From 0855d35bbfe58c2680178919e8c97618fcf4576b Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Thu, 20 Feb 2020 20:26:57 -0500
Subject: [PATCH] fixes for 5.5

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...dmi-quirk-for-razer-blade-stealth-13.patch |  48 ++
 ...umber-of-ids-handling-in-iort_id_map.patch | 156 +++++
 ...ler-create-buffer-fields-in-acpi_par.patch |  86 +++
 ...alarmtimer-platform-device-child-of-.patch | 102 +++
 ...lv-read-operation-for-callback-type-.patch |  61 ++
 ...king-station-support-for-lenovo-thin.patch |  38 ++
 ...-add-retry-logic-to-parse_intel_hdmi.patch |  52 ++
 ...-apply-mic-mute-led-quirk-for-dell-e.patch |  61 ++
 ...lsa-sh-fix-compile-warning-wrt-const.patch |  41 ++
 ...alsa-sh-fix-unused-variable-warnings.patch |  54 ++
 ...dio-add-boot-quirk-for-motu-m-series.patch | 119 ++++
 ...dd-implicit-fb-quirk-for-motu-m-seri.patch |  43 ++
 ...dd-quirks-for-line6-helix-devices-fw.patch |  41 ++
 ...a-usb-audio-unlock-on-error-in-probe.patch |  36 +
 ...t-indentation-in-snd_usx2y_hwdep_dsp.patch |  51 ++
 ...pressor-enable-cp15-barrier-instruct.patch |  82 +++
 ...m-8951-1-fix-kexec-compilation-issue.patch |  53 ++
 ...52-1-disable-kmemleak-on-xip-kernels.patch |  54 ++
 .../arm-dts-allwinner-h3-add-pmu-node.patch   |  73 ++
 ...du2-disable-wp-for-usdhc2-and-usdhc3.patch |  69 ++
 ...-imx6-rdu2-limit-usbh1-to-full-speed.patch |  43 ++
 ...add-device-node-for-arm-global-timer.patch |  44 ++
 ...-add-reg-property-to-brcmf-sub-node-.patch |  48 ++
 ...d-power-supply-for-dsi-panel-on-stm3.patch |  49 ++
 ...nfig-bring-back-explicitly-wanted-op.patch |  65 ++
 ...quirks-add-prm-data-for-reset-suppor.patch |  57 ++
 .../arm64-dts-allwinner-h5-add-pmu-node.patch |  74 ++
 .../arm64-dts-allwinner-h6-add-pmu-mode.patch |  47 ++
 ...b845c-enable-ath10k-8bit-host-cap-qu.patch |  37 +
 ...sm8996-disable-usb2-phy-suspend-by-c.patch |  51 ++
 ...ip-add-reg-property-to-brcmf-sub-nod.patch |  90 +++
 ...ckchip-fix-dwmmc-clock-name-for-px30.patch |  61 ++
 ...chip-fix-dwmmc-clock-name-for-rk3308.patch |  61 ++
 ...-rockchip-fix-nanopc-t4-cooling-maps.patch |  66 ++
 ...j721e-main-add-missing-power-domains.patch |  37 +
 ...atives-with-llvm-s-integrated-assemb.patch | 119 ++++
 ...e-atomics-with-llvm-s-integrated-ass.patch | 221 ++++++
 ...eneric-tlb-add-missing-config-symbol.patch |  40 ++
 ...uild-error-with-config_snd_atmel_soc.patch |  43 ++
 ...l-consistent-hdmi-codec-probing-code.patch | 226 ++++++
 ...t5682-add-quirk-for-number-of-hdmi-d.patch |  66 ++
 ...t5682-add-support-for-tgl-max98357a-.patch |  74 ++
 ...t5682-ignore-the-speaker-amp-when-th.patch |  71 ++
 ...c-soc-topology-fix-endianness-issues.patch | 144 ++++
 ...da-dai-fix-compilation-warning-in-pc.patch |  54 ++
 ...asoc-sof-intel-hda-fix-skl-dai-count.patch |  39 ++
 ...da-solve-msi-issues-by-merging-ipc-a.patch | 340 +++++++++
 ...asoc-txx9-remove-unused-rtd-variable.patch |  52 ++
 ...rect-cache-handling-of-new-kernel-co.patch | 218 ++++++
 ...he-dma-direction-for-management-tx-b.patch |  57 ++
 ...he-tlv-len-of-ath10k_wmi_tlv_op_gen_.patch |  53 ++
 .../ath10k-fix-qmi-init-error-handling.patch  |  49 ++
 .../b43legacy-fix-wcast-function-type.patch   |  48 ++
 ...wled-fix-unsigned-comparison-to-zero.patch |  45 ++
 ...ed_dev_free-needs-to-put-the-sb-page.patch |  39 ++
 ...xplicity-type-cast-in-bset_bkey_last.patch |  52 ++
 ...rect-data-type-usage-in-btree_flush_.patch |  87 +++
 ...y-corruption-in-bch_cache_accounting.patch | 164 +++++
 ...ix-use-after-free-in-register_bcache.patch |  53 ++
 ...initialize-path-and-err-in-register_.patch |  60 ++
 ...k-error-unwinding-in-register_bcache.patch | 162 +++++
 ...-plug-i-o-for-bfq_queues-with-no-pro.patch |  76 +++
 ...-from-page-pool-before-sending-up-th.patch |  38 ++
 ...utput-invariant-hit-in-pahole-dwarf-.patch |  61 ++
 ...-should-always-increase-position-ind.patch |  48 ++
 ...rror-message-for-bpftool-cgroup-show.patch | 140 ++++
 ...qc-for-invalid-map-type-in-__bpf_tx_.patch |  45 ++
 ...-synchronize_rcu-before-free-ing-map.patch |  44 ++
 ...mory-leak-in-brcmf_p2p_create_p2pdev.patch |  39 ++
 ...-after-free-in-brcmf_sdio_readframes.patch |  41 ++
 ...x-oob-interrupt-initialization-on-br.patch |  67 ++
 .../brd-check-and-limit-max_part-par.patch    | 109 +++
 ...vice-stats-log-when-stats-are-zeroed.patch |  47 ++
 ...delalloc-reservation-under-page-lock.patch | 220 ++++++
 ...le-null-pointer-dereference-in-integ.patch |  51 ++
 ...brain-handling-when-changing-fsid-to.patch | 108 +++
 ...-dirty-when-using-btrfs_writepage_fi.patch | 166 +++++
 ...ance-counter-when-looking-up-bio-csu.patch |  53 ++
 ...efinition-of-assertion-failure-handl.patch |  70 ++
 ...-properly-empty-initialize-structure.patch |  44 ++
 ...ement-quirk-handling-for-clkdm_noaut.patch |  73 ++
 ...ability-of-mds-cluster-on-mount-afte.patch |  59 ++
 ...char-hpet-fix-out-of-bounds-read-bug.patch |  56 ++
 ...-silence-a-lockdep-splat-with-printk.patch | 278 ++++++++
 ...s-fix-mount-options-set-in-automount.patch | 215 ++++++
 ...ix-null-dereference-in-match_prepath.patch |  43 ++
 ...ized-variable-poential-problem-with-.patch |  43 ++
 ...ng-message-once-if-out-of-disk-space.patch |  42 ++
 ...l-the-clock-init-before-any-other-ca.patch |  69 ++
 ...x60-fix-programmable-clock-prescaler.patch |  41 ++
 ...emove-set-but-not-used-variable-fref.patch |  46 ++
 ...ect-failure-handling-for-clk-based-h.patch | 109 +++
 ...b-make-the-ccf-use-the-glitch-free-m.patch |  65 ++
 ...x-by-0-division-in-__pll_params_to_r.patch |  77 +++
 ...add-missing-msm8998-gcc_bimc_gfx_clk.patch |  68 ++
 ...verwrite-cfg-in-clk_rcg2_dfs_populat.patch |  60 ++
 ...n-t-crash-if-our-parent-can-t-be-fou.patch |  71 ++
 .../clk-qcom-smd-add-missing-bimc-clock.patch |  48 ++
 ...-gen3-allow-changing-the-rpc-d2-cloc.patch |  49 ++
 ...-mux-and-pll-notifiers-for-a64-cpu-c.patch |  79 +++
 ...-ti-dra7-fix-parent-for-gmac_clkctrl.patch |  37 +
 ...dd-scssi-clock-gate-for-each-channel.patch |  63 ++
 ...ode-pointer-during-registration-if-n.patch |  94 +++
 ...nci-only-enable-clockevents-once-tim.patch |  58 ++
 ...ers-bcm2835_timer-fix-memory-leak-of.patch |  51 ++
 ...-buffer-overflow-in-cmd64x_program_t.patch |  36 +
 ..._machine-fix-stop_machine-vs-hotplug.patch |  91 +++
 ...add-unspecified-has_iomem-dependency.patch |  41 ++
 .../crypto-chtls-fixed-memory-leak.patch      | 145 ++++
 ...-aead-capitalization-and-preposition.patch |  41 ++
 .../crypto-hisilicon-bugfixed-tfm-leak.patch  |  83 +++
 ...licon-update-debugfs-usage-of-sec-v2.patch | 112 +++
 ...cure-add-unspecified-has_iomem-depen.patch |  42 ++
 .../debugobjects-fix-various-data-races.patch | 238 +++++++
 ...raid-table-line-rebuild-status-fixes.patch | 137 ++++
 ...low-changing-data-device-during-thin.patch | 122 ++++
 ...-fsl-qdma-fix-duplicated-argument-to.patch |  41 ++
 .../dmaengine-imx-sdma-fix-memory-leak.patch  |  78 +++
 ...re-module-owner-in-dma_device-struct.patch |  80 +++
 ...engine-ti-edma-add-missed-operations.patch | 133 ++++
 ...a-fix-error-return-code-in-edma_prob.patch |  41 ++
 ...form-fix-u32-greater-or-equal-to-zer.patch |  41 ++
 ...form-prevent-resouce-overflow-from-c.patch |  75 ++
 ...t-device-when-resources-present-in-r.patch |  45 ++
 ...am-zram_drv.c-fix-error-return-codes.patch |  56 ++
 ...clear-state-after-exiting-fixed-acti.patch |  49 ++
 ...do-not-allocate-display_mode_lib-unn.patch |  67 ++
 ...lay-fix-update_bw_bounding_box-calcs.patch |  62 ++
 ...m-amd-display-fixup-dml-dependencies.patch |  62 ++
 ...display-lower-dpp-dto-only-when-safe.patch | 124 ++++
 ...map-odm-memory-correctly-when-doing-.patch |  89 +++
 ...md-display-renoir-chroma-viewport-wa.patch | 141 ++++
 ...retrain-dongles-when-sink_count-beco.patch |  71 ++
 ...ay-handle-multiple-numbers-of-fclks-.patch |  78 +++
 ...-not-throw-an-error-for-a-display-wi.patch |  42 ++
 ...e-ret-is-always-initialized-when-usi.patch |  69 ++
 ...-double-gpu_recovery-for-nv-of-sriov.patch |  47 ++
 ...x-kiq-ring-test-fail-in-tdr-of-sriov.patch |  46 ++
 ...e-4-set-but-not-used-variable-in-amd.patch |  75 ++
 ...-fix-smu10_get_clock_by_type_with_la.patch |  49 ++
 ...-fix-smu10_get_clock_by_type_with_vo.patch |  41 ++
 ...-workaround-on-rev_id-for-navi12-und.patch |  44 ++
 ...-bug-in-sdma-rlc-queue-counting-unde.patch |  57 ++
 ...m-amdkfd-fix-permissions-of-hang_hws.patch |  37 +
 ...p_mst-fix-multiple-frees-of-tx-bytes.patch |  43 ++
 ...ck-to-non-tiled-mode-if-all-tiles-no.patch | 169 +++++
 ...p-fbdev-stolen-size-usage-evaluation.patch |  61 ++
 ...-gamma-property-according-to-hardwar.patch |  60 ++
 ...dle-events-when-enabling-disabling-c.patch |  51 ++
 ...ix-off-by-one-bugs-in-mipi_dbi_blank.patch |  51 ++
 ...sm-adreno-fix-zap-vs-no-zap-handling.patch |  86 +++
 ...-nv50-prevent-oops-when-no-channel-m.patch |  41 ++
 ...ttm-remove-set-but-not-used-variable.patch |  58 ++
 ...t-gv100-fix-memory-leak-on-module-un.patch |  30 +
 ...copy-paste-error-in-nouveau_fence_wa.patch |  37 +
 ...k20a-gm200-add-terminators-to-method.patch |  76 +++
 ...-nouveau-mmu-fix-comptag-memory-leak.patch |  32 +
 ...eau-fix-incorrect-sizeof-on-args.src.patch |  43 ++
 ...oot-gm20b-initialize-pointer-in-gm20.patch |  48 ++
 ...-add-logic-pd-type-28-display-suppor.patch |  84 +++
 ...-exception-handling-in-qxl_device_in.patch |  49 ++
 ...gnize-renesas-vsps-in-addition-to-vs.patch |  74 ++
 ...move-the-newline-for-crc-source-name.patch |  48 ++
 ...yteorder-handling-in-virtio_gpu_cmd_.patch | 194 ++++++
 ...nt-memory-leak-in-vmw_cmdbuf_res_add.patch |  40 ++
 ...x-return-value-check-in-ecc_register.patch |  40 ++
 ...obe-of-pcie-backed-efifb-on-dt-syste.patch | 168 +++++
 ...nic-or-bug-on-non-critical-error-con.patch | 131 ++++
 ...entire-efi-vendor-string-before-copy.patch |  69 ++
 ...t-from-enetc_sched_speed_set-when-li.patch |  40 ++
 ...iable-tc_max_sized_frame-set-but-not.patch |  46 ++
 ...k-allocating-bio_post_read_ctx-from-.patch |  81 +++
 ...x_read-write-inode-locking-sequence-.patch |  59 ++
 ...-panic-when-aborting-with-zero-errno.patch |  76 +++
 ...fs_balance_fs-outside-of-locked-page.patch |  68 ++
 queue-5.5/f2fs-fix-memleak-of-kobject.patch   |  54 ++
 queue-5.5/f2fs-free-sysfs-kobject.patch       |  31 +
 ...-dio-blocks-when-forcing-buffered_io.patch | 124 ++++
 ...ble-early-to-avoid-wrong-access-by-v.patch | 134 ++++
 ...fbdev-fix-numbering-of-fbcon-options.patch |  67 ++
 ...orrect-checks-of-null-pointer-derefe.patch |  80 +++
 ..._next-should-increase-position-index.patch |  63 ++
 ...t-overflow-llong_max-with-end-offset.patch |  55 ++
 ...imestamping-with-a-stacked-dsa-drive.patch |  89 +++
 ...-fix-possible-sleep-in-atomic-contex.patch |  78 +++
 ...dep-class-for-hierarchical-irq-domai.patch | 120 ++++
 ...avoid-null-pointer-deference-in-plan.patch |  55 ++
 ..._next-should-increase-position-index.patch |  35 +
 ...ndentation-in-prism2_hostapd_add_sta.patch |  52 ++
 ...xsk_wakeup-s-return-value-when-pf-is.patch |  42 ++
 ...-core-distribute-cache-update-events.patch | 384 +++++++++++
 ...dd-rcvshortlengtherrcnt-to-hfi1stats.patch |  63 ++
 ...-software-counter-for-ctxt0-seq-drop.patch |  95 +++
 ...d-extra-check-for-null-rx-descriptor.patch |  58 ++
 ...potential-overflow-in-svwks_set_pio_.patch |  45 ++
 ...sx-check-return-value-from-st_lsm6ds.patch |  48 ++
 queue-5.5/ima-check-ima-policy-flag.patch     |  41 ++
 ...-work-around-first-register-access-e.patch |  55 ++
 ...feature-support-bit-before-accessing.patch |  83 +++
 ...upport-x2apic-with-ivhd-type-11h-40h.patch |  54 ++
 ...3-use-write_once-when-changing-valid.patch |  40 ++
 ...lence-warnings-under-memory-pressure.patch | 161 +++++
 ...-avoid-sending-invalid-page-response.patch |  45 ++
 ...d-fix-off-by-one-in-pasid-allocation.patch |  39 ++
 ...firmware-tainted-if-rmrr-fails-sanit.patch |  57 ++
 ...vt-d-match-cpu-and-iommu-paging-mode.patch |  57 ++
 ...vt-d-remove-unnecessary-warn_on_once.patch |  49 ++
 .../ipw2x00-fix-wcast-function-type.patch     |  81 +++
 ...ts-fix-get_vlpi_map-breakage-with-do.patch |  55 ++
 ...ts-reference-to-its_invall_cmd-descr.patch |  40 ++
 ...nly-provision-redistributors-that-ar.patch |  71 ++
 ...et-driver-.suppress_bind_attrs-to-av.patch | 127 ++++
 ...don-t-mark-kcapi_proc_exit-as-__exit.patch |  49 ++
 ...loop-counter-addr-does-not-wrap-and-.patch |  42 ++
 .../iwlegacy-fix-wcast-function-type.patch    |  72 ++
 ...k-the-sta-is-not-null-in-iwl_mvm_cfg.patch |  77 +++
 ...fi-mvm-fix-thermal-zone-registration.patch |  64 ++
 ...abort-flag-before-journal_reset-to-u.patch |  56 ++
 ...shutdown-to-be-recorded-in-the-journ.patch |  43 ++
 ...se-jbd2_journal_abort-when-failed-to.patch |  51 ++
 ...make-multiple-directory-targets-work.patch |  45 ++
 ...-remove-.tmp-file-when-filechk-fails.patch |  83 +++
 ...tead-of-e-for-precise-cc-option-test.patch |  52 ++
 ...en-dependency-in-randconfig-generate.patch |  46 ++
 ...x-memleak-in-module_add_modinfo_attr.patch |  38 ++
 ...mize_kprobe-unoptimize_kprobe-cancel.patch | 167 +++++
 ...se-dependency-of-get_size-on-c-libra.patch | 113 +++
 ...eout-dependence-on-sysctl_hung_task_.patch |  80 +++
 ...v-release-lock-on-page-out-failure-p.patch |  37 +
 ...e-set-but-not-used-variable-ra-rs-rt.patch |  55 ++
 .../kvm-s390-enotsupp-eopnotsupp-fixups.patch |  56 ++
 ...ca963x-fix-open-drain-initialization.patch |  69 ++
 ...c-adjust-indentation-in-__sg_alloc_t.patch |  51 ++
 ...885-add-support-for-avermedia-ce310b.patch | 113 +++
 ...2-fix-enum-mbus-codes-and-frame-size.patch |  63 ++
 ...missing-allocation-failure-check-on-.patch |  42 ++
 ...-check-for-pll1-exceeding-max-allowe.patch |  42 ++
 ...fix-a-possible-sleep-in-atomic-conte.patch |  60 ++
 ...edia-sun4i-csi-deal-with-dram-offset.patch |  71 ++
 ...-fix-data-sampling-polarity-handling.patch |  45 ++
 ...4i-csi-fix-hv-sync-polarity-handling.patch |  89 +++
 ...dd-a-quirk-to-force-geo-gc6500-camer.patch |  85 +++
 ...e.h-explicitly-compare-grp-id-mask-t.patch |  94 +++
 ...ze-prevent-the-overflow-of-the-start.patch |  37 +
 ...gardena_smart_gateway_mt7688-limit-u.patch |  40 ++
 ..._sdfec-fix-xsdfec_poll-s-return-type.patch |  64 ++
 ...ork-around-high-stack-usage-with-gcc.patch |  46 ++
 ...alidation-of-hardware-device-types-f.patch |  98 +++
 ...pectrum_dpipe-add-missing-error-path.patch |  45 ++
 ...ting-info-name-early-in-case-we-can-.patch |  61 ++
 ...suppress-suspicious-rcu-usage-warnin.patch |  90 +++
 ...-flush_workqueue-in-nbd_start_device.patch |  56 ++
 ...ethernet-ixp4xx-standard-module-init.patch | 228 +++++++
 .../net-mlx5e-fix-printk-format-warning.patch |  38 ++
 ...y-fix-use-after-free-when-checking-l.patch |  47 ++
 ...add-logging-for-the-rgmii-tx-delay-c.patch |  74 ++
 ..._hdlc-reject-muram-offsets-above-64k.patch |  44 ++
 ...nnel-add-the-missing-erspan_version-.patch |  39 ++
 ...ert-cpu_to_le16-le16_to_cpu-e1-e2-to.patch |  37 +
 queue-5.5/nfs-fix-memory-leaks.patch          |  51 ++
 queue-5.5/nfs-fix-timstamp-debug-prints.patch |  65 ++
 ...-should-commit-src-file-metadata-too.patch |  69 ++
 ...-deference-on-strange-copy-compounds.patch |  54 ++
 queue-5.5/nvme-pci-remove-nvmeq-tags.patch    | 100 +++
 ...ilure-when-payload-does-not-match-sg.patch |  89 +++
 ...pass-lockdep-expression-to-rcu-lists.patch |  53 ++
 .../objtool-fix-arch-x86_64-build-error.patch |  66 ++
 ...-pointer-dereference-when-call-ocfs2.patch | 140 ++++
 ...cal-header-paths-relative-to-c-files.patch | 340 +++++++++
 ...tic-opps-on-errors-while-adding-them.patch |  78 +++
 ...id-assertion-in-case-of-null-pointer.patch |  37 +
 ...quire-cpu_hotplug_lock-before-pinst-.patch |  71 ++
 ...cpumask-without-removed-cpu-during-o.patch | 187 +++++
 ...-add-dma-alias-quirk-for-plx-pex-ntb.patch |  54 ++
 ...ric-quirk-for-increasing-d3hot-delay.patch |  61 ++
 ...evfns-parameter-to-pci_add_dma_alias.patch | 175 +++++
 ...export_symbol_gpl-for-pci_-enable-di.patch |  59 ++
 ...i-fix-pci_add_dma_alias-bitmask-size.patch |  77 +++
 ...delay-for-amd-ryzen5-7-xhci-controll.patch |  69 ++
 ...quirk_paxc_bridge-for-module-as-well.patch | 105 +++
 ...mx_ddr-fix-cpu-hotplug-state-cleanup.patch |  79 +++
 ...strain-large-increment-per-cycle-eve.patch | 204 ++++++
 ...-do-not-clear-irq-flags-on-direct-ir.patch |  60 ++
 ...sh-pfc-sh7264-fix-can-function-gpios.patch |  94 +++
 ...sh-pfc-sh7269-fix-can-function-gpios.patch | 184 +++++
 ...ake-tiger-lake-uses-_hid-enumeration.patch | 643 ++++++++++++++++++
 ...ebugfs-support-with-devfreq_summary-.patch | 173 +++++
 ...-devfreq-change-time-stats-to-64-bit.patch |  95 +++
 ...xynos-ppmu-fix-excessive-stack-usage.patch |  74 ++
