Merge remote-tracking branch 'origin/f30' into f30-user-thl-vanilla-fedora

6 files changed, 624 insertions, 0 deletions

diff --git a/0001-drm-i915-dsi-Use-a-fuzzy-check-for-burst-mode-clock-.patch b/0001-drm-i915-dsi-Use-a-fuzzy-check-for-burst-mode-clock-.patch
new file mode 100644
index 000000000..51a5a3a85
--- /dev/null
+++ b/0001-drm-i915-dsi-Use-a-fuzzy-check-for-burst-mode-clock-.patch
@@ -0,0 +1,77 @@
+From f158b268ddbb3758dec49861bdf3ad8c9aae2e87 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 29 Nov 2018 12:40:05 +0100
+Subject: [PATCH] drm/i915/dsi: Use a fuzzy check for burst mode clock check
+
+Prior to this commit we fail to init the DSI panel on the GPD MicroPC:
+https://www.indiegogo.com/projects/gpd-micropc-6-inch-handheld-industry-laptop#/
+
+The problem is intel_dsi_vbt_init() failing with the following error:
+*ERROR* Burst mode freq is less than computed
+
+The pclk in the VBT panel modeline is 70000, together with 24 bpp and
+4 lines this results in a bitrate value of 70000 * 24 / 4 = 420000.
+But the target_burst_mode_freq in the VBT is 418000.
+
+This commit works around this problem by adding an intel_fuzzy_clock_check
+when target_burst_mode_freq < bitrate and setting target_burst_mode_freq to
+bitrate when that checks succeeds, fixing the panel not working.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/gpu/drm/i915/intel_display.c |  2 +-
+ drivers/gpu/drm/i915/intel_drv.h     |  1 +
+ drivers/gpu/drm/i915/intel_dsi_vbt.c | 11 +++++++++++
+ 3 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 5098228f1302..ceb78f44f087 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -11942,7 +11942,7 @@ intel_modeset_pipe_config(struct drm_crtc *crtc,
+ 	return 0;
+ }
+ 
+-static bool intel_fuzzy_clock_check(int clock1, int clock2)
++bool intel_fuzzy_clock_check(int clock1, int clock2)
+ {
+ 	int diff;
+ 
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index a38b9cff5cd0..e85cd377a652 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -1742,6 +1742,7 @@ int vlv_force_pll_on(struct drm_i915_private *dev_priv, enum pipe pipe,
+ 		     const struct dpll *dpll);
+ void vlv_force_pll_off(struct drm_i915_private *dev_priv, enum pipe pipe);
+ int lpt_get_iclkip(struct drm_i915_private *dev_priv);
++bool intel_fuzzy_clock_check(int clock1, int clock2);
+ 
+ /* modesetting asserts */
+ void assert_panel_unlocked(struct drm_i915_private *dev_priv,
+diff --git a/drivers/gpu/drm/i915/intel_dsi_vbt.c b/drivers/gpu/drm/i915/intel_dsi_vbt.c
+index 3074448446bc..4b8e48db1843 100644
+--- a/drivers/gpu/drm/i915/intel_dsi_vbt.c
++++ b/drivers/gpu/drm/i915/intel_dsi_vbt.c
+@@ -853,6 +853,17 @@ bool intel_dsi_vbt_init(struct intel_dsi *intel_dsi, u16 panel_id)
+ 		if (mipi_config->target_burst_mode_freq) {
+ 			u32 bitrate = intel_dsi_bitrate(intel_dsi);
+ 
++			/*
++			 * Sometimes the VBT contains a slightly lower clock,
++			 * then the bitrate we have calculated, in this case
++			 * just replace it with the calculated bitrate.
++			 */
++			if (mipi_config->target_burst_mode_freq < bitrate &&
++			    intel_fuzzy_clock_check(
++					mipi_config->target_burst_mode_freq,
++					bitrate))
++				mipi_config->target_burst_mode_freq = bitrate;
++
+ 			if (mipi_config->target_burst_mode_freq < bitrate) {
+ 				DRM_ERROR("Burst mode freq is less than computed\n");
+ 				return false;
+-- 
+2.21.0
+
diff --git a/0001-platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch b/0001-platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch
new file mode 100644
index 000000000..84e529c1d
--- /dev/null
+++ b/0001-platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch
@@ -0,0 +1,161 @@
+Delivered-To: hdegoede@gapps.redhat.com

