diff --git a/boards/kgpe-d16/kgpe-d16.config b/boards/kgpe-d16/kgpe-d16.config
index 58130699..6c2c4ac6 100644
--- a/boards/kgpe-d16/kgpe-d16.config
+++ b/boards/kgpe-d16/kgpe-d16.config
@@ -1,6 +1,7 @@
 # Configuration for a kgpe-d16 running non-Qubes
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-kgpe-d16.config
 CONFIG_LINUX_CONFIG=config/linux-kgpe-d16.config
diff --git a/boards/librem13v2/librem13v2.config b/boards/librem13v2/librem13v2.config
index 46837ed5..1fbbe88d 100644
--- a/boards/librem13v2/librem13v2.config
+++ b/boards/librem13v2/librem13v2.config
@@ -4,6 +4,7 @@ CONFIG_COREBOOT_CONFIG=config/coreboot-librem13v2.config
 
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_CRYPTSETUP=y
 CONFIG_FLASHROM=y
diff --git a/boards/librem13v4/librem13v4.config b/boards/librem13v4/librem13v4.config
index 5c5de684..f3996b39 100644
--- a/boards/librem13v4/librem13v4.config
+++ b/boards/librem13v4/librem13v4.config
@@ -4,6 +4,7 @@ CONFIG_COREBOOT_CONFIG=config/coreboot-librem13v4.config
 
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_CRYPTSETUP=y
 CONFIG_FLASHROM=y
diff --git a/boards/librem15v3/librem15v3.config b/boards/librem15v3/librem15v3.config
index 5177be03..7f116989 100644
--- a/boards/librem15v3/librem15v3.config
+++ b/boards/librem15v3/librem15v3.config
@@ -6,6 +6,7 @@ CONFIG_COREBOOT_CONFIG=config/coreboot-librem15v3.config
 
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_CRYPTSETUP=y
 CONFIG_FLASHROM=y
diff --git a/boards/librem15v4/librem15v4.config b/boards/librem15v4/librem15v4.config
index 9adf6ef8..651a6189 100644
--- a/boards/librem15v4/librem15v4.config
+++ b/boards/librem15v4/librem15v4.config
@@ -6,6 +6,7 @@ CONFIG_COREBOOT_CONFIG=config/coreboot-librem15v4.config
 
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_CRYPTSETUP=y
 CONFIG_FLASHROM=y
diff --git a/boards/qemu-coreboot-fbwhiptail/qemu-coreboot-fbwhiptail.config b/boards/qemu-coreboot-fbwhiptail/qemu-coreboot-fbwhiptail.config
index 73ced6ba..b6210ca7 100644
--- a/boards/qemu-coreboot-fbwhiptail/qemu-coreboot-fbwhiptail.config
+++ b/boards/qemu-coreboot-fbwhiptail/qemu-coreboot-fbwhiptail.config
@@ -3,6 +3,7 @@
 
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-qemu-fbwhiptail.config
 CONFIG_LINUX_CONFIG=config/linux-qemu.config
diff --git a/boards/qemu-coreboot/qemu-coreboot.config b/boards/qemu-coreboot/qemu-coreboot.config
index ce2a2fa7..dce3583e 100644
--- a/boards/qemu-coreboot/qemu-coreboot.config
+++ b/boards/qemu-coreboot/qemu-coreboot.config
@@ -3,6 +3,7 @@
 # will just drop into the recovery shell.
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-qemu.config
 CONFIG_LINUX_CONFIG=config/linux-qemu.config
diff --git a/boards/qemu-linuxboot/qemu-linuxboot.config b/boards/qemu-linuxboot/qemu-linuxboot.config
index 4a9a3317..64545789 100644
--- a/boards/qemu-linuxboot/qemu-linuxboot.config
+++ b/boards/qemu-linuxboot/qemu-linuxboot.config
@@ -1,6 +1,8 @@
 # Configuration for emulating LinuxBoot+Heads with qemu
 #
 export CONFIG_LINUXBOOT=y
+export CONFIG_LINUX_VERSION=4.14.62
+
 CONFIG_LINUXBOOT_BOARD=qemu
 CONFIG_LINUX_CONFIG=config/linux-linuxboot.config
 
diff --git a/boards/r630/r630.config b/boards/r630/r630.config
index 8f24f057..2f0ec38e 100644
--- a/boards/r630/r630.config
+++ b/boards/r630/r630.config
@@ -5,6 +5,8 @@ CONFIG_LINUXBOOT=y
 CONFIG_LINUXBOOT_ROM=blobs/r630-1.3.6.rom
 CONFIG_LINUX_CONFIG=config/linux-linuxboot.config
 