 ...9_dmc-add-compile_test-and-have_arm_.patch |  53 ++
 ...onsider-weak-unresolved-symbol-reloc.patch | 105 +++
 ...-vf-pdev-fixup-into-pcibios_fixup_io.patch | 123 ++++
 ...m-don-t-log-user-reads-to-0xffffffff.patch |  43 ++
 ...iov-ensure-the-pdn-for-vfs-always-co.patch | 167 +++++
 ...lparcfg-fix-display-of-maximum-memor.patch |  41 ++
 ...move-vf-eeh_dev-state-when-disabling.patch |  57 ++
 ...intk-fix-exclusive_console-replaying.patch |  58 ++
 ...-remove-pwm-chip-in-.remove-before-m.patch |  53 ++
 ...omap-dmtimer-simplify-error-handling.patch |  85 +++
 ...-remove-set-but-not-set-variable-pwm.patch |  51 ++
 ...-function-used-to-release-some-memor.patch |  57 ++
 ...-realtek-phy-driver-module-is-loaded.patch |  47 ++
 ...ert-10ms-sleep-in-dce5_crtc_load_lut.patch |  53 ++
 .../raid6-test-fix-a-compilation-error.patch  |  58 ++
 ...raid6-test-fix-a-compilation-warning.patch |  59 ++
 ...d-work-around-wuninitialized-warning.patch |  44 ++
 ...a-race-due-to-atomic_t-copy-by-value.patch | 132 ++++
 ...-fix-missed-wakeup-of-exp_wq-waiters.patch | 102 +++
 ...p_tree-hierarchy-print-always-active.patch |  81 +++
 ...ce-for-assignments-to-pprev-for-hlis.patch | 169 +++++
 ...s-avoid-printing-address-of-mtt-page.patch |  38 ++
 ...lx5-don-t-fake-udata-for-kernel-path.patch | 169 +++++
 ...ma-rxe-fix-error-type-of-mmap_offset.patch |  38 ++
 ...ve-needs_kfree_rcu-from-uverbs_obj_t.patch |  90 +++
 ...ix-exported-symbols-to-the-exported-.patch |  49 ++
 ...lower-log-level-on-optional-gpios-be.patch |  45 ++
 ...regulator-avoid-deadlock-getting-and.patch | 174 +++++
 ...rious-unlock-in-reiserfs_fill_super-.patch |  36 +
 ...-null-pointer-dereference-in-reiserf.patch |  44 ++
 ...oc-initialize-rproc_class-before-use.patch |  73 ++
 ...mss-remove-mem-clk-from-the-active-p.patch |  37 +
 ...dd-scssi-reset-control-for-each-chan.patch |  63 ++
 ...u-enable-vcn-dpg-on-raven-and-raven2.patch |  51 ++
 ...ix-memory-leak-in-nfp_abm_u32_knode_.patch |  74 ++
 ...d-inclusion-of-regmap-support-when-n.patch |  74 ++
 ...wifi-rtl_pci-fix-wcast-function-type.patch |  58 ++
 ...-potential-null-skb-access-in-tx-isr.patch |  43 ++
 .../rtw88-fix-rate-mask-for-1ss-chip.patch    |  68 ++
 ...ked-stack-support-check-for-clang-10.patch |  49 ++
 queue-5.5/s390-fix-__emit_bug-macro.patch     | 201 ++++++
 ...generate-traced-function-stack-frame.patch | 103 +++
 ...x-possible-deadlock-in-recover_store.patch | 216 ++++++
 ...pci-recover-handle-in-clp_set_pci_fn.patch | 194 ++++++
 ...fno-stack-protector-when-building-bp.patch |  46 ++
 ...fix-size-of-rq-uclamp-initialization.patch |  39 ++
 ...ssert-non-numa-topology-masks-don-t-.patch | 144 ++++
 ...ust-indentation-in-ahc_find_syncrate.patch |  54 ++
 ...-destroy-session-if-there-are-outsta.patch | 138 ++++
 ...work-setting-of-fdmi-symbolic-node-n.patch |  94 +++
 ...e-pending-requests-in-host-reset-and.patch | 122 ++++
 ...k-add-apply_dev_quirks-variant-opera.patch |  68 ++
 ...vice-information-to-apply_dev_quirks.patch | 117 ++++
 ...set-global-state-between-reuseport-t.patch |  64 ++
 ...ftests-eeh-bump-eeh-wait-time-to-60s.patch |  51 ++
 ...ke-so_txtime-more-robust-to-timer-va.patch | 226 ++++++
 ...-settings-tests-can-be-in-subsubdirs.patch |  60 ++
 ...ialized-variable-in-test_cgcore_proc.patch |  40 ++
 ...e-cleanup-the-internal-avc-counters-.patch |  95 +++
 ...anup-the-internal-avc-counters-.patch-8688 |  40 ++
 queue-5.5/series                              | 393 +++++++++++
 ...e-return-type-of-cpm_muram_alloc-to-.patch | 188 +++++
 ...orrect-straps-address-for-older-tegr.patch |  38 ++
 queue-5.5/sparc-add-.exit.data-section.patch  |  43 ++
 ...l-lpspi-fix-only-one-cs-gpio-working.patch |  90 +++
 ...-ensure-width-is-respected-in-spi-me.patch |  41 ++
 ...-rtl8188-avoid-excessive-stack-usage.patch |  74 ++
 ...possible-overflow-on-jiffies-compara.patch |  61 ++
 ...tential-leaks-in-sunrpc_cache_unhash.patch |  36 +
 ...g-add-missing-nsplugin-to-basic.json.patch | 199 ++++++
 ...-fix-gcc9-stringop-truncation-compil.patch |  67 ++
 ...invalid-var_ref_vals-assumption-in-t.patch | 175 +++++
 ...ing_stat-return-values-in-error-hand.patch |  58 ++
 ...-unlikely-race-of-registering-two-st.patch |  87 +++
 ...-assignment-parsing-for-hist-trigger.patch | 193 ++++++
 ..._next-should-increase-position-index.patch |  64 ++
 ...adjust-indentation-in-several-functi.patch | 118 ++++
 ...djust-indentation-in-several-functio.patch | 159 +++++
 ...low-writing-to-rewritable-partitions.patch |  60 ++
 ...ce-reporting-for-metadata-and-virtua.patch |  76 +++
 ...in-atomic-context-bug-in-uio_dmem_ge.patch |  57 ++
 .../usb-dwc2-fix-in-fifo-allocation.patch     |  84 +++
 ...per-initializers-for-property-entrie.patch |  54 ++
 ...ix-possible-sleep-in-atomic-context-.patch | 111 +++
 ...0-get-rid-of-musb-.set_vbus-for-omap.patch |  56 ++
 ...p-fix-unsafe-unaligned-pointer-usage.patch | 156 +++++
 ...k2-skip-unpinning-pages-on-error-exi.patch |  49 ++
 ...erv_fb-use-physical-memory-for-fb-on.patch | 360 ++++++++++
 ...o_balloon-prevent-pfn-array-overflow.patch |  36 +
 ...us-fix-uninitialized-variable-access.patch |  60 ++
 .../vme-bridges-reduce-stack-usage.patch      | 110 +++
 queue-5.5/wan-hdlc_x25-fix-skb-handling.patch |  70 ++
 ...xx_hss-fix-compile-testing-on-64-bit.patch |  55 ++
 ...kup-enforce-that-timestamp-is-valid-.patch |  81 +++
 ...k-that-is-never-reached-because-of-z.patch |  51 ++
 ...pic-uv-avoid-unused-variable-warning.patch | 106 +++
 ...sed-relax-sed-symbol-type-regex-for-.patch |  68 ++
 ...-decoder-add-test-opcode-to-group3-2.patch |  80 +++
 ...te-fpu-state-after-failure-during-st.patch |  88 +++
 ...rot-mark-throttle_active_work-as-__m.patch |  53 ++
 ...t-clearing-issue-in-kernel_map_pages.patch |  62 ++
 ...rq_work-from-the-long-duration-nmi-h.patch | 100 +++
 ...86-sysfb-fix-check-for-bad-vram-size.patch |  50 ++
 ...orc-fix-config_modules-build-warning.patch |  55 ++
 ...86-vdso-provide-missing-include-file.patch |  47 ++
 394 files changed, 32037 insertions(+)
 create mode 100644 queue-5.5/acpi-button-add-dmi-quirk-for-razer-blade-stealth-13.patch
 create mode 100644 queue-5.5/acpi-iort-fix-number-of-ids-handling-in-iort_id_map.patch
 create mode 100644 queue-5.5/acpica-disassembler-create-buffer-fields-in-acpi_par.patch
 create mode 100644 queue-5.5/alarmtimer-make-alarmtimer-platform-device-child-of-.patch
 create mode 100644 queue-5.5/alsa-ctl-allow-tlv-read-operation-for-callback-type-.patch
 create mode 100644 queue-5.5/alsa-hda-add-docking-station-support-for-lenovo-thin.patch
 create mode 100644 queue-5.5/alsa-hda-hdmi-add-retry-logic-to-parse_intel_hdmi.patch
 create mode 100644 queue-5.5/alsa-hda-realtek-apply-mic-mute-led-quirk-for-dell-e.patch
 create mode 100644 queue-5.5/alsa-sh-fix-compile-warning-wrt-const.patch
 create mode 100644 queue-5.5/alsa-sh-fix-unused-variable-warnings.patch
 create mode 100644 queue-5.5/alsa-usb-audio-add-boot-quirk-for-motu-m-series.patch
 create mode 100644 queue-5.5/alsa-usb-audio-add-implicit-fb-quirk-for-motu-m-seri.patch
 create mode 100644 queue-5.5/alsa-usb-audio-add-quirks-for-line6-helix-devices-fw.patch
 create mode 100644 queue-5.5/alsa-usb-audio-unlock-on-error-in-probe.patch
 create mode 100644 queue-5.5/alsa-usx2y-adjust-indentation-in-snd_usx2y_hwdep_dsp.patch
 create mode 100644 queue-5.5/arm-8941-1-decompressor-enable-cp15-barrier-instruct.patch
 create mode 100644 queue-5.5/arm-8951-1-fix-kexec-compilation-issue.patch
 create mode 100644 queue-5.5/arm-8952-1-disable-kmemleak-on-xip-kernels.patch
 create mode 100644 queue-5.5/arm-dts-allwinner-h3-add-pmu-node.patch
 create mode 100644 queue-5.5/arm-dts-imx6-rdu2-disable-wp-for-usdhc2-and-usdhc3.patch
 create mode 100644 queue-5.5/arm-dts-imx6-rdu2-limit-usbh1-to-full-speed.patch
 create mode 100644 queue-5.5/arm-dts-r8a7779-add-device-node-for-arm-global-timer.patch
 create mode 100644 queue-5.5/arm-dts-rockchip-add-reg-property-to-brcmf-sub-node-.patch
 create mode 100644 queue-5.5/arm-dts-stm32-add-power-supply-for-dsi-panel-on-stm3.patch
 create mode 100644 queue-5.5/arm-exynos_defconfig-bring-back-explicitly-wanted-op.patch
 create mode 100644 queue-5.5/arm-omap2-pdata-quirks-add-prm-data-for-reset-suppor.patch
 create mode 100644 queue-5.5/arm64-dts-allwinner-h5-add-pmu-node.patch
 create mode 100644 queue-5.5/arm64-dts-allwinner-h6-add-pmu-mode.patch
 create mode 100644 queue-5.5/arm64-dts-qcom-db845c-enable-ath10k-8bit-host-cap-qu.patch
 create mode 100644 queue-5.5/arm64-dts-qcom-msm8996-disable-usb2-phy-suspend-by-c.patch
 create mode 100644 queue-5.5/arm64-dts-rockchip-add-reg-property-to-brcmf-sub-nod.patch
 create mode 100644 queue-5.5/arm64-dts-rockchip-fix-dwmmc-clock-name-for-px30.patch
 create mode 100644 queue-5.5/arm64-dts-rockchip-fix-dwmmc-clock-name-for-rk3308.patch
 create mode 100644 queue-5.5/arm64-dts-rockchip-fix-nanopc-t4-cooling-maps.patch
 create mode 100644 queue-5.5/arm64-dts-ti-k3-j721e-main-add-missing-power-domains.patch
 create mode 100644 queue-5.5/arm64-fix-alternatives-with-llvm-s-integrated-assemb.patch
 create mode 100644 queue-5.5/arm64-lse-fix-lse-atomics-with-llvm-s-integrated-ass.patch
 create mode 100644 queue-5.5/asm-generic-tlb-add-missing-config-symbol.patch
 create mode 100644 queue-5.5/asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch
 create mode 100644 queue-5.5/asoc-intel-consistent-hdmi-codec-probing-code.patch
 create mode 100644 queue-5.5/asoc-intel-sof_rt5682-add-quirk-for-number-of-hdmi-d.patch
 create mode 100644 queue-5.5/asoc-intel-sof_rt5682-add-support-for-tgl-max98357a-.patch
 create mode 100644 queue-5.5/asoc-intel-sof_rt5682-ignore-the-speaker-amp-when-th.patch
 create mode 100644 queue-5.5/asoc-soc-topology-fix-endianness-issues.patch
 create mode 100644 queue-5.5/asoc-sof-intel-hda-dai-fix-compilation-warning-in-pc.patch
 create mode 100644 queue-5.5/asoc-sof-intel-hda-fix-skl-dai-count.patch
 create mode 100644 queue-5.5/asoc-sof-intel-hda-solve-msi-issues-by-merging-ipc-a.patch
 create mode 100644 queue-5.5/asoc-txx9-remove-unused-rtd-variable.patch
 create mode 100644 queue-5.5/asoc-wm_adsp-correct-cache-handling-of-new-kernel-co.patch
 create mode 100644 queue-5.5/ath10k-correct-the-dma-direction-for-management-tx-b.patch
 create mode 100644 queue-5.5/ath10k-correct-the-tlv-len-of-ath10k_wmi_tlv_op_gen_.patch
 create mode 100644 queue-5.5/ath10k-fix-qmi-init-error-handling.patch
 create mode 100644 queue-5.5/b43legacy-fix-wcast-function-type.patch
 create mode 100644 queue-5.5/backlight-qcom-wled-fix-unsigned-comparison-to-zero.patch
 create mode 100644 queue-5.5/bcache-cached_dev_free-needs-to-put-the-sb-page.patch
 create mode 100644 queue-5.5/bcache-explicity-type-cast-in-bset_bkey_last.patch
 create mode 100644 queue-5.5/bcache-fix-incorrect-data-type-usage-in-btree_flush_.patch
 create mode 100644 queue-5.5/bcache-fix-memory-corruption-in-bch_cache_accounting.patch
 create mode 100644 queue-5.5/bcache-fix-use-after-free-in-register_bcache.patch
 create mode 100644 queue-5.5/bcache-properly-initialize-path-and-err-in-register_.patch
 create mode 100644 queue-5.5/bcache-rework-error-unwinding-in-register_bcache.patch
 create mode 100644 queue-5.5/block-bfq-do-not-plug-i-o-for-bfq_queues-with-no-pro.patch
 create mode 100644 queue-5.5/bnxt-detach-page-from-page-pool-before-sending-up-th.patch
 create mode 100644 queue-5.5/bpf-btf-always-output-invariant-hit-in-pahole-dwarf-.patch
 create mode 100644 queue-5.5/bpf-map_seq_next-should-always-increase-position-ind.patch
 create mode 100644 queue-5.5/bpf-print-error-message-for-bpftool-cgroup-show.patch
 create mode 100644 queue-5.5/bpf-return-ebadrqc-for-invalid-map-type-in-__bpf_tx_.patch
 create mode 100644 queue-5.5/bpf-sockhash-synchronize_rcu-before-free-ing-map.patch
 create mode 100644 queue-5.5/brcmfmac-fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch
 create mode 100644 queue-5.5/brcmfmac-fix-use-after-free-in-brcmf_sdio_readframes.patch
 create mode 100644 queue-5.5/brcmfmac-sdio-fix-oob-interrupt-initialization-on-br.patch
 create mode 100644 queue-5.5/brd-check-and-limit-max_part-par.patch
 create mode 100644 queue-5.5/btrfs-device-stats-log-when-stats-are-zeroed.patch
 create mode 100644 queue-5.5/btrfs-do-not-do-delalloc-reservation-under-page-lock.patch
 create mode 100644 queue-5.5/btrfs-fix-possible-null-pointer-dereference-in-integ.patch
 create mode 100644 queue-5.5/btrfs-fix-split-brain-handling-when-changing-fsid-to.patch
 create mode 100644 queue-5.5/btrfs-keep-pages-dirty-when-using-btrfs_writepage_fi.patch
 create mode 100644 queue-5.5/btrfs-safely-advance-counter-when-looking-up-bio-csu.patch
 create mode 100644 queue-5.5/btrfs-separate-definition-of-assertion-failure-handl.patch
 create mode 100644 queue-5.5/bus-fsl-mc-properly-empty-initialize-structure.patch
 create mode 100644 queue-5.5/bus-ti-sysc-implement-quirk-handling-for-clkdm_noaut.patch
 create mode 100644 queue-5.5/ceph-check-availability-of-mds-cluster-on-mount-afte.patch
 create mode 100644 queue-5.5/char-hpet-fix-out-of-bounds-read-bug.patch
 create mode 100644 queue-5.5/char-random-silence-a-lockdep-splat-with-printk.patch
 create mode 100644 queue-5.5/cifs-fix-mount-options-set-in-automount.patch
 create mode 100644 queue-5.5/cifs-fix-null-dereference-in-match_prepath.patch
 create mode 100644 queue-5.5/cifs-fix-unitialized-variable-poential-problem-with-.patch
 create mode 100644 queue-5.5/cifs-log-warning-message-once-if-out-of-disk-space.patch
 create mode 100644 queue-5.5/clk-actually-call-the-clock-init-before-any-other-ca.patch
 create mode 100644 queue-5.5/clk-at91-sam9x60-fix-programmable-clock-prescaler.patch
 create mode 100644 queue-5.5/clk-bm1800-remove-set-but-not-used-variable-fref.patch
 create mode 100644 queue-5.5/clk-imx-add-correct-failure-handling-for-clk-based-h.patch
 create mode 100644 queue-5.5/clk-meson-meson8b-make-the-ccf-use-the-glitch-free-m.patch
 create mode 100644 queue-5.5/clk-meson-pll-fix-by-0-division-in-__pll_params_to_r.patch
 create mode 100644 queue-5.5/clk-qcom-add-missing-msm8998-gcc_bimc_gfx_clk.patch
 create mode 100644 queue-5.5/clk-qcom-don-t-overwrite-cfg-in-clk_rcg2_dfs_populat.patch
 create mode 100644 queue-5.5/clk-qcom-rcg2-don-t-crash-if-our-parent-can-t-be-fou.patch
 create mode 100644 queue-5.5/clk-qcom-smd-add-missing-bimc-clock.patch
 create mode 100644 queue-5.5/clk-renesas-rcar-gen3-allow-changing-the-rpc-d2-cloc.patch
 create mode 100644 queue-5.5/clk-sunxi-ng-add-mux-and-pll-notifiers-for-a64-cpu-c.patch
 create mode 100644 queue-5.5/clk-ti-dra7-fix-parent-for-gmac_clkctrl.patch
 create mode 100644 queue-5.5/clk-uniphier-add-scssi-clock-gate-for-each-channel.patch
 create mode 100644 queue-5.5/clk-use-parent-node-pointer-during-registration-if-n.patch
 create mode 100644 queue-5.5/clocksource-davinci-only-enable-clockevents-once-tim.patch
 create mode 100644 queue-5.5/clocksource-drivers-bcm2835_timer-fix-memory-leak-of.patch
 create mode 100644 queue-5.5/cmd64x-potential-buffer-overflow-in-cmd64x_program_t.patch
 create mode 100644 queue-5.5/cpu-hotplug-stop_machine-fix-stop_machine-vs-hotplug.patch
 create mode 100644 queue-5.5/crypto-amlogic-add-unspecified-has_iomem-dependency.patch
 create mode 100644 queue-5.5/crypto-chtls-fixed-memory-leak.patch
 create mode 100644 queue-5.5/crypto-essiv-fix-aead-capitalization-and-preposition.patch
 create mode 100644 queue-5.5/crypto-hisilicon-bugfixed-tfm-leak.patch
 create mode 100644 queue-5.5/crypto-hisilicon-update-debugfs-usage-of-sec-v2.patch
 create mode 100644 queue-5.5/crypto-inside-secure-add-unspecified-has_iomem-depen.patch
 create mode 100644 queue-5.5/debugobjects-fix-various-data-races.patch
 create mode 100644 queue-5.5/dm-raid-table-line-rebuild-status-fixes.patch
 create mode 100644 queue-5.5/dm-thin-don-t-allow-changing-data-device-during-thin.patch
 create mode 100644 queue-5.5/dmaengine-fsl-qdma-fix-duplicated-argument-to.patch
 create mode 100644 queue-5.5/dmaengine-imx-sdma-fix-memory-leak.patch
 create mode 100644 queue-5.5/dmaengine-store-module-owner-in-dma_device-struct.patch
 create mode 100644 queue-5.5/dmaengine-ti-edma-add-missed-operations.patch
 create mode 100644 queue-5.5/dmaengine-ti-edma-fix-error-return-code-in-edma_prob.patch
 create mode 100644 queue-5.5/driver-core-platform-fix-u32-greater-or-equal-to-zer.patch
 create mode 100644 queue-5.5/driver-core-platform-prevent-resouce-overflow-from-c.patch
 create mode 100644 queue-5.5/driver-core-print-device-when-resources-present-in-r.patch
 create mode 100644 queue-5.5/drivers-block-zram-zram_drv.c-fix-error-return-codes.patch
