diff --git a/.kernel.metadata b/.kernel.metadata
index 6230047..9c34010 100644
--- a/.kernel.metadata
+++ b/.kernel.metadata
@@ -1,2 +1,2 @@
 40f3e72192d59c0b7a4638cebd0ea55d35a782bb  SOURCES/linux-4.19.tar.xz
-6135a68aa82864f7f8127a1254f66ed0c0275d26  SOURCES/patch-4.19.32.xz
+fb34003dd692474c184651618b963a1aeaa0a708  SOURCES/patch-4.19.34.xz
diff --git a/SOURCES/9999-centos-r40-v40-dts-update.patch b/SOURCES/9999-centos-r40-v40-dts-update.patch
new file mode 100644
index 0000000..a4a753c
--- /dev/null
+++ b/SOURCES/9999-centos-r40-v40-dts-update.patch
@@ -0,0 +1,469 @@
+From c41ca64d075020e2d5daecb7f48da6af0ba5b512 Mon Sep 17 00:00:00 2001
+From: Tuomas Tynkkynen <tuomas@tuxera.com>
+Date: Wed, 8 Aug 2018 02:25:53 +0300
+Subject: ARM: dts: sunxi: Don't use cd-inverted in sun8i-r40-bananapi-m2-ultra
+
+Another user of cd-inverted seems to have crept in. Switch it away from
+cd-inverted to be consistent with other sunxi boards.
+
+Signed-off-by: Tuomas Tynkkynen <tuomas@tuxera.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+---
+ arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+index c39b9169ea64..a891a387e8f1 100644
+--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
++++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+@@ -159,8 +159,7 @@
+ &mmc0 {
+ 	vmmc-supply = <&reg_dcdc1>;
+ 	bus-width = <4>;
+-	cd-gpios = <&pio 7 13 GPIO_ACTIVE_HIGH>; /* PH13 */
+-	cd-inverted;
++	cd-gpios = <&pio 7 13 GPIO_ACTIVE_LOW>; /* PH13 */
+ 	status = "okay";
+ };
+ 
+-- 
+cgit 1.2-0.3.lf.el7
+
+From e5c6e693be831c1bba9b4f8f1da597fb5514deca Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Wed, 9 Jan 2019 23:02:55 +0800
+Subject: ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix WiFi regulator
+ definitions
+
+The design of the Bananapi M2 Ultra has both DLDO1 and DLDO2 regulators
+provide power to the WiFi+BT module, which is based on the Broadcom
+BCM43438 or BCM43430 chip. Each regulator output from the PMIC can supply
+up to 200 mA. The datasheet of the chip suggests a maximum power draw of
+up to 360 mA when transmitting, thus requiring two outputs from the PMIC
+to handle the load. However the device tree only references one of them,
+leaving the other unused and possibly turned off.
+
+This patch marks both as always-on, since we don't have a proper binding
+to specify two regulators as "bound together". The name and constraints
+of DLDO2 are also added.
+
+Fixes: da7ac948fa93 ("ARM: dts: sun8i: Add board dts file for Banana Pi M2
+		      Ultra")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+---
+ arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+index 438b7b44dab3..1a6794e63b90 100644
+--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
++++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+@@ -250,12 +250,27 @@
+ 	regulator-name = "vcc-wifi-io";
+ };
+ 
++/*
++ * Our WiFi chip needs both DLDO2 and DLDO3 to be powered at the same
++ * time, with the two being in sync, to be able to meet maximum power
++ * consumption during transmits. Since this is not really supported
++ * right now, just use the two as always on, and we will fix it later.
