kernel: bump 4.19 to 4.19.90

Refreshed all patches.

Remove upstreamed:
- 010-dmaengine-dw-dmac-implement-dma-prot.patch
- 950-0148-Increase-firmware-call-buffer-size-to-48-bytes.patch
- 950-0206-Mailbox-firmware-calls-now-use-kmalloc-2749.patch
- 402-leds-trigger-netdev-fix-handling-on-interface-rename.patch

Fixes:
- CVE-2019-19332

Compile-tested on: cns3xxx
Runtime-tested on: cns3xxx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
[Add 010-dt-bindings-dmaengine-dw-dmac-add-protection-control.patch]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

34 files changed, 153 insertions, 386 deletions

diff --git a/target/linux/apm821xx/patches-4.19/010-dmaengine-dw-dmac-implement-dma-prot.patch b/target/linux/apm821xx/patches-4.19/010-dmaengine-dw-dmac-implement-dma-prot.patch
deleted file mode 100644
index 86da6fcd89..0000000000
--- a/target/linux/apm821xx/patches-4.19/010-dmaengine-dw-dmac-implement-dma-prot.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From 7b0c03ecc42fb223baf015877fee9d517c2c8af1 Mon Sep 17 00:00:00 2001
-From: Christian Lamparter <chunkeey@gmail.com>
-Date: Sat, 17 Nov 2018 17:17:21 +0100
-Subject: dmaengine: dw-dmac: implement dma protection control setting
-
-This patch adds a new device-tree property that allows to
-specify the dma protection control bits for the all of the
-DMA controller's channel uniformly.
-
-Setting the "correct" bits can have a huge impact on the
-PPC460EX and APM82181 that use this DMA engine in combination
-with a DesignWare' SATA-II core (sata_dwc_460ex driver).
-
-In the OpenWrt Forum, the user takimata reported that:
-|It seems your patch unleashed the full power of the SATA port.
-|Where I was previously hitting a really hard limit at around
-|82 MB/s for reading and 27 MB/s for writing, I am now getting this:
-|
-|root@OpenWrt:/mnt# time dd if=/dev/zero of=tempfile bs=1M count=1024
-|1024+0 records in
-|1024+0 records out
-|real    0m 13.65s
-|user    0m 0.01s
-|sys     0m 11.89s
-|
-|root@OpenWrt:/mnt# time dd if=tempfile of=/dev/null bs=1M count=1024
-|1024+0 records in
-|1024+0 records out
-|real    0m 8.41s
-|user    0m 0.01s
-|sys     0m 4.70s
-|
-|This means: 121 MB/s reading and 75 MB/s writing!
-|
-|The drive is a WD Green WD10EARX taken from an older MBL Single.
-|I repeated the test a few times with even larger files to rule out
-|any caching, I'm still seeing the same great performance. OpenWrt is
-|now completely on par with the original MBL firmware's performance.
-
-Another user And.short reported:
-|I can report that your fix worked! Boots up fine with two
-|drives even with more partitions, and no more reboot on
-|concurrent disk access!
-
-A closer look into the sata_dwc_460ex code revealed that
-the driver did initally set the correct protection control
-bits. However, this feature was lost when the sata_dwc_460ex
-driver was converted to the generic DMA driver framework.
-
-BugLink: https://forum.openwrt.org/t/wd-mybook-live-duo-two-disks/16195/55
-BugLink: https://forum.openwrt.org/t/wd-mybook-live-duo-two-disks/16195/50
-Fixes: 8b3444852a2b ("sata_dwc_460ex: move to generic DMA driver")
-Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
-Signed-off-by: Vinod Koul <vkoul@kernel.org>
----
-
---- a/drivers/dma/dw/core.c
-+++ b/drivers/dma/dw/core.c
-@@ -160,12 +160,14 @@ static void dwc_initialize_chan_idma32(s
- 
- static void dwc_initialize_chan_dw(struct dw_dma_chan *dwc)
- {
-+	struct dw_dma *dw = to_dw_dma(dwc->chan.device);
- 	u32 cfghi = DWC_CFGH_FIFO_MODE;
- 	u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority);
- 	bool hs_polarity = dwc->dws.hs_polarity;
- 
- 	cfghi |= DWC_CFGH_DST_PER(dwc->dws.dst_id);
- 	cfghi |= DWC_CFGH_SRC_PER(dwc->dws.src_id);
-+	cfghi |= DWC_CFGH_PROTCTL(dw->pdata->protctl);
- 
- 	/* Set polarity of handshake interface */
- 	cfglo |= hs_polarity ? DWC_CFGL_HS_DST_POL | DWC_CFGL_HS_SRC_POL : 0;
---- a/drivers/dma/dw/platform.c
-+++ b/drivers/dma/dw/platform.c
-@@ -162,6 +162,12 @@ dw_dma_parse_dt(struct platform_device *
- 			pdata->multi_block[tmp] = 1;
- 	}
- 
-+	if (!of_property_read_u32(np, "snps,dma-protection-control", &tmp)) {
-+		if (tmp > CHAN_PROTCTL_MASK)
-+			return NULL;
-+		pdata->protctl = tmp;
-+	}
-+
- 	return pdata;
- }
- #else
---- a/drivers/dma/dw/regs.h
-+++ b/drivers/dma/dw/regs.h
-@@ -200,6 +200,10 @@ enum dw_dma_msize {
- #define DWC_CFGH_FCMODE		(1 << 0)
- #define DWC_CFGH_FIFO_MODE	(1 << 1)
- #define DWC_CFGH_PROTCTL(x)	((x) << 2)
-+#define DWC_CFGH_PROTCTL_DATA	(0 << 2)	/* data access - always set */
-+#define DWC_CFGH_PROTCTL_PRIV	(1 << 2)	/* privileged -> AHB HPROT[1] */
-+#define DWC_CFGH_PROTCTL_BUFFER	(2 << 2)	/* bufferable -> AHB HPROT[2] */
-+#define DWC_CFGH_PROTCTL_CACHE	(4 << 2)	/* cacheable  -> AHB HPROT[3] */
- #define DWC_CFGH_DS_UPD_EN	(1 << 5)
- #define DWC_CFGH_SS_UPD_EN	(1 << 6)
- #define DWC_CFGH_SRC_PER(x)	((x) << 7)
---- a/include/linux/platform_data/dma-dw.h
-+++ b/include/linux/platform_data/dma-dw.h
-@@ -49,6 +49,7 @@ struct dw_dma_slave {
-  * @data_width: Maximum data width supported by hardware per AHB master
-  *		(in bytes, power of 2)
-  * @multi_block: Multi block transfers supported by hardware per channel.
-+ * @protctl: Protection control signals setting per channel.
-  */
- struct dw_dma_platform_data {
- 	unsigned int	nr_channels;
-@@ -65,6 +66,11 @@ struct dw_dma_platform_data {
- 	unsigned char	nr_masters;
- 	unsigned char	data_width[DW_DMA_MAX_NR_MASTERS];
- 	unsigned char	multi_block[DW_DMA_MAX_NR_CHANNELS];
-+#define CHAN_PROTCTL_PRIVILEGED		BIT(0)
-+#define CHAN_PROTCTL_BUFFERABLE		BIT(1)
-+#define CHAN_PROTCTL_CACHEABLE		BIT(2)
-+#define CHAN_PROTCTL_MASK		GENMASK(2, 0)
-+	unsigned char	protctl;
- };
- 
- #endif /* _PLATFORM_DATA_DMA_DW_H */
---- /dev/null
-+++ b/include/dt-bindings/dma/dw-dmac.h
-@@ -0,0 +1,14 @@
-+/* SPDX-License-Identifier: (GPL-2.0 OR MIT) */
-+
-+#ifndef __DT_BINDINGS_DMA_DW_DMAC_H__
-+#define __DT_BINDINGS_DMA_DW_DMAC_H__
-+
-+/*
-+ * Protection Control bits provide protection against illegal transactions.
-+ * The protection bits[0:2] are one-to-one mapped to AHB HPROT[3:1] signals.
-+ */
-+#define DW_DMAC_HPROT1_PRIVILEGED_MODE	(1 << 0)	/* Privileged Mode */
-+#define DW_DMAC_HPROT2_BUFFERABLE	(1 << 1)	/* DMA is bufferable */
-+#define DW_DMAC_HPROT3_CACHEABLE	(1 << 2)	/* DMA is cacheable */
-+
-+#endif /* __DT_BINDINGS_DMA_DW_DMAC_H__ */
diff --git a/target/linux/apm821xx/patches-4.19/010-dt-bindings-dmaengine-dw-dmac-add-protection-control.patch b/target/linux/apm821xx/patches-4.19/010-dt-bindings-dmaengine-dw-dmac-add-protection-control.patch
new file mode 100644
index 0000000000..572b8b6522
--- /dev/null
+++ b/target/linux/apm821xx/patches-4.19/010-dt-bindings-dmaengine-dw-dmac-add-protection-control.patch
@@ -0,0 +1,74 @@
+From 538098281ce884a51d2aa4ab445056a41741c6ad Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Sat, 17 Nov 2018 17:17:20 +0100
+Subject: [PATCH] dt-bindings: dmaengine: dw-dmac: add protection control
+ property
+
+This patch for the DesignWare AHB Central
+Direct Memory Access Controller adds the dma
+protection control property:
+	"snps,dma-protection-control"
+
+as well as the properties specific values defines into
+a new include file: include/dt-bindings/dma/dw-dmac.h
+
+Note: The protection control signals are one-to-one
+mapped to the AHB HPROT[1:3] signals for this controller.
+The HPROT0 (Data Access) is always hardwired to 1.
+
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+---
+ Documentation/devicetree/bindings/dma/snps-dma.txt |  4 ++++
+ MAINTAINERS                                        |  4 +++-
+ include/dt-bindings/dma/dw-dmac.h                  | 14 ++++++++++++++
+ 3 files changed, 21 insertions(+), 1 deletion(-)
+ create mode 100644 include/dt-bindings/dma/dw-dmac.h
+
+--- a/Documentation/devicetree/bindings/dma/snps-dma.txt
++++ b/Documentation/devicetree/bindings/dma/snps-dma.txt
+@@ -27,6 +27,10 @@ Optional properties:
+   general purpose DMA channel allocator. False if not passed.
+ - multi-block: Multi block transfers supported by hardware. Array property with
+   one cell per channel. 0: not supported, 1 (default): supported.
++- snps,dma-protection-control: AHB HPROT[3:1] protection setting.
++  The default value is 0 (for non-cacheable, non-buffered,
++  unprivileged data access).
++  Refer to include/dt-bindings/dma/dw-dmac.h for possible values.
+ 
+ Example:
+ 
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -14075,9 +14075,11 @@ SYNOPSYS DESIGNWARE DMAC DRIVER
+ M:	Viresh Kumar <vireshk@kernel.org>
+ R:	Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+ S:	Maintained
++F:	Documentation/devicetree/bindings/dma/snps-dma.txt
++F:	drivers/dma/dw/
++F:	include/dt-bindings/dma/dw-dmac.h
+ F:	include/linux/dma/dw.h
+ F:	include/linux/platform_data/dma-dw.h
+-F:	drivers/dma/dw/
+ 
+ SYNOPSYS DESIGNWARE ENTERPRISE ETHERNET DRIVER
+ M:	Jose Abreu <Jose.Abreu@synopsys.com>
+--- /dev/null
++++ b/include/dt-bindings/dma/dw-dmac.h
+@@ -0,0 +1,14 @@
++/* SPDX-License-Identifier: (GPL-2.0 OR MIT) */
++
++#ifndef __DT_BINDINGS_DMA_DW_DMAC_H__
++#define __DT_BINDINGS_DMA_DW_DMAC_H__
++
++/*
++ * Protection Control bits provide protection against illegal transactions.
++ * The protection bits[0:2] are one-to-one mapped to AHB HPROT[3:1] signals.
++ */
++#define DW_DMAC_HPROT1_PRIVILEGED_MODE	(1 << 0)	/* Privileged Mode */
++#define DW_DMAC_HPROT2_BUFFERABLE	(1 << 1)	/* DMA is bufferable */
++#define DW_DMAC_HPROT3_CACHEABLE	(1 << 2)	/* DMA is cacheable */
++
++#endif /* __DT_BINDINGS_DMA_DW_DMAC_H__ */
diff --git a/target/linux/apm821xx/patches-4.19/023-0004-crypto4xx_core-don-t-abuse-__dma_sync_page.patch b/target/linux/apm821xx/patches-4.19/023-0004-crypto4xx_core-don-t-abuse-__dma_sync_page.patch
index 635ab0037e..d1849aefbb 100644
--- a/target/linux/apm821xx/patches-4.19/023-0004-crypto4xx_core-don-t-abuse-__dma_sync_page.patch
+++ b/target/linux/apm821xx/patches-4.19/023-0004-crypto4xx_core-don-t-abuse-__dma_sync_page.patch
@@ -19,7 +19,7 @@ Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
 