 create mode 100644 queue-5.5/drm-amd-display-clear-state-after-exiting-fixed-acti.patch
 create mode 100644 queue-5.5/drm-amd-display-do-not-allocate-display_mode_lib-unn.patch
 create mode 100644 queue-5.5/drm-amd-display-fix-update_bw_bounding_box-calcs.patch
 create mode 100644 queue-5.5/drm-amd-display-fixup-dml-dependencies.patch
 create mode 100644 queue-5.5/drm-amd-display-lower-dpp-dto-only-when-safe.patch
 create mode 100644 queue-5.5/drm-amd-display-map-odm-memory-correctly-when-doing-.patch
 create mode 100644 queue-5.5/drm-amd-display-renoir-chroma-viewport-wa.patch
 create mode 100644 queue-5.5/drm-amd-display-retrain-dongles-when-sink_count-beco.patch
 create mode 100644 queue-5.5/drm-amdgpu-display-handle-multiple-numbers-of-fclks-.patch
 create mode 100644 queue-5.5/drm-amdgpu-dm-do-not-throw-an-error-for-a-display-wi.patch
 create mode 100644 queue-5.5/drm-amdgpu-ensure-ret-is-always-initialized-when-usi.patch
 create mode 100644 queue-5.5/drm-amdgpu-fix-double-gpu_recovery-for-nv-of-sriov.patch
 create mode 100644 queue-5.5/drm-amdgpu-fix-kiq-ring-test-fail-in-tdr-of-sriov.patch
 create mode 100644 queue-5.5/drm-amdgpu-remove-4-set-but-not-used-variable-in-amd.patch
 create mode 100644 queue-5.5/drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_la.patch
 create mode 100644 queue-5.5/drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_vo.patch
 create mode 100644 queue-5.5/drm-amdgpu-sriov-workaround-on-rev_id-for-navi12-und.patch
 create mode 100644 queue-5.5/drm-amdkfd-fix-a-bug-in-sdma-rlc-queue-counting-unde.patch
 create mode 100644 queue-5.5/drm-amdkfd-fix-permissions-of-hang_hws.patch
 create mode 100644 queue-5.5/drm-dp_mst-fix-multiple-frees-of-tx-bytes.patch
 create mode 100644 queue-5.5/drm-fbdev-fallback-to-non-tiled-mode-if-all-tiles-no.patch
 create mode 100644 queue-5.5/drm-gma500-fixup-fbdev-stolen-size-usage-evaluation.patch
 create mode 100644 queue-5.5/drm-mediatek-add-gamma-property-according-to-hardwar.patch
 create mode 100644 queue-5.5/drm-mediatek-handle-events-when-enabling-disabling-c.patch
 create mode 100644 queue-5.5/drm-mipi_dbi-fix-off-by-one-bugs-in-mipi_dbi_blank.patch
 create mode 100644 queue-5.5/drm-msm-adreno-fix-zap-vs-no-zap-handling.patch
 create mode 100644 queue-5.5/drm-nouveau-disp-nv50-prevent-oops-when-no-channel-m.patch
 create mode 100644 queue-5.5/drm-nouveau-drm-ttm-remove-set-but-not-used-variable.patch
 create mode 100644 queue-5.5/drm-nouveau-fault-gv100-fix-memory-leak-on-module-un.patch
 create mode 100644 queue-5.5/drm-nouveau-fix-copy-paste-error-in-nouveau_fence_wa.patch
 create mode 100644 queue-5.5/drm-nouveau-gr-gk20a-gm200-add-terminators-to-method.patch
 create mode 100644 queue-5.5/drm-nouveau-mmu-fix-comptag-memory-leak.patch
 create mode 100644 queue-5.5/drm-nouveau-nouveau-fix-incorrect-sizeof-on-args.src.patch
 create mode 100644 queue-5.5/drm-nouveau-secboot-gm20b-initialize-pointer-in-gm20.patch
 create mode 100644 queue-5.5/drm-panel-simple-add-logic-pd-type-28-display-suppor.patch
 create mode 100644 queue-5.5/drm-qxl-complete-exception-handling-in-qxl_device_in.patch
 create mode 100644 queue-5.5/drm-rcar-du-recognize-renesas-vsps-in-addition-to-vs.patch
 create mode 100644 queue-5.5/drm-remove-the-newline-for-crc-source-name.patch
 create mode 100644 queue-5.5/drm-virtio-fix-byteorder-handling-in-virtio_gpu_cmd_.patch
 create mode 100644 queue-5.5/drm-vmwgfx-prevent-memory-leak-in-vmw_cmdbuf_res_add.patch
 create mode 100644 queue-5.5/edac-sifive-fix-return-value-check-in-ecc_register.patch
 create mode 100644 queue-5.5/efi-arm-defer-probe-of-pcie-backed-efifb-on-dt-syste.patch
 create mode 100644 queue-5.5/efi-x86-don-t-panic-or-bug-on-non-critical-error-con.patch
 create mode 100644 queue-5.5/efi-x86-map-the-entire-efi-vendor-string-before-copy.patch
 create mode 100644 queue-5.5/enetc-don-t-print-from-enetc_sched_speed_set-when-li.patch
 create mode 100644 queue-5.5/enetc-remove-variable-tc_max_sized_frame-set-but-not.patch
 create mode 100644 queue-5.5/ext4-fix-deadlock-allocating-bio_post_read_ctx-from-.patch
 create mode 100644 queue-5.5/ext4-fix-ext4_dax_read-write-inode-locking-sequence-.patch
 create mode 100644 queue-5.5/ext4-jbd2-ensure-panic-when-aborting-with-zero-errno.patch
 create mode 100644 queue-5.5/f2fs-call-f2fs_balance_fs-outside-of-locked-page.patch
 create mode 100644 queue-5.5/f2fs-fix-memleak-of-kobject.patch
 create mode 100644 queue-5.5/f2fs-free-sysfs-kobject.patch
 create mode 100644 queue-5.5/f2fs-preallocate-dio-blocks-when-forcing-buffered_io.patch
 create mode 100644 queue-5.5/f2fs-set-i_linkable-early-to-avoid-wrong-access-by-v.patch
 create mode 100644 queue-5.5/fbdev-fix-numbering-of-fbcon-options.patch
 create mode 100644 queue-5.5/fore200e-fix-incorrect-checks-of-null-pointer-derefe.patch
 create mode 100644 queue-5.5/ftrace-fpid_next-should-increase-position-index.patch
 create mode 100644 queue-5.5/fuse-don-t-overflow-llong_max-with-end-offset.patch
 create mode 100644 queue-5.5/gianfar-fix-tx-timestamping-with-a-stacked-dsa-drive.patch
 create mode 100644 queue-5.5/gpio-gpio-grgpio-fix-possible-sleep-in-atomic-contex.patch
 create mode 100644 queue-5.5/gpiolib-set-lockdep-class-for-hierarchical-irq-domai.patch
 create mode 100644 queue-5.5/gpu-drm-ingenic-avoid-null-pointer-deference-in-plan.patch
 create mode 100644 queue-5.5/help_next-should-increase-position-index.patch
 create mode 100644 queue-5.5/hostap-adjust-indentation-in-prism2_hostapd_add_sta.patch
 create mode 100644 queue-5.5/i40e-relax-i40e_xsk_wakeup-s-return-value-when-pf-is.patch
 create mode 100644 queue-5.5/ib-core-let-ib-core-distribute-cache-update-events.patch
 create mode 100644 queue-5.5/ib-hfi1-add-rcvshortlengtherrcnt-to-hfi1stats.patch
 create mode 100644 queue-5.5/ib-hfi1-add-software-counter-for-ctxt0-seq-drop.patch
 create mode 100644 queue-5.5/ice-add-extra-check-for-null-rx-descriptor.patch
 create mode 100644 queue-5.5/ide-serverworks-potential-overflow-in-svwks_set_pio_.patch
 create mode 100644 queue-5.5/iio-imu-st_lsm6dsx-check-return-value-from-st_lsm6ds.patch
 create mode 100644 queue-5.5/ima-check-ima-policy-flag.patch
 create mode 100644 queue-5.5/input-edt-ft5x06-work-around-first-register-access-e.patch
 create mode 100644 queue-5.5/iommu-amd-check-feature-support-bit-before-accessing.patch
 create mode 100644 queue-5.5/iommu-amd-only-support-x2apic-with-ivhd-type-11h-40h.patch
 create mode 100644 queue-5.5/iommu-arm-smmu-v3-use-write_once-when-changing-valid.patch
 create mode 100644 queue-5.5/iommu-iova-silence-warnings-under-memory-pressure.patch
 create mode 100644 queue-5.5/iommu-vt-d-avoid-sending-invalid-page-response.patch
 create mode 100644 queue-5.5/iommu-vt-d-fix-off-by-one-in-pasid-allocation.patch
 create mode 100644 queue-5.5/iommu-vt-d-mark-firmware-tainted-if-rmrr-fails-sanit.patch
 create mode 100644 queue-5.5/iommu-vt-d-match-cpu-and-iommu-paging-mode.patch
 create mode 100644 queue-5.5/iommu-vt-d-remove-unnecessary-warn_on_once.patch
 create mode 100644 queue-5.5/ipw2x00-fix-wcast-function-type.patch
 create mode 100644 queue-5.5/irqchip-gic-v3-its-fix-get_vlpi_map-breakage-with-do.patch
 create mode 100644 queue-5.5/irqchip-gic-v3-its-reference-to-its_invall_cmd-descr.patch
 create mode 100644 queue-5.5/irqchip-gic-v3-only-provision-redistributors-that-ar.patch
 create mode 100644 queue-5.5/irqchip-mbigen-set-driver-.suppress_bind_attrs-to-av.patch
 create mode 100644 queue-5.5/isdn-don-t-mark-kcapi_proc_exit-as-__exit.patch
 create mode 100644 queue-5.5/iwlegacy-ensure-loop-counter-addr-does-not-wrap-and-.patch
 create mode 100644 queue-5.5/iwlegacy-fix-wcast-function-type.patch
 create mode 100644 queue-5.5/iwlwifi-mvm-check-the-sta-is-not-null-in-iwl_mvm_cfg.patch
 create mode 100644 queue-5.5/iwlwifi-mvm-fix-thermal-zone-registration.patch
 create mode 100644 queue-5.5/jbd2-clear-jbd2_abort-flag-before-journal_reset-to-u.patch
 create mode 100644 queue-5.5/jbd2-make-sure-eshutdown-to-be-recorded-in-the-journ.patch
 create mode 100644 queue-5.5/jbd2-switch-to-use-jbd2_journal_abort-when-failed-to.patch
 create mode 100644 queue-5.5/kbuild-make-multiple-directory-targets-work.patch
 create mode 100644 queue-5.5/kbuild-remove-.tmp-file-when-filechk-fails.patch
 create mode 100644 queue-5.5/kbuild-use-s-instead-of-e-for-precise-cc-option-test.patch
 create mode 100644 queue-5.5/kconfig-fix-broken-dependency-in-randconfig-generate.patch
 create mode 100644 queue-5.5/kernel-module-fix-memleak-in-module_add_modinfo_attr.patch
 create mode 100644 queue-5.5/kprobes-fix-optimize_kprobe-unoptimize_kprobe-cancel.patch
 create mode 100644 queue-5.5/kselftest-minimise-dependency-of-get_size-on-c-libra.patch
 create mode 100644 queue-5.5/kunit-remove-timeout-dependence-on-sysctl_hung_task_.patch
 create mode 100644 queue-5.5/kvm-ppc-book3s-hv-release-lock-on-page-out-failure-p.patch
 create mode 100644 queue-5.5/kvm-ppc-remove-set-but-not-used-variable-ra-rs-rt.patch
 create mode 100644 queue-5.5/kvm-s390-enotsupp-eopnotsupp-fixups.patch
 create mode 100644 queue-5.5/leds-pca963x-fix-open-drain-initialization.patch
 create mode 100644 queue-5.5/lib-scatterlist.c-adjust-indentation-in-__sg_alloc_t.patch
 create mode 100644 queue-5.5/media-cx23885-add-support-for-avermedia-ce310b.patch
 create mode 100644 queue-5.5/media-i2c-mt9v032-fix-enum-mbus-codes-and-frame-size.patch
 create mode 100644 queue-5.5/media-meson-add-missing-allocation-failure-check-on-.patch
 create mode 100644 queue-5.5/media-ov5640-fix-check-for-pll1-exceeding-max-allowe.patch
 create mode 100644 queue-5.5/media-sti-bdisp-fix-a-possible-sleep-in-atomic-conte.patch
 create mode 100644 queue-5.5/media-sun4i-csi-deal-with-dram-offset.patch
 create mode 100644 queue-5.5/media-sun4i-csi-fix-data-sampling-polarity-handling.patch
 create mode 100644 queue-5.5/media-sun4i-csi-fix-hv-sync-polarity-handling.patch
 create mode 100644 queue-5.5/media-uvcvideo-add-a-quirk-to-force-geo-gc6500-camer.patch
 create mode 100644 queue-5.5/media-v4l2-device.h-explicitly-compare-grp-id-mask-t.patch
 create mode 100644 queue-5.5/microblaze-prevent-the-overflow-of-the-start.patch
 create mode 100644 queue-5.5/mips-ralink-dts-gardena_smart_gateway_mt7688-limit-u.patch
 create mode 100644 queue-5.5/misc-xilinx_sdfec-fix-xsdfec_poll-s-return-type.patch
 create mode 100644 queue-5.5/mlx5-work-around-high-stack-usage-with-gcc.patch
 create mode 100644 queue-5.5/mlxsw-core-add-validation-of-hardware-device-types-f.patch
 create mode 100644 queue-5.5/mlxsw-spectrum_dpipe-add-missing-error-path.patch
 create mode 100644 queue-5.5/module-avoid-setting-info-name-early-in-case-we-can-.patch
 create mode 100644 queue-5.5/modules-lockdep-suppress-suspicious-rcu-usage-warnin.patch
 create mode 100644 queue-5.5/nbd-add-a-flush_workqueue-in-nbd_start_device.patch
 create mode 100644 queue-5.5/net-ethernet-ixp4xx-standard-module-init.patch
 create mode 100644 queue-5.5/net-mlx5e-fix-printk-format-warning.patch
 create mode 100644 queue-5.5/net-phy-fixed_phy-fix-use-after-free-when-checking-l.patch
 create mode 100644 queue-5.5/net-phy-realtek-add-logging-for-the-rgmii-tx-delay-c.patch
 create mode 100644 queue-5.5/net-wan-fsl_ucc_hdlc-reject-muram-offsets-above-64k.patch
 create mode 100644 queue-5.5/netfilter-nft_tunnel-add-the-missing-erspan_version-.patch
 create mode 100644 queue-5.5/nfc-port100-convert-cpu_to_le16-le16_to_cpu-e1-e2-to.patch
 create mode 100644 queue-5.5/nfs-fix-memory-leaks.patch
 create mode 100644 queue-5.5/nfs-fix-timstamp-debug-prints.patch
 create mode 100644 queue-5.5/nfsd-clone-should-commit-src-file-metadata-too.patch
 create mode 100644 queue-5.5/nfsd4-avoid-null-deference-on-strange-copy-compounds.patch
 create mode 100644 queue-5.5/nvme-pci-remove-nvmeq-tags.patch
 create mode 100644 queue-5.5/nvmet-fix-dsm-failure-when-payload-does-not-match-sg.patch
 create mode 100644 queue-5.5/nvmet-pass-lockdep-expression-to-rcu-lists.patch
 create mode 100644 queue-5.5/objtool-fix-arch-x86_64-build-error.patch
 create mode 100644 queue-5.5/ocfs2-fix-a-null-pointer-dereference-when-call-ocfs2.patch
 create mode 100644 queue-5.5/ocfs2-make-local-header-paths-relative-to-c-files.patch
 create mode 100644 queue-5.5/opp-free-static-opps-on-errors-while-adding-them.patch
 create mode 100644 queue-5.5/orinoco-avoid-assertion-in-case-of-null-pointer.patch
 create mode 100644 queue-5.5/padata-always-acquire-cpu_hotplug_lock-before-pinst-.patch
 create mode 100644 queue-5.5/padata-validate-cpumask-without-removed-cpu-during-o.patch
 create mode 100644 queue-5.5/pci-add-dma-alias-quirk-for-plx-pex-ntb.patch
 create mode 100644 queue-5.5/pci-add-generic-quirk-for-increasing-d3hot-delay.patch
 create mode 100644 queue-5.5/pci-add-nr_devfns-parameter-to-pci_add_dma_alias.patch
 create mode 100644 queue-5.5/pci-ats-restore-export_symbol_gpl-for-pci_-enable-di.patch
 create mode 100644 queue-5.5/pci-fix-pci_add_dma_alias-bitmask-size.patch
 create mode 100644 queue-5.5/pci-increase-d3-delay-for-amd-ryzen5-7-xhci-controll.patch
 create mode 100644 queue-5.5/pci-iproc-apply-quirk_paxc_bridge-for-module-as-well.patch
 create mode 100644 queue-5.5/perf-imx_ddr-fix-cpu-hotplug-state-cleanup.patch
 create mode 100644 queue-5.5/perf-x86-amd-constrain-large-increment-per-cycle-eve.patch
 create mode 100644 queue-5.5/pinctrl-baytrail-do-not-clear-irq-flags-on-direct-ir.patch
 create mode 100644 queue-5.5/pinctrl-sh-pfc-sh7264-fix-can-function-gpios.patch
 create mode 100644 queue-5.5/pinctrl-sh-pfc-sh7269-fix-can-function-gpios.patch
 create mode 100644 queue-5.5/pinctrl-tigerlake-tiger-lake-uses-_hid-enumeration.patch
 create mode 100644 queue-5.5/pm-devfreq-add-debugfs-support-with-devfreq_summary-.patch
 create mode 100644 queue-5.5/pm-devfreq-change-time-stats-to-64-bit.patch
 create mode 100644 queue-5.5/pm-devfreq-exynos-ppmu-fix-excessive-stack-usage.patch
 create mode 100644 queue-5.5/pm-devfreq-rk3399_dmc-add-compile_test-and-have_arm_.patch
 create mode 100644 queue-5.5/powerpc-do-not-consider-weak-unresolved-symbol-reloc.patch
 create mode 100644 queue-5.5/powerpc-iov-move-vf-pdev-fixup-into-pcibios_fixup_io.patch
 create mode 100644 queue-5.5/powerpc-mm-don-t-log-user-reads-to-0xffffffff.patch
 create mode 100644 queue-5.5/powerpc-powernv-iov-ensure-the-pdn-for-vfs-always-co.patch
 create mode 100644 queue-5.5/powerpc-pseries-lparcfg-fix-display-of-maximum-memor.patch
 create mode 100644 queue-5.5/powerpc-sriov-remove-vf-eeh_dev-state-when-disabling.patch
 create mode 100644 queue-5.5/printk-fix-exclusive_console-replaying.patch
 create mode 100644 queue-5.5/pwm-omap-dmtimer-remove-pwm-chip-in-.remove-before-m.patch
 create mode 100644 queue-5.5/pwm-omap-dmtimer-simplify-error-handling.patch
 create mode 100644 queue-5.5/pwm-remove-set-but-not-set-variable-pwm.patch
 create mode 100644 queue-5.5/pxa168fb-fix-the-function-used-to-release-some-memor.patch
 create mode 100644 queue-5.5/r8169-check-that-realtek-phy-driver-module-is-loaded.patch
 create mode 100644 queue-5.5/radeon-insert-10ms-sleep-in-dce5_crtc_load_lut.patch
 create mode 100644 queue-5.5/raid6-test-fix-a-compilation-error.patch
 create mode 100644 queue-5.5/raid6-test-fix-a-compilation-warning.patch
 create mode 100644 queue-5.5/rbd-work-around-wuninitialized-warning.patch
 create mode 100644 queue-5.5/rcu-fix-data-race-due-to-atomic_t-copy-by-value.patch
 create mode 100644 queue-5.5/rcu-fix-missed-wakeup-of-exp_wq-waiters.patch
 create mode 100644 queue-5.5/rcu-nocb-fix-dump_tree-hierarchy-print-always-active.patch
 create mode 100644 queue-5.5/rcu-use-write_once-for-assignments-to-pprev-for-hlis.patch
 create mode 100644 queue-5.5/rdma-hns-avoid-printing-address-of-mtt-page.patch
 create mode 100644 queue-5.5/rdma-mlx5-don-t-fake-udata-for-kernel-path.patch
 create mode 100644 queue-5.5/rdma-rxe-fix-error-type-of-mmap_offset.patch
 create mode 100644 queue-5.5/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch
 create mode 100644 queue-5.5/regulator-core-fix-exported-symbols-to-the-exported-.patch
 create mode 100644 queue-5.5/regulator-rk808-lower-log-level-on-optional-gpios-be.patch
 create mode 100644 queue-5.5/regulator-vctrl-regulator-avoid-deadlock-getting-and.patch
 create mode 100644 queue-5.5/reiserfs-fix-spurious-unlock-in-reiserfs_fill_super-.patch
 create mode 100644 queue-5.5/reiserfs-prevent-null-pointer-dereference-in-reiserf.patch
 create mode 100644 queue-5.5/remoteproc-initialize-rproc_class-before-use.patch
 create mode 100644 queue-5.5/remoteproc-q6v5-mss-remove-mem-clk-from-the-active-p.patch