++ */
++
+ &reg_dldo2 {
++	regulator-always-on;
+ 	regulator-min-microvolt = <3300000>;
+ 	regulator-max-microvolt = <3300000>;
+ 	regulator-name = "vcc-wifi";
+ };
+ 
++&reg_dldo3 {
++	regulator-always-on;
++	regulator-min-microvolt = <3300000>;
++	regulator-max-microvolt = <3300000>;
++	regulator-name = "vcc-wifi-2";
++};
++
+ &reg_dldo4 {
+ 	regulator-min-microvolt = <2500000>;
+ 	regulator-max-microvolt = <2500000>;
+-- 
+cgit 1.2-0.3.lf.el7
+
+From 0729b4af5753b65aa031f58c435da53dbbf56d19 Mon Sep 17 00:00:00 2001
+From: Rob Herring <robh@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:32 -0500
+Subject: ARM: dts: sunxi: Fix I2C bus warnings
+
+dtc has new checks for I2C buses. Fix the warnings in unit-addresses.
+
+arch/arm/boot/dts/sun8i-a23-gt90h-v4.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun8i-a23-inet86dz.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun8i-a23-polaroid-mid2407pxe03.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun8i-a23-polaroid-mid2809pxe04.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun8i-a33-ga10h-v1.1.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun8i-a33-inet-d978-rev2.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: missing or empty reg property
+arch/arm/boot/dts/sun8i-a33-ippo-q8h-v1.2.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: missing or empty reg property
+arch/arm/boot/dts/sun8i-a33-q8-tablet.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: missing or empty reg property
+arch/arm/boot/dts/sun5i-a13-utoo-p66.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: I2C bus unit address format error, expected "40"
+arch/arm/boot/dts/sun5i-a13-difrnce-dit4350.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property
+arch/arm/boot/dts/sun5i-a13-empire-electronix-m712.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property
+arch/arm/boot/dts/sun5i-a13-inet-98v-rev2.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property
+arch/arm/boot/dts/sun5i-a13-q8-tablet.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property
+
+Cc: Maxime Ripard <maxime.ripard@bootlin.com>
+Cc: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+---
+ arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+(limited to 'arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts')
+
+diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+index 35859d8f3267..bf97f6244c23 100644
+--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+@@ -95,7 +95,7 @@
+ &i2c0 {
+ 	status = "okay";
+ 
+-	axp22x: pmic@68 {
++	axp22x: pmic@34 {
+ 		compatible = "x-powers,axp221";
+ 		reg = <0x34>;
+ 		interrupt-parent = <&nmi_intc>;
+-- 
+cgit 1.2-0.3.lf.el7
+
+From 933ea7e9d143cee0c8c3bdc274afa69c91d91d61 Mon Sep 17 00:00:00 2001
+From: Pablo Greco <pgreco@centosproject.org>
+Date: Wed, 10 Apr 2019 18:59:25 -0300
+Subject: [PATCH v2 1/6] ARM: dts: sun8i: v40: bananapi-m2-berry: Sort device
+ node dereferences.
+
+The device node dereferences are out of order, sort them.
