diff --git a/bundles.tar.xz b/bundles.tar.xz
index f4a0867..5bebb38 100644
--- a/bundles.tar.xz
+++ b/bundles.tar.xz
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:762feed085945e5748ef0337546b3ca80faf002511b7287457fa633931af3785
-size 73408
+oid sha256:dce0ee97070ce006efec65be07aba08f250cb06df9e1f9fa0ef8a2a21b7e6c5c
+size 88648
diff --git a/qemu.changes b/qemu.changes
index 5b6e4c6..c0445b4 100644
--- a/qemu.changes
+++ b/qemu.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Tue Feb  4 04:01:19 UTC 2020 - Liang Yan <lyan@suse.com>
+
+- Avoid query-cpu-model-expansion crashed qemu when using
+  machine type none, patch is queued in upstream now, will
+  update commit id later (bsc#1159443)
+  target-arm-monitor-query-cpu-model-expan.patch
+
 -------------------------------------------------------------------
 Mon Feb  3 16:00:26 UTC 2020 - Dominique Leuenberger <dimstar@opensuse.org>
 
diff --git a/qemu.spec b/qemu.spec
index ab2db78..4ad4562 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -219,6 +219,7 @@ Patch00088:     test-add-mapping-from-arch-of-i686-to-qe.patch
 Patch00089:     roms-Makefile-enable-cross-compile-for-b.patch
 Patch00090:     iscsi-Cap-block-count-from-GET-LBA-STATU.patch
 Patch00091:     block-backup-fix-memory-leak-in-bdrv_bac.patch
+Patch00092:     target-arm-monitor-query-cpu-model-expan.patch
 # Patches applied in roms/seabios/:
 Patch01000:     seabios-use-python2-explicitly-as-needed.patch
 Patch01001:     seabios-switch-to-python3-as-needed.patch
@@ -1017,6 +1018,7 @@ This package provides a service file for starting and stopping KSM.
 %patch00089 -p1
 %patch00090 -p1
 %patch00091 -p1
+%patch00092 -p1
 %patch01000 -p1
 %patch01001 -p1
 %patch01002 -p1
diff --git a/qemu.spec.in b/qemu.spec.in
index 58b0492..35d62de 100644
--- a/qemu.spec.in
+++ b/qemu.spec.in
@@ -236,9 +236,9 @@ BuildRequires:  libSDL2_image-devel
 BuildRequires:  libseccomp-devel >= 2.3.0
 BuildRequires:  libspice-server-devel >= 0.12.5
 BuildRequires:  libssh-devel >= 0.8
-BuildRequires:  libudev-devel
 BuildRequires:  libusb-1_0-devel >= 1.0.13
 BuildRequires:  libvdeplug-devel
+BuildRequires:  pkgconfig(libudev)
 %if 0%{?is_opensuse}
 BuildRequires:  lzfse-devel
 %endif
diff --git a/target-arm-monitor-query-cpu-model-expan.patch b/target-arm-monitor-query-cpu-model-expan.patch
new file mode 100644
index 0000000..bf28dbf
--- /dev/null
+++ b/target-arm-monitor-query-cpu-model-expan.patch
@@ -0,0 +1,54 @@
+From: Liang Yan <lyan@suse.com>
+Date: Fri, 31 Jan 2020 14:54:06 -0500
+Subject: target/arm/monitor: query-cpu-model-expansion crashed qemu when using
+ machine type none
+
+References: bsc#1159443
+
+Commit e19afd566781 mentioned that target-arm only supports queryable
+cpu models 'max', 'host', and the current type when KVM is in use.
+The logic works well until using machine type none.
+
+For machine type none, cpu_type will be null if cpu option is not
+set by command line, strlen(cpu_type) will terminate process.
+So We add a check above it.
+
+This won't affect i386 and s390x since they do not use current_cpu.
+
+[LY: patch only queued in upstream, will update commit id later]
+Signed-off-by: Liang Yan <lyan@suse.com>
+---
+ target/arm/monitor.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/target/arm/monitor.c b/target/arm/monitor.c
+index fa054f8a369c8221c8746b8d8046..782085ca2120b243584f7c058ef8 100644
+--- a/target/arm/monitor.c
++++ b/target/arm/monitor.c
+@@ -136,17 +136,20 @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+     }
+ 
+     if (kvm_enabled()) {
+-        const char *cpu_type = current_machine->cpu_type;
+-        int len = strlen(cpu_type) - strlen(ARM_CPU_TYPE_SUFFIX);
+         bool supported = false;
+ 
+         if (!strcmp(model->name, "host") || !strcmp(model->name, "max")) {
+             /* These are kvmarm's recommended cpu types */
+             supported = true;
+-        } else if (strlen(model->name) == len &&
+-                   !strncmp(model->name, cpu_type, len)) {
+-            /* KVM is enabled and we're using this type, so it works. */
+-            supported = true;
++        } else if (current_machine->cpu_type) {
++            const char *cpu_type = current_machine->cpu_type;
++            int len = strlen(cpu_type) - strlen(ARM_CPU_TYPE_SUFFIX);
++
++            if (strlen(model->name) == len &&
++                !strncmp(model->name, cpu_type, len)) {
++                /* KVM is enabled and we're using this type, so it works. */
++                supported = true;
++            }
+         }
+         if (!supported) {
+             error_setg(errp, "We cannot guarantee the CPU type '%s' works "