 create mode 100644 queue-5.5/reset-uniphier-add-scssi-reset-control-for-each-chan.patch
 create mode 100644 queue-5.5/revert-drm-amdgpu-enable-vcn-dpg-on-raven-and-raven2.patch
 create mode 100644 queue-5.5/revert-nfp-abm-fix-memory-leak-in-nfp_abm_u32_knode_.patch
 create mode 100644 queue-5.5/rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-n.patch
 create mode 100644 queue-5.5/rtlwifi-rtl_pci-fix-wcast-function-type.patch
 create mode 100644 queue-5.5/rtw88-fix-potential-null-skb-access-in-tx-isr.patch
 create mode 100644 queue-5.5/rtw88-fix-rate-mask-for-1ss-chip.patch
 create mode 100644 queue-5.5/s390-adjust-mpacked-stack-support-check-for-clang-10.patch
 create mode 100644 queue-5.5/s390-fix-__emit_bug-macro.patch
 create mode 100644 queue-5.5/s390-ftrace-generate-traced-function-stack-frame.patch
 create mode 100644 queue-5.5/s390-pci-fix-possible-deadlock-in-recover_store.patch
 create mode 100644 queue-5.5/s390-pci-recover-handle-in-clp_set_pci_fn.patch
 create mode 100644 queue-5.5/samples-bpf-set-fno-stack-protector-when-building-bp.patch
 create mode 100644 queue-5.5/sched-core-fix-size-of-rq-uclamp-initialization.patch
 create mode 100644 queue-5.5/sched-topology-assert-non-numa-topology-masks-don-t-.patch
 create mode 100644 queue-5.5/scsi-aic7xxx-adjust-indentation-in-ahc_find_syncrate.patch
 create mode 100644 queue-5.5/scsi-iscsi-don-t-destroy-session-if-there-are-outsta.patch
 create mode 100644 queue-5.5/scsi-lpfc-fix-rework-setting-of-fdmi-symbolic-node-n.patch
 create mode 100644 queue-5.5/scsi-ufs-complete-pending-requests-in-host-reset-and.patch
 create mode 100644 queue-5.5/scsi-ufs-mediatek-add-apply_dev_quirks-variant-opera.patch
 create mode 100644 queue-5.5/scsi-ufs-pass-device-information-to-apply_dev_quirks.patch
 create mode 100644 queue-5.5/selftests-bpf-reset-global-state-between-reuseport-t.patch
 create mode 100644 queue-5.5/selftests-eeh-bump-eeh-wait-time-to-60s.patch
 create mode 100644 queue-5.5/selftests-net-make-so_txtime-more-robust-to-timer-va.patch
 create mode 100644 queue-5.5/selftests-settings-tests-can-be-in-subsubdirs.patch
 create mode 100644 queue-5.5/selftests-uninitialized-variable-in-test_cgcore_proc.patch
 create mode 100644 queue-5.5/selinux-ensure-we-cleanup-the-internal-avc-counters-.patch
 create mode 100644 queue-5.5/selinux-ensure-we-cleanup-the-internal-avc-counters-.patch-8688
 create mode 100644 queue-5.5/soc-fsl-qe-change-return-type-of-cpm_muram_alloc-to-.patch
 create mode 100644 queue-5.5/soc-tegra-fuse-correct-straps-address-for-older-tegr.patch
 create mode 100644 queue-5.5/sparc-add-.exit.data-section.patch
 create mode 100644 queue-5.5/spi-fsl-lpspi-fix-only-one-cs-gpio-working.patch
 create mode 100644 queue-5.5/spi-spi-fsl-qspi-ensure-width-is-respected-in-spi-me.patch
 create mode 100644 queue-5.5/staging-rtl8188-avoid-excessive-stack-usage.patch
 create mode 100644 queue-5.5/staging-wfx-fix-possible-overflow-on-jiffies-compara.patch
 create mode 100644 queue-5.5/sunrpc-fix-potential-leaks-in-sunrpc_cache_unhash.patch
 create mode 100644 queue-5.5/tc-testing-add-missing-nsplugin-to-basic.json.patch
 create mode 100644 queue-5.5/tools-lib-api-fs-fix-gcc9-stringop-truncation-compil.patch
 create mode 100644 queue-5.5/tracing-fix-now-invalid-var_ref_vals-assumption-in-t.patch
 create mode 100644 queue-5.5/tracing-fix-tracing_stat-return-values-in-error-hand.patch
 create mode 100644 queue-5.5/tracing-fix-very-unlikely-race-of-registering-two-st.patch
 create mode 100644 queue-5.5/tracing-simplify-assignment-parsing-for-hist-trigger.patch
 create mode 100644 queue-5.5/trigger_next-should-increase-position-index.patch
 create mode 100644 queue-5.5/tty-synclink_gt-adjust-indentation-in-several-functi.patch
 create mode 100644 queue-5.5/tty-synclinkmp-adjust-indentation-in-several-functio.patch
 create mode 100644 queue-5.5/udf-allow-writing-to-rewritable-partitions.patch
 create mode 100644 queue-5.5/udf-fix-free-space-reporting-for-metadata-and-virtua.patch
 create mode 100644 queue-5.5/uio-fix-a-sleep-in-atomic-context-bug-in-uio_dmem_ge.patch
 create mode 100644 queue-5.5/usb-dwc2-fix-in-fifo-allocation.patch
 create mode 100644 queue-5.5/usb-dwc3-use-proper-initializers-for-property-entrie.patch
 create mode 100644 queue-5.5/usb-gadget-udc-fix-possible-sleep-in-atomic-context-.patch
 create mode 100644 queue-5.5/usb-musb-omap2430-get-rid-of-musb-.set_vbus-for-omap.patch
 create mode 100644 queue-5.5/usbip-fix-unsafe-unaligned-pointer-usage.patch
 create mode 100644 queue-5.5/vfio-spapr-nvlink2-skip-unpinning-pages-on-error-exi.patch
 create mode 100644 queue-5.5/video-hyperv-hyperv_fb-use-physical-memory-for-fb-on.patch
 create mode 100644 queue-5.5/virtio_balloon-prevent-pfn-array-overflow.patch
 create mode 100644 queue-5.5/visorbus-fix-uninitialized-variable-access.patch
 create mode 100644 queue-5.5/vme-bridges-reduce-stack-usage.patch
 create mode 100644 queue-5.5/wan-hdlc_x25-fix-skb-handling.patch
 create mode 100644 queue-5.5/wan-ixp4xx_hss-fix-compile-testing-on-64-bit.patch
 create mode 100644 queue-5.5/watchdog-softlockup-enforce-that-timestamp-is-valid-.patch
 create mode 100644 queue-5.5/wil6210-fix-break-that-is-never-reached-because-of-z.patch
 create mode 100644 queue-5.5/x86-apic-uv-avoid-unused-variable-warning.patch
 create mode 100644 queue-5.5/x86-boot-compressed-relax-sed-symbol-type-regex-for-.patch
 create mode 100644 queue-5.5/x86-decoder-add-test-opcode-to-group3-2.patch
 create mode 100644 queue-5.5/x86-fpu-deactivate-fpu-state-after-failure-during-st.patch
 create mode 100644 queue-5.5/x86-mce-therm_throt-mark-throttle_active_work-as-__m.patch
 create mode 100644 queue-5.5/x86-mm-fix-nx-bit-clearing-issue-in-kernel_map_pages.patch
 create mode 100644 queue-5.5/x86-nmi-remove-irq_work-from-the-long-duration-nmi-h.patch
 create mode 100644 queue-5.5/x86-sysfb-fix-check-for-bad-vram-size.patch
 create mode 100644 queue-5.5/x86-unwind-orc-fix-config_modules-build-warning.patch
 create mode 100644 queue-5.5/x86-vdso-provide-missing-include-file.patch

diff --git a/queue-5.5/acpi-button-add-dmi-quirk-for-razer-blade-stealth-13.patch b/queue-5.5/acpi-button-add-dmi-quirk-for-razer-blade-stealth-13.patch
new file mode 100644
index 00000000000..be070566df4
--- /dev/null
+++ b/queue-5.5/acpi-button-add-dmi-quirk-for-razer-blade-stealth-13.patch
@@ -0,0 +1,48 @@
+From ab2d80e09c3dbf862843cebbea37b2da456d8f09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 14:27:54 -0600
+Subject: ACPI: button: Add DMI quirk for Razer Blade Stealth 13 late 2019 lid
+ switch
+
+From: Jason Ekstrand <jason@jlekstrand.net>
+
+[ Upstream commit 0528904926aab19bffb2068879aa44db166c6d5f ]
+
+Running evemu-record on the lid switch event shows that the lid reports
+the first "close" but then never reports an "open".  This causes systemd
+to continuously re-suspend the laptop every 30s.  Resetting the _LID to
+"open" fixes the issue.
+
+Signed-off-by: Jason Ekstrand <jason@jlekstrand.net>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/button.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index b758b45737f50..f6925f16c4a2a 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -122,6 +122,17 @@ static const struct dmi_system_id dmi_lid_quirks[] = {
+ 		},
+ 		.driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
+ 	},
++	{
++		/*
++		 * Razer Blade Stealth 13 late 2019, notification of the LID device
++		 * only happens on close, not on open and _LID always returns closed.
++		 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Razer"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Razer Blade Stealth 13 Late 2019"),
++		},
++		.driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
++	},
+ 	{}
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/acpi-iort-fix-number-of-ids-handling-in-iort_id_map.patch b/queue-5.5/acpi-iort-fix-number-of-ids-handling-in-iort_id_map.patch
new file mode 100644
index 00000000000..34e3bc97df3
--- /dev/null
+++ b/queue-5.5/acpi-iort-fix-number-of-ids-handling-in-iort_id_map.patch
@@ -0,0 +1,156 @@
+From 89c1b3d3579e87612373d72ca331587605ff6533 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2020 20:14:11 +0800
+Subject: ACPI/IORT: Fix 'Number of IDs' handling in iort_id_map()
+
+From: Hanjun Guo <guohanjun@huawei.com>
+
+[ Upstream commit 3c23b83a88d00383e1d498cfa515249aa2fe0238 ]
+
+The IORT specification [0] (Section 3, table 4, page 9) defines the
+'Number of IDs' as 'The number of IDs in the range minus one'.
+
+However, the IORT ID mapping function iort_id_map() treats the 'Number
+of IDs' field as if it were the full IDs mapping count, with the
+following check in place to detect out of boundary input IDs:
+
+InputID >= Input base + Number of IDs
+
+This check is flawed in that it considers the 'Number of IDs' field as
+the full number of IDs mapping and disregards the 'minus one' from
+the IDs count.
+
+The correct check in iort_id_map() should be implemented as:
+
+InputID > Input base + Number of IDs
+
+this implements the specification correctly but unfortunately it breaks
+existing firmwares that erroneously set the 'Number of IDs' as the full
+IDs mapping count rather than IDs mapping count minus one.
+
+e.g.
+
+PCI hostbridge mapping entry 1:
+Input base:  0x1000
+ID Count:    0x100
+Output base: 0x1000
+Output reference: 0xC4  //ITS reference
+
+PCI hostbridge mapping entry 2:
+Input base:  0x1100
+ID Count:    0x100
+Output base: 0x2000
+Output reference: 0xD4  //ITS reference
+
+Two mapping entries which the second entry's Input base = the first
+entry's Input base + ID count, so for InputID 0x1100 and with the
+correct InputID check in place in iort_id_map() the kernel would map
+the InputID to ITS 0xC4 not 0xD4 as it would be expected.
+
+Therefore, to keep supporting existing flawed firmwares, introduce a
+workaround that instructs the kernel to use the old InputID range check
+logic in iort_id_map(), so that we can support both firmwares written
+with the flawed 'Number of IDs' logic and the correct one as defined in
+the specifications.
+
+[0]: http://infocenter.arm.com/help/topic/com.arm.doc.den0049d/DEN0049D_IO_Remapping_Table.pdf
+
+Reported-by: Pankaj Bansal <pankaj.bansal@nxp.com>
+Link: https://lore.kernel.org/linux-acpi/20191215203303.29811-1-pankaj.bansal@nxp.com/
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Cc: Pankaj Bansal <pankaj.bansal@nxp.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Sudeep Holla <sudeep.holla@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/arm64/iort.c | 57 +++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 55 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
+index 33f71983e0017..6078064684c6c 100644
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -298,6 +298,59 @@ out:
+ 	return status;
+ }
+ 
++struct iort_workaround_oem_info {
++	char oem_id[ACPI_OEM_ID_SIZE + 1];
++	char oem_table_id[ACPI_OEM_TABLE_ID_SIZE + 1];
++	u32 oem_revision;
++};
++
++static bool apply_id_count_workaround;
++
++static struct iort_workaround_oem_info wa_info[] __initdata = {
++	{
++		.oem_id		= "HISI  ",
++		.oem_table_id	= "HIP07   ",
++		.oem_revision	= 0,
++	}, {
++		.oem_id		= "HISI  ",
++		.oem_table_id	= "HIP08   ",
++		.oem_revision	= 0,
++	}
++};
++
++static void __init
++iort_check_id_count_workaround(struct acpi_table_header *tbl)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(wa_info); i++) {
++		if (!memcmp(wa_info[i].oem_id, tbl->oem_id, ACPI_OEM_ID_SIZE) &&
++		    !memcmp(wa_info[i].oem_table_id, tbl->oem_table_id, ACPI_OEM_TABLE_ID_SIZE) &&
++		    wa_info[i].oem_revision == tbl->oem_revision) {
++			apply_id_count_workaround = true;
++			pr_warn(FW_BUG "ID count for ID mapping entry is wrong, applying workaround\n");
++			break;
++		}
++	}
++}
++
++static inline u32 iort_get_map_max(struct acpi_iort_id_mapping *map)
++{
++	u32 map_max = map->input_base + map->id_count;
++
++	/*
++	 * The IORT specification revision D (Section 3, table 4, page 9) says
++	 * Number of IDs = The number of IDs in the range minus one, but the
++	 * IORT code ignored the "minus one", and some firmware did that too,
++	 * so apply a workaround here to keep compatible with both the spec
++	 * compliant and non-spec compliant firmwares.
++	 */
++	if (apply_id_count_workaround)
++		map_max--;
++
++	return map_max;
++}
++
+ static int iort_id_map(struct acpi_iort_id_mapping *map, u8 type, u32 rid_in,
+ 		       u32 *rid_out)
+ {
+@@ -314,8 +367,7 @@ static int iort_id_map(struct acpi_iort_id_mapping *map, u8 type, u32 rid_in,
+ 		return -ENXIO;
+ 	}
+ 
+-	if (rid_in < map->input_base ||
+-	    (rid_in >= map->input_base + map->id_count))
++	if (rid_in < map->input_base || rid_in > iort_get_map_max(map))
+ 		return -ENXIO;
+ 
+ 	*rid_out = map->output_base + (rid_in - map->input_base);
+@@ -1631,5 +1683,6 @@ void __init acpi_iort_init(void)
+ 		return;
+ 	}
+ 
++	iort_check_id_count_workaround(iort_table);
+ 	iort_init_platform_devices();
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/acpica-disassembler-create-buffer-fields-in-acpi_par.patch b/queue-5.5/acpica-disassembler-create-buffer-fields-in-acpi_par.patch
new file mode 100644
index 00000000000..b3f16ed2e3d
--- /dev/null
+++ b/queue-5.5/acpica-disassembler-create-buffer-fields-in-acpi_par.patch
@@ -0,0 +1,86 @@
+From d87fb4fb01d9c81a822eb5270cd41b7d489cb633 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 11:35:20 -0800
+Subject: ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
+
+From: Erik Kaneda <erik.kaneda@intel.com>
+
+[ Upstream commit 5ddbd77181dfca61b16d2e2222382ea65637f1b9 ]
+
+ACPICA commit 29cc8dbc5463a93625bed87d7550a8bed8913bf4
+
+create_buffer_field is a deferred op that is typically processed in
+load pass 2. However, disassembly of control method contents walk the
+parse tree with ACPI_PARSE_LOAD_PASS1 and AML_CREATE operators are
+processed in a later walk. This is a problem when there is a control
+method that has the same name as the AML_CREATE object. In this case,
+any use of the name segment will be detected as a method call rather
+than a reference to a buffer field. If this is detected as a method
+call, it can result in a mal-formed parse tree if the control methods
+have parameters.
+
+This change in processing AML_CREATE ops earlier solves this issue by
+inserting the named object in the ACPI namespace so that references
+to this name would be detected as a name string rather than a method
+call.
+
+Link: https://github.com/acpica/acpica/commit/29cc8dbc
+Reported-by: Elia Geretto <elia.f.geretto@gmail.com>
+Tested-by: Elia Geretto <elia.f.geretto@gmail.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Erik Kaneda <erik.kaneda@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsfield.c |  2 +-
+ drivers/acpi/acpica/dswload.c | 21 +++++++++++++++++++++
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsfield.c b/drivers/acpi/acpica/dsfield.c
+index faa38a22263ad..ae713d746c8b8 100644
+--- a/drivers/acpi/acpica/dsfield.c
++++ b/drivers/acpi/acpica/dsfield.c
+@@ -243,7 +243,7 @@ cleanup:
+  * FUNCTION:    acpi_ds_get_field_names
+  *
+  * PARAMETERS:  info            - create_field info structure
+- *  `           walk_state      - Current method state
++ *              walk_state      - Current method state
+  *              arg             - First parser arg for the field name list
+  *
+  * RETURN:      Status
+diff --git a/drivers/acpi/acpica/dswload.c b/drivers/acpi/acpica/dswload.c
+index c88fd31208a5b..4bcf15bf03ded 100644
+--- a/drivers/acpi/acpica/dswload.c
++++ b/drivers/acpi/acpica/dswload.c
+@@ -410,6 +410,27 @@ acpi_status acpi_ds_load1_end_op(struct acpi_walk_state *walk_state)
+ 	ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH, "Op=%p State=%p\n", op,
+ 			  walk_state));
+ 
++	/*
++	 * Disassembler: handle create field operators here.
++	 *
++	 * create_buffer_field is a deferred op that is typically processed in load
++	 * pass 2. However, disassembly of control method contents walk the parse
++	 * tree with ACPI_PARSE_LOAD_PASS1 and AML_CREATE operators are processed
++	 * in a later walk. This is a problem when there is a control method that
++	 * has the same name as the AML_CREATE object. In this case, any use of the
++	 * name segment will be detected as a method call rather than a reference
++	 * to a buffer field.
++	 *
++	 * This earlier creation during disassembly solves this issue by inserting
++	 * the named object in the ACPI namespace so that references to this name
++	 * would be a name string rather than a method call.