 --- a/drivers/crypto/amcc/crypto4xx_core.c
 +++ b/drivers/crypto/amcc/crypto4xx_core.c
-@@ -596,7 +596,7 @@ static void crypto4xx_aead_done(struct c
+@@ -592,7 +592,7 @@ static void crypto4xx_aead_done(struct c
  					  pd->pd_ctl_len.bf.pkt_len,
  					  dst);
  	} else {
diff --git a/target/linux/apm821xx/patches-4.19/023-0006-crypto-crypto4xx-add-prng-crypto-support.patch b/target/linux/apm821xx/patches-4.19/023-0006-crypto-crypto4xx-add-prng-crypto-support.patch
index ba4419787c..cf7f92c2d0 100644
--- a/target/linux/apm821xx/patches-4.19/023-0006-crypto-crypto4xx-add-prng-crypto-support.patch
+++ b/target/linux/apm821xx/patches-4.19/023-0006-crypto-crypto4xx-add-prng-crypto-support.patch
@@ -31,7 +31,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  #include <crypto/internal/skcipher.h>
  #include "crypto4xx_reg_def.h"
  #include "crypto4xx_core.h"
-@@ -1046,6 +1048,10 @@ static int crypto4xx_register_alg(struct
+@@ -1042,6 +1044,10 @@ static int crypto4xx_register_alg(struct
  			rc = crypto_register_ahash(&alg->alg.u.hash);
  			break;
  
@@ -42,7 +42,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  		default:
  			rc = crypto_register_skcipher(&alg->alg.u.cipher);
  			break;
-@@ -1075,6 +1081,10 @@ static void crypto4xx_unregister_alg(str
+@@ -1071,6 +1077,10 @@ static void crypto4xx_unregister_alg(str
  			crypto_unregister_aead(&alg->alg.u.aead);
  			break;
  
@@ -53,7 +53,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  		default:
  			crypto_unregister_skcipher(&alg->alg.u.cipher);
  		}
-@@ -1133,6 +1143,69 @@ static irqreturn_t crypto4xx_ce_interrup
+@@ -1129,6 +1139,69 @@ static irqreturn_t crypto4xx_ce_interrup
  		PPC4XX_TMO_ERR_INT);
  }
  
@@ -123,7 +123,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  /**
   * Supported Crypto Algorithms
   */
-@@ -1302,6 +1375,18 @@ static struct crypto4xx_alg_common crypt
+@@ -1298,6 +1371,18 @@ static struct crypto4xx_alg_common crypt
  			.cra_module	= THIS_MODULE,
  		},
  	} },
@@ -142,7 +142,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  };
  