+
+Signed-off-by: Pablo Greco <pgreco@centosproject.org>
+---
+ arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 36 +++++++++++------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+index bf97f62..f05cabd 100644
+--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+@@ -105,6 +105,24 @@
+ 
+ #include "axp22x.dtsi"
+ 
++&mmc0 {
++	vmmc-supply = <&reg_dcdc1>;
++	bus-width = <4>;
++	cd-gpios = <&pio 7 13 GPIO_ACTIVE_LOW>; /* PH13 */
++	status = "okay";
++};
++
++&mmc1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&mmc1_pg_pins>;
++	vmmc-supply = <&reg_dldo2>;
++	vqmmc-supply = <&reg_dldo1>;
++	mmc-pwrseq = <&wifi_pwrseq>;
++	bus-width = <4>;
++	non-removable;
++	status = "okay";
++};
++
+ &reg_aldo3 {
+ 	regulator-always-on;
+ 	regulator-min-microvolt = <2700000>;
+@@ -152,24 +170,6 @@
+ 	regulator-name = "vcc-wifi";
+ };
+ 
+-&mmc0 {
+-	vmmc-supply = <&reg_dcdc1>;
+-	bus-width = <4>;
+-	cd-gpios = <&pio 7 13 GPIO_ACTIVE_LOW>; /* PH13 */
+-	status = "okay";
+-};
+-
+-&mmc1 {
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&mmc1_pg_pins>;
+-	vmmc-supply = <&reg_dldo2>;
+-	vqmmc-supply = <&reg_dldo1>;
+-	mmc-pwrseq = <&wifi_pwrseq>;
+-	bus-width = <4>;
+-	non-removable;
+-	status = "okay";
+-};
+-
+ &uart0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&uart0_pb_pins>;
+-- 
+1.8.3.1
+
+From 745c1a105e34553caf247215cdcefa30db95092a Mon Sep 17 00:00:00 2001
+From: Pablo Greco <pgreco@centosproject.org>
+Date: Thu, 11 Apr 2019 13:58:49 -0300
+Subject: [PATCH v2 2/6] ARM: dts: sun8i: v40: bananapi-m2-berry: Enable GMAC
+ ethernet controller
+
+Just like the Bananapi M2 Ultra, the Bananapi M2 Berry has a Realtek
+RTL8211E RGMII PHY tied to the GMAC.
+The PMIC's DC1SW output provides power for the PHY, while the ALDO2
+output provides I/O voltages on both sides.
+
+Signed-off-by: Pablo Greco <pgreco@centosproject.org>
+---
+ arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 30 +++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+index f05cabd..0d79e91 100644
+--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+@@ -50,6 +50,7 @@
+ 	compatible = "sinovoip,bpi-m2-berry", "allwinner,sun8i-r40";
+ 
+ 	aliases {
++		ethernet0 = &gmac;
+ 		serial0 = &uart0;
+ 	};
+ 
+@@ -92,6 +93,22 @@
+ 	status = "okay";
+ };
+ 
++&gmac {
++	pinctrl-names = "default";
++	pinctrl-0 = <&gmac_rgmii_pins>;
++	phy-handle = <&phy1>;
++	phy-mode = "rgmii";
++	phy-supply = <&reg_dc1sw>;
++	status = "okay";
++};
++
++&gmac_mdio {
++	phy1: ethernet-phy@1 {
++		compatible = "ethernet-phy-ieee802.3-c22";
++		reg = <1>;
++	};
++};
++
+ &i2c0 {
+ 	status = "okay";
+ 
+@@ -123,6 +140,13 @@
+ 	status = "okay";
+ };
+ 
++&reg_aldo2 {
++	regulator-always-on;
++	regulator-min-microvolt = <2500000>;
++	regulator-max-microvolt = <2500000>;
++	regulator-name = "vcc-pa";
++};
++
+ &reg_aldo3 {
+ 	regulator-always-on;
+ 	regulator-min-microvolt = <2700000>;
+@@ -130,6 +154,12 @@
+ 	regulator-name = "avcc";
+ };
+ 
++&reg_dc1sw {
++	regulator-min-microvolt = <3000000>;
++	regulator-max-microvolt = <3000000>;
++	regulator-name = "vcc-gmac-phy";
++};
++
+ &reg_dcdc1 {
+ 	regulator-always-on;
+ 	regulator-min-microvolt = <3000000>;
+-- 
+1.8.3.1
+
+From 274ba1411bac61fcecdf021a13d645891e7b723c Mon Sep 17 00:00:00 2001
+From: Pablo Greco <pgreco@centosproject.org>
+Date: Thu, 11 Apr 2019 14:00:05 -0300