++	 */
++	if ((walk_state->parse_flags & ACPI_PARSE_DISASSEMBLE) &&
++	    (walk_state->op_info->flags & AML_CREATE)) {
++		status = acpi_ds_create_buffer_field(op, walk_state);
++		return_ACPI_STATUS(status);
++	}
++
+ 	/* We are only interested in opcodes that have an associated name */
+ 
+ 	if (!(walk_state->op_info->flags & (AML_NAMED | AML_FIELD))) {
+-- 
+2.20.1
+
diff --git a/queue-5.5/alarmtimer-make-alarmtimer-platform-device-child-of-.patch b/queue-5.5/alarmtimer-make-alarmtimer-platform-device-child-of-.patch
new file mode 100644
index 00000000000..7fbf6b29d37
--- /dev/null
+++ b/queue-5.5/alarmtimer-make-alarmtimer-platform-device-child-of-.patch
@@ -0,0 +1,102 @@
+From 624d48d71d10339c6ca7887be9de96d17edb7784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 21:58:46 -0800
+Subject: alarmtimer: Make alarmtimer platform device child of RTC device
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit c79108bd19a8490315847e0c95ac6526fcd8e770 ]
+
+The alarmtimer_suspend() function will fail if an RTC device is on a bus
+such as SPI or i2c and that RTC device registers and probes after
+alarmtimer_init() registers and probes the 'alarmtimer' platform device.
+
+This is because system wide suspend suspends devices in the reverse order
+of their probe. When alarmtimer_suspend() attempts to program the RTC for a
+wakeup it will try to program an RTC device on a bus that has already been
+suspended.
+
+Move the alarmtimer device registration to happen when the RTC which is
+used for wakeup is registered. Register the 'alarmtimer' platform device as
+a child of the RTC device too, so that it can be guaranteed that the RTC
+device won't be suspended when alarmtimer_suspend() is called.
+
+Reported-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20200124055849.154411-2-swboyd@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/alarmtimer.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index 4b11f0309eee4..b97401f6bc232 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -88,6 +88,7 @@ static int alarmtimer_rtc_add_device(struct device *dev,
+ 	unsigned long flags;
+ 	struct rtc_device *rtc = to_rtc_device(dev);
+ 	struct wakeup_source *__ws;
++	struct platform_device *pdev;
+ 	int ret = 0;
+ 
+ 	if (rtcdev)
+@@ -99,9 +100,11 @@ static int alarmtimer_rtc_add_device(struct device *dev,
+ 		return -1;
+ 
+ 	__ws = wakeup_source_register(dev, "alarmtimer");
++	pdev = platform_device_register_data(dev, "alarmtimer",
++					     PLATFORM_DEVID_AUTO, NULL, 0);
+ 
+ 	spin_lock_irqsave(&rtcdev_lock, flags);
+-	if (!rtcdev) {
++	if (__ws && !IS_ERR(pdev) && !rtcdev) {
+ 		if (!try_module_get(rtc->owner)) {
+ 			ret = -1;
+ 			goto unlock;
+@@ -112,10 +115,14 @@ static int alarmtimer_rtc_add_device(struct device *dev,
+ 		get_device(dev);
+ 		ws = __ws;
+ 		__ws = NULL;
++		pdev = NULL;
++	} else {
++		ret = -1;
+ 	}
+ unlock:
+ 	spin_unlock_irqrestore(&rtcdev_lock, flags);
+ 
++	platform_device_unregister(pdev);
+ 	wakeup_source_unregister(__ws);
+ 
+ 	return ret;
+@@ -876,8 +883,7 @@ static struct platform_driver alarmtimer_driver = {
+  */
+ static int __init alarmtimer_init(void)
+ {
+-	struct platform_device *pdev;
+-	int error = 0;
++	int error;
+ 	int i;
+ 
+ 	alarmtimer_rtc_timer_init();
+@@ -900,15 +906,7 @@ static int __init alarmtimer_init(void)
+ 	if (error)
+ 		goto out_if;
+ 
+-	pdev = platform_device_register_simple("alarmtimer", -1, NULL, 0);
+-	if (IS_ERR(pdev)) {
+-		error = PTR_ERR(pdev);
+-		goto out_drv;
+-	}
+ 	return 0;
+-
+-out_drv:
+-	platform_driver_unregister(&alarmtimer_driver);
+ out_if:
+ 	alarmtimer_rtc_interface_remove();
+ 	return error;
+-- 
+2.20.1
+
diff --git a/queue-5.5/alsa-ctl-allow-tlv-read-operation-for-callback-type-.patch b/queue-5.5/alsa-ctl-allow-tlv-read-operation-for-callback-type-.patch
new file mode 100644
index 00000000000..33ee7d09c97
--- /dev/null
+++ b/queue-5.5/alsa-ctl-allow-tlv-read-operation-for-callback-type-.patch
@@ -0,0 +1,61 @@
+From d0eb98633d20a5aee3afa41cbf546b9b5d8b45e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Dec 2019 18:33:47 +0900
+Subject: ALSA: ctl: allow TLV read operation for callback type of element in
+ locked case
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit d61fe22c2ae42d9fd76c34ef4224064cca4b04b0 ]
+
+A design of ALSA control core allows applications to execute three
+operations for TLV feature; read, write and command. Furthermore, it
+allows driver developers to process the operations by two ways; allocated
+array or callback function. In the former, read operation is just allowed,
+thus developers uses the latter when device driver supports variety of
+models or the target model is expected to dynamically change information
+stored in TLV container.
+
+The core also allows applications to lock any element so that the other
+applications can't perform write operation to the element for element
+value and TLV information. When the element is locked, write and command
+operation for TLV information are prohibited as well as element value.
+Any read operation should be allowed in the case.
+
+At present, when an element has callback function for TLV information,
+TLV read operation returns EPERM if the element is locked. On the
+other hand, the read operation is success when an element has allocated
+array for TLV information. In both cases, read operation is success for
+element value expectedly.
+
+This commit fixes the bug. This change can be backported to v4.14
+kernel or later.
+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Reviewed-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20191223093347.15279-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/control.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/control.c b/sound/core/control.c
+index 7a4d8690ce41f..08ca7666e84cf 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -1430,8 +1430,9 @@ static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
+ 	if (kctl->tlv.c == NULL)
+ 		return -ENXIO;
+ 
+-	/* When locked, this is unavailable. */
+-	if (vd->owner != NULL && vd->owner != file)
++	/* Write and command operations are not allowed for locked element. */
++	if (op_flag != SNDRV_CTL_TLV_OP_READ &&
++	    vd->owner != NULL && vd->owner != file)
+ 		return -EPERM;
+ 
+ 	return kctl->tlv.c(kctl, op_flag, size, buf);
+-- 
+2.20.1
+
diff --git a/queue-5.5/alsa-hda-add-docking-station-support-for-lenovo-thin.patch b/queue-5.5/alsa-hda-add-docking-station-support-for-lenovo-thin.patch
new file mode 100644
index 00000000000..e93b57dbce3
--- /dev/null
+++ b/queue-5.5/alsa-hda-add-docking-station-support-for-lenovo-thin.patch
@@ -0,0 +1,38 @@
+From 72c95567fb7a63064b15609269891211894720e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 19:01:06 +0100
+Subject: ALSA: hda - Add docking station support for Lenovo Thinkpad T420s
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Große <pegro@friiks.de>
+
+[ Upstream commit ef7d84caa5928b40b1c93a26dbe5a3f12737c6ab ]
+
+Lenovo Thinkpad T420s uses the same codec as T420, so apply the
+same quirk to enable audio output on a docking station.
+
+Signed-off-by: Peter Große <pegro@friiks.de>
+Link: https://lore.kernel.org/r/20200122180106.9351-1-pegro@friiks.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 90aa0f400a57d..1e20e85e9b466 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -922,6 +922,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
++	SND_PCI_QUIRK(0x17aa, 0x21d2, "Lenovo T420s", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410),
+ 	SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD),
+-- 
+2.20.1
+
diff --git a/queue-5.5/alsa-hda-hdmi-add-retry-logic-to-parse_intel_hdmi.patch b/queue-5.5/alsa-hda-hdmi-add-retry-logic-to-parse_intel_hdmi.patch
new file mode 100644
index 00000000000..4818420101c
--- /dev/null
+++ b/queue-5.5/alsa-hda-hdmi-add-retry-logic-to-parse_intel_hdmi.patch
@@ -0,0 +1,52 @@
+From 5d9bd871ab0d2c3079108d8bbfcadb36be99e5a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 18:01:17 +0200
+Subject: ALSA: hda/hdmi - add retry logic to parse_intel_hdmi()
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit 2928fa0a97ebb9549cb877fdc99aed9b95438c3a ]
+
+The initial snd_hda_get_sub_node() can fail on certain
+devices (e.g. some Chromebook models using Intel GLK).
+The failure rate is very low, but as this is is part of
+the probe process, end-user impact is high.
+
+In observed cases, related hardware status registers have
+expected values, but the node query still fails. Retrying
+the node query does seem to help, so fix the problem by
+adding retry logic to the query. This does not impact
+non-Intel platforms.
+
+BugLink: https://github.com/thesofproject/linux/issues/1642
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20200120160117.29130-4-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index bde50414029d9..4f195c7d966a9 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2862,9 +2862,12 @@ static int alloc_intel_hdmi(struct hda_codec *codec)
+ /* parse and post-process for Intel codecs */
+ static int parse_intel_hdmi(struct hda_codec *codec)
+ {
+-	int err;
++	int err, retries = 3;
++
++	do {
++		err = hdmi_parse_codec(codec);
++	} while (err < 0 && retries--);
+ 
+-	err = hdmi_parse_codec(codec);
+ 	if (err < 0) {
+ 		generic_spec_free(codec);
+ 		return err;
+-- 
+2.20.1
+
diff --git a/queue-5.5/alsa-hda-realtek-apply-mic-mute-led-quirk-for-dell-e.patch b/queue-5.5/alsa-hda-realtek-apply-mic-mute-led-quirk-for-dell-e.patch
new file mode 100644
index 00000000000..e4852de5e9f
--- /dev/null
+++ b/queue-5.5/alsa-hda-realtek-apply-mic-mute-led-quirk-for-dell-e.patch
@@ -0,0 +1,61 @@
+From b897d85d3951ec6bd21fe6e105febc8a2bd83601 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jan 2020 09:11:19 +0100
+Subject: ALSA: hda/realtek - Apply mic mute LED quirk for Dell E7xx laptops,
+ too
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 5fab5829674c279839a7408ab30c71c6dfe726b9 ]
+
+Dell E7xx laptops have also mic mute LED that is driven by the
+dell-laptop platform driver.  Bind it with the capture control as
+already done for other models.
+
+A caveat is that the fixup hook for the mic mute LED has to be applied
+at last, otherwise it results in the invalid override of the callback.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205529
+Link: https://lore.kernel.org/r/20200105081119.21396-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 128d81b4140b3..c6b1581c6ffaa 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5852,6 +5852,7 @@ enum {
+ 	ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 	ALC288_FIXUP_DELL_XPS_13,
+ 	ALC288_FIXUP_DISABLE_AAMIX,
++	ALC292_FIXUP_DELL_E7X_AAMIX,
+ 	ALC292_FIXUP_DELL_E7X,
+ 	ALC292_FIXUP_DISABLE_AAMIX,
+ 	ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK,
+@@ -6547,12 +6548,19 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC293_FIXUP_DELL1_MIC_NO_PRESENCE
+ 	},
+-	[ALC292_FIXUP_DELL_E7X] = {
++	[ALC292_FIXUP_DELL_E7X_AAMIX] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc_fixup_dell_xps13,
+ 		.chained = true,
+ 		.chain_id = ALC292_FIXUP_DISABLE_AAMIX
+ 	},
++	[ALC292_FIXUP_DELL_E7X] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = snd_hda_gen_fixup_micmute_led,
++		/* micmute fixup must be applied at last */
++		.chained_before = true,
++		.chain_id = ALC292_FIXUP_DELL_E7X_AAMIX,
++	},
+ 	[ALC298_FIXUP_ALIENWARE_MIC_NO_PRESENCE] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+-- 
+2.20.1
+
diff --git a/queue-5.5/alsa-sh-fix-compile-warning-wrt-const.patch b/queue-5.5/alsa-sh-fix-compile-warning-wrt-const.patch
new file mode 100644
index 00000000000..a5a4bbabd38
--- /dev/null
+++ b/queue-5.5/alsa-sh-fix-compile-warning-wrt-const.patch
@@ -0,0 +1,41 @@
+From 91dd0594ad0eaddfe9c8e9d93f1d533f776f7e77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jan 2020 15:48:23 +0100
+Subject: ALSA: sh: Fix compile warning wrt const
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit f1dd4795b1523fbca7ab4344dd5a8bb439cc770d ]
+
+A long-standing compile warning was seen during build test:
+  sound/sh/aica.c: In function 'load_aica_firmware':
+  sound/sh/aica.c:521:25: warning: passing argument 2 of 'spu_memload' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
+
+Fixes: 198de43d758c ("[ALSA] Add ALSA support for the SEGA Dreamcast PCM device")
+Link: https://lore.kernel.org/r/20200105144823.29547-69-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/sh/aica.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/sh/aica.c b/sound/sh/aica.c
+index bf1fb0d8a9306..f69072d2564c8 100644
+--- a/sound/sh/aica.c
++++ b/sound/sh/aica.c
+@@ -101,10 +101,10 @@ static void spu_memset(u32 toi, u32 what, int length)
+ }
+ 
+ /* spu_memload - write to SPU address space */
+-static void spu_memload(u32 toi, void *from, int length)
++static void spu_memload(u32 toi, const void *from, int length)
+ {
+ 	unsigned long flags;
+-	u32 *froml = from;
++	const u32 *froml = from;
+ 	u32 __iomem *to = (u32 __iomem *) (SPU_MEMORY_BASE + toi);
+ 	int i;
+ 	u32 val;
+-- 
+2.20.1
+
diff --git a/queue-5.5/alsa-sh-fix-unused-variable-warnings.patch b/queue-5.5/alsa-sh-fix-unused-variable-warnings.patch
new file mode 100644
index 00000000000..a0bc1957f7b
--- /dev/null
+++ b/queue-5.5/alsa-sh-fix-unused-variable-warnings.patch
@@ -0,0 +1,54 @@
+From 2310280b0d2e077ba2668692a88daee709c1277b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2020 12:00:57 +0100
+Subject: ALSA: sh: Fix unused variable warnings
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 5da116f164ce265e397b8f59af5c39e4a61d61a5 ]
+
+Remove unused variables that are left over after the conversion of new
+PCM ops:
+  sound/sh/sh_dac_audio.c:166:26: warning: unused variable 'runtime'
+  sound/sh/sh_dac_audio.c:186:26: warning: unused variable 'runtime'
+  sound/sh/sh_dac_audio.c:205:26: warning: unused variable 'runtime'
+
+Fixes: 1cc2f8ba0b3e ("ALSA: sh: Convert to the new PCM ops")
+Link: https://lore.kernel.org/r/20200104110057.13875-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/sh/sh_dac_audio.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/sound/sh/sh_dac_audio.c b/sound/sh/sh_dac_audio.c
+index f9e36abc98ac7..725992937e8f1 100644
+--- a/sound/sh/sh_dac_audio.c
++++ b/sound/sh/sh_dac_audio.c
+@@ -175,7 +175,6 @@ static int snd_sh_dac_pcm_copy(struct snd_pcm_substream *substream,
+ {
+ 	/* channel is not used (interleaved data) */
+ 	struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+-	struct snd_pcm_runtime *runtime = substream->runtime;
+ 
+ 	if (copy_from_user_toio(chip->data_buffer + pos, src, count))
+ 		return -EFAULT;
+@@ -195,7 +194,6 @@ static int snd_sh_dac_pcm_copy_kernel(struct snd_pcm_substream *substream,
+ {
+ 	/* channel is not used (interleaved data) */
+ 	struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+-	struct snd_pcm_runtime *runtime = substream->runtime;
+ 
+ 	memcpy_toio(chip->data_buffer + pos, src, count);
+ 	chip->buffer_end = chip->data_buffer + pos + count;
+@@ -214,7 +212,6 @@ static int snd_sh_dac_pcm_silence(struct snd_pcm_substream *substream,
+ {
+ 	/* channel is not used (interleaved data) */
+ 	struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+-	struct snd_pcm_runtime *runtime = substream->runtime;
+ 
+ 	memset_io(chip->data_buffer + pos, 0, count);
+ 	chip->buffer_end = chip->data_buffer + pos + count;
+-- 
+2.20.1
+
diff --git a/queue-5.5/alsa-usb-audio-add-boot-quirk-for-motu-m-series.patch b/queue-5.5/alsa-usb-audio-add-boot-quirk-for-motu-m-series.patch
new file mode 100644
index 00000000000..1b347706382
--- /dev/null
+++ b/queue-5.5/alsa-usb-audio-add-boot-quirk-for-motu-m-series.patch
@@ -0,0 +1,119 @@
+From 37a81ac56a8833184361c453a8b421dfaeb0a765 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 13:23:58 +0300
+Subject: ALSA: usb-audio: Add boot quirk for MOTU M Series
+
+From: Alexander Tsoy <alexander@tsoy.me>
+
+[ Upstream commit 73ac9f5e5b43a5dbadb61f27dae7a971f7ec0d22 ]
+
+Add delay to make sure that audio urbs are not sent too early.
+Otherwise the device hangs. Windows driver makes ~2s delay, so use
+about the same time delay value.
+
+snd_usb_apply_boot_quirk() is called 3 times for my MOTU M4, which
+is an overkill. Thus a quirk that is called only once is implemented.
+
+Also send two vendor-specific control messages before and after
+the delay. This behaviour is blindly copied from the Windows driver.
+
+Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
+Link: https://lore.kernel.org/r/20200112102358.18085-1-alexander@tsoy.me
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c   |  4 ++++
+ sound/usb/quirks.c | 38 ++++++++++++++++++++++++++++++++++++++
+ sound/usb/quirks.h |  5 +++++
+ 3 files changed, 47 insertions(+)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 9f743ebae615d..2f582ac7cf789 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -600,6 +600,10 @@ static int usb_audio_probe(struct usb_interface *intf,
+ 		}
+ 	}
+ 	if (! chip) {
++		err = snd_usb_apply_boot_quirk_once(dev, intf, quirk, id);
++		if (err < 0)
++			return err;
++
+ 		/* it's a fresh one.
+ 		 * now look for an empty slot and create a new card instance
+ 		 */
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 1ed25b1d2a6a2..7448ab07bd363 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1113,6 +1113,31 @@ free_buf:
+ 	return err;
+ }
+ 
++static int snd_usb_motu_m_series_boot_quirk(struct usb_device *dev)
++{
++	int ret;
++
++	if (snd_usb_pipe_sanity_check(dev, usb_sndctrlpipe(dev, 0)))
++		return -EINVAL;
++	ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
++			      1, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
++			      0x0, 0, NULL, 0, 1000);
++
++	if (ret < 0)
++		return ret;
++
++	msleep(2000);
++
++	ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
++			      1, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
++			      0x20, 0, NULL, 0, 1000);
++
++	if (ret < 0)
++		return ret;
++
++	return 0;
++}
++
+ /*
+  * Setup quirks
+  */
+@@ -1297,6 +1322,19 @@ int snd_usb_apply_boot_quirk(struct usb_device *dev,
+ 	return 0;
+ }
+ 
++int snd_usb_apply_boot_quirk_once(struct usb_device *dev,
++				  struct usb_interface *intf,
++				  const struct snd_usb_audio_quirk *quirk,
++				  unsigned int id)
++{
++	switch (id) {
++	case USB_ID(0x07fd, 0x0008): /* MOTU M Series */
++		return snd_usb_motu_m_series_boot_quirk(dev);
++	}
++
++	return 0;
++}
++
+ /*
+  * check if the device uses big-endian samples
+  */
+diff --git a/sound/usb/quirks.h b/sound/usb/quirks.h
+index a80e0ddd07364..df0355843a4c1 100644
+--- a/sound/usb/quirks.h
++++ b/sound/usb/quirks.h
+@@ -20,6 +20,11 @@ int snd_usb_apply_boot_quirk(struct usb_device *dev,
+ 			     const struct snd_usb_audio_quirk *quirk,
+ 			     unsigned int usb_id);
+ 
++int snd_usb_apply_boot_quirk_once(struct usb_device *dev,
++				  struct usb_interface *intf,
++				  const struct snd_usb_audio_quirk *quirk,
++				  unsigned int usb_id);
++
+ void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
+ 			      struct audioformat *fmt);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/alsa-usb-audio-add-implicit-fb-quirk-for-motu-m-seri.patch b/queue-5.5/alsa-usb-audio-add-implicit-fb-quirk-for-motu-m-seri.patch
new file mode 100644
index 00000000000..cc8dbcea64c
--- /dev/null
+++ b/queue-5.5/alsa-usb-audio-add-implicit-fb-quirk-for-motu-m-seri.patch
@@ -0,0 +1,43 @@
+From 92056c2314dec34d72550b05978ff9a9e81f1a2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 18:13:58 +0300
+Subject: ALSA: usb-audio: add implicit fb quirk for MOTU M Series
+
+From: Alexander Tsoy <alexander@tsoy.me>
+
+[ Upstream commit c249177944b650816069f6c49b769baaa94339dc ]
+
+This fixes crackling sound during playback.
+
+Further note: MOTU is known for reusing Product IDs for different
+devices or different generations of the device (e.g. MicroBook
+I/II/IIc shares a single Product ID). This patch was only tested with
+M4 audio interface, but the same Product ID is also used by M2. Hope
+it will work for M2 as well.