  /**
-@@ -1371,6 +1456,7 @@ static int crypto4xx_probe(struct platfo
+@@ -1367,6 +1452,7 @@ static int crypto4xx_probe(struct platfo
  	core_dev->dev->core_dev = core_dev;
  	core_dev->dev->is_revb = is_revb;
  	core_dev->device = dev;
@@ -150,7 +150,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  	spin_lock_init(&core_dev->lock);
  	INIT_LIST_HEAD(&core_dev->dev->alg_list);
  	ratelimit_default_init(&core_dev->dev->aead_ratelimit);
-@@ -1450,6 +1536,7 @@ static int crypto4xx_remove(struct platf
+@@ -1446,6 +1532,7 @@ static int crypto4xx_remove(struct platf
  	tasklet_kill(&core_dev->tasklet);
  	/* Un-register with Linux CryptoAPI */
  	crypto4xx_unregister_alg(core_dev->dev);
diff --git a/target/linux/apm821xx/patches-4.19/023-0012-crypto-crypto4xx-get-rid-of-redundant-using_sd-varia.patch b/target/linux/apm821xx/patches-4.19/023-0012-crypto-crypto4xx-get-rid-of-redundant-using_sd-varia.patch
index 4b246a793d..24e34edd58 100644
--- a/target/linux/apm821xx/patches-4.19/023-0012-crypto-crypto4xx-get-rid-of-redundant-using_sd-varia.patch
+++ b/target/linux/apm821xx/patches-4.19/023-0012-crypto-crypto4xx-get-rid-of-redundant-using_sd-varia.patch
@@ -17,7 +17,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
 
 --- a/drivers/crypto/amcc/crypto4xx_core.c
 +++ b/drivers/crypto/amcc/crypto4xx_core.c
-@@ -539,7 +539,7 @@ static void crypto4xx_cipher_done(struct
+@@ -535,7 +535,7 @@ static void crypto4xx_cipher_done(struct
  
  	req = skcipher_request_cast(pd_uinfo->async_req);
  
@@ -26,7 +26,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  		crypto4xx_copy_pkt_to_dst(dev, pd, pd_uinfo,
  					  req->cryptlen, req->dst);
  	} else {
-@@ -593,7 +593,7 @@ static void crypto4xx_aead_done(struct c
+@@ -589,7 +589,7 @@ static void crypto4xx_aead_done(struct c
  	u32 icv[AES_BLOCK_SIZE];
  	int err = 0;
  
@@ -35,7 +35,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  		crypto4xx_copy_pkt_to_dst(dev, pd, pd_uinfo,
  					  pd->pd_ctl_len.bf.pkt_len,
  					  dst);
-@@ -887,7 +887,6 @@ int crypto4xx_build_pd(struct crypto_asy
+@@ -883,7 +883,6 @@ int crypto4xx_build_pd(struct crypto_asy
  		 * we know application give us dst a whole piece of memory
  		 * no need to use scatter ring.
  		 */
@@ -43,7 +43,7 @@ Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
  		pd_uinfo->first_sd = 0xffffffff;
  		sa->sa_command_0.bf.scatter = 0;
  		pd->dest = (u32)dma_map_page(dev->core_dev->device,
-@@ -901,7 +900,6 @@ int crypto4xx_build_pd(struct crypto_asy
+@@ -897,7 +896,6 @@ int crypto4xx_build_pd(struct crypto_asy
  		u32 sd_idx = fst_sd;
  		nbytes = datalen;
  		sa->sa_command_0.bf.scatter = 1;
diff --git a/target/linux/brcm2708/patches-4.19/950-0034-amba_pl011-Don-t-use-DT-aliases-for-numbering.patch b/target/linux/brcm2708/patches-4.19/950-0034-amba_pl011-Don-t-use-DT-aliases-for-numbering.patch
index 8b70d80e15..61ab7095fb 100644
--- a/target/linux/brcm2708/patches-4.19/950-0034-amba_pl011-Don-t-use-DT-aliases-for-numbering.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0034-amba_pl011-Don-t-use-DT-aliases-for-numbering.patch
@@ -14,7 +14,7 @@ use the same logic.
 
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -2578,7 +2578,12 @@ static int pl011_setup_port(struct devic
+@@ -2576,7 +2576,12 @@ static int pl011_setup_port(struct devic
  	if (IS_ERR(base))
  		return PTR_ERR(base);
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0035-amba_pl011-Round-input-clock-up.patch b/target/linux/brcm2708/patches-4.19/950-0035-amba_pl011-Round-input-clock-up.patch
index 82ef72b280..d5e9f3174c 100644
--- a/target/linux/brcm2708/patches-4.19/950-0035-amba_pl011-Round-input-clock-up.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0035-amba_pl011-Round-input-clock-up.patch
@@ -26,7 +26,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -1652,6 +1652,23 @@ static void pl011_put_poll_char(struct u
+@@ -1650,6 +1650,23 @@ static void pl011_put_poll_char(struct u
  
  #endif /* CONFIG_CONSOLE_POLL */
  
@@ -50,7 +50,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  static int pl011_hwinit(struct uart_port *port)
  {
  	struct uart_amba_port *uap =
-@@ -1668,7 +1685,7 @@ static int pl011_hwinit(struct uart_port
+@@ -1666,7 +1683,7 @@ static int pl011_hwinit(struct uart_port
  	if (retval)
  		return retval;
  
@@ -59,7 +59,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  	/* Clear pending error and receive interrupts */
  	pl011_write(UART011_OEIS | UART011_BEIS | UART011_PEIS |
-@@ -2324,7 +2341,7 @@ static int __init pl011_console_setup(st
+@@ -2322,7 +2339,7 @@ static int __init pl011_console_setup(st
  			plat->init();
  	}
  
@@ -68,7 +68,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  	if (uap->vendor->fixed_options) {
  		baud = uap->fixed_baud;
-@@ -2509,6 +2526,7 @@ static struct uart_driver amba_reg = {
+@@ -2507,6 +2524,7 @@ static struct uart_driver amba_reg = {
  	.cons			= AMBA_CONSOLE,
  };
  
@@ -76,7 +76,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  static int pl011_probe_dt_alias(int index, struct device *dev)
  {
  	struct device_node *np;
-@@ -2540,6 +2558,7 @@ static int pl011_probe_dt_alias(int inde
+@@ -2538,6 +2556,7 @@ static int pl011_probe_dt_alias(int inde
  
  	return ret;
  }
diff --git a/target/linux/brcm2708/patches-4.19/950-0036-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch b/target/linux/brcm2708/patches-4.19/950-0036-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch
index 7fdedd2bff..eef29187ae 100644
--- a/target/linux/brcm2708/patches-4.19/950-0036-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0036-amba_pl011-Insert-mb-for-correct-FIFO-handling.patch
@@ -17,7 +17,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -1385,6 +1385,7 @@ static bool pl011_tx_char(struct uart_am
+@@ -1383,6 +1383,7 @@ static bool pl011_tx_char(struct uart_am
  		return false; /* unable to transmit character */
  
  	pl011_write(c, uap, REG_DR);
diff --git a/target/linux/brcm2708/patches-4.19/950-0037-amba_pl011-Add-cts-event-workaround-DT-property.patch b/target/linux/brcm2708/patches-4.19/950-0037-amba_pl011-Add-cts-event-workaround-DT-property.patch
index c23f6dd6c3..e5a3c39b3f 100644
--- a/target/linux/brcm2708/patches-4.19/950-0037-amba_pl011-Add-cts-event-workaround-DT-property.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0037-amba_pl011-Add-cts-event-workaround-DT-property.patch
@@ -33,7 +33,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -2661,6 +2661,11 @@ static int pl011_probe(struct amba_devic
+@@ -2659,6 +2659,11 @@ static int pl011_probe(struct amba_devic
  	if (IS_ERR(uap->clk))
  		return PTR_ERR(uap->clk);
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0055-firmware-bcm2835-Support-ARCH_BCM270x.patch b/target/linux/brcm2708/patches-4.19/950-0055-firmware-bcm2835-Support-ARCH_BCM270x.patch
index 3cba92983b..a47be248a2 100644
--- a/target/linux/brcm2708/patches-4.19/950-0055-firmware-bcm2835-Support-ARCH_BCM270x.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0055-firmware-bcm2835-Support-ARCH_BCM270x.patch
@@ -27,7 +27,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
 
