unlink) can get it
   */
-@@ -1495,6 +1576,11 @@ static int xhci_urb_enqueue(struct usb_h
+@@ -1492,6 +1573,11 @@ static int xhci_urb_enqueue(struct usb_h
  		}
  	}
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0652-Revert-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.patch b/target/linux/brcm2708/patches-4.19/950-0652-Revert-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.patch
index 10b0a5b921..6ea178b5be 100644
--- a/target/linux/brcm2708/patches-4.19/950-0652-Revert-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0652-Revert-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.patch
@@ -11,7 +11,7 @@ This reverts commit 1cf1071a79f320bc4497a3ade77431f04442eb17.
 
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -1428,87 +1428,6 @@ command_cleanup:
+@@ -1425,87 +1425,6 @@ command_cleanup:
  }
  
  /*
@@ -99,7 +99,7 @@ This reverts commit 1cf1071a79f320bc4497a3ade77431f04442eb17.
   * non-error returns are a promise to giveback() the urb later
   * we drop ownership so next owner (or urb unlink) can get it
   */
-@@ -1576,11 +1495,6 @@ static int xhci_urb_enqueue(struct usb_h
+@@ -1573,11 +1492,6 @@ static int xhci_urb_enqueue(struct usb_h
  		}
  	}
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0654-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch b/target/linux/brcm2708/patches-4.19/950-0654-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
index 48b556735a..ffcb9ba41f 100644
--- a/target/linux/brcm2708/patches-4.19/950-0654-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0654-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
@@ -15,7 +15,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -1428,6 +1428,103 @@ command_cleanup:
+@@ -1425,6 +1425,103 @@ command_cleanup:
  }
  
  /*
@@ -119,7 +119,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
   * non-error returns are a promise to giveback() the urb later
   * we drop ownership so next owner (or urb unlink) can get it
   */
-@@ -5220,6 +5317,7 @@ static const struct hc_driver xhci_hc_dr
+@@ -5217,6 +5314,7 @@ static const struct hc_driver xhci_hc_dr
  	.endpoint_reset =	xhci_endpoint_reset,
  	.check_bandwidth =	xhci_check_bandwidth,
  	.reset_bandwidth =	xhci_reset_bandwidth,
diff --git a/target/linux/brcm2708/patches-4.19/950-0698-tty-amba-pl011-Make-TX-optimisation-conditional.patch b/target/linux/brcm2708/patches-4.19/950-0698-tty-amba-pl011-Make-TX-optimisation-conditional.patch
index d6a9cdde35..6b7ab56859 100644
--- a/target/linux/brcm2708/patches-4.19/950-0698-tty-amba-pl011-Make-TX-optimisation-conditional.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0698-tty-amba-pl011-Make-TX-optimisation-conditional.patch
@@ -42,15 +42,15 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  #ifdef CONFIG_DMA_ENGINE
  	/* DMA stuff */
  	bool			using_tx_dma;
-@@ -814,6 +815,7 @@ __acquires(&uap->port.lock)
+@@ -813,6 +814,7 @@ __acquires(&uap->port.lock)
+ 	if (!uap->using_tx_dma)
  		return;
  
- 	/* Avoid deadlock with the DMA engine callback */
 +	uap->irq_locked = 0;
- 	spin_unlock(&uap->port.lock);
- 	dmaengine_terminate_all(uap->dmatx.chan);
- 	spin_lock(&uap->port.lock);
-@@ -941,6 +943,7 @@ static void pl011_dma_rx_chars(struct ua
+ 	dmaengine_terminate_async(uap->dmatx.chan);
+ 
+ 	if (uap->dmatx.queued) {
+@@ -939,6 +941,7 @@ static void pl011_dma_rx_chars(struct ua
  		fifotaken = pl011_fifo_to_tty(uap);
  	}
  
@@ -58,7 +58,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	spin_unlock(&uap->port.lock);
  	dev_vdbg(uap->port.dev,
  		 "Took %d chars from DMA buffer and %d chars from the FIFO\n",
-@@ -1349,6 +1352,7 @@ __acquires(&uap->port.lock)
+@@ -1347,6 +1350,7 @@ __acquires(&uap->port.lock)
  {
  	pl011_fifo_to_tty(uap);
  
@@ -66,7 +66,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	spin_unlock(&uap->port.lock);
  	tty_flip_buffer_push(&uap->port.state->port);
  	/*
-@@ -1484,6 +1488,7 @@ static irqreturn_t pl011_int(int irq, vo
+@@ -1482,6 +1486,7 @@ static irqreturn_t pl011_int(int irq, vo
  	int handled = 0;
  
  	spin_lock_irqsave(&uap->port.lock, flags);
@@ -74,7 +74,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	status = pl011_read(uap, REG_RIS) & uap->im;
  	if (status) {
  		do {
-@@ -1503,7 +1508,7 @@ static irqreturn_t pl011_int(int irq, vo
+@@ -1501,7 +1506,7 @@ static irqreturn_t pl011_int(int irq, vo
  				      UART011_CTSMIS|UART011_RIMIS))
  				pl011_modem_status(uap);
  			if (status & UART011_TXIS)
diff --git a/target/linux/brcm2708/patches-4.19/950-0765-xhci-Use-more-event-ring-segment-table-entries.patch b/target/linux/brcm2708/patches-4.19/950-0765-xhci-Use-more-event-ring-segment-table-entries.patch
index ef1349153e..e2bc7469fc 100644
--- a/target/linux/brcm2708/patches-4.19/950-0765-xhci-Use-more-event-ring-segment-table-entries.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0765-xhci-Use-more-event-ring-segment-table-entries.patch
@@ -22,7 +22,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/usb/host/xhci-mem.c
 +++ b/drivers/usb/host/xhci-mem.c
-@@ -2491,9 +2491,11 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+@@ -2495,9 +2495,11 @@ int xhci_mem_init(struct xhci_hcd *xhci,
  	 * Event ring setup: Allocate a normal ring, but also setup
  	 * the event ring segment table (ERST).  Section 4.9.3.
  	 */
@@ -36,7 +36,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
  	if (!xhci->event_ring)
  		goto fail;
  	if (xhci_check_trb_in_td_math(xhci) < 0)
-@@ -2506,7 +2508,7 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+@@ -2510,7 +2512,7 @@ int xhci_mem_init(struct xhci_hcd *xhci,
  	/* set ERST count with the number of entries in the segment table */
  	val = readl(&xhci->ir_set->erst_size);
  	val &= ERST_SIZE_MASK;