+Subject: [PATCH v2 3/6] ARM: dts: sun8i: v40: bananapi-m2-berry: Enable HDMI
+ output
+
+This patch adds the hdmi nodes to the Bananapi M2 Berry, the same way it
+was done to the Bananapi M2 Ultra
+
+Signed-off-by: Pablo Greco <pgreco@centosproject.org>
+---
+ arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 29 +++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+index 0d79e91..2a5b80b 100644
+--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+@@ -58,6 +58,17 @@
+ 		stdout-path = "serial0:115200n8";
+ 	};
+ 
++	connector {
++		compatible = "hdmi-connector";
++		type = "a";
++
++		port {
++			hdmi_con_in: endpoint {
++				remote-endpoint = <&hdmi_out_con>;
++			};
++		};
++	};
++
+ 	leds {
+ 		compatible = "gpio-leds";
+ 
+@@ -88,6 +99,10 @@
+ 	};
+ };
+ 
++&de {
++	status = "okay";
++};
++
+ &ehci1 {
+ 	/* Terminus Tech FE 1.1s 4-port USB 2.0 hub here */
+ 	status = "okay";
+@@ -109,6 +124,16 @@
+ 	};
+ };
+ 
++&hdmi {
++	status = "okay";
++};
++
++&hdmi_out {
++	hdmi_out_con: endpoint {
++		remote-endpoint = <&hdmi_con_in>;
++	};
++};
++
+ &i2c0 {
+ 	status = "okay";
+ 
+@@ -200,6 +225,10 @@
+ 	regulator-name = "vcc-wifi";
+ };
+ 
++&tcon_tv0 {
++	status = "okay";
++};
++
+ &uart0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&uart0_pb_pins>;
+-- 
+1.8.3.1
+
+From e91ec82e21aaf29f1453053175050b8230c2b495 Mon Sep 17 00:00:00 2001
+From: Pablo Greco <pgreco@centosproject.org>
+Date: Thu, 11 Apr 2019 14:03:54 -0300
+Subject: [PATCH v2 4/6] ARM: dts: sun8i: v40: bananapi-m2-berry: Enable AHCI
+
+Just like the Bananapi M2 Ultra, enable the ahci controller and
+the two regulators needed to activate it.
+
+Signed-off-by: Pablo Greco <pgreco@centosproject.org>
+---
+ arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+index 2a5b80b..c37c7ab 100644
+--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+@@ -99,6 +99,12 @@
+ 	};
+ };
+ 
++&ahci {
++	ahci-supply = <&reg_dldo4>;
++	phy-supply = <&reg_eldo3>;
++	status = "okay";
++};
++
+ &de {
+ 	status = "okay";
+ };
+@@ -225,6 +231,18 @@
+ 	regulator-name = "vcc-wifi";
+ };
+ 
++&reg_dldo4 {
++	regulator-min-microvolt = <2500000>;
++	regulator-max-microvolt = <2500000>;
++	regulator-name = "vdd2v5-sata";
++};
++
++&reg_eldo3 {
++	regulator-min-microvolt = <1200000>;
++	regulator-max-microvolt = <1200000>;
++	regulator-name = "vdd1v2-sata";
++};
++
+ &tcon_tv0 {
+ 	status = "okay";
+ };
+-- 
+1.8.3.1
+
+From df95d67e4385275586d3f91ee145f8d13885a560 Mon Sep 17 00:00:00 2001
+From: Pablo Greco <pgreco@centosproject.org>
+Date: Thu, 11 Apr 2019 14:04:35 -0300
+Subject: [PATCH v2 5/6] ARM: dts: sun8i: v40: bananapi-m2-berry: Fix WiFi
+ regulator definitions
+
+Just like was done for the bananapi-m2-ultra, add the second wifi/bt
+regulator and mark both as always-on.
+
+Signed-off-by: Pablo Greco <pgreco@centosproject.org>
+---
+ arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+index c37c7ab..78f4a1a 100644
+--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts
+@@ -225,12 +225,27 @@
+ 	regulator-name = "vcc-wifi-io";
+ };
+ 
++/*
++ * Our WiFi chip needs both DLDO2 and DLDO3 to be powered at the same
++ * time, with the two being in sync, to be able to meet maximum power
++ * consumption during transmits. Since this is not really supported
++ * right now, just use the two as always on, and we will fix it later.