+Received: by 2002:ac9:6402:0:0:0:0:0 with SMTP id r2csp1159009ock;

+        Mon, 20 May 2019 23:28:40 -0700 (PDT)

+X-Google-Smtp-Source: APXvYqzEtwqq6Q1hbrBqTEFvHJuczfsldfTxiiS018/hst2dmGipO/i52QcWyXJaIxAb/ecz61yL

+X-Received: by 2002:a05:620a:1116:: with SMTP id o22mr60937067qkk.23.1558420120852;

+        Mon, 20 May 2019 23:28:40 -0700 (PDT)

+ARC-Seal: i=1; a=rsa-sha256; t=1558420120; cv=none;

+        d=google.com; s=arc-20160816;

+        b=j/NtlSCAGn5q9DlinYEqsw+9oDJu7zz7hZdeHecj2hwygNbfIbK6CHEBtQws9lpBM2

+         2X/7zdY451jiHHtP8cXvYsVRkvlIyOgd7jagu+kIOpgVY+IoiEW0UzuWY/dUMwQTK6D+

+         CD9FmPs0hMdTVx8++AHS3N+SNujtJcFpRngUYfPJ0YOmbQJGt4nKRKaW0kkZD1pBsK91

+         +YhTSQqz4e2xZ02r0LbfWgYWyE1ppjjz53nTq6ezyvKhQ84JViMf5kFMoGUDKoLRVH5U

+         sH5xsZCzzGptH0dA6oJJzk8rjDc+puOwJWIW8D5fsCz93a0rRi/ia5rfsN54P/MpPMgQ

+         DsHg==

+ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;

+        h=content-transfer-encoding:mime-version:message-id:date:subject:cc

+         :to:from:delivered-to;

+        bh=KdOwY7jBol7uA/PFFDO66V1bihnYwiif3YrjkSKRUiA=;

+        b=gSM2abji2zLjywkvGpQ72oLfbsLhc8/waOBxP9JVMgMzkd6YXKAMdqeDG78UgEUkZX

+         RS//NNHSAIA+CDPrZHd9IBuV/GA887Hoezn4lryvCIYVNjoWOcBuFlG5/ix32GqMUNs5

+         gQDcToEn7rWl2LJpuhgMDLfvCcV8B77lRJThslE6zeeLR/M4lTklAl2epcopBQmZqXqS

+         QaIJg7rndM61R469mrv9TLpaBxun3CAA8OQ+W0+j059ZoiGUMIJ4ZsuMCpvTHp4gQ5fe

+         EmXXpAFxUE8a70UmSgRqIDbaqC6ik9ox9yCLhu1Aby5fvHeBW78nA83obbfix90uBmak

+         QVag==

+ARC-Authentication-Results: i=1; mx.google.com;

+       spf=pass (google.com: domain gapps.redhat.com configured 209.132.183.28 as internal address) smtp.mailfrom=hdegoede@redhat.com

+Return-Path: <hdegoede@redhat.com>

+Received: from mx1.redhat.com (mx1.redhat.com. [209.132.183.28])

+        by mx.google.com with ESMTPS id a51si948515qta.226.2019.05.20.23.28.40

+        for <hdegoede@gapps.redhat.com>

+        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);

+        Mon, 20 May 2019 23:28:40 -0700 (PDT)

+Received-SPF: pass (google.com: domain gapps.redhat.com configured 209.132.183.28 as internal address)

+Authentication-Results: mx.google.com;

+       spf=pass (google.com: domain gapps.redhat.com configured 209.132.183.28 as internal address) smtp.mailfrom=hdegoede@redhat.com

+Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23])

+	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))

+	(No client certificate requested)

+	by mx1.redhat.com (Postfix) with ESMTPS id 1EB1285539

+	for <hdegoede@gapps.redhat.com>; Tue, 21 May 2019 06:28:40 +0000 (UTC)

+Received: by smtp.corp.redhat.com (Postfix)

+	id 18D0E19C67; Tue, 21 May 2019 06:28:40 +0000 (UTC)

+Delivered-To: hdegoede@redhat.com

+Received: from shalem.localdomain.com (ovpn-116-215.ams2.redhat.com [10.36.116.215])