+export CONFIG_LINUX_VERSION=4.14.62
+
 #CONFIG_CRYPTSETUP=y
 CONFIG_FLASHROM=y
 #CONFIG_GPG=y
diff --git a/boards/s2600wf/s2600wf.config b/boards/s2600wf/s2600wf.config
index 2c810da0..591984b3 100644
--- a/boards/s2600wf/s2600wf.config
+++ b/boards/s2600wf/s2600wf.config
@@ -13,6 +13,8 @@ CONFIG_LINUXBOOT=y
 CONFIG_LINUXBOOT_ROM=blobs/s2600wf.rom
 CONFIG_LINUX_CONFIG=config/linux-linuxboot.config
 
+export CONFIG_LINUX_VERSION=4.14.62
+
 #CONFIG_CRYPTSETUP=y
 #CONFIG_FLASHROM=y
 CONFIG_FLASHTOOLS=y
diff --git a/boards/t420/t420.config b/boards/t420/t420.config
index c83e3097..0dcc865f 100644
--- a/boards/t420/t420.config
+++ b/boards/t420/t420.config
@@ -1,6 +1,7 @@
 # Configuration for a T420 running Qubes and other OS, T420 is identical to X230 on the Linux Side of things.
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-t420.config
 CONFIG_LINUX_CONFIG=config/linux-x230.config
diff --git a/boards/t430-flash/t430-flash.config b/boards/t430-flash/t430-flash.config
index 626fde19..43be7cb2 100644
--- a/boards/t430-flash/t430-flash.config
+++ b/boards/t430-flash/t430-flash.config
@@ -3,6 +3,7 @@ BOARD=t430.flash
 
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_FLASHROM=y
 CONFIG_FLASHTOOLS=y
diff --git a/boards/t430/t430.config b/boards/t430/t430.config
index 3eaaba71..dde67329 100644
--- a/boards/t430/t430.config
+++ b/boards/t430/t430.config
@@ -1,6 +1,7 @@
 # Configuration for a t430 running Qubes and other OSes
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-t430.config
 CONFIG_LINUX_CONFIG=config/linux-x230.config
diff --git a/boards/tioga/tioga.config b/boards/tioga/tioga.config
index af16c1ce..c0dcb4f9 100644
--- a/boards/tioga/tioga.config
+++ b/boards/tioga/tioga.config
@@ -4,6 +4,8 @@ CONFIG_LINUXBOOT=y
 CONFIG_LINUXBOOT_ROM=blobs/tioga.rom
 CONFIG_LINUX_CONFIG=config/linux-linuxboot.config
 
+export CONFIG_LINUX_VERSION=4.14.62
+
 # If you want to build with the go-based u-root instead of Heads
 CONFIG_UROOT ?= n
 
diff --git a/boards/winterfell/winterfell.config b/boards/winterfell/winterfell.config
index b49421c2..fe1cc3b4 100644
--- a/boards/winterfell/winterfell.config
+++ b/boards/winterfell/winterfell.config
@@ -4,6 +4,8 @@ CONFIG_LINUXBOOT=y
 CONFIG_LINUXBOOT_ROM=blobs/winterfell.rom
 CONFIG_LINUX_CONFIG=config/linux-linuxboot.config
 
+export CONFIG_LINUX_VERSION=4.14.62
+
 # If you want to build with the go-based u-root instead of Heads
 CONFIG_UROOT ?= y
 
diff --git a/boards/x220/x220.config b/boards/x220/x220.config
index 0efffec4..ae2080e4 100644
--- a/boards/x220/x220.config
+++ b/boards/x220/x220.config
@@ -1,6 +1,7 @@
 # Configuration for a x220 running Qubes and other OS, X220 is identical to X230 on the Linux Side of things.
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-x220.config
 CONFIG_LINUX_CONFIG=config/linux-x230.config
diff --git a/boards/x230-flash/x230-flash.config b/boards/x230-flash/x230-flash.config
index c878012d..edb417ea 100644
--- a/boards/x230-flash/x230-flash.config
+++ b/boards/x230-flash/x230-flash.config
@@ -3,6 +3,7 @@ BOARD=x230.flash
 