++ */
++
+ &reg_dldo2 {
++	regulator-always-on;
+ 	regulator-min-microvolt = <3300000>;
+ 	regulator-max-microvolt = <3300000>;
+ 	regulator-name = "vcc-wifi";
+ };
+ 
++&reg_dldo3 {
++	regulator-always-on;
++	regulator-min-microvolt = <3300000>;
++	regulator-max-microvolt = <3300000>;
++	regulator-name = "vcc-wifi-2";
++};
++
+ &reg_dldo4 {
+ 	regulator-min-microvolt = <2500000>;
+ 	regulator-max-microvolt = <2500000>;
+-- 
+1.8.3.1
+
diff --git a/SOURCES/9999-centos-r40sata.patch b/SOURCES/9999-centos-r40sata.patch
index d47fc6b..09e1f11 100644
--- a/SOURCES/9999-centos-r40sata.patch
+++ b/SOURCES/9999-centos-r40sata.patch
@@ -1602,3 +1602,69 @@ index a891a387e8f1..438b7b44dab3 100644
  &tcon_tv0 {
  	status = "okay";
  };
+From b9f6b80e04ad061ff4e12bdb72ea21af3518d79f Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+Date: Mon, 25 Mar 2019 14:52:44 +0100
+Subject: ARM: dts: sun8i: r40: Fix AHCI reset-names property
+
+The AHCI node was introduced with a typo in the reset-names property that
+got written resets-name instead.
+
+This was working because the reset is optional for that driver, and the
+controller was put out of reset by the bootloader.
+
+Fixes: 41c64d3318aa ("ARM: dts: sun8i: r40: add sata node")
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+---
+ arch/arm/boot/dts/sun8i-r40.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+(limited to 'arch/arm/boot/dts/sun8i-r40.dtsi')
+
+diff --git a/arch/arm/boot/dts/sun8i-r40.dtsi b/arch/arm/boot/dts/sun8i-r40.dtsi
+index 1061d46efafd..9784c23346a8 100644
+--- a/arch/arm/boot/dts/sun8i-r40.dtsi
++++ b/arch/arm/boot/dts/sun8i-r40.dtsi
+@@ -562,7 +562,7 @@
+ 			interrupts = <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&ccu CLK_BUS_SATA>, <&ccu CLK_SATA>;
+ 			resets = <&ccu RST_BUS_SATA>;
+-			resets-name = "ahci";
++			reset-names = "ahci";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			status = "disabled";
+-- 
+cgit 1.2-0.3.lf.el7
+
+From 327384569871e7e3ed637d89726abacda3902098 Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+Date: Mon, 25 Mar 2019 14:52:45 +0100
+Subject: ARM: dts: sun8i: r40: Remove useless AHCI properties
+
+The SATA controller never have any children nodes, so we don't need the
+address and size cells properties.
+
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+---
+ arch/arm/boot/dts/sun8i-r40.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-r40.dtsi b/arch/arm/boot/dts/sun8i-r40.dtsi
+index 9784c23346a8..56c6885b02d1 100644
+--- a/arch/arm/boot/dts/sun8i-r40.dtsi
++++ b/arch/arm/boot/dts/sun8i-r40.dtsi
+@@ -563,8 +563,6 @@
+ 			clocks = <&ccu CLK_BUS_SATA>, <&ccu CLK_SATA>;
+ 			resets = <&ccu RST_BUS_SATA>;
+ 			reset-names = "ahci";
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+ 			status = "disabled";
+ 
+ 		};
+-- 
+cgit 1.2-0.3.lf.el7
+
diff --git a/SOURCES/CVE-2019-3459-and-CVE-2019-3460.patch b/SOURCES/CVE-2019-3459-and-CVE-2019-3460.patch
deleted file mode 100644
index c7fa627..0000000
--- a/SOURCES/CVE-2019-3459-and-CVE-2019-3460.patch
+++ /dev/null
@@ -1,167 +0,0 @@
-From 20614b74e481f0c9f94032ae99f110d4647b65a6 Mon Sep 17 00:00:00 2001
-From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Date: Thu, 10 Jan 2019 07:28:33 +0100
-Subject: [PATCH 1/2] Bluetooth: check message types in l2cap_get_conf_opt
-
-l2cap_get_conf_opt can handle a "default" message type, but it needs to
-be verified that it really is the correct type (CONF_EFS or CONF_RFC)
-before passing it back to the caller.  To do this we need to check the
-return value of this call now and handle the error correctly up the
-stack.