+
+Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
+Link: https://lore.kernel.org/r/20200115151358.56672-1-alexander@tsoy.me
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/pcm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 0e4eab96e23e0..c9e1609296dff 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -348,6 +348,10 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ 		ep = 0x84;
+ 		ifnum = 0;
+ 		goto add_sync_ep_from_ifnum;
++	case USB_ID(0x07fd, 0x0008): /* MOTU M Series */
++		ep = 0x81;
++		ifnum = 2;
++		goto add_sync_ep_from_ifnum;
+ 	case USB_ID(0x0582, 0x01d8): /* BOSS Katana */
+ 		/* BOSS Katana amplifiers do not need quirks */
+ 		return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.5/alsa-usb-audio-add-quirks-for-line6-helix-devices-fw.patch b/queue-5.5/alsa-usb-audio-add-quirks-for-line6-helix-devices-fw.patch
new file mode 100644
index 00000000000..890d6a38346
--- /dev/null
+++ b/queue-5.5/alsa-usb-audio-add-quirks-for-line6-helix-devices-fw.patch
@@ -0,0 +1,41 @@
+From 58962677f5990483eeb6df087b847d42518fea41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jan 2020 15:09:17 +0000
+Subject: ALSA: usb-audio: add quirks for Line6 Helix devices fw>=2.82
+
+From: Nicola Lunghi <nick83ola@gmail.com>
+
+[ Upstream commit b81cbf7abfc94878a3c6f0789f2185ee55b1cc21 ]
+
+With firmware 2.82 Line6 changed the usb id of some of the Helix
+devices but the quirks is still needed.
+
+Add it to the quirk list for line6 helix family of devices.
+
+Thanks to Jens for pointing out the missing ids.
+
+Signed-off-by: Nicola Lunghi <nick83ola@gmail.com>
+Link: https://lore.kernel.org/r/20200125150917.5040-1-nick83ola@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/format.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/usb/format.c b/sound/usb/format.c
+index 25668ba5e68e3..f4f0cf3deaf0c 100644
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -296,6 +296,9 @@ static int line6_parse_audio_format_rates_quirk(struct snd_usb_audio *chip,
+ 	case USB_ID(0x0E41, 0x4242): /* Line6 Helix Rack */
+ 	case USB_ID(0x0E41, 0x4244): /* Line6 Helix LT */
+ 	case USB_ID(0x0E41, 0x4246): /* Line6 HX-Stomp */
++	case USB_ID(0x0E41, 0x4248): /* Line6 Helix >= fw 2.82 */
++	case USB_ID(0x0E41, 0x4249): /* Line6 Helix Rack >= fw 2.82 */
++	case USB_ID(0x0E41, 0x424a): /* Line6 Helix LT >= fw 2.82 */
+ 		/* supported rates: 48Khz */
+ 		kfree(fp->rate_table);
+ 		fp->rate_table = kmalloc(sizeof(int), GFP_KERNEL);
+-- 
+2.20.1
+
diff --git a/queue-5.5/alsa-usb-audio-unlock-on-error-in-probe.patch b/queue-5.5/alsa-usb-audio-unlock-on-error-in-probe.patch
new file mode 100644
index 00000000000..86d0f95ac7a
--- /dev/null
+++ b/queue-5.5/alsa-usb-audio-unlock-on-error-in-probe.patch
@@ -0,0 +1,36 @@
+From 74ced0966254122c04efff2a6a05956158db9540 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 20:46:04 +0300
+Subject: ALSA: usb-audio: unlock on error in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit a3afa29942b84b4e2548beacccc3a68b8d77e3dc ]
+
+We need to unlock before we returning on this error path.
+
+Fixes: 73ac9f5e5b43 ("ALSA: usb-audio: Add boot quirk for MOTU M Series")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20200115174604.rhanfgy4j3uc65cx@kili.mountain
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 2f582ac7cf789..827fb0bc8b561 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -602,7 +602,7 @@ static int usb_audio_probe(struct usb_interface *intf,
+ 	if (! chip) {
+ 		err = snd_usb_apply_boot_quirk_once(dev, intf, quirk, id);
+ 		if (err < 0)
+-			return err;
++			goto __error;
+ 
+ 		/* it's a fresh one.
+ 		 * now look for an empty slot and create a new card instance
+-- 
+2.20.1
+
diff --git a/queue-5.5/alsa-usx2y-adjust-indentation-in-snd_usx2y_hwdep_dsp.patch b/queue-5.5/alsa-usx2y-adjust-indentation-in-snd_usx2y_hwdep_dsp.patch
new file mode 100644
index 00000000000..1d7764620aa
--- /dev/null
+++ b/queue-5.5/alsa-usx2y-adjust-indentation-in-snd_usx2y_hwdep_dsp.patch
@@ -0,0 +1,51 @@
+From aaf40ee466a0bcbe5435bcb3a9923a88605075ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 20:42:57 -0700
+Subject: ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit df4654bd6e42125d9b85ce3a26eaca2935290b98 ]
+
+Clang warns:
+
+../sound/usb/usx2y/usX2Yhwdep.c:122:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+        info->version = USX2Y_DRIVER_VERSION;
+        ^
+../sound/usb/usx2y/usX2Yhwdep.c:120:2: note: previous statement is here
+        if (us428->chip_status & USX2Y_STAT_CHIP_INIT)
+        ^
+1 warning generated.
+
+This warning occurs because there is a space before the tab on this
+line. Remove it so that the indentation is consistent with the Linux
+kernel coding style and clang no longer warns.
+
+This was introduced before the beginning of git history so no fixes tag.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/831
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Link: https://lore.kernel.org/r/20191218034257.54535-1-natechancellor@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/usx2y/usX2Yhwdep.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
+index d1caa8ed9e681..9985fc139487b 100644
+--- a/sound/usb/usx2y/usX2Yhwdep.c
++++ b/sound/usb/usx2y/usX2Yhwdep.c
+@@ -119,7 +119,7 @@ static int snd_usX2Y_hwdep_dsp_status(struct snd_hwdep *hw,
+ 	info->num_dsps = 2;		// 0: Prepad Data, 1: FPGA Code
+ 	if (us428->chip_status & USX2Y_STAT_CHIP_INIT)
+ 		info->chip_ready = 1;
+- 	info->version = USX2Y_DRIVER_VERSION; 
++	info->version = USX2Y_DRIVER_VERSION;
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm-8941-1-decompressor-enable-cp15-barrier-instruct.patch b/queue-5.5/arm-8941-1-decompressor-enable-cp15-barrier-instruct.patch
new file mode 100644
index 00000000000..6931d112722
--- /dev/null
+++ b/queue-5.5/arm-8941-1-decompressor-enable-cp15-barrier-instruct.patch
@@ -0,0 +1,82 @@
+From e3ccc60f3721d998e5a621f57ec408003569aca3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2019 12:59:00 +0100
+Subject: ARM: 8941/1: decompressor: enable CP15 barrier instructions in v7
+ cache setup code
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+[ Upstream commit 8239fc7755fd3d410920006615abd0c7d653560f ]
+
+Commit e17b1af96b2afc38e684aa2f1033387e2ed10029
+
+  "ARM: 8857/1: efi: enable CP15 DMB instructions before cleaning the cache"
+
+added some explicit handling of the CP15BEN bit in the SCTLR system
+register, to ensure that CP15 barrier instructions are enabled, even
+if we enter the decompressor via the EFI stub.
+
+However, as it turns out, there are other ways in which we may end up
+using CP15 barrier instructions without them being enabled. I.e., when
+the decompressor startup code skips the cache_on() initially, we end
+up calling cache_clean_flush() with the caches and MMU off, in which
+case the CP15BEN bit in SCTLR may not be programmed either. And in
+fact, cache_on() itself issues CP15 barrier instructions before actually
+enabling them by programming the new SCTLR value (and issuing an ISB)
+
+Since these routines are shared between v7 CPUs and older ones that
+implement the CPUID extension as well, using the ordinary v7 barrier
+instructions in this code is not possible, and so we should enable the
+CP15 ones explicitly before issuing them. Note that a v7 ISB is still
+required between programming the SCTLR register and using the CP15 barrier
+instructions, and we should take care to branch over it if the CP15BEN
+bit is already set, given that in that case, the CPU may not support it.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/head.S | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index ead21e5f2b803..469a2b3b60c09 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -140,6 +140,17 @@
+ #endif
+ 		.endm
+ 
++		.macro	enable_cp15_barriers, reg
++		mrc	p15, 0, \reg, c1, c0, 0	@ read SCTLR
++		tst	\reg, #(1 << 5)		@ CP15BEN bit set?
++		bne	.L_\@
++		orr	\reg, \reg, #(1 << 5)	@ CP15 barrier instructions
++		mcr	p15, 0, \reg, c1, c0, 0	@ write SCTLR
++ ARM(		.inst   0xf57ff06f		@ v7+ isb	)
++ THUMB(		isb						)
++.L_\@:
++		.endm
++
+ 		.section ".start", "ax"
+ /*
+  * sort out different calling conventions
+@@ -820,6 +831,7 @@ __armv4_mmu_cache_on:
+ 		mov	pc, r12
+ 
+ __armv7_mmu_cache_on:
++		enable_cp15_barriers	r11
+ 		mov	r12, lr
+ #ifdef CONFIG_MMU
+ 		mrc	p15, 0, r11, c0, c1, 4	@ read ID_MMFR0
+@@ -1209,6 +1221,7 @@ __armv6_mmu_cache_flush:
+ 		mov	pc, lr
+ 
+ __armv7_mmu_cache_flush:
++		enable_cp15_barriers	r10
+ 		tst	r4, #1
+ 		bne	iflush
+ 		mrc	p15, 0, r10, c0, c1, 5	@ read ID_MMFR1
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm-8951-1-fix-kexec-compilation-issue.patch b/queue-5.5/arm-8951-1-fix-kexec-compilation-issue.patch
new file mode 100644
index 00000000000..1f0f7d7417a
--- /dev/null
+++ b/queue-5.5/arm-8951-1-fix-kexec-compilation-issue.patch
@@ -0,0 +1,53 @@
+From 258a942a0555f89d2a22c6f6fd34ec04be92b9b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 13:37:59 +0100
+Subject: ARM: 8951/1: Fix Kexec compilation issue.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincenzo Frascino <vincenzo.frascino@arm.com>
+
+[ Upstream commit 76950f7162cad51d2200ebd22c620c14af38f718 ]
+
+To perform the reserve_crashkernel() operation kexec uses SECTION_SIZE to
+find a memblock in a range.
+SECTION_SIZE is not defined for nommu systems. Trying to compile kexec in
+these conditions results in a build error:
+
+  linux/arch/arm/kernel/setup.c: In function ‘reserve_crashkernel’:
+  linux/arch/arm/kernel/setup.c:1016:25: error: ‘SECTION_SIZE’ undeclared
+     (first use in this function); did you mean ‘SECTIONS_WIDTH’?
+             crash_size, SECTION_SIZE);
+                         ^~~~~~~~~~~~
+                         SECTIONS_WIDTH
+  linux/arch/arm/kernel/setup.c:1016:25: note: each undeclared identifier
+     is reported only once for each function it appears in
+  linux/scripts/Makefile.build:265: recipe for target 'arch/arm/kernel/setup.o'
+     failed
+
+Make KEXEC depend on MMU to fix the compilation issue.
+
+Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 2c3a9fd05f571..7ef1916fcbf45 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1905,7 +1905,7 @@ config XIP_DEFLATED_DATA
+ config KEXEC
+ 	bool "Kexec system call (EXPERIMENTAL)"
+ 	depends on (!SMP || PM_SLEEP_SMP)
+-	depends on !CPU_V7M
++	depends on MMU
+ 	select KEXEC_CORE
+ 	help
+ 	  kexec is a system call that implements the ability to shutdown your
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm-8952-1-disable-kmemleak-on-xip-kernels.patch b/queue-5.5/arm-8952-1-disable-kmemleak-on-xip-kernels.patch
new file mode 100644
index 00000000000..9b58e3dba8b
--- /dev/null
+++ b/queue-5.5/arm-8952-1-disable-kmemleak-on-xip-kernels.patch
@@ -0,0 +1,54 @@
+From 6c89a1a5f788aea20dfeaa032063561a79f4ff14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 13:39:26 +0100
+Subject: ARM: 8952/1: Disable kmemleak on XIP kernels
+
+From: Vincenzo Frascino <vincenzo.frascino@arm.com>
+
+[ Upstream commit bc420c6ceefbb86cbbc8c00061bd779c17fa6997 ]
+
+Kmemleak relies on specific symbols to register the read only data
+during init (e.g. __start_ro_after_init).
+Trying to build an XIP kernel on arm results in the linking error
+reported below because when this option is selected read only data
+after init are not allowed since .data is read only (.rodata).
+
+  arm-linux-gnueabihf-ld: mm/kmemleak.o: in function `kmemleak_init':
+  kmemleak.c:(.init.text+0x148): undefined reference to `__end_ro_after_init'
+  arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x14c):
+     undefined reference to `__end_ro_after_init'
+  arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x150):
+     undefined reference to `__start_ro_after_init'
+  arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x156):
+     undefined reference to `__start_ro_after_init'
+  arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x162):
+     undefined reference to `__start_ro_after_init'
+  arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x16a):
+     undefined reference to `__start_ro_after_init'
+  linux/Makefile:1078: recipe for target 'vmlinux' failed
+
+Fix the issue enabling kmemleak only on non XIP kernels.
+
+Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 96dab76da3b39..2c3a9fd05f571 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -74,7 +74,7 @@ config ARM
+ 	select HAVE_CONTEXT_TRACKING
+ 	select HAVE_COPY_THREAD_TLS
+ 	select HAVE_C_RECORDMCOUNT
+-	select HAVE_DEBUG_KMEMLEAK
++	select HAVE_DEBUG_KMEMLEAK if !XIP_KERNEL
+ 	select HAVE_DMA_CONTIGUOUS if MMU
+ 	select HAVE_DYNAMIC_FTRACE if !XIP_KERNEL && !CPU_ENDIAN_BE32 && MMU
+ 	select HAVE_DYNAMIC_FTRACE_WITH_REGS if HAVE_DYNAMIC_FTRACE
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm-dts-allwinner-h3-add-pmu-node.patch b/queue-5.5/arm-dts-allwinner-h3-add-pmu-node.patch
new file mode 100644
index 00000000000..31e90e5e578
--- /dev/null
+++ b/queue-5.5/arm-dts-allwinner-h3-add-pmu-node.patch
@@ -0,0 +1,73 @@
+From 148130f178c2f28c58ef7f4c994fb486182f822e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 01:18:35 +0000
+Subject: arm: dts: allwinner: H3: Add PMU node
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 0388a110747bec0c9d9de995842bb2a03a26aae1 ]
+
+Add the Performance Monitoring Unit (PMU) device tree node to the H3
+.dtsi, which tells DT users which interrupts are triggered by PMU
+overflow events on each core. The numbers come from the manual and have
+been checked in U-Boot and with perf in Linux.
+
+Tested with perf record and taskset on an OrangePi Zero.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3.dtsi | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3.dtsi b/arch/arm/boot/dts/sun8i-h3.dtsi
+index fe773c72a69b7..b4f1673df9ee0 100644
+--- a/arch/arm/boot/dts/sun8i-h3.dtsi
++++ b/arch/arm/boot/dts/sun8i-h3.dtsi
+@@ -80,7 +80,7 @@
+ 			#cooling-cells = <2>;
+ 		};
+ 
+-		cpu@1 {
++		cpu1: cpu@1 {
+ 			compatible = "arm,cortex-a7";
+ 			device_type = "cpu";
+ 			reg = <1>;
+@@ -90,7 +90,7 @@
+ 			#cooling-cells = <2>;
+ 		};
+ 
+-		cpu@2 {
++		cpu2: cpu@2 {
+ 			compatible = "arm,cortex-a7";
+ 			device_type = "cpu";
+ 			reg = <2>;
+@@ -100,7 +100,7 @@
+ 			#cooling-cells = <2>;
+ 		};
+ 
+-		cpu@3 {
++		cpu3: cpu@3 {
+ 			compatible = "arm,cortex-a7";
+ 			device_type = "cpu";
+ 			reg = <3>;
+@@ -111,6 +111,15 @@
+ 		};
+ 	};
+ 
++	pmu {
++		compatible = "arm,cortex-a7-pmu";
++		interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
++			     <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
++			     <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
++			     <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
++	};
++
+ 	timer {
+ 		compatible = "arm,armv7-timer";
+ 		interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm-dts-imx6-rdu2-disable-wp-for-usdhc2-and-usdhc3.patch b/queue-5.5/arm-dts-imx6-rdu2-disable-wp-for-usdhc2-and-usdhc3.patch
new file mode 100644
index 00000000000..2fd6f89170d
--- /dev/null
+++ b/queue-5.5/arm-dts-imx6-rdu2-disable-wp-for-usdhc2-and-usdhc3.patch
@@ -0,0 +1,69 @@
+From 3cee17b50bd178dafac1ef0d548a5b8b947be5fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 08:50:17 -0800
+Subject: ARM: dts: imx6: rdu2: Disable WP for USDHC2 and USDHC3
+
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+
+[ Upstream commit cd58a174e58649426fb43d7456e5f7d7eab58af1 ]
+
+RDU2 production units come with resistor connecting WP pin to
+correpsonding GPIO DNPed for both SD card slots. Drop any WP related
+configuration and mark both slots with "disable-wp".
+
+Reported-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+index a2a4f33a3e3ef..4ec9fb332610e 100644
+--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+@@ -629,7 +629,7 @@
+ 	pinctrl-0 = <&pinctrl_usdhc2>;
+ 	bus-width = <4>;
+ 	cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
+-	wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
++	disable-wp;
+ 	vmmc-supply = <&reg_3p3v_sd>;
+ 	vqmmc-supply = <&reg_3p3v>;
+ 	no-1-8-v;
+@@ -642,7 +642,7 @@
+ 	pinctrl-0 = <&pinctrl_usdhc3>;
+ 	bus-width = <4>;
+ 	cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
+-	wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
++	disable-wp;
+ 	vmmc-supply = <&reg_3p3v_sd>;
+ 	vqmmc-supply = <&reg_3p3v>;
+ 	no-1-8-v;
+@@ -1056,7 +1056,6 @@
+ 			MX6QDL_PAD_SD2_DAT1__SD2_DATA1		0x17059
+ 			MX6QDL_PAD_SD2_DAT2__SD2_DATA2		0x17059
+ 			MX6QDL_PAD_SD2_DAT3__SD2_DATA3		0x17059
+-			MX6QDL_PAD_NANDF_D3__GPIO2_IO03		0x40010040
+ 			MX6QDL_PAD_NANDF_D2__GPIO2_IO02		0x40010040
+ 		>;
+ 	};
+@@ -1069,7 +1068,6 @@
+ 			MX6QDL_PAD_SD3_DAT1__SD3_DATA1		0x17059
+ 			MX6QDL_PAD_SD3_DAT2__SD3_DATA2		0x17059
+ 			MX6QDL_PAD_SD3_DAT3__SD3_DATA3		0x17059
+-			MX6QDL_PAD_NANDF_D1__GPIO2_IO01		0x40010040
+ 			MX6QDL_PAD_NANDF_D0__GPIO2_IO00		0x40010040
+ 
+ 		>;
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm-dts-imx6-rdu2-limit-usbh1-to-full-speed.patch b/queue-5.5/arm-dts-imx6-rdu2-limit-usbh1-to-full-speed.patch
new file mode 100644
index 00000000000..3eb9115f076
--- /dev/null
+++ b/queue-5.5/arm-dts-imx6-rdu2-limit-usbh1-to-full-speed.patch
@@ -0,0 +1,43 @@
+From 71af5f1092f90945ba039118599a9defe281fb45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 08:50:18 -0800
+Subject: ARM: dts: imx6: rdu2: Limit USBH1 to Full Speed
+
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+
+[ Upstream commit 6bb1e09c4c375db29770444f689f35f5cbe696bc ]
+
+Cabling used to connect devices to USBH1 on RDU2 does not meet USB
+spec cable quality and cable length requirements to operate at High
+Speed, so limit the port to Full Speed only.
+
+Reported-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+index 4ec9fb332610e..cbafadbe86f45 100644
+--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+@@ -776,6 +776,7 @@
+ &usbh1 {
+ 	vbus-supply = <&reg_5p0v_main>;
+ 	disable-over-current;
++	maximum-speed = "full-speed";
+ 	status = "okay";
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm-dts-r8a7779-add-device-node-for-arm-global-timer.patch b/queue-5.5/arm-dts-r8a7779-add-device-node-for-arm-global-timer.patch
new file mode 100644
index 00000000000..ffeb2ecc54a
--- /dev/null
+++ b/queue-5.5/arm-dts-r8a7779-add-device-node-for-arm-global-timer.patch
@@ -0,0 +1,44 @@
+From 2f836e7abcf11228771707798cce5919c2a865b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 14:52:21 +0100
+Subject: ARM: dts: r8a7779: Add device node for ARM global timer
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 8443ffd1bbd5be74e9b12db234746d12e8ea93e2 ]
+
+Add a device node for the global timer, which is part of the Cortex-A9
+MPCore.