+	by smtp.corp.redhat.com (Postfix) with ESMTP id 8119F19C5B;

+	Tue, 21 May 2019 06:28:38 +0000 (UTC)

+From: Hans de Goede <hdegoede@redhat.com>

+To: Darren Hart <dvhart@infradead.org>,

+	Andy Shevchenko <andy@infradead.org>,

+	Corentin Chary <corentin.chary@gmail.com>

+Cc: Hans de Goede <hdegoede@redhat.com>,

+	acpi4asus-user@lists.sourceforge.net,

+	platform-driver-x86@vger.kernel.org,

+	linux-kernel@vger.kernel.org,

+	=?UTF-8?q?Jo=C3=A3o=20Paulo=20Rechi=20Vita?= <jprvita@endlessm.com>

+Subject: [PATCH] platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi

+Date: Tue, 21 May 2019 08:28:37 +0200

+Message-Id: <20190521062837.3887-1-hdegoede@redhat.com>

+MIME-Version: 1.0

+Content-Type: text/plain; charset=UTF-8

+Content-Transfer-Encoding: 8bit

+X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23

+X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Tue, 21 May 2019 06:28:40 +0000 (UTC)

+

+Commit 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will

+handle the display off hotkey") causes the backlight to be permanently off

+on various EeePC laptop models using the eeepc-wmi driver (Asus EeePC

+1015BX, Asus EeePC 1025C).

+

+The asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL) call added

+by that commit is made conditional in this commit and only enabled in

+the quirk_entry structs in the asus-nb-wmi driver fixing the broken

+display / backlight on various EeePC laptop models.

+

+Cc: João Paulo Rechi Vita <jprvita@endlessm.com>

+Fixes: 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey")

+Signed-off-by: Hans de Goede <hdegoede@redhat.com>

+---

+ drivers/platform/x86/asus-nb-wmi.c | 8 ++++++++

+ drivers/platform/x86/asus-wmi.c    | 2 +-

+ drivers/platform/x86/asus-wmi.h    | 1 +

+ 3 files changed, 10 insertions(+), 1 deletion(-)

+

+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c

+index b6f2ff95c3ed..59f3a37a44d7 100644

+--- a/drivers/platform/x86/asus-nb-wmi.c

++++ b/drivers/platform/x86/asus-nb-wmi.c

+@@ -78,10 +78,12 @@ static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str,

+ 

+ static struct quirk_entry quirk_asus_unknown = {

+ 	.wapf = 0,

++	.wmi_backlight_set_devstate = true,

+ };

+ 

+ static struct quirk_entry quirk_asus_q500a = {

+ 	.i8042_filter = asus_q500a_i8042_filter,

++	.wmi_backlight_set_devstate = true,

+ };

+ 

+ /*

+@@ -92,26 +94,32 @@ static struct quirk_entry quirk_asus_q500a = {

+ static struct quirk_entry quirk_asus_x55u = {

+ 	.wapf = 4,

+ 	.wmi_backlight_power = true,

++	.wmi_backlight_set_devstate = true,

+ 	.no_display_toggle = true,

+ };

+ 

+ static struct quirk_entry quirk_asus_wapf4 = {

+ 	.wapf = 4,

++	.wmi_backlight_set_devstate = true,

+ };

+ 

+ static struct quirk_entry quirk_asus_x200ca = {

+ 	.wapf = 2,

++	.wmi_backlight_set_devstate = true,

+ };

+ 

+ static struct quirk_entry quirk_asus_ux303ub = {

+ 	.wmi_backlight_native = true,

++	.wmi_backlight_set_devstate = true,

+ };

+ 

+ static struct quirk_entry quirk_asus_x550lb = {

++	.wmi_backlight_set_devstate = true,

+ 	.xusb2pr = 0x01D9,

+ };

+ 

+ static struct quirk_entry quirk_asus_forceals = {

++	.wmi_backlight_set_devstate = true,

+ 	.wmi_force_als_set = true,

+ };

+ 

+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c

+index ee1fa93708ec..a66e99500c12 100644

+--- a/drivers/platform/x86/asus-wmi.c

++++ b/drivers/platform/x86/asus-wmi.c

+@@ -2131,7 +2131,7 @@ static int asus_wmi_add(struct platform_device *pdev)