-
-Based on a patch from Ran Menscher.
-
-Reported-by: Ran Menscher <ran.menscher@karambasecurity.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Jeremy Cline <jcline@redhat.com>
----
- net/bluetooth/l2cap_core.c | 25 +++++++++++++++++++------
- 1 file changed, 19 insertions(+), 6 deletions(-)
-
-diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
-index d17a4736e47c..a0ce6e8e5ef7 100644
---- a/net/bluetooth/l2cap_core.c
-+++ b/net/bluetooth/l2cap_core.c
-@@ -2979,6 +2979,10 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
- 		break;
- 
- 	default:
-+		/* Only CONF_EFS and CONF_RFC are allowed here */
-+		if ((opt->type != L2CAP_CONF_EFS) &&
-+		    (opt->type != L2CAP_CONF_RFC))
-+			return -EPROTO;
- 		*val = (unsigned long) opt->val;
- 		break;
- 	}
-@@ -3323,7 +3327,7 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
- 	void *endptr = data + data_size;
- 	void *req = chan->conf_req;
- 	int len = chan->conf_len;
--	int type, hint, olen;
-+	int type, hint, olen, err;
- 	unsigned long val;
- 	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
- 	struct l2cap_conf_efs efs;
-@@ -3335,7 +3339,10 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
- 	BT_DBG("chan %p", chan);
- 
- 	while (len >= L2CAP_CONF_OPT_SIZE) {
--		len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
-+		err = l2cap_get_conf_opt(&req, &type, &olen, &val);
-+		if (err < 0)
-+			return err;
-+		len -= err;
- 
- 		hint  = type & L2CAP_CONF_HINT;
- 		type &= L2CAP_CONF_MASK;
-@@ -3538,7 +3545,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
- 	struct l2cap_conf_req *req = data;
- 	void *ptr = req->data;
- 	void *endptr = data + size;
--	int type, olen;
-+	int type, olen, err;
- 	unsigned long val;
- 	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
- 	struct l2cap_conf_efs efs;
-@@ -3546,7 +3553,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
- 	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
- 
- 	while (len >= L2CAP_CONF_OPT_SIZE) {
--		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
-+		err = l2cap_get_conf_opt(&rsp, &type, &olen, &val);
-+		if (err < 0)
-+			return err;
-+		len -= err;
- 
- 		switch (type) {
- 		case L2CAP_CONF_MTU:
-@@ -3706,7 +3716,7 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
- 
- static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
- {
--	int type, olen;
-+	int type, olen, err;
- 	unsigned long val;
- 	/* Use sane default values in case a misbehaving remote device
- 	 * did not send an RFC or extended window size option.
-@@ -3726,7 +3736,10 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
- 		return;
- 
- 	while (len >= L2CAP_CONF_OPT_SIZE) {
--		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
-+		err = l2cap_get_conf_opt(&rsp, &type, &olen, &val);
-+		if (err < 0)
-+			return;
-+		len -= err;
- 
- 		switch (type) {
- 		case L2CAP_CONF_RFC:
--- 
-2.20.1
-
-From 50cd5314f5ffa264906f4986f414750d648c4ece Mon Sep 17 00:00:00 2001
-From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Date: Thu, 10 Jan 2019 07:29:17 +0100
-Subject: [PATCH 2/2] Bluetooth: check the buffer size for some messages before
- parsing
-
-The L2CAP_CONF_EFS and L2CAP_CONF_RFC messages can be sent from
-userspace so their structure sizes need to be checked before parsing
-them.