 --- a/drivers/firmware/raspberrypi.c
 +++ b/drivers/firmware/raspberrypi.c
-@@ -32,6 +32,8 @@ struct rpi_firmware {
+@@ -31,6 +31,8 @@ struct rpi_firmware {
  	u32 enabled;
  };
  
@@ -36,7 +36,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
  static DEFINE_MUTEX(transaction_lock);
  
  static void response_callback(struct mbox_client *cl, void *msg)
-@@ -229,6 +231,7 @@ static int rpi_firmware_probe(struct pla
+@@ -230,6 +232,7 @@ static int rpi_firmware_probe(struct pla
  	init_completion(&fw->c);
  
  	platform_set_drvdata(pdev, fw);
@@ -44,7 +44,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
  
  	rpi_firmware_print_firmware_revision(fw);
  	rpi_register_hwmon_driver(dev, fw);
-@@ -243,6 +246,7 @@ static int rpi_firmware_remove(struct pl
+@@ -244,6 +247,7 @@ static int rpi_firmware_remove(struct pl
  	platform_device_unregister(rpi_hwmon);
  	rpi_hwmon = NULL;
  	mbox_free_channel(fw->chan);
@@ -52,7 +52,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
  
  	return 0;
  }
-@@ -255,7 +259,7 @@ static int rpi_firmware_remove(struct pl
+@@ -256,7 +260,7 @@ static int rpi_firmware_remove(struct pl
   */
  struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
  {
@@ -61,7 +61,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
  
  	if (!pdev)
  		return NULL;
-@@ -278,7 +282,18 @@ static struct platform_driver rpi_firmwa
+@@ -279,7 +283,18 @@ static struct platform_driver rpi_firmwa
  	.probe		= rpi_firmware_probe,
  	.remove		= rpi_firmware_remove,
  };
diff --git a/target/linux/brcm2708/patches-4.19/950-0057-BCM2708-Add-core-Device-Tree-support.patch b/target/linux/brcm2708/patches-4.19/950-0057-BCM2708-Add-core-Device-Tree-support.patch
index fd251d6f8f..f2ad9710fd 100644
--- a/target/linux/brcm2708/patches-4.19/950-0057-BCM2708-Add-core-Device-Tree-support.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0057-BCM2708-Add-core-Device-Tree-support.patch
@@ -15890,7 +15890,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	-Wno-avoid_unnecessary_addr_size \
  	-Wno-alias_paths \
  	-Wno-graph_child_address \
-@@ -292,6 +293,18 @@ cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \
+@@ -293,6 +294,18 @@ cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \
  $(obj)/%.dtb: $(src)/%.dts $(DTC) FORCE
  	$(call if_changed_dep,dtc)
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0062-Improve-__copy_to_user-and-__copy_from_user-performa.patch b/target/linux/brcm2708/patches-4.19/950-0062-Improve-__copy_to_user-and-__copy_from_user-performa.patch
index 0c3634d0c8..4335ff9560 100644
--- a/target/linux/brcm2708/patches-4.19/950-0062-Improve-__copy_to_user-and-__copy_from_user-performa.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0062-Improve-__copy_to_user-and-__copy_from_user-performa.patch
@@ -56,7 +56,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  #endif
 --- a/arch/arm/include/asm/uaccess.h
 +++ b/arch/arm/include/asm/uaccess.h
-@@ -496,6 +496,9 @@ do {									\
+@@ -514,6 +514,9 @@ do {									\
  extern unsigned long __must_check
  arm_copy_from_user(void *to, const void __user *from, unsigned long n);
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0110-raspberrypi-firmware-Export-the-general-transaction-.patch b/target/linux/brcm2708/patches-4.19/950-0110-raspberrypi-firmware-Export-the-general-transaction-.patch
index 9f5405334d..945ba536eb 100644
--- a/target/linux/brcm2708/patches-4.19/950-0110-raspberrypi-firmware-Export-the-general-transaction-.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0110-raspberrypi-firmware-Export-the-general-transaction-.patch
@@ -13,7 +13,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
 
 --- a/drivers/firmware/raspberrypi.c
 +++ b/drivers/firmware/raspberrypi.c
-@@ -46,7 +46,7 @@ static void response_callback(struct mbo
+@@ -45,7 +45,7 @@ static void response_callback(struct mbo
   * Sends a request to the firmware through the BCM2835 mailbox driver,
   * and synchronously waits for the reply.
   */
@@ -22,7 +22,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
  rpi_firmware_transaction(struct rpi_firmware *fw, u32 chan, u32 data)
  {
  	u32 message = MBOX_MSG(chan, data);
-@@ -67,6 +67,7 @@ rpi_firmware_transaction(struct rpi_firm
+@@ -66,6 +66,7 @@ rpi_firmware_transaction(struct rpi_firm
  
  	return ret;
  }
diff --git a/target/linux/brcm2708/patches-4.19/950-0131-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch b/target/linux/brcm2708/patches-4.19/950-0131-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch
index 34d2a8a241..ffe679fcf2 100644
--- a/target/linux/brcm2708/patches-4.19/950-0131-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0131-firmware-raspberrypi-Notify-firmware-of-a-reboot.patch
@@ -18,10 +18,10 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  #include <linux/of_platform.h>
  #include <linux/platform_device.h>
 +#include <linux/reboot.h>
+ #include <linux/slab.h>
  #include <soc/bcm2835/raspberrypi-firmware.h>
  
- #define MBOX_MSG(chan, data28)		(((data28) & ~0xf) | ((chan) & 0xf))
-@@ -174,6 +175,26 @@ int rpi_firmware_property(struct rpi_fir
+@@ -175,6 +176,26 @@ int rpi_firmware_property(struct rpi_fir
  }
  EXPORT_SYMBOL_GPL(rpi_firmware_property);
  
@@ -48,7 +48,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  static void
  rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
  {
-@@ -284,15 +305,32 @@ static struct platform_driver rpi_firmwa
+@@ -285,15 +306,32 @@ static struct platform_driver rpi_firmwa
  	.remove		= rpi_firmware_remove,
  };
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0147-firmware-raspberrypi-Add-backward-compatible-get_thr.patch b/target/linux/brcm2708/patches-4.19/950-0147-firmware-raspberrypi-Add-backward-compatible-get_thr.patch
index dea72e690e..1a74f9c1fa 100644
--- a/target/linux/brcm2708/patches-4.19/950-0147-firmware-raspberrypi-Add-backward-compatible-get_thr.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0147-firmware-raspberrypi-Add-backward-compatible-get_thr.patch
@@ -16,7 +16,7 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
 
 --- a/drivers/firmware/raspberrypi.c
 +++ b/drivers/firmware/raspberrypi.c
-@@ -31,6 +31,7 @@ struct rpi_firmware {
+@@ -30,6 +30,7 @@ struct rpi_firmware {
  	struct mbox_chan *chan; /* The property channel. */
  	struct completion c;
  	u32 enabled;
@@ -24,9 +24,9 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
  };
  
  static struct platform_device *g_pdev;
-@@ -171,6 +172,12 @@ int rpi_firmware_property(struct rpi_fir
- 	       data + sizeof(struct rpi_firmware_property_tag_header),
- 	       buf_size);
+@@ -172,6 +173,12 @@ int rpi_firmware_property(struct rpi_fir
+ 
+ 	kfree(data);
  