+ 		err = asus_wmi_backlight_init(asus);

+ 		if (err && err != -ENODEV)

+ 			goto fail_backlight;

+-	} else

++	} else if (asus->driver->quirks->wmi_backlight_set_devstate)

+ 		err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL);

+ 

+ 	status = wmi_install_notify_handler(asus->driver->event_guid,

+diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h

+index 6c1311f4b04d..57a79bddb286 100644

+--- a/drivers/platform/x86/asus-wmi.h

++++ b/drivers/platform/x86/asus-wmi.h

+@@ -44,6 +44,7 @@ struct quirk_entry {

+ 	bool store_backlight_power;

+ 	bool wmi_backlight_power;

+ 	bool wmi_backlight_native;

++	bool wmi_backlight_set_devstate;

+ 	bool wmi_force_als_set;

+ 	int wapf;

+ 	/*

+-- 

+2.21.0

+

diff --git a/drm-panel-orientation-quirks.patch b/drm-panel-orientation-quirks.patch
new file mode 100644
index 000000000..7504fab7b
--- /dev/null
+++ b/drm-panel-orientation-quirks.patch
@@ -0,0 +1,113 @@
+From 0dfd69f0ef79517b722c36000b20c64a6263519d Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 21 May 2019 17:02:15 +0200
+Subject: [PATCH 1/2] drm: panel-orientation-quirks: Add quirk for GPD pocket2
+
+GPD has done it again, make a nice device (good), use way too generic
+DMI strings (bad) and use a portrait screen rotated 90 degrees (ugly).
+
+Because of the too generic DMI strings this entry is also doing bios-date
+matching, so the gpd_pocket2 data struct may very well need to be updated
+with some extra bios-dates in the future.
+
+Changes in v2:
+-Add one more known BIOS date to the list of BIOS dates
+
+Cc: Jurgen Kramer <gtmkramer@xs4all.nl>
+Reported-by: Jurgen Kramer <gtmkramer@xs4all.nl>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 521aff99b08a..98679c831f66 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -50,6 +50,14 @@ static const struct drm_dmi_panel_orientation_data gpd_pocket = {
+ 	.orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+ };
+ 
++static const struct drm_dmi_panel_orientation_data gpd_pocket2 = {
++	.width = 1200,
++	.height = 1920,
++	.bios_dates = (const char * const []){ "06/28/2018", "08/28/2018",
++		"12/07/2018", NULL },
++	.orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data gpd_win = {
+ 	.width = 720,
+ 	.height = 1280,
+@@ -112,6 +120,14 @@ static const struct dmi_system_id orientation_data[] = {
+ 		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
+ 		},
+ 		.driver_data = (void *)&gpd_pocket,
++	}, {	/* GPD Pocket 2 (generic strings, also match on bios date) */
++		.matches = {
++		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
++		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
++		  DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
++		  DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
++		},
++		.driver_data = (void *)&gpd_pocket2,
+ 	}, {	/* GPD Win (same note on DMI match as GPD Pocket) */
+ 		.matches = {
+ 		  DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
+-- 
+2.21.0
+
+From de2393a0d476c441c7afb4e5df1c31e53aef2cbc Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 23 May 2019 12:09:29 +0200
+Subject: [PATCH 2/2] drm: panel-orientation-quirks: Add quirk for GPD MicroPC
+
+GPD has done it again, make a nice device (good), use way too generic
+DMI strings (bad) and use a portrait screen rotated 90 degrees (ugly).
+
+Because of the too generic DMI strings this entry is also doing bios-date
+matching, so the gpd_micropc data struct may very well need to be updated
+with some extra bios-dates in the future.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 98679c831f66..d8a0bcd02f34 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -42,6 +42,14 @@ static const struct drm_dmi_panel_orientation_data asus_t100ha = {
+ 	.orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP,
+ };
+ 
++static const struct drm_dmi_panel_orientation_data gpd_micropc = {
++	.width = 720,
++	.height = 1280,
++	.bios_dates = (const char * const []){ "04/26/2019",
++		NULL },