+
+The global timer can serve as an accurate (4 ns) clock source for
+scheduling and delay loops.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191211135222.26770-4-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a7779.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi
+index ebf5b7cfe2159..63341635bddf8 100644
+--- a/arch/arm/boot/dts/r8a7779.dtsi
++++ b/arch/arm/boot/dts/r8a7779.dtsi
+@@ -68,6 +68,14 @@
+ 		      <0xf0000100 0x100>;
+ 	};
+ 
++	timer@f0000200 {
++		compatible = "arm,cortex-a9-global-timer";
++		reg = <0xf0000200 0x100>;
++		interrupts = <GIC_PPI 11
++			(GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
++		clocks = <&cpg_clocks R8A7779_CLK_ZS>;
++	};
++
+ 	timer@f0000600 {
+ 		compatible = "arm,cortex-a9-twd-timer";
+ 		reg = <0xf0000600 0x20>;
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm-dts-rockchip-add-reg-property-to-brcmf-sub-node-.patch b/queue-5.5/arm-dts-rockchip-add-reg-property-to-brcmf-sub-node-.patch
new file mode 100644
index 00000000000..b11b27072ce
--- /dev/null
+++ b/queue-5.5/arm-dts-rockchip-add-reg-property-to-brcmf-sub-node-.patch
@@ -0,0 +1,48 @@
+From fccccda348aeb0e45f66f1fe315f4b3ff63b85d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 14:44:20 +0100
+Subject: ARM: dts: rockchip: add reg property to brcmf sub node for
+ rk3188-bqedison2qc
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit cf206bca178cd5b5a436494b2e0cea75295944f4 ]
+
+An experimental test with the command below gives this error:
+rk3188-bqedison2qc.dt.yaml: dwmmc@10218000: wifi@1:
+'reg' is a required property
+
+So fix this by adding a reg property to the brcmf sub node.
+Also add #address-cells and #size-cells to prevent more warnings.
+
+make ARCH=arm dtbs_check
+DT_SCHEMA_FILES=Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.yaml
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/20200110134420.11280-1-jbx6244@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3188-bqedison2qc.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/dts/rk3188-bqedison2qc.dts b/arch/arm/boot/dts/rk3188-bqedison2qc.dts
+index c8b62bbd6a4a4..ad1afd403052a 100644
+--- a/arch/arm/boot/dts/rk3188-bqedison2qc.dts
++++ b/arch/arm/boot/dts/rk3188-bqedison2qc.dts
+@@ -466,9 +466,12 @@
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&sd1_clk>, <&sd1_cmd>, <&sd1_bus4>;
+ 	vmmcq-supply = <&vccio_wl>;
++	#address-cells = <1>;
++	#size-cells = <0>;
+ 	status = "okay";
+ 
+ 	brcmf: wifi@1 {
++		reg = <1>;
+ 		compatible = "brcm,bcm4329-fmac";
+ 		interrupt-parent = <&gpio3>;
+ 		interrupts = <RK_PD2 GPIO_ACTIVE_HIGH>;
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm-dts-stm32-add-power-supply-for-dsi-panel-on-stm3.patch b/queue-5.5/arm-dts-stm32-add-power-supply-for-dsi-panel-on-stm3.patch
new file mode 100644
index 00000000000..fd0ae8f9f8d
--- /dev/null
+++ b/queue-5.5/arm-dts-stm32-add-power-supply-for-dsi-panel-on-stm3.patch
@@ -0,0 +1,49 @@
+From 2eafce28115e3ecd704581f527c574c93134e628 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 14:26:47 +0100
+Subject: ARM: dts: stm32: Add power-supply for DSI panel on stm32f469-disco
+
+From: Benjamin Gaignard <benjamin.gaignard@st.com>
+
+[ Upstream commit 0ff15a86d0c5a3f004fee2e92d65b88e56a3bc58 ]
+
+Add a fixed regulator and use it as power supply for DSI panel.
+
+Fixes: 18c8866266 ("ARM: dts: stm32: Add display support on stm32f469-disco")
+
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32f469-disco.dts | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/stm32f469-disco.dts b/arch/arm/boot/dts/stm32f469-disco.dts
+index f3ce477b7bae6..9397db0c43de2 100644
+--- a/arch/arm/boot/dts/stm32f469-disco.dts
++++ b/arch/arm/boot/dts/stm32f469-disco.dts
+@@ -76,6 +76,13 @@
+ 		regulator-max-microvolt = <3300000>;
+ 	};
+ 
++	vdd_dsi: vdd-dsi {
++		compatible = "regulator-fixed";
++		regulator-name = "vdd_dsi";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++	};
++
+ 	soc {
+ 		dma-ranges = <0xc0000000 0x0 0x10000000>;
+ 	};
+@@ -155,6 +162,7 @@
+ 		compatible = "orisetech,otm8009a";
+ 		reg = <0>; /* dsi virtual channel (0..3) */
+ 		reset-gpios = <&gpioh 7 GPIO_ACTIVE_LOW>;
++		power-supply = <&vdd_dsi>;
+ 		status = "okay";
+ 
+ 		port {
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm-exynos_defconfig-bring-back-explicitly-wanted-op.patch b/queue-5.5/arm-exynos_defconfig-bring-back-explicitly-wanted-op.patch
new file mode 100644
index 00000000000..b7ee6ebd987
--- /dev/null
+++ b/queue-5.5/arm-exynos_defconfig-bring-back-explicitly-wanted-op.patch
@@ -0,0 +1,65 @@
+From 978366f3a90709060cf057736a257400fb95b9bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 21:00:06 +0100
+Subject: ARM: exynos_defconfig: Bring back explicitly wanted options
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 9f9e2df2e64df197ff6548ef494f76be5b35d08a ]
+
+Few options KALLSYMS_ALL, SCSI, PM_DEVFREQ and mutex/spinlock debugging
+were removed with savedefconfig because they were selected by other
+options.  However these are user-visible options and they might not be
+selected in the future.  Exactly this happened with commit 0e4a459f56c3
+("tracing: Remove unnecessary DEBUG_FS dependency") removing the
+dependency between DEBUG_FS and TRACING.
+
+To avoid losing these options in the future, explicitly mention them in
+defconfig.
+
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/exynos_defconfig | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm/configs/exynos_defconfig b/arch/arm/configs/exynos_defconfig
+index fde84f123fbb5..ead8348ec999f 100644
+--- a/arch/arm/configs/exynos_defconfig
++++ b/arch/arm/configs/exynos_defconfig
+@@ -38,6 +38,7 @@ CONFIG_CRYPTO_SHA256_ARM=m
+ CONFIG_CRYPTO_SHA512_ARM=m
+ CONFIG_CRYPTO_AES_ARM_BS=m
+ CONFIG_CRYPTO_CHACHA20_NEON=m
++CONFIG_KALLSYMS_ALL=y
+ CONFIG_MODULES=y
+ CONFIG_MODULE_UNLOAD=y
+ CONFIG_PARTITION_ADVANCED=y
+@@ -92,6 +93,7 @@ CONFIG_BLK_DEV_LOOP=y
+ CONFIG_BLK_DEV_CRYPTOLOOP=y
+ CONFIG_BLK_DEV_RAM=y
+ CONFIG_BLK_DEV_RAM_SIZE=8192
++CONFIG_SCSI=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_ATA=y
+@@ -291,6 +293,7 @@ CONFIG_CROS_EC_SPI=y
+ CONFIG_COMMON_CLK_MAX77686=y
+ CONFIG_COMMON_CLK_S2MPS11=y
+ CONFIG_EXYNOS_IOMMU=y
++CONFIG_PM_DEVFREQ=y
+ CONFIG_DEVFREQ_GOV_PERFORMANCE=y
+ CONFIG_DEVFREQ_GOV_POWERSAVE=y
+ CONFIG_DEVFREQ_GOV_USERSPACE=y
+@@ -356,4 +359,7 @@ CONFIG_SOFTLOCKUP_DETECTOR=y
+ # CONFIG_DETECT_HUNG_TASK is not set
+ CONFIG_PROVE_LOCKING=y
+ CONFIG_DEBUG_ATOMIC_SLEEP=y
++CONFIG_DEBUG_RT_MUTEXES=y
++CONFIG_DEBUG_SPINLOCK=y
++CONFIG_DEBUG_MUTEXES=y
+ CONFIG_DEBUG_USER=y
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm-omap2-pdata-quirks-add-prm-data-for-reset-suppor.patch b/queue-5.5/arm-omap2-pdata-quirks-add-prm-data-for-reset-suppor.patch
new file mode 100644
index 00000000000..d0590e880ad
--- /dev/null
+++ b/queue-5.5/arm-omap2-pdata-quirks-add-prm-data-for-reset-suppor.patch
@@ -0,0 +1,57 @@
+From 0d0f63c35cda97742d349cd81ded472b99656503 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 15:05:37 +0200
+Subject: ARM: OMAP2+: pdata-quirks: add PRM data for reset support
+
+From: Tero Kristo <t-kristo@ti.com>
+
+[ Upstream commit 8de44fb70659a5bc0c53a443e6129ea1bf00fd8b ]
+
+The parent clockdomain for reset must be in force wakeup mode, otherwise
+the reset may never complete. Add pdata quirks for this purpose for PRM
+driver.
+
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/pdata-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
+index e95c224ffc4d8..7a79bcc02a11b 100644
+--- a/arch/arm/mach-omap2/pdata-quirks.c
++++ b/arch/arm/mach-omap2/pdata-quirks.c
+@@ -23,6 +23,7 @@
+ #include <linux/platform_data/ti-sysc.h>
+ #include <linux/platform_data/wkup_m3.h>
+ #include <linux/platform_data/asoc-ti-mcbsp.h>
++#include <linux/platform_data/ti-prm.h>
+ 
+ #include "clockdomain.h"
+ #include "common.h"
+@@ -412,6 +413,12 @@ void omap_pcs_legacy_init(int irq, void (*rearm)(void))
+ 	pcs_pdata.rearm = rearm;
+ }
+ 
++static struct ti_prm_platform_data ti_prm_pdata = {
++	.clkdm_deny_idle = clkdm_deny_idle,
++	.clkdm_allow_idle = clkdm_allow_idle,
++	.clkdm_lookup = clkdm_lookup,
++};
++
+ /*
+  * GPIOs for TWL are initialized by the I2C bus and need custom
+  * handing until DSS has device tree bindings.
+@@ -514,6 +521,7 @@ static struct of_dev_auxdata omap_auxdata_lookup[] = {
+ 	/* Common auxdata */
+ 	OF_DEV_AUXDATA("ti,sysc", 0, NULL, &ti_sysc_pdata),
+ 	OF_DEV_AUXDATA("pinctrl-single", 0, NULL, &pcs_pdata),
++	OF_DEV_AUXDATA("ti,omap-prm-inst", 0, NULL, &ti_prm_pdata),
+ 	{ /* sentinel */ },
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm64-dts-allwinner-h5-add-pmu-node.patch b/queue-5.5/arm64-dts-allwinner-h5-add-pmu-node.patch
new file mode 100644
index 00000000000..cecaf8695e7
--- /dev/null
+++ b/queue-5.5/arm64-dts-allwinner-h5-add-pmu-node.patch
@@ -0,0 +1,74 @@
+From 31dd5913a70efafddb7097f80bf47f324a730b0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 01:18:34 +0000
+Subject: arm64: dts: allwinner: H5: Add PMU node
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit c35a516a46187c8eeb7a56c64505ec6f7e22a0c7 ]
+
+Add the Performance Monitoring Unit (PMU) device tree node to the H5
+.dtsi, which tells DT users which interrupts are triggered by PMU
+overflow events on each core.
+As with the A64, the interrupt numbers from the manual were wrong (off
+by 4), the actual SPI IDs have been gathered in U-Boot, and were
+verified with perf in Linux.
+
+Tested with perf record and taskset on an OrangePi PC2.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
+index e92c4de5bf3b4..7c775a918a4e7 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
+@@ -54,21 +54,21 @@
+ 			enable-method = "psci";
+ 		};
+ 
+-		cpu@1 {
++		cpu1: cpu@1 {
+ 			compatible = "arm,cortex-a53";
+ 			device_type = "cpu";
+ 			reg = <1>;
+ 			enable-method = "psci";
+ 		};
+ 
+-		cpu@2 {
++		cpu2: cpu@2 {
+ 			compatible = "arm,cortex-a53";
+ 			device_type = "cpu";
+ 			reg = <2>;
+ 			enable-method = "psci";
+ 		};
+ 
+-		cpu@3 {
++		cpu3: cpu@3 {
+ 			compatible = "arm,cortex-a53";
+ 			device_type = "cpu";
+ 			reg = <3>;
+@@ -76,6 +76,16 @@
+ 		};
+ 	};
+ 
++	pmu {
++		compatible = "arm,cortex-a53-pmu",
++			     "arm,armv8-pmuv3";
++		interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
++			     <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
++			     <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
++			     <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
++	};
++
+ 	psci {
+ 		compatible = "arm,psci-0.2";
+ 		method = "smc";
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm64-dts-allwinner-h6-add-pmu-mode.patch b/queue-5.5/arm64-dts-allwinner-h6-add-pmu-mode.patch
new file mode 100644
index 00000000000..87046bd431d
--- /dev/null
+++ b/queue-5.5/arm64-dts-allwinner-h6-add-pmu-mode.patch
@@ -0,0 +1,47 @@
+From 65b27d59b3b1c4f08d0be5475a7c24460e0412c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 01:18:33 +0000
+Subject: arm64: dts: allwinner: H6: Add PMU mode
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 7aa9b9eb7d6a8fde7acbe0446444f7e3fae1fe3b ]
+
+Add the Performance Monitoring Unit (PMU) device tree node to the H6
+.dtsi, which tells DT users which interrupts are triggered by PMU
+overflow events on each core. The numbers come from the manual and have
+been checked in U-Boot and with perf in Linux.
+
+Tested with perf record and taskset on a Pine H64.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index 29824081b43b0..24ffe2dcbddbf 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -70,6 +70,16 @@
+ 		clock-output-names = "ext_osc32k";
+ 	};
+ 
++	pmu {
++		compatible = "arm,cortex-a53-pmu",
++			     "arm,armv8-pmuv3";
++		interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
++			     <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
++			     <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
++			     <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
++	};
++
+ 	psci {
+ 		compatible = "arm,psci-0.2";
+ 		method = "smc";
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm64-dts-qcom-db845c-enable-ath10k-8bit-host-cap-qu.patch b/queue-5.5/arm64-dts-qcom-db845c-enable-ath10k-8bit-host-cap-qu.patch
new file mode 100644
index 00000000000..d07ec013fce
--- /dev/null
+++ b/queue-5.5/arm64-dts-qcom-db845c-enable-ath10k-8bit-host-cap-qu.patch
@@ -0,0 +1,37 @@
+From 0476854614f34af4f607ef6dd1f75daa640d36af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 15:22:45 -0800
+Subject: arm64: dts: qcom: db845c: Enable ath10k 8bit host-cap quirk
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 2e198c395a084ff3015d71896e35de049c40e3a4 ]
+
+The WiFi firmware used on db845c implements the 8bit host-capability
+message, so enable the quirk for this.
+
+Reviewed-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20191113232245.4039932-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+index d100f46791a62..912ba745c0fc9 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -529,6 +529,8 @@
+ 	vdd-1.8-xo-supply = <&vreg_l7a_1p8>;
+ 	vdd-1.3-rfa-supply = <&vreg_l17a_1p3>;
+ 	vdd-3.3-ch0-supply = <&vreg_l25a_3p3>;
++
++	qcom,snoc-host-cap-8bit-quirk;
+ };
+ 
+ /* PINCTRL - additions to nodes defined in sdm845.dtsi */
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm64-dts-qcom-msm8996-disable-usb2-phy-suspend-by-c.patch b/queue-5.5/arm64-dts-qcom-msm8996-disable-usb2-phy-suspend-by-c.patch
new file mode 100644
index 00000000000..2dfc6bce59d
--- /dev/null
+++ b/queue-5.5/arm64-dts-qcom-msm8996-disable-usb2-phy-suspend-by-c.patch
@@ -0,0 +1,51 @@
+From be0199ff770dfed47c8f29702942005bdc918859 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 16:15:01 +0100
+Subject: arm64: dts: qcom: msm8996: Disable USB2 PHY suspend by core
+
+From: Manu Gautam <mgautam@codeaurora.org>
+
+[ Upstream commit d026c96b25b7ce5df89526aad2df988d553edb4d ]
+
+QUSB2 PHY on msm8996 doesn't work well when autosuspend by
+dwc3 core using USB2PHYCFG register is enabled. One of the
+issue seen is that PHY driver reports PLL lock failure and
+fails phy_init() if dwc3 core has USB2 PHY suspend enabled.
+Fix this by using quirks to disable USB2 PHY LPM/suspend and
+dwc3 core already takes care of explicitly suspending PHY
+during suspend if quirks are specified.
+
+Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
+Signed-off-by: Paolo Pisati <p.pisati@gmail.com>
+Link: https://lore.kernel.org/r/20191209151501.26993-1-p.pisati@gmail.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 4ca2e7b44559c..1eed3c41521ab 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -1602,6 +1602,8 @@
+ 				interrupts = <0 138 IRQ_TYPE_LEVEL_HIGH>;
+ 				phys = <&hsusb_phy2>;
+ 				phy-names = "usb2-phy";
++				snps,dis_u2_susphy_quirk;
++				snps,dis_enblslpm_quirk;
+ 			};
+ 		};
+ 
+@@ -1632,6 +1634,8 @@
+ 				interrupts = <0 131 IRQ_TYPE_LEVEL_HIGH>;
+ 				phys = <&hsusb_phy1>, <&ssusb_phy_0>;
+ 				phy-names = "usb2-phy", "usb3-phy";
++				snps,dis_u2_susphy_quirk;
++				snps,dis_enblslpm_quirk;
+ 			};
+ 		};
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm64-dts-rockchip-add-reg-property-to-brcmf-sub-nod.patch b/queue-5.5/arm64-dts-rockchip-add-reg-property-to-brcmf-sub-nod.patch
new file mode 100644
index 00000000000..d79100bc678
--- /dev/null
+++ b/queue-5.5/arm64-dts-rockchip-add-reg-property-to-brcmf-sub-nod.patch
@@ -0,0 +1,90 @@
+From 38e223dd6c5573cff2cf63ab49321efd17ab2ba9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 15:21:28 +0100
+Subject: arm64: dts: rockchip: add reg property to brcmf sub-nodes
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 96ff264bccb22175bbe2185a1eb5204ca3c5f03f ]
+
+An experimental test with the command below gives this error:
+rk3399-firefly.dt.yaml: dwmmc@fe310000: wifi@1:
+'reg' is a required property
+rk3399-orangepi.dt.yaml: dwmmc@fe310000: wifi@1:
+'reg' is a required property
+rk3399-khadas-edge.dt.yaml: dwmmc@fe310000: wifi@1:
+'reg' is a required property
+rk3399-khadas-edge-captain.dt.yaml: dwmmc@fe310000: wifi@1:
+'reg' is a required property
+rk3399-khadas-edge-v.dt.yaml: dwmmc@fe310000: wifi@1:
+'reg' is a required property
+So fix this by adding a reg property to the brcmf sub node.
+Also add #address-cells and #size-cells to prevent more warnings.
+
+make ARCH=arm64 dtbs_check
+DT_SCHEMA_FILES=Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.yaml
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/20200110142128.13522-1-jbx6244@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-firefly.dts      | 3 +++
+ arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi | 3 +++
+ arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts     | 3 +++
+ 3 files changed, 9 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
+index c706db0ee9ec6..76f5db696009b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
+@@ -669,9 +669,12 @@
+ 	vqmmc-supply = &vcc1v8_s3;	/* IO line */
+ 	vmmc-supply = &vcc_sdio;	/* card's power */
+ 
++	#address-cells = <1>;
++	#size-cells = <0>;
+ 	status = "okay";
+ 
+ 	brcmf: wifi@1 {
++		reg = <1>;
+ 		compatible = "brcm,bcm4329-fmac";
+ 		interrupt-parent = <&gpio0>;
+ 		interrupts = <RK_PA3 GPIO_ACTIVE_HIGH>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
+index 4944d78a0a1cb..e87a04477440e 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
+@@ -654,9 +654,12 @@
+ 	sd-uhs-sdr104;
+ 	vqmmc-supply = <&vcc1v8_s3>;
+ 	vmmc-supply = <&vccio_sd>;
++	#address-cells = <1>;
++	#size-cells = <0>;
+ 	status = "okay";
+ 
+ 	brcmf: wifi@1 {
++		reg = <1>;
+ 		compatible = "brcm,bcm4329-fmac";
+ 		interrupt-parent = <&gpio0>;
+ 		interrupts = <RK_PA3 GPIO_ACTIVE_HIGH>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts b/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts
+index 0541dfce924d6..9c659f3115c88 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts
+@@ -648,9 +648,12 @@
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&sdio0_bus4 &sdio0_cmd &sdio0_clk>;
+ 	sd-uhs-sdr104;
++	#address-cells = <1>;
++	#size-cells = <0>;
+ 	status = "okay";
+ 
+ 	brcmf: wifi@1 {
++		reg = <1>;
+ 		compatible = "brcm,bcm4329-fmac";
+ 		interrupt-parent = <&gpio0>;
+ 		interrupts = <RK_PA3 GPIO_ACTIVE_HIGH>;
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm64-dts-rockchip-fix-dwmmc-clock-name-for-px30.patch b/queue-5.5/arm64-dts-rockchip-fix-dwmmc-clock-name-for-px30.patch
new file mode 100644
index 00000000000..a76f9005e1b
--- /dev/null
+++ b/queue-5.5/arm64-dts-rockchip-fix-dwmmc-clock-name-for-px30.patch
@@ -0,0 +1,61 @@
+From a72dccc3a608838814a8d9c9adf817db079722fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 17:12:00 +0100
+Subject: arm64: dts: rockchip: fix dwmmc clock name for px30
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 7f2147350291569acd1df5a26dcdfc573916016f ]
+
+An experimental test with the command below gives this error:
+px30-evb.dt.yaml: dwmmc@ff390000: clock-names:2:
+'ciu-drive' was expected
+
+'ciu-drv' is not a valid dwmmc clock name,
+so fix this by changing it to 'ciu-drive'.