 +	if ((tag == RPI_FIRMWARE_GET_THROTTLED) &&
 +	     memcmp(&fw->get_throttled, tag_data, sizeof(fw->get_throttled))) {
@@ -37,7 +37,7 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
  	return ret;
  }
  EXPORT_SYMBOL_GPL(rpi_firmware_property);
-@@ -195,6 +202,27 @@ static int rpi_firmware_notify_reboot(st
+@@ -196,6 +203,27 @@ static int rpi_firmware_notify_reboot(st
  	return 0;
  }
  
@@ -65,7 +65,7 @@ Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
  static void
  rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
  {
-@@ -227,6 +255,11 @@ rpi_register_hwmon_driver(struct device
+@@ -228,6 +256,11 @@ rpi_register_hwmon_driver(struct device
  
  	rpi_hwmon = platform_device_register_data(dev, "raspberrypi-hwmon",
  						  -1, NULL, 0);
diff --git a/target/linux/brcm2708/patches-4.19/950-0148-Increase-firmware-call-buffer-size-to-48-bytes.patch b/target/linux/brcm2708/patches-4.19/950-0148-Increase-firmware-call-buffer-size-to-48-bytes.patch
deleted file mode 100644
index 99e1679cdf..0000000000
--- a/target/linux/brcm2708/patches-4.19/950-0148-Increase-firmware-call-buffer-size-to-48-bytes.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 3118f1a2f29ae802a334963c2aded87d60bddd56 Mon Sep 17 00:00:00 2001
-From: James Hughes <james.hughes@raspberrypi.org>
-Date: Wed, 31 Oct 2018 13:00:46 +0000
-Subject: [PATCH 148/806] Increase firmware call buffer size to 48 bytes
-
-An assumption was made in commit a1547e0bc that 32 bytes
-would be enough data buffer size for all firmware calls. However,
-the axi performance monitor driver uses a call with 44 bytes
-(RPI_FIRMWARE_GET_PERIPH_REG) to get the VC registers values.
-
-Increase value to 48 to take this in to account.
-
-Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
----
- drivers/firmware/raspberrypi.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/firmware/raspberrypi.c
-+++ b/drivers/firmware/raspberrypi.c
-@@ -22,7 +22,7 @@
- #define MBOX_DATA28(msg)		((msg) & ~0xf)
- #define MBOX_CHAN_PROPERTY		8
- 
--#define MAX_RPI_FW_PROP_BUF_SIZE	32
-+#define MAX_RPI_FW_PROP_BUF_SIZE	48
- 
- static struct platform_device *rpi_hwmon;
- 
diff --git a/target/linux/brcm2708/patches-4.19/950-0206-Mailbox-firmware-calls-now-use-kmalloc-2749.patch b/target/linux/brcm2708/patches-4.19/950-0206-Mailbox-firmware-calls-now-use-kmalloc-2749.patch
deleted file mode 100644
index aeb74b0741..0000000000
--- a/target/linux/brcm2708/patches-4.19/950-0206-Mailbox-firmware-calls-now-use-kmalloc-2749.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From 01995961823e4185f687c02cf326d78ba1b6b7bf Mon Sep 17 00:00:00 2001
-From: James Hughes <JamesH65@users.noreply.github.com>
-Date: Tue, 13 Nov 2018 17:27:00 +0000
-Subject: [PATCH 206/806] Mailbox firmware calls now use kmalloc (#2749)
-
-A previous change moved away from variable stack
-allocation of a data buffer to a fixed maximum size.
-However, some mailbox calls use larger data buffers
-than the maximum allowed. This change moves from
-stack storage to kmalloc to ensure all sizes are
-catered for.
-
-Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
----
- drivers/firmware/raspberrypi.c | 35 +++++++++++++++++-----------------
- 1 file changed, 18 insertions(+), 17 deletions(-)
-
---- a/drivers/firmware/raspberrypi.c
-+++ b/drivers/firmware/raspberrypi.c
-@@ -15,6 +15,7 @@
- #include <linux/of_platform.h>
- #include <linux/platform_device.h>
- #include <linux/reboot.h>
-+#include <linux/slab.h>
- #include <soc/bcm2835/raspberrypi-firmware.h>
- 
- #define MBOX_MSG(chan, data28)		(((data28) & ~0xf) | ((chan) & 0xf))
-@@ -22,8 +23,6 @@
- #define MBOX_DATA28(msg)		((msg) & ~0xf)
- #define MBOX_CHAN_PROPERTY		8
- 
--#define MAX_RPI_FW_PROP_BUF_SIZE	48
--
- static struct platform_device *rpi_hwmon;
- 
- struct rpi_firmware {
-@@ -149,28 +148,28 @@ EXPORT_SYMBOL_GPL(rpi_firmware_property_
- int rpi_firmware_property(struct rpi_firmware *fw,
- 			  u32 tag, void *tag_data, size_t buf_size)
- {
--	/* Single tags are very small (generally 8 bytes), so the
--	 * stack should be safe.
--	 */
--	u8 data[sizeof(struct rpi_firmware_property_tag_header) +
--		MAX_RPI_FW_PROP_BUF_SIZE];
--	struct rpi_firmware_property_tag_header *header =
--		(struct rpi_firmware_property_tag_header *)data;
- 	int ret;
-+	struct rpi_firmware_property_tag_header *header;
- 
--	if (WARN_ON(buf_size > sizeof(data) - sizeof(*header)))
--		return -EINVAL;
-+	/* Some mailboxes can use over 1k bytes. Rather than checking
-+	 * size and using stack or kmalloc depending on requirements,
-+	 * just use kmalloc. Mailboxes don't get called enough to worry
-+	 * too much about the time taken in the allocation.
-+	 */
-+	void *data = kmalloc(sizeof(*header) + buf_size, GFP_KERNEL);
- 
-+	if (!data)
-+		return -ENOMEM;
-+
-+	header = data;
- 	header->tag = tag;
- 	header->buf_size = buf_size;
- 	header->req_resp_size = 0;
--	memcpy(data + sizeof(struct rpi_firmware_property_tag_header),
--	       tag_data, buf_size);
-+	memcpy(data + sizeof(*header), tag_data, buf_size);
- 
--	ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));
--	memcpy(tag_data,
--	       data + sizeof(struct rpi_firmware_property_tag_header),
--	       buf_size);
-+	ret = rpi_firmware_property_list(fw, data, buf_size + sizeof(*header));
-+
-+	memcpy(tag_data, data + sizeof(*header), buf_size);
- 
- 	if ((tag == RPI_FIRMWARE_GET_THROTTLED) &&
- 	     memcmp(&fw->get_throttled, tag_data, sizeof(fw->get_throttled))) {
-@@ -178,6 +177,8 @@ int rpi_firmware_property(struct rpi_fir
- 		sysfs_notify(&fw->cl.dev->kobj, NULL, "get_throttled");
- 	}
- 
-+	kfree(data);
-+
- 	return ret;
- }
- EXPORT_SYMBOL_GPL(rpi_firmware_property);
diff --git a/target/linux/brcm2708/patches-4.19/950-0519-tty-amba-pl011-allow-shared-interrupt.patch b/target/linux/brcm2708/patches-4.19/950-0519-tty-amba-pl011-allow-shared-interrupt.patch
index ae9036755f..7d79ed0f05 100644
--- a/target/linux/brcm2708/patches-4.19/950-0519-tty-amba-pl011-allow-shared-interrupt.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0519-tty-amba-pl011-allow-shared-interrupt.patch
@@ -16,7 +16,7 @@ Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
 