++	.orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data gpd_pocket = {
+ 	.width = 1200,
+ 	.height = 1920,
+@@ -107,6 +115,14 @@ static const struct dmi_system_id orientation_data[] = {
+ 		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"),
+ 		},
+ 		.driver_data = (void *)&asus_t100ha,
++	}, {	/* GPD MicroPC (generic strings, also match on bios date) */
++		.matches = {
++		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
++		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
++		  DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
++		  DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
++		},
++		.driver_data = (void *)&gpd_micropc,
+ 	}, {	/*
+ 		 * GPD Pocket, note that the the DMI data is less generic then
+ 		 * it seems, devices with a board-vendor of "AMI Corporation"
+-- 
+2.21.0
+
diff --git a/efi-bgrt-acpi6.2-support.patch b/efi-bgrt-acpi6.2-support.patch
new file mode 100644
index 000000000..753c93577
--- /dev/null
+++ b/efi-bgrt-acpi6.2-support.patch
@@ -0,0 +1,82 @@
+From 240090cb2d72f5de98f8fc2e3aa27803cab378b2 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 29 May 2019 14:50:17 +0200
+Subject: [PATCH] efi/bgrt: Drop BGRT status field reserved bits check
+
+Starting with ACPI 6.2 bits 1 and 2 of the BGRT status field are no longer
+reserved. These bits are now used to indicate if the image needs to be
+rotated before being displayed.
+
+The first device using these bits has now shown up (the GPD MicroPC) and
+the reserved bits check causes us to reject the valid BGRT table on this
+device.
+
+Rather then changing the reserved bits check, allowing only the 2 new bits,
+instead just completely remove it so that we do not end up with a similar
+problem when more bits are added in the future.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/firmware/efi/efi-bgrt.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c
+index a2384184a7de..b07c17643210 100644
+--- a/drivers/firmware/efi/efi-bgrt.c
++++ b/drivers/firmware/efi/efi-bgrt.c
+@@ -47,11 +47,6 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
+ 		       bgrt->version);
+ 		goto out;
+ 	}
+-	if (bgrt->status & 0xfe) {
+-		pr_notice("Ignoring BGRT: reserved status bits are non-zero %u\n",
+-		       bgrt->status);
+-		goto out;
+-	}
+ 	if (bgrt->image_type != 0) {
+ 		pr_notice("Ignoring BGRT: invalid image type %u (expected 0)\n",
+ 		       bgrt->image_type);
+-- 
+2.21.0
+
+From 8f8d779bd966ef8af2279906772dec322220e73a Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 29 May 2019 15:44:09 +0200
+Subject: [PATCH] efifb: BGRT: Add check for new BGRT status field rotation
+ bits
+
+Starting with ACPI 6.2 bits 1 and 2 of the BGRT status field are no longer
+reserved. These bits are now used to indicate if the image needs to be
+rotated before being displayed.
+
+The efifb code does not support rotating the image before copying it to
+the screen.
+
+This commit adds a check for these new bits and if they are set leaves the
+fb contents as is instead of trying to use the un-rotated BGRT image.
+
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/video/fbdev/efifb.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
+index 9f39f0c360e0..dfa8dd47d19d 100644
+--- a/drivers/video/fbdev/efifb.c
++++ b/drivers/video/fbdev/efifb.c
+@@ -169,6 +169,11 @@ static void efifb_show_boot_graphics(struct fb_info *info)
+ 		return;
+ 	}
+ 
++	if (bgrt_tab.status & 0x06) {
++		pr_info("efifb: BGRT rotation bits set, not showing boot graphics\n");
++		return;
++	}
++
+ 	/* Avoid flashing the logo if we're going to print std probe messages */
+ 	if (console_loglevel > CONSOLE_LOGLEVEL_QUIET)
+ 		return;
+-- 
+2.21.0
+
diff --git a/kernel.spec b/kernel.spec
index 22d046b45..133cc224b 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -645,6 +645,17 @@ Patch539: usb-dwc2-Fix-DMA-cache-alignment-issues.patch
 # Mainlined, https://bugzilla.redhat.com/show_bug.cgi?id=1716289
 Patch540: 0001-netfilter-nat-fix-udp-checksum-corruption.patch
 