-
-Based on a patch from Ran Menscher.
-
-Reported-by: Ran Menscher <ran.menscher@karambasecurity.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Jeremy Cline <jcline@redhat.com>
----
- net/bluetooth/l2cap_core.c | 12 ++++++++----
- 1 file changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
-index a0ce6e8e5ef7..d8d3cbdc0d29 100644
---- a/net/bluetooth/l2cap_core.c
-+++ b/net/bluetooth/l2cap_core.c
-@@ -3360,7 +3360,8 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
- 			break;
- 
- 		case L2CAP_CONF_RFC:
--			if (olen == sizeof(rfc))
-+			if ((olen == sizeof(rfc)) &&
-+			    (endptr - ptr >= L2CAP_CONF_OPT_SIZE + sizeof(rfc)))
- 				memcpy(&rfc, (void *) val, olen);
- 			break;
- 
-@@ -3370,7 +3371,8 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
- 			break;
- 
- 		case L2CAP_CONF_EFS:
--			if (olen == sizeof(efs)) {
-+			if ((olen == sizeof(efs)) &&
-+			    (endptr - ptr >= L2CAP_CONF_OPT_SIZE + sizeof(efs))) {
- 				remote_efs = 1;
- 				memcpy(&efs, (void *) val, olen);
- 			}
-@@ -3575,7 +3577,8 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
- 			break;
- 
- 		case L2CAP_CONF_RFC:
--			if (olen == sizeof(rfc))
-+			if ((olen == sizeof(rfc)) &&
-+			    (endptr - ptr >= L2CAP_CONF_OPT_SIZE + sizeof(rfc)))
- 				memcpy(&rfc, (void *)val, olen);
- 
- 			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
-@@ -3595,7 +3598,8 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
- 			break;
- 
- 		case L2CAP_CONF_EFS:
--			if (olen == sizeof(efs)) {
-+			if ((olen == sizeof(efs)) &&
-+			    (endptr - ptr >= L2CAP_CONF_OPT_SIZE + sizeof(efs))) {
- 				memcpy(&efs, (void *)val, olen);
- 
- 				if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
--- 
-2.20.1
-
diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec
index 65a3957..a4fb681 100644
--- a/SPECS/kernel.spec
+++ b/SPECS/kernel.spec
@@ -54,7 +54,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 32
+%define stable_update 34
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -652,12 +652,10 @@ Patch516: asus-fx503-keyb.patch
 # rhbz 1661961 patch merged upstream in 4.20
 Patch517: 0001-Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM434.patch
 
-# CVE-2019-3459 and CVE-2019-3460 rbhz 1663176 1663179 1665925
-Patch519: CVE-2019-3459-and-CVE-2019-3460.patch
-
 ##centos
 Patch10002: 9999-centos-a83t-hdmi.patch
 Patch11002: 9999-centos-r40sata.patch
+Patch11003: 9999-centos-r40-v40-dts-update.patch
 ##end centos
 
 # END OF PATCH DEFINITIONS
@@ -2216,6 +2214,12 @@ fi
 #
 #
 %changelog
+* Sat Apr 13 2019 Pablo Greco <pablo@fliagreco.com.ar> - 4.19.34-300
+- Linux v4.19.34
+- Update device tree for BananaPi M2 Berry
+- Update device tree for BananaPi M2 Ultra
+- Remove upstreamed patches
+
 * Fri Mar 29 2019 Pablo Greco <pablo@fliagreco.com.ar> - 4.19.32-300
 - Linux v4.19.32