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -1735,7 +1735,8 @@ static int pl011_allocate_irq(struct uar
+@@ -1733,7 +1733,8 @@ static int pl011_allocate_irq(struct uar
  {
  	pl011_write(uap->im, uap, REG_IMSC);
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0548-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.mousep.patch b/target/linux/brcm2708/patches-4.19/950-0548-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.mousep.patch
index d5e37d87db..bd332715fc 100644
--- a/target/linux/brcm2708/patches-4.19/950-0548-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.mousep.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0548-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.mousep.patch
@@ -20,7 +20,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -1428,6 +1428,87 @@ command_cleanup:
+@@ -1425,6 +1425,87 @@ command_cleanup:
  }
  
  /*
@@ -108,7 +108,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
   * non-error returns are a promise to giveback() the urb later
   * we drop ownership so next owner (or urb unlink) can get it
   */
-@@ -1495,6 +1576,11 @@ static int xhci_urb_enqueue(struct usb_h
+@@ -1492,6 +1573,11 @@ static int xhci_urb_enqueue(struct usb_h
  		}
  	}
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0652-Revert-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.patch b/target/linux/brcm2708/patches-4.19/950-0652-Revert-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.patch
index 10b0a5b921..6ea178b5be 100644
--- a/target/linux/brcm2708/patches-4.19/950-0652-Revert-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0652-Revert-usb-xhci-hack-xhci_urb_enqueue-to-support-hid.patch
@@ -11,7 +11,7 @@ This reverts commit 1cf1071a79f320bc4497a3ade77431f04442eb17.
 
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -1428,87 +1428,6 @@ command_cleanup:
+@@ -1425,87 +1425,6 @@ command_cleanup:
  }
  
  /*
@@ -99,7 +99,7 @@ This reverts commit 1cf1071a79f320bc4497a3ade77431f04442eb17.
   * non-error returns are a promise to giveback() the urb later
   * we drop ownership so next owner (or urb unlink) can get it
   */
-@@ -1576,11 +1495,6 @@ static int xhci_urb_enqueue(struct usb_h
+@@ -1573,11 +1492,6 @@ static int xhci_urb_enqueue(struct usb_h
  		}
  	}
  
diff --git a/target/linux/brcm2708/patches-4.19/950-0654-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch b/target/linux/brcm2708/patches-4.19/950-0654-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
index 48b556735a..ffcb9ba41f 100644
--- a/target/linux/brcm2708/patches-4.19/950-0654-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0654-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
@@ -15,7 +15,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -1428,6 +1428,103 @@ command_cleanup:
+@@ -1425,6 +1425,103 @@ command_cleanup:
  }
  
  /*
@@ -119,7 +119,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
   * non-error returns are a promise to giveback() the urb later
   * we drop ownership so next owner (or urb unlink) can get it
   */
-@@ -5220,6 +5317,7 @@ static const struct hc_driver xhci_hc_dr
+@@ -5217,6 +5314,7 @@ static const struct hc_driver xhci_hc_dr
  	.endpoint_reset =	xhci_endpoint_reset,
  	.check_bandwidth =	xhci_check_bandwidth,
  	.reset_bandwidth =	xhci_reset_bandwidth,
diff --git a/target/linux/brcm2708/patches-4.19/950-0698-tty-amba-pl011-Make-TX-optimisation-conditional.patch b/target/linux/brcm2708/patches-4.19/950-0698-tty-amba-pl011-Make-TX-optimisation-conditional.patch
index d6a9cdde35..6b7ab56859 100644
--- a/target/linux/brcm2708/patches-4.19/950-0698-tty-amba-pl011-Make-TX-optimisation-conditional.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0698-tty-amba-pl011-Make-TX-optimisation-conditional.patch
@@ -42,15 +42,15 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  #ifdef CONFIG_DMA_ENGINE
  	/* DMA stuff */
  	bool			using_tx_dma;
-@@ -814,6 +815,7 @@ __acquires(&uap->port.lock)
+@@ -813,6 +814,7 @@ __acquires(&uap->port.lock)
+ 	if (!uap->using_tx_dma)
  		return;
  
- 	/* Avoid deadlock with the DMA engine callback */
 +	uap->irq_locked = 0;
- 	spin_unlock(&uap->port.lock);
- 	dmaengine_terminate_all(uap->dmatx.chan);
- 	spin_lock(&uap->port.lock);
-@@ -941,6 +943,7 @@ static void pl011_dma_rx_chars(struct ua
+ 	dmaengine_terminate_async(uap->dmatx.chan);
+ 
+ 	if (uap->dmatx.queued) {
+@@ -939,6 +941,7 @@ static void pl011_dma_rx_chars(struct ua
  		fifotaken = pl011_fifo_to_tty(uap);
  	}
  
@@ -58,7 +58,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	spin_unlock(&uap->port.lock);
  	dev_vdbg(uap->port.dev,
  		 "Took %d chars from DMA buffer and %d chars from the FIFO\n",
-@@ -1349,6 +1352,7 @@ __acquires(&uap->port.lock)
+@@ -1347,6 +1350,7 @@ __acquires(&uap->port.lock)
  {
  	pl011_fifo_to_tty(uap);
  
@@ -66,7 +66,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	spin_unlock(&uap->port.lock);
  	tty_flip_buffer_push(&uap->port.state->port);
  	/*
-@@ -1484,6 +1488,7 @@ static irqreturn_t pl011_int(int irq, vo
+@@ -1482,6 +1486,7 @@ static irqreturn_t pl011_int(int irq, vo
  	int handled = 0;
  