+# CVE-2019-10126 rhbz 1716992 1720122
+Patch541: mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_ies.patch
+
+# 1697069 LCD panel an Asus EeePC 1025C not lighting up, submitted upstream
+Patch542: 0001-platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch
+
+# Fix the LCD panel on the GPD MicroPC not working, pending as fixes for 5.2
+Patch543: 0001-drm-i915-dsi-Use-a-fuzzy-check-for-burst-mode-clock-.patch
+Patch544: drm-panel-orientation-quirks.patch
+Patch545: efi-bgrt-acpi6.2-support.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1886,6 +1897,13 @@ fi
 #
 #
 %changelog
+* Fri Jun 14 2019 Hans de Goede <hdegoede@redhat.com>
+- Fix the LCD panel an Asus EeePC 1025C not lighting up (rhbz#1697069)
+- Fix the LCD panel on the GPD MicroPC not working
+
+* Thu Jun 13 2019 Justin M. Forbes <jforbes@fedoraproject.org>
+- Fix CVE-2019-10126 (rhbz 1716992 1720122)
+
 * Tue Jun 11 2019 Jeremy Cline <jcline@redhat.com> - 5.1.9-300
 - Linux v5.1.9
 - Fix UDP checkshums for SIP packets (rhbz 1716289)
diff --git a/mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_ies.patch b/mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_ies.patch
new file mode 100644
index 000000000..c9a0f13a7
--- /dev/null
+++ b/mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_ies.patch
@@ -0,0 +1,173 @@
+From patchwork Fri May 31 13:18:41 2019
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Takashi Iwai <tiwai@suse.de>
+X-Patchwork-Id: 10970141
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org
+ [172.30.200.125])
+	by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A2FA614C0
+	for <patchwork-linux-wireless@patchwork.kernel.org>;
+ Fri, 31 May 2019 13:19:19 +0000 (UTC)
+Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1])
+	by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 914E928CA2
+	for <patchwork-linux-wireless@patchwork.kernel.org>;
+ Fri, 31 May 2019 13:19:19 +0000 (UTC)
+Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486)
+	id 858EA28CA3; Fri, 31 May 2019 13:19:19 +0000 (UTC)
+X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
+	pdx-wl-mail.web.codeaurora.org
+X-Spam-Level: 
+X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI,
+	RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+	by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C4AB628CB5
+	for <patchwork-linux-wireless@patchwork.kernel.org>;
+ Fri, 31 May 2019 13:19:18 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S1726687AbfEaNTR (ORCPT
+        <rfc822;patchwork-linux-wireless@patchwork.kernel.org>);
+        Fri, 31 May 2019 09:19:17 -0400
+Received: from mx2.suse.de ([195.135.220.15]:46148 "EHLO mx1.suse.de"
+        rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP
+        id S1726330AbfEaNTR (ORCPT <rfc822;linux-wireless@vger.kernel.org>);
+        Fri, 31 May 2019 09:19:17 -0400
+X-Virus-Scanned: by amavisd-new at test-mx.suse.de
+Received: from relay2.suse.de (unknown [195.135.220.254])
+        by mx1.suse.de (Postfix) with ESMTP id A72A4AE4D;
+        Fri, 31 May 2019 13:19:15 +0000 (UTC)
+From: Takashi Iwai <tiwai@suse.de>
+To: Kalle Valo <kvalo@codeaurora.org>
+Cc: Amitkumar Karwar <amitkarwar@gmail.com>,
+        Nishant Sarmukadam <nishants@marvell.com>,
+        Ganapathi Bhat <gbhat@marvell.com>,
+        Xinming Hu <huxinming820@gmail.com>,
+        huangwen <huangwen@venustech.com.cn>,
+        Solar Designer <solar@openwall.com>,
+        Marcus Meissner <meissner@suse.de>,
+        linux-wireless@vger.kernel.org
+Subject: [PATCH] mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()
+Date: Fri, 31 May 2019 15:18:41 +0200
+Message-Id: <20190531131841.7552-1-tiwai@suse.de>
+X-Mailer: git-send-email 2.16.4
+Sender: linux-wireless-owner@vger.kernel.org
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+X-Virus-Scanned: ClamAV using ClamSMTP