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_FLASHROM=y
 #CONFIG_GPG=y
diff --git a/boards/x230-hotp-verification/x230-hotp-verification.config b/boards/x230-hotp-verification/x230-hotp-verification.config
index 59f0acdc..5eef5868 100644
--- a/boards/x230-hotp-verification/x230-hotp-verification.config
+++ b/boards/x230-hotp-verification/x230-hotp-verification.config
@@ -2,6 +2,7 @@
 # running Qubes and other OSes
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-x230-hotp-verification.config
 CONFIG_LINUX_CONFIG=config/linux-x230.config
diff --git a/boards/x230/x230.config b/boards/x230/x230.config
index 8a04bc57..f52fb355 100644
--- a/boards/x230/x230.config
+++ b/boards/x230/x230.config
@@ -1,6 +1,7 @@
 # Configuration for a x230 running Qubes and other OSes
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=4.8.1
+export CONFIG_LINUX_VERSION=4.14.62
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-x230.config
 CONFIG_LINUX_CONFIG=config/linux-x230.config
diff --git a/modules/linux b/modules/linux
index f8817935..101f54da 100644
--- a/modules/linux
+++ b/modules/linux
@@ -1,6 +1,15 @@
 modules-y += linux
 
+ifeq "$(CONFIG_LINUX_VERSION)" "4.14.62"
 linux_version := 4.14.62
+linux_hash := 51ca4d7e8ee156dc0f19bc7768915cfae41dbb0b4f251e4fa8b178c5674c22ab
+else ifeq "$(CONFIG_LINUX_VERSION)" "4.19.139"
+linux_version := 4.19.139
+linux_hash := 9c4ebf21fe949f80fbcfbbd6e7fe181040d325e89475e230ab53ef01f9d55605
+else
+$(error "$(BOARD): does not specify linux kernel version under CONFIG_LINUX_VERSION")
+endif 
+
 linux_base_dir := linux-$(linux_version)
 
 # TODO: fixup the patch process
@@ -15,12 +24,6 @@ linux_dir := $(linux_base_dir)/$(notdir $(basename $(linux_kconfig)))
 linux_tar := linux-$(linux_version).tar.xz
 linux_url := https://cdn.kernel.org/pub/linux/kernel/v4.x/$(linux_tar)
 
-linux-4.9.38_hash := 76d789d87dd51d2fd58c095727171984fa4a992f5e25b9e3eb1e5fd5cd129074
-linux-4.9.80_hash := 9e2e83ccc0afc3f23340ed5e58a35d8c6300a7c58aa98ca913848de41226477b
-linux-4.14.62_hash := 51ca4d7e8ee156dc0f19bc7768915cfae41dbb0b4f251e4fa8b178c5674c22ab
-
-linux_hash := $(linux-$(linux_version)_hash)
-
 # Ensure that touching the config file will force a reconfig/rebuild
 $(build)/$(linux_dir)/.configured: $(linux_kconfig)
 