  	spin_lock_irqsave(&uap->port.lock, flags);
@@ -74,7 +74,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	status = pl011_read(uap, REG_RIS) & uap->im;
  	if (status) {
  		do {
-@@ -1503,7 +1508,7 @@ static irqreturn_t pl011_int(int irq, vo
+@@ -1501,7 +1506,7 @@ static irqreturn_t pl011_int(int irq, vo
  				      UART011_CTSMIS|UART011_RIMIS))
  				pl011_modem_status(uap);
  			if (status & UART011_TXIS)
diff --git a/target/linux/brcm2708/patches-4.19/950-0765-xhci-Use-more-event-ring-segment-table-entries.patch b/target/linux/brcm2708/patches-4.19/950-0765-xhci-Use-more-event-ring-segment-table-entries.patch
index ef1349153e..e2bc7469fc 100644
--- a/target/linux/brcm2708/patches-4.19/950-0765-xhci-Use-more-event-ring-segment-table-entries.patch
+++ b/target/linux/brcm2708/patches-4.19/950-0765-xhci-Use-more-event-ring-segment-table-entries.patch
@@ -22,7 +22,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/usb/host/xhci-mem.c
 +++ b/drivers/usb/host/xhci-mem.c
-@@ -2491,9 +2491,11 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+@@ -2495,9 +2495,11 @@ int xhci_mem_init(struct xhci_hcd *xhci,
  	 * Event ring setup: Allocate a normal ring, but also setup
  	 * the event ring segment table (ERST).  Section 4.9.3.
  	 */
@@ -36,7 +36,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
  	if (!xhci->event_ring)
  		goto fail;
  	if (xhci_check_trb_in_td_math(xhci) < 0)
-@@ -2506,7 +2508,7 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+@@ -2510,7 +2512,7 @@ int xhci_mem_init(struct xhci_hcd *xhci,
  	/* set ERST count with the number of entries in the segment table */
  	val = readl(&xhci->ir_set->erst_size);
  	val &= ERST_SIZE_MASK;
diff --git a/target/linux/generic/backport-4.19/402-leds-trigger-netdev-fix-handling-on-interface-rename.patch b/target/linux/generic/backport-4.19/402-leds-trigger-netdev-fix-handling-on-interface-rename.patch
deleted file mode 100644
index c40ca42471..0000000000
--- a/target/linux/generic/backport-4.19/402-leds-trigger-netdev-fix-handling-on-interface-rename.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 0ff035231edca3713c3d0839c44e64a4ac41ef38 Mon Sep 17 00:00:00 2001
-From: Martin Schiller <ms@dev.tdt.de>
-Date: Thu, 24 Oct 2019 15:09:23 +0200
-Subject: [PATCH] leds: trigger: netdev: fix handling on interface rename
-
-The NETDEV_CHANGENAME code is not "unneeded" like it is stated in commit
-4cb6560514fa ("leds: trigger: netdev: fix refcnt leak on interface
-rename").
-
-The event was accidentally misinterpreted equivalent to
-NETDEV_UNREGISTER, but should be equivalent to NETDEV_REGISTER.
-
-This was the case in the original code from the openwrt project.
-
-Otherwise, you are unable to set netdev led triggers for (non-existent)
-netdevices, which has to be renamed. This is the case, for example, for
-ppp interfaces in openwrt.
-
-Fixes: 06f502f57d0d ("leds: trigger: Introduce a NETDEV trigger")
-Fixes: 4cb6560514fa ("leds: trigger: netdev: fix refcnt leak on interface rename")
-Signed-off-by: Martin Schiller <ms@dev.tdt.de>
----
- drivers/leds/trigger/ledtrig-netdev.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
---- a/drivers/leds/trigger/ledtrig-netdev.c
-+++ b/drivers/leds/trigger/ledtrig-netdev.c
-@@ -302,10 +302,12 @@ static int netdev_trig_notify(struct not
- 		container_of(nb, struct led_netdev_data, notifier);
- 
- 	if (evt != NETDEV_UP && evt != NETDEV_DOWN && evt != NETDEV_CHANGE
--	    && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER)
-+	    && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER
-+	    && evt != NETDEV_CHANGENAME)
- 		return NOTIFY_DONE;
- 
- 	if (!(dev == trigger_data->net_dev ||
-+	      (evt == NETDEV_CHANGENAME && !strcmp(dev->name, trigger_data->device_name)) ||
- 	      (evt == NETDEV_REGISTER && !strcmp(dev->name, trigger_data->device_name))))
- 		return NOTIFY_DONE;
- 
-@@ -315,6 +317,7 @@ static int netdev_trig_notify(struct not
- 
- 	clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
- 	switch (evt) {
-+	case NETDEV_CHANGENAME:
- 	case NETDEV_REGISTER:
- 		if (trigger_data->net_dev)
- 			dev_put(trigger_data->net_dev);
diff --git a/target/linux/generic/hack-4.19/204-module_strip.patch b/target/linux/generic/hack-4.19/204-module_strip.patch
index b218e3b6a8..b9d7c886ae 100644
--- a/target/linux/generic/hack-4.19/204-module_strip.patch
+++ b/target/linux/generic/hack-4.19/204-module_strip.patch
@@ -114,7 +114,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  config MODULES_TREE_LOOKUP
 --- a/kernel/module.c
 +++ b/kernel/module.c
-@@ -3025,9 +3025,11 @@ static int setup_load_info(struct load_i
+@@ -3027,9 +3027,11 @@ static int setup_load_info(struct load_i
  
  static int check_modinfo(struct module *mod, struct load_info *info, int flags)
  {
@@ -127,7 +127,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (flags & MODULE_INIT_IGNORE_VERMAGIC)
  		modmagic = NULL;
  
-@@ -3048,6 +3050,7 @@ static int check_modinfo(struct module *
+@@ -3050,6 +3052,7 @@ static int check_modinfo(struct module *
  				mod->name);
  		add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK);
  	}
@@ -137,7 +137,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/scripts/mod/modpost.c
 +++ b/scripts/mod/modpost.c
-@@ -1971,7 +1971,9 @@ static void read_symbols(const char *mod
+@@ -1983,7 +1983,9 @@ static void read_symbols(const char *mod
  		symname = remove_dot(info.strtab + sym->st_name);
  
  		handle_modversions(mod, &info, sym, symname);
@@ -147,7 +147,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  	if (!is_vmlinux(modname) || vmlinux_section_warnings)
  		check_sec_ref(mod, modname, &info);
-@@ -2134,8 +2136,10 @@ static void add_header(struct buffer *b,
+@@ -2146,8 +2148,10 @@ static void add_header(struct buffer *b,
  	buf_printf(b, "\n");
  	buf_printf(b, "BUILD_SALT;\n");
  	buf_printf(b, "\n");
@@ -158,7 +158,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	buf_printf(b, "\n");
  	buf_printf(b, "__visible struct module __this_module\n");
  	buf_printf(b, "__attribute__((section(\".gnu.linkonce.this_module\"))) = {\n");
-@@ -2152,8 +2156,10 @@ static void add_header(struct buffer *b,
+@@ -2164,8 +2168,10 @@ static void add_header(struct buffer *b,
  
  static void add_intree_flag(struct buffer *b, int is_intree)
  {
@@ -169,7 +169,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  /* Cannot check for assembler */
-@@ -2166,8 +2172,10 @@ static void add_retpoline(struct buffer
+@@ -2178,8 +2184,10 @@ static void add_retpoline(struct buffer
  
  static void add_staging_flag(struct buffer *b, const char *name)
  {
@@ -180,7 +180,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  /**
-@@ -2266,11 +2274,13 @@ static void add_depends(struct buffer *b
+@@ -2278,11 +2286,13 @@ static void add_depends(struct buffer *b
  
  static void add_srcversion(struct buffer *b, struct module *mod)
  {
@@ -194,7 +194,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  static void write_if_changed(struct buffer *b, const char *fname)
-@@ -2507,7 +2517,9 @@ int main(int argc, char **argv)
+@@ -2519,7 +2529,9 @@ int main(int argc, char **argv)
  		add_staging_flag(&buf, mod->name);
  		err |= add_versions(&buf, mod);
  		add_depends(&buf, mod, modules);
diff --git a/target/linux/generic/hack-4.19/230-openwrt_lzma_options.patch b/target/linux/generic/hack-4.19/230-openwrt_lzma_options.patch
index b45ed1184f..1e945cd4c1 100644
--- a/target/linux/generic/hack-4.19/230-openwrt_lzma_options.patch
+++ b/target/linux/generic/hack-4.19/230-openwrt_lzma_options.patch
@@ -23,7 +23,7 @@ Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
  	{ {0x02, 0x21}, "lz4", unlz4 },
 --- a/scripts/Makefile.lib
 +++ b/scripts/Makefile.lib
-@@ -324,7 +324,7 @@ cmd_bzip2 = (cat $(filter-out FORCE,$^)
+@@ -325,7 +325,7 @@ cmd_bzip2 = (cat $(filter-out FORCE,$^)
  
  quiet_cmd_lzma = LZMA    $@
  cmd_lzma = (cat $(filter-out FORCE,$^) | \
diff --git a/target/linux/generic/hack-4.19/301-mips_image_cmdline_hack.patch b/target/linux/generic/hack-4.19/301-mips_image_cmdline_hack.patch
index 7a6948d481..da7d1fdbe0 100644
--- a/target/linux/generic/hack-4.19/301-mips_image_cmdline_hack.patch
+++ b/target/linux/generic/hack-4.19/301-mips_image_cmdline_hack.patch
@@ -10,7 +10,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
-@@ -1143,6 +1143,10 @@ config SYNC_R4K
+@@ -1144,6 +1144,10 @@ config SYNC_R4K
  config MIPS_MACHINE
  	def_bool n
  
diff --git a/target/linux/generic/hack-4.19/902-debloat_proc.patch b/target/linux/generic/hack-4.19/902-debloat_proc.patch
index 4bd4d22168..f562c9f2e1 100644
--- a/target/linux/generic/hack-4.19/902-debloat_proc.patch
+++ b/target/linux/generic/hack-4.19/902-debloat_proc.patch
@@ -243,7 +243,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				&vmalloc_op,
 --- a/mm/vmstat.c
 +++ b/mm/vmstat.c
-@@ -1971,10 +1971,12 @@ void __init init_mm_internals(void)
+@@ -1972,10 +1972,12 @@ void __init init_mm_internals(void)
  	start_shepherd_timer();
  #endif
  #ifdef CONFIG_PROC_FS
diff --git a/target/linux/generic/pending-4.19/300-mips_expose_boot_raw.patch b/target/linux/generic/pending-4.19/300-mips_expose_boot_raw.patch
index 5d10cae86c..e19cec1400 100644
--- a/target/linux/generic/pending-4.19/300-mips_expose_boot_raw.patch
+++ b/target/linux/generic/pending-4.19/300-mips_expose_boot_raw.patch
@@ -9,7 +9,7 @@ Acked-by: Rob Landley <rob@landley.net>
 ---
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
-@@ -1062,9 +1062,6 @@ config FW_ARC
+@@ -1063,9 +1063,6 @@ config FW_ARC
  config ARCH_MAY_HAVE_PC_FDC
  	bool
  