+
+A few places in mwifiex_uap_parse_tail_ies() perform memcpy()
+unconditionally, which may lead to either buffer overflow or read over
+boundary.
+
+This patch addresses the issues by checking the read size and the
+destination size at each place more properly.  Along with the fixes,
+the patch cleans up the code slightly by introducing a temporary
+variable for the token size, and unifies the error path with the
+standard goto statement.
+
+Reported-by: huangwen <huangwen@venustech.com.cn>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+---
+ drivers/net/wireless/marvell/mwifiex/ie.c | 47 ++++++++++++++++++++-----------
+ 1 file changed, 31 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/ie.c b/drivers/net/wireless/marvell/mwifiex/ie.c
+index 6845eb57b39a..653d347a9a19 100644
+--- a/drivers/net/wireless/marvell/mwifiex/ie.c
++++ b/drivers/net/wireless/marvell/mwifiex/ie.c
+@@ -329,6 +329,8 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
+ 	struct ieee80211_vendor_ie *vendorhdr;
+ 	u16 gen_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0;
+ 	int left_len, parsed_len = 0;
++	unsigned int token_len;
++	int err = 0;
+ 
+ 	if (!info->tail || !info->tail_len)
+ 		return 0;
+@@ -344,6 +346,12 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
+ 	 */
+ 	while (left_len > sizeof(struct ieee_types_header)) {
+ 		hdr = (void *)(info->tail + parsed_len);
++		token_len = hdr->len + sizeof(struct ieee_types_header);
++		if (token_len > left_len) {
++			err = -EINVAL;
++			goto out;
++		}
++
+ 		switch (hdr->element_id) {
+ 		case WLAN_EID_SSID:
+ 		case WLAN_EID_SUPP_RATES:
+@@ -361,17 +369,20 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
+ 			if (cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
+ 						    WLAN_OUI_TYPE_MICROSOFT_WMM,
+ 						    (const u8 *)hdr,
+-						    hdr->len + sizeof(struct ieee_types_header)))
++						    token_len))
+ 				break;
+ 			/* fall through */
+ 		default:
+-			memcpy(gen_ie->ie_buffer + ie_len, hdr,
+-			       hdr->len + sizeof(struct ieee_types_header));
+-			ie_len += hdr->len + sizeof(struct ieee_types_header);
++			if (ie_len + token_len > IEEE_MAX_IE_SIZE) {
++				err = -EINVAL;
++				goto out;
++			}
++			memcpy(gen_ie->ie_buffer + ie_len, hdr, token_len);
++			ie_len += token_len;
+ 			break;
+ 		}
+-		left_len -= hdr->len + sizeof(struct ieee_types_header);
+-		parsed_len += hdr->len + sizeof(struct ieee_types_header);
++		left_len -= token_len;
++		parsed_len += token_len;
+ 	}
+ 
+ 	/* parse only WPA vendor IE from tail, WMM IE is configured by
+@@ -381,15 +392,17 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
+ 						    WLAN_OUI_TYPE_MICROSOFT_WPA,
+ 						    info->tail, info->tail_len);
+ 	if (vendorhdr) {
+-		memcpy(gen_ie->ie_buffer + ie_len, vendorhdr,
+-		       vendorhdr->len + sizeof(struct ieee_types_header));
+-		ie_len += vendorhdr->len + sizeof(struct ieee_types_header);
++		token_len = vendorhdr->len + sizeof(struct ieee_types_header);
++		if (ie_len + token_len > IEEE_MAX_IE_SIZE) {
++			err = -EINVAL;
++			goto out;
++		}
++		memcpy(gen_ie->ie_buffer + ie_len, vendorhdr, token_len);
++		ie_len += token_len;
+ 	}
+ 
+-	if (!ie_len) {
+-		kfree(gen_ie);
+-		return 0;
+-	}
++	if (!ie_len)
++		goto out;
+ 
+ 	gen_ie->ie_index = cpu_to_le16(gen_idx);
+ 	gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON |
+@@ -399,13 +412,15 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
+ 
+ 	if (mwifiex_update_uap_custom_ie(priv, gen_ie, &gen_idx, NULL, NULL,
+ 					 NULL, NULL)) {
+-		kfree(gen_ie);
+-		return -1;
++		err = -EINVAL;
++		goto out;
+ 	}
+ 
+ 	priv->gen_idx = gen_idx;
++
++ out:
+ 	kfree(gen_ie);
+-	return 0;
++	return err;
+ }
+ 
+ /* This function parses different IEs-head & tail IEs, beacon IEs,