diff --git a/patches/linux-4.19.139/0000-efi_bds.patch b/patches/linux-4.19.139/0000-efi_bds.patch
new file mode 100644
index 00000000..0d2d76ea
--- /dev/null
+++ b/patches/linux-4.19.139/0000-efi_bds.patch
@@ -0,0 +1,54 @@
+diff -u --recursive ../../clean/linux-4.14.62/arch/x86/boot/compressed/eboot.c linux-4.14.62/arch/x86/boot/compressed/eboot.c
+--- ../../clean/linux-4.14.62/arch/x86/boot/compressed/eboot.c	2018-08-09 06:16:40.000000000 -0400
++++ linux-4.14.62/arch/x86/boot/compressed/eboot.c	2018-08-09 10:13:11.801000000 -0400
+@@ -630,8 +630,8 @@
+ 	u16 *s2;
+ 	u8 *s1;
+ 	int i;
+-	unsigned long ramdisk_addr;
+-	unsigned long ramdisk_size;
++	unsigned long ramdisk_addr = 0;
++	unsigned long ramdisk_size = 0;
+ 
+ 	efi_early = c;
+ 	sys_table = (efi_system_table_t *)(unsigned long)efi_early->table;
+@@ -686,9 +686,6 @@
+ 	/* Fill in upper bits of command line address, NOP on 32 bit  */
+ 	boot_params->ext_cmd_line_ptr = (u64)(unsigned long)cmdline_ptr >> 32;
+ 
+-	hdr->ramdisk_image = 0;
+-	hdr->ramdisk_size = 0;
+-
+ 	/* Clear APM BIOS info */
+ 	memset(bi, 0, sizeof(*bi));
+ 
+@@ -712,10 +709,16 @@
+ 
+ 	if (status != EFI_SUCCESS)
+ 		goto fail2;
+-	hdr->ramdisk_image = ramdisk_addr & 0xffffffff;
+-	hdr->ramdisk_size  = ramdisk_size & 0xffffffff;
+-	boot_params->ext_ramdisk_image = (u64)ramdisk_addr >> 32;
+-	boot_params->ext_ramdisk_size  = (u64)ramdisk_size >> 32;
++
++	// don't overwrite the bzImage or loader provided ramdisk pointer
++	// unless the kernel command line specified a different one.
++	if (ramdisk_addr != 0)
++	{
++		hdr->ramdisk_image = ramdisk_addr & 0xffffffff;
++		hdr->ramdisk_size  = ramdisk_size & 0xffffffff;
++		boot_params->ext_ramdisk_image = (u64)ramdisk_addr >> 32;
++		boot_params->ext_ramdisk_size  = (u64)ramdisk_size >> 32;
++	}
+ 
+ 	return boot_params;
+ fail2:
+--- clean/linux-4.14.62/arch/x86/boot/compressed/early_serial_console.c	2018-08-09 12:16:40.000000000 +0200
++++ linux-4.14.62/arch/x86/boot/compressed/early_serial_console.c	2018-09-28 11:59:36.824015244 +0200
+@@ -1,5 +1,5 @@
+ #include "misc.h"
+ 
+-int early_serial_base;
++int early_serial_base = 0x3f8;
+ 
+ #include "../early_serial_console.c"
diff --git a/patches/linux-4.19.139/0001-fake-acpi.patch b/patches/linux-4.19.139/0001-fake-acpi.patch
new file mode 100644
index 00000000..0c8b3b54
--- /dev/null
+++ b/patches/linux-4.19.139/0001-fake-acpi.patch
@@ -0,0 +1,32 @@
+diff --recursive -u ./clean/linux-4.9.80/drivers/acpi/acpica/evxfevnt.c linux-4.9.80/drivers/acpi/acpica/evxfevnt.c
+--- ./clean/linux-4.9.80/drivers/acpi/acpica/evxfevnt.c	2018-02-03 11:05:43.000000000 -0500
++++ linux-4.9.80/drivers/acpi/acpica/evxfevnt.c	2018-02-07 15:51:28.786502597 -0500
+@@ -111,6 +111,8 @@
+ 	}
+ 
+ 	ACPI_ERROR((AE_INFO, "Hardware did not enter ACPI mode"));
++printk("%s:%d faking ACPI mode\n", __func__, __LINE__);
++	return_ACPI_STATUS(AE_OK);
+ 	return_ACPI_STATUS(AE_NO_HARDWARE_RESPONSE);
+ }
+ 
+diff --recursive -u ./clean/linux-4.9.80/drivers/acpi/acpica/hwacpi.c linux-4.9.80/drivers/acpi/acpica/hwacpi.c
+--- ./clean/linux-4.9.80/drivers/acpi/acpica/hwacpi.c	2018-02-03 11:05:43.000000000 -0500
++++ linux-4.9.80/drivers/acpi/acpica/hwacpi.c	2018-02-07 15:51:35.126557868 -0500
+@@ -168,12 +168,16 @@
+ 
+ 	status = acpi_read_bit_register(ACPI_BITREG_SCI_ENABLE, &value);
+ 	if (ACPI_FAILURE(status)) {
++printk("%s:%d faking ACPI mode\n", __func__, __LINE__);
++		return_UINT32(ACPI_SYS_MODE_ACPI);