@@ -19,7 +19,7 @@ Acked-by: Rob Landley <rob@landley.net>
  config CEVT_BCM1480
  	bool
  
-@@ -2968,6 +2965,18 @@ choice
+@@ -2969,6 +2966,18 @@ choice
  		bool "Extend builtin kernel arguments with bootloader arguments"
  endchoice
  
diff --git a/target/linux/generic/pending-4.19/304-mips_disable_fpu.patch b/target/linux/generic/pending-4.19/304-mips_disable_fpu.patch
index 2278576d21..332bb71e22 100644
--- a/target/linux/generic/pending-4.19/304-mips_disable_fpu.patch
+++ b/target/linux/generic/pending-4.19/304-mips_disable_fpu.patch
@@ -24,7 +24,7 @@ v2: incorporated changes suggested by Jonas Gorski
 
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
-@@ -2892,6 +2892,20 @@ config MIPS_O32_FP64_SUPPORT
+@@ -2893,6 +2893,20 @@ config MIPS_O32_FP64_SUPPORT
  
  	  If unsure, say N.
  
diff --git a/target/linux/generic/pending-4.19/341-MIPS-mm-remove-no-op-dma_map_ops-where-possible.patch b/target/linux/generic/pending-4.19/341-MIPS-mm-remove-no-op-dma_map_ops-where-possible.patch
index d28bc7ba99..07a6da453f 100644
--- a/target/linux/generic/pending-4.19/341-MIPS-mm-remove-no-op-dma_map_ops-where-possible.patch
+++ b/target/linux/generic/pending-4.19/341-MIPS-mm-remove-no-op-dma_map_ops-where-possible.patch
@@ -19,7 +19,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
 
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
-@@ -1116,7 +1116,6 @@ config DMA_PERDEV_COHERENT
+@@ -1117,7 +1117,6 @@ config DMA_PERDEV_COHERENT
  config DMA_NONCOHERENT
  	bool
  	select ARCH_HAS_SYNC_DMA_FOR_DEVICE
@@ -27,7 +27,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	select NEED_DMA_MAP_STATE
  	select DMA_NONCOHERENT_MMAP
  	select DMA_NONCOHERENT_CACHE_SYNC
-@@ -1897,9 +1896,11 @@ config SYS_HAS_CPU_MIPS32_R3_5
+@@ -1898,9 +1897,11 @@ config SYS_HAS_CPU_MIPS32_R3_5
  
  config SYS_HAS_CPU_MIPS32_R5
  	bool
@@ -39,7 +39,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  
  config SYS_HAS_CPU_MIPS64_R1
  	bool
-@@ -1909,6 +1910,7 @@ config SYS_HAS_CPU_MIPS64_R2
+@@ -1910,6 +1911,7 @@ config SYS_HAS_CPU_MIPS64_R2
  
  config SYS_HAS_CPU_MIPS64_R6
  	bool
@@ -47,7 +47,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  
  config SYS_HAS_CPU_R3000
  	bool
-@@ -1945,6 +1947,7 @@ config SYS_HAS_CPU_R8000
+@@ -1946,6 +1948,7 @@ config SYS_HAS_CPU_R8000
  
  config SYS_HAS_CPU_R10000
  	bool
@@ -55,7 +55,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  
  config SYS_HAS_CPU_RM7000
  	bool
-@@ -1973,6 +1976,7 @@ config SYS_HAS_CPU_BMIPS4380
+@@ -1974,6 +1977,7 @@ config SYS_HAS_CPU_BMIPS4380
  config SYS_HAS_CPU_BMIPS5000
  	bool
  	select SYS_HAS_CPU_BMIPS
diff --git a/target/linux/generic/pending-4.19/640-netfilter-nf_flow_table-add-hardware-offload-support.patch b/target/linux/generic/pending-4.19/640-netfilter-nf_flow_table-add-hardware-offload-support.patch
index dcd9b187c3..0a1e017f89 100644
--- a/target/linux/generic/pending-4.19/640-netfilter-nf_flow_table-add-hardware-offload-support.patch
+++ b/target/linux/generic/pending-4.19/640-netfilter-nf_flow_table-add-hardware-offload-support.patch
@@ -506,7 +506,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
 +MODULE_ALIAS("nf-flow-table-hw");
 --- a/net/netfilter/nf_tables_api.c
 +++ b/net/netfilter/nf_tables_api.c
-@@ -5473,6 +5473,13 @@ static int nf_tables_flowtable_parse_hoo
+@@ -5470,6 +5470,13 @@ static int nf_tables_flowtable_parse_hoo
  	if (err < 0)
  		return err;
  
@@ -520,7 +520,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  	ops = kcalloc(n, sizeof(struct nf_hook_ops), GFP_KERNEL);
  	if (!ops)
  		return -ENOMEM;
-@@ -5604,10 +5611,19 @@ static int nf_tables_newflowtable(struct
+@@ -5601,10 +5608,19 @@ static int nf_tables_newflowtable(struct
  	}
  
  	flowtable->data.type = type;
@@ -540,7 +540,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  	err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
  					     flowtable);
  	if (err < 0)
-@@ -5733,7 +5749,8 @@ static int nf_tables_fill_flowtable_info
+@@ -5730,7 +5746,8 @@ static int nf_tables_fill_flowtable_info
  	    nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
  	    nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
  	    nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
diff --git a/target/linux/lantiq/patches-4.19/0152-lantiq-VPE.patch b/target/linux/lantiq/patches-4.19/0152-lantiq-VPE.patch
index d40dcef509..9e39427c6a 100644
--- a/target/linux/lantiq/patches-4.19/0152-lantiq-VPE.patch
+++ b/target/linux/lantiq/patches-4.19/0152-lantiq-VPE.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
-@@ -2317,6 +2317,12 @@ config MIPS_VPE_LOADER
+@@ -2318,6 +2318,12 @@ config MIPS_VPE_LOADER
  	  Includes a loader for loading an elf relocatable object
  	  onto another VPE and running it.
  
diff --git a/target/linux/x86/patches-4.19/011-tune_lzma_options.patch b/target/linux/x86/patches-4.19/011-tune_lzma_options.patch
index e680f9c484..09d3c6c7ce 100644
--- a/target/linux/x86/patches-4.19/011-tune_lzma_options.patch
+++ b/target/linux/x86/patches-4.19/011-tune_lzma_options.patch
@@ -1,6 +1,6 @@
 --- a/scripts/Makefile.lib
 +++ b/scripts/Makefile.lib
-@@ -324,7 +324,7 @@ cmd_bzip2 = (cat $(filter-out FORCE,$^)
+@@ -325,7 +325,7 @@ cmd_bzip2 = (cat $(filter-out FORCE,$^)
  
  quiet_cmd_lzma = LZMA    $@
  cmd_lzma = (cat $(filter-out FORCE,$^) | \