+ 		return_UINT32(ACPI_SYS_MODE_LEGACY);
+ 	}
+ 
+ 	if (value) {
+ 		return_UINT32(ACPI_SYS_MODE_ACPI);
+ 	} else {
++//printk("%s:%d faking ACPI mode\n", __func__, __LINE__);
++//		return_UINT32(ACPI_SYS_MODE_ACPI);
+ 		return_UINT32(ACPI_SYS_MODE_LEGACY);
+ 	}
+ }
diff --git a/patches/linux-4.19.139/0002-nmi-squelch.patch b/patches/linux-4.19.139/0002-nmi-squelch.patch
new file mode 100644
index 00000000..bce1cd2f
--- /dev/null
+++ b/patches/linux-4.19.139/0002-nmi-squelch.patch
@@ -0,0 +1,20 @@
+diff --recursive -u ./clean/linux-4.9.80/arch/x86/kernel/nmi.c linux-4.9.80/arch/x86/kernel/nmi.c
+--- ./clean/linux-4.9.80/arch/x86/kernel/nmi.c	2018-02-03 11:05:43.000000000 -0500
++++ linux-4.9.80/arch/x86/kernel/nmi.c	2018-02-07 18:56:10.475613884 -0500
+@@ -303,6 +303,8 @@
+ 
+ 	__this_cpu_add(nmi_stats.unknown, 1);
+ 
++#if 0
++// qemu generates these for some reason
+ 	pr_emerg("Uhhuh. NMI received for unknown reason %02x on CPU %d.\n",
+ 		 reason, smp_processor_id());
+ 
+@@ -311,6 +313,7 @@
+ 		nmi_panic(regs, "NMI: Not continuing");
+ 
+ 	pr_emerg("Dazed and confused, but trying to continue\n");
++#endif
+ }
+ NOKPROBE_SYMBOL(unknown_nmi_error);
+ 
diff --git a/patches/linux-4.19.139/0003-fake-trampoline.patch b/patches/linux-4.19.139/0003-fake-trampoline.patch
new file mode 100644
index 00000000..e6ec15c9
--- /dev/null
+++ b/patches/linux-4.19.139/0003-fake-trampoline.patch
@@ -0,0 +1,28 @@
+diff --recursive -u ./clean/linux-4.9.80/arch/x86/realmode/init.c linux-4.9.80/arch/x86/realmode/init.c
+--- ./clean/linux-4.9.80/arch/x86/realmode/init.c	2018-02-03 11:05:43.000000000 -0500
++++ linux-4.9.80/arch/x86/realmode/init.c	2018-02-07 15:51:28.538500435 -0500
+@@ -35,8 +35,8 @@
+ 	/* Has to be under 1M so we can execute real-mode AP code. */
+ 	mem = memblock_find_in_range(0, 1<<20, size, PAGE_SIZE);
+ 	if (!mem) {
+-		pr_info("No sub-1M memory is available for the trampoline\n");
+-		return;
++		mem = 0x4000;
++		pr_info("No sub-1M memory is available for the trampoline, guessing %p\n", mem);
+ 	}
+ 
+ 	memblock_reserve(mem, size);
+@@ -138,7 +138,12 @@
+ static int __init init_real_mode(void)
+ {
+ 	if (!real_mode_header)
+-		panic("Real mode trampoline was not allocated");
++	{
++		// ignore for now
++		//panic("Real mode trampoline was not allocated");
++		pr_warn("Real mode trampoline was not allocated");
++		return 0;
++	}
+ 
+ 	setup_real_mode();
+ 	set_real_mode_permissions();
diff --git a/patches/linux-4.19.139/0010-winterfell-ahci.patch b/patches/linux-4.19.139/0010-winterfell-ahci.patch
new file mode 100644
index 00000000..9c4df7e2
--- /dev/null
+++ b/patches/linux-4.19.139/0010-winterfell-ahci.patch
@@ -0,0 +1,18 @@
+diff --recursive -u ./clean/linux-4.9.80/drivers/ata/libahci.c linux-4.9.80/drivers/ata/libahci.c
+--- ./clean/linux-4.9.80/drivers/ata/libahci.c	2018-02-03 11:05:43.000000000 -0500
++++ linux-4.9.80/drivers/ata/libahci.c	2018-02-07 18:02:32.526535910 -0500
+@@ -537,8 +537,12 @@
+ 	}
+ 
+ 	/* fabricate port_map from cap.nr_ports for < AHCI 1.3 */
+-	if (!port_map && vers < 0x10300) {
+-		port_map = (1 << ahci_nr_ports(cap)) - 1;
++	if (!port_map) { //  && vers < 0x10300) {
++		printk("%s: saved_port=%02x\n", __func__, hpriv->saved_port_map);
++		writel(0x1, mmio + HOST_PORTS_IMPL);
++		port_map = readl(mmio + HOST_PORTS_IMPL);
++
++		//port_map = (1 << ahci_nr_ports(cap)) - 1;
+ 		dev_warn(dev, "forcing PORTS_IMPL to 0x%x\n", port_map);
+ 
+ 		/* write the fixed up value to the PI register */