+
+make ARCH=arm64 dtbs_check
+DT_SCHEMA_FILES=Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.yaml
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/20200110161200.22755-1-jbx6244@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/px30.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/px30.dtsi b/arch/arm64/boot/dts/rockchip/px30.dtsi
+index 8812b70f39111..5acd5ce714d4a 100644
+--- a/arch/arm64/boot/dts/rockchip/px30.dtsi
++++ b/arch/arm64/boot/dts/rockchip/px30.dtsi
+@@ -826,7 +826,7 @@
+ 		interrupts = <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&cru HCLK_SDMMC>, <&cru SCLK_SDMMC>,
+ 			 <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>;
+-		clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
++		clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ 		fifo-depth = <0x100>;
+ 		max-frequency = <150000000>;
+ 		pinctrl-names = "default";
+@@ -841,7 +841,7 @@
+ 		interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&cru HCLK_SDIO>, <&cru SCLK_SDIO>,
+ 			 <&cru SCLK_SDIO_DRV>, <&cru SCLK_SDIO_SAMPLE>;
+-		clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
++		clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ 		fifo-depth = <0x100>;
+ 		max-frequency = <150000000>;
+ 		pinctrl-names = "default";
+@@ -856,7 +856,7 @@
+ 		interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&cru HCLK_EMMC>, <&cru SCLK_EMMC>,
+ 			 <&cru SCLK_EMMC_DRV>, <&cru SCLK_EMMC_SAMPLE>;
+-		clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
++		clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ 		fifo-depth = <0x100>;
+ 		max-frequency = <150000000>;
+ 		pinctrl-names = "default";
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm64-dts-rockchip-fix-dwmmc-clock-name-for-rk3308.patch b/queue-5.5/arm64-dts-rockchip-fix-dwmmc-clock-name-for-rk3308.patch
new file mode 100644
index 00000000000..0dd590be7e9
--- /dev/null
+++ b/queue-5.5/arm64-dts-rockchip-fix-dwmmc-clock-name-for-rk3308.patch
@@ -0,0 +1,61 @@
+From 0e09544d6caa0330e347b6bb958488bb6a69d11b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 17:12:00 +0100
+Subject: arm64: dts: rockchip: fix dwmmc clock name for rk3308
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 2be6a280144e521248a4bdefb691a0a97e604294 ]
+
+An experimental test with the command below gives this error:
+rk3308-evb.dt.yaml: dwmmc@ff480000: clock-names:2:
+'ciu-drive' was expected
+
+'ciu-drv' is not a valid dwmmc clock name,
+so fix this by changing it to 'ciu-drive'.
+
+make ARCH=arm64 dtbs_check
+DT_SCHEMA_FILES=Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.yaml
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/20200110161200.22755-1-jbx6244@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3308.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3308.dtsi b/arch/arm64/boot/dts/rockchip/rk3308.dtsi
+index 8bdc66c62975b..fa0d55f1a5871 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3308.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3308.dtsi
+@@ -591,7 +591,7 @@
+ 		bus-width = <4>;
+ 		clocks = <&cru HCLK_SDMMC>, <&cru SCLK_SDMMC>,
+ 			 <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>;
+-		clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
++		clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ 		fifo-depth = <0x100>;
+ 		max-frequency = <150000000>;
+ 		pinctrl-names = "default";
+@@ -606,7 +606,7 @@
+ 		bus-width = <8>;
+ 		clocks = <&cru HCLK_EMMC>, <&cru SCLK_EMMC>,
+ 			 <&cru SCLK_EMMC_DRV>, <&cru SCLK_EMMC_SAMPLE>;
+-		clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
++		clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ 		fifo-depth = <0x100>;
+ 		max-frequency = <150000000>;
+ 		status = "disabled";
+@@ -619,7 +619,7 @@
+ 		bus-width = <4>;
+ 		clocks = <&cru HCLK_SDIO>, <&cru SCLK_SDIO>,
+ 			 <&cru SCLK_SDIO_DRV>, <&cru SCLK_SDIO_SAMPLE>;
+-		clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
++		clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ 		fifo-depth = <0x100>;
+ 		max-frequency = <150000000>;
+ 		pinctrl-names = "default";
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm64-dts-rockchip-fix-nanopc-t4-cooling-maps.patch b/queue-5.5/arm64-dts-rockchip-fix-nanopc-t4-cooling-maps.patch
new file mode 100644
index 00000000000..8ae1f4d5a5a
--- /dev/null
+++ b/queue-5.5/arm64-dts-rockchip-fix-nanopc-t4-cooling-maps.patch
@@ -0,0 +1,66 @@
+From b14e49b65909c8866c89146f8cbc5a52ba942339 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2019 12:47:19 +0000
+Subject: arm64: dts: rockchip: Fix NanoPC-T4 cooling maps
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit a793e19c15f25a126138ac4ae9facf9204754af3 ]
+
+Although it appeared to follow logically from the bindings, apparently
+the thermal framework can't properly cope with a single cooling device
+being shared between multiple maps. The CPU zone is probably easier to
+overheat, so remove the references to the (optional) fan from the GPU
+cooling zone to avoid things getting confused. Hopefully GPU-intensive
+tasks will leak enough heat across to the CPU zone to still hit the
+fan trips before reaching critical GPU temperatures.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/5bb39f3115df1a487d717d3ae87e523b03749379.1573908197.git.robin.murphy@arm.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/rockchip/rk3399-nanopc-t4.dts    | 27 -------------------
+ 1 file changed, 27 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts b/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts
+index 2a127985ab171..d3ed8e5e770f1 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts
+@@ -94,33 +94,6 @@
+ 	};
+ };
+ 
+-&gpu_thermal {
+-	trips {
+-		gpu_warm: gpu_warm {
+-			temperature = <55000>;
+-			hysteresis = <2000>;
+-			type = "active";
+-		};
+-
+-		gpu_hot: gpu_hot {
+-			temperature = <65000>;
+-			hysteresis = <2000>;
+-			type = "active";
+-		};
+-	};
+-	cooling-maps {
+-		map1 {
+-			trip = <&gpu_warm>;
+-			cooling-device = <&fan THERMAL_NO_LIMIT 1>;
+-		};
+-
+-		map2 {
+-			trip = <&gpu_hot>;
+-			cooling-device = <&fan 2 THERMAL_NO_LIMIT>;
+-		};
+-	};
+-};
+-
+ &pinctrl {
+ 	ir {
+ 		ir_rx: ir-rx {
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm64-dts-ti-k3-j721e-main-add-missing-power-domains.patch b/queue-5.5/arm64-dts-ti-k3-j721e-main-add-missing-power-domains.patch
new file mode 100644
index 00000000000..e476f1b8771
--- /dev/null
+++ b/queue-5.5/arm64-dts-ti-k3-j721e-main-add-missing-power-domains.patch
@@ -0,0 +1,37 @@
+From 3c3b5509d13179cf3ded9c231b41fe4b410fb555 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2019 15:33:56 +0530
+Subject: arm64: dts: ti: k3-j721e-main: Add missing power-domains for smmu
+
+From: Lokesh Vutla <lokeshvutla@ti.com>
+
+[ Upstream commit 3f03a58b25753843ce9e4511e9e246c51bd11011 ]
+
+Add power-domains entry for smmu, so that the it is accessible as long
+as the driver is active. Without this device shutdown is throwing the
+below warning:
+"[   44.736348] arm-smmu-v3 36600000.smmu: failed to clear cr0"
+
+Reported-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+index 1e4c2b78d66d6..68d478af7a3e6 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+@@ -43,6 +43,7 @@
+ 	smmu0: smmu@36600000 {
+ 		compatible = "arm,smmu-v3";
+ 		reg = <0x0 0x36600000 0x0 0x100000>;
++		power-domains = <&k3_pds 229 TI_SCI_PD_EXCLUSIVE>;
+ 		interrupt-parent = <&gic500>;
+ 		interrupts = <GIC_SPI 772 IRQ_TYPE_EDGE_RISING>,
+ 			     <GIC_SPI 768 IRQ_TYPE_EDGE_RISING>;
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm64-fix-alternatives-with-llvm-s-integrated-assemb.patch b/queue-5.5/arm64-fix-alternatives-with-llvm-s-integrated-assemb.patch
new file mode 100644
index 00000000000..1e03c0d29c9
--- /dev/null
+++ b/queue-5.5/arm64-fix-alternatives-with-llvm-s-integrated-assemb.patch
@@ -0,0 +1,119 @@
+From 45aac8a0fa8c83518ca533ba8921c659c7416f55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 12:46:52 -0700
+Subject: arm64: fix alternatives with LLVM's integrated assembler
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit c54f90c2627cc316d365e3073614731e17dbc631 ]
+
+LLVM's integrated assembler fails with the following error when
+building KVM:
+
+  <inline asm>:12:6: error: expected absolute expression
+   .if kvm_update_va_mask == 0
+       ^
+  <inline asm>:21:6: error: expected absolute expression
+   .if kvm_update_va_mask == 0
+       ^
+  <inline asm>:24:2: error: unrecognized instruction mnemonic
+          NOT_AN_INSTRUCTION
+          ^
+  LLVM ERROR: Error parsing inline asm
+
+These errors come from ALTERNATIVE_CB and __ALTERNATIVE_CFG,
+which test for the existence of the callback parameter in inline
+assembly using the following expression:
+
+  " .if " __stringify(cb) " == 0\n"
+
+This works with GNU as, but isn't supported by LLVM. This change
+splits __ALTERNATIVE_CFG and ALTINSTR_ENTRY into separate macros
+to fix the LLVM build.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/472
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Tested-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/alternative.h | 32 ++++++++++++++++++----------
+ 1 file changed, 21 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+index b9f8d787eea9f..324e7d5ab37ed 100644
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -35,13 +35,16 @@ void apply_alternatives_module(void *start, size_t length);
+ static inline void apply_alternatives_module(void *start, size_t length) { }
+ #endif
+ 
+-#define ALTINSTR_ENTRY(feature,cb)					      \
++#define ALTINSTR_ENTRY(feature)					              \
+ 	" .word 661b - .\n"				/* label           */ \
+-	" .if " __stringify(cb) " == 0\n"				      \
+ 	" .word 663f - .\n"				/* new instruction */ \
+-	" .else\n"							      \
++	" .hword " __stringify(feature) "\n"		/* feature bit     */ \
++	" .byte 662b-661b\n"				/* source len      */ \
++	" .byte 664f-663f\n"				/* replacement len */
++
++#define ALTINSTR_ENTRY_CB(feature, cb)					      \
++	" .word 661b - .\n"				/* label           */ \
+ 	" .word " __stringify(cb) "- .\n"		/* callback */	      \
+-	" .endif\n"							      \
+ 	" .hword " __stringify(feature) "\n"		/* feature bit     */ \
+ 	" .byte 662b-661b\n"				/* source len      */ \
+ 	" .byte 664f-663f\n"				/* replacement len */
+@@ -62,15 +65,14 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+  *
+  * Alternatives with callbacks do not generate replacement instructions.
+  */
+-#define __ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg_enabled, cb)	\
++#define __ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg_enabled)	\
+ 	".if "__stringify(cfg_enabled)" == 1\n"				\
+ 	"661:\n\t"							\
+ 	oldinstr "\n"							\
+ 	"662:\n"							\
+ 	".pushsection .altinstructions,\"a\"\n"				\
+-	ALTINSTR_ENTRY(feature,cb)					\
++	ALTINSTR_ENTRY(feature)						\
+ 	".popsection\n"							\
+-	" .if " __stringify(cb) " == 0\n"				\
+ 	".pushsection .altinstr_replacement, \"a\"\n"			\
+ 	"663:\n\t"							\
+ 	newinstr "\n"							\
+@@ -78,17 +80,25 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ 	".popsection\n\t"						\
+ 	".org	. - (664b-663b) + (662b-661b)\n\t"			\
+ 	".org	. - (662b-661b) + (664b-663b)\n"			\
+-	".else\n\t"							\
++	".endif\n"
++
++#define __ALTERNATIVE_CFG_CB(oldinstr, feature, cfg_enabled, cb)	\
++	".if "__stringify(cfg_enabled)" == 1\n"				\
++	"661:\n\t"							\
++	oldinstr "\n"							\
++	"662:\n"							\
++	".pushsection .altinstructions,\"a\"\n"				\
++	ALTINSTR_ENTRY_CB(feature, cb)					\
++	".popsection\n"							\
+ 	"663:\n\t"							\
+ 	"664:\n\t"							\
+-	".endif\n"							\
+ 	".endif\n"
+ 
+ #define _ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg, ...)	\
+-	__ALTERNATIVE_CFG(oldinstr, newinstr, feature, IS_ENABLED(cfg), 0)
++	__ALTERNATIVE_CFG(oldinstr, newinstr, feature, IS_ENABLED(cfg))
+ 
+ #define ALTERNATIVE_CB(oldinstr, cb) \
+-	__ALTERNATIVE_CFG(oldinstr, "NOT_AN_INSTRUCTION", ARM64_CB_PATCH, 1, cb)
++	__ALTERNATIVE_CFG_CB(oldinstr, ARM64_CB_PATCH, 1, cb)
+ #else
+ 
+ #include <asm/assembler.h>
+-- 
+2.20.1
+
diff --git a/queue-5.5/arm64-lse-fix-lse-atomics-with-llvm-s-integrated-ass.patch b/queue-5.5/arm64-lse-fix-lse-atomics-with-llvm-s-integrated-ass.patch
new file mode 100644
index 00000000000..4b890a332a3
--- /dev/null
+++ b/queue-5.5/arm64-lse-fix-lse-atomics-with-llvm-s-integrated-ass.patch
@@ -0,0 +1,221 @@
+From a916f63db0f3e2e5f318124de749dc6c09f33192 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 12:57:05 -0700
+Subject: arm64: lse: fix LSE atomics with LLVM's integrated assembler
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit e0d5896bd356cd577f9710a02d7a474cdf58426b ]
+
+Unlike gcc, clang considers each inline assembly block to be independent
+and therefore, when using the integrated assembler for inline assembly,
+any preambles that enable features must be repeated in each block.
+
+This change defines __LSE_PREAMBLE and adds it to each inline assembly
+block that has LSE instructions, which allows them to be compiled also
+with clang's assembler.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/671
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Tested-by: Andrew Murray <andrew.murray@arm.com>
+Tested-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/atomic_lse.h | 19 +++++++++++++++++++
+ arch/arm64/include/asm/lse.h        |  6 +++---
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/include/asm/atomic_lse.h b/arch/arm64/include/asm/atomic_lse.h
+index 574808b9df4c8..da3280f639cd7 100644
+--- a/arch/arm64/include/asm/atomic_lse.h
++++ b/arch/arm64/include/asm/atomic_lse.h
+@@ -14,6 +14,7 @@
+ static inline void __lse_atomic_##op(int i, atomic_t *v)			\
+ {									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ "	" #asm_op "	%w[i], %[v]\n"					\
+ 	: [i] "+r" (i), [v] "+Q" (v->counter)				\
+ 	: "r" (v));							\
+@@ -30,6 +31,7 @@ ATOMIC_OP(add, stadd)
+ static inline int __lse_atomic_fetch_##op##name(int i, atomic_t *v)	\
+ {									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ "	" #asm_op #mb "	%w[i], %w[i], %[v]"				\
+ 	: [i] "+r" (i), [v] "+Q" (v->counter)				\
+ 	: "r" (v)							\
+@@ -58,6 +60,7 @@ static inline int __lse_atomic_add_return##name(int i, atomic_t *v)	\
+ 	u32 tmp;							\
+ 									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ 	"	ldadd" #mb "	%w[i], %w[tmp], %[v]\n"			\
+ 	"	add	%w[i], %w[i], %w[tmp]"				\
+ 	: [i] "+r" (i), [v] "+Q" (v->counter), [tmp] "=&r" (tmp)	\
+@@ -77,6 +80,7 @@ ATOMIC_OP_ADD_RETURN(        , al, "memory")
+ static inline void __lse_atomic_and(int i, atomic_t *v)
+ {
+ 	asm volatile(
++	__LSE_PREAMBLE
+ 	"	mvn	%w[i], %w[i]\n"
+ 	"	stclr	%w[i], %[v]"
+ 	: [i] "+&r" (i), [v] "+Q" (v->counter)
+@@ -87,6 +91,7 @@ static inline void __lse_atomic_and(int i, atomic_t *v)
+ static inline int __lse_atomic_fetch_and##name(int i, atomic_t *v)	\
+ {									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ 	"	mvn	%w[i], %w[i]\n"					\
+ 	"	ldclr" #mb "	%w[i], %w[i], %[v]"			\
+ 	: [i] "+&r" (i), [v] "+Q" (v->counter)				\
+@@ -106,6 +111,7 @@ ATOMIC_FETCH_OP_AND(        , al, "memory")
+ static inline void __lse_atomic_sub(int i, atomic_t *v)
+ {
+ 	asm volatile(
++	__LSE_PREAMBLE
+ 	"	neg	%w[i], %w[i]\n"
+ 	"	stadd	%w[i], %[v]"
+ 	: [i] "+&r" (i), [v] "+Q" (v->counter)
+@@ -118,6 +124,7 @@ static inline int __lse_atomic_sub_return##name(int i, atomic_t *v)	\
+ 	u32 tmp;							\
+ 									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ 	"	neg	%w[i], %w[i]\n"					\
+ 	"	ldadd" #mb "	%w[i], %w[tmp], %[v]\n"			\
+ 	"	add	%w[i], %w[i], %w[tmp]"				\
+@@ -139,6 +146,7 @@ ATOMIC_OP_SUB_RETURN(        , al, "memory")
+ static inline int __lse_atomic_fetch_sub##name(int i, atomic_t *v)	\
+ {									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ 	"	neg	%w[i], %w[i]\n"					\
+ 	"	ldadd" #mb "	%w[i], %w[i], %[v]"			\
+ 	: [i] "+&r" (i), [v] "+Q" (v->counter)				\
+@@ -159,6 +167,7 @@ ATOMIC_FETCH_OP_SUB(        , al, "memory")
+ static inline void __lse_atomic64_##op(s64 i, atomic64_t *v)		\
+ {									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ "	" #asm_op "	%[i], %[v]\n"					\
+ 	: [i] "+r" (i), [v] "+Q" (v->counter)				\
+ 	: "r" (v));							\
+@@ -175,6 +184,7 @@ ATOMIC64_OP(add, stadd)
+ static inline long __lse_atomic64_fetch_##op##name(s64 i, atomic64_t *v)\
+ {									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ "	" #asm_op #mb "	%[i], %[i], %[v]"				\
+ 	: [i] "+r" (i), [v] "+Q" (v->counter)				\
+ 	: "r" (v)							\
+@@ -203,6 +213,7 @@ static inline long __lse_atomic64_add_return##name(s64 i, atomic64_t *v)\
+ 	unsigned long tmp;						\
+ 									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ 	"	ldadd" #mb "	%[i], %x[tmp], %[v]\n"			\
+ 	"	add	%[i], %[i], %x[tmp]"				\
+ 	: [i] "+r" (i), [v] "+Q" (v->counter), [tmp] "=&r" (tmp)	\
+@@ -222,6 +233,7 @@ ATOMIC64_OP_ADD_RETURN(        , al, "memory")
+ static inline void __lse_atomic64_and(s64 i, atomic64_t *v)
+ {
+ 	asm volatile(
++	__LSE_PREAMBLE
+ 	"	mvn	%[i], %[i]\n"
+ 	"	stclr	%[i], %[v]"
+ 	: [i] "+&r" (i), [v] "+Q" (v->counter)
+@@ -232,6 +244,7 @@ static inline void __lse_atomic64_and(s64 i, atomic64_t *v)
+ static inline long __lse_atomic64_fetch_and##name(s64 i, atomic64_t *v)	\
+ {									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ 	"	mvn	%[i], %[i]\n"					\
+ 	"	ldclr" #mb "	%[i], %[i], %[v]"			\
+ 	: [i] "+&r" (i), [v] "+Q" (v->counter)				\
+@@ -251,6 +264,7 @@ ATOMIC64_FETCH_OP_AND(        , al, "memory")
+ static inline void __lse_atomic64_sub(s64 i, atomic64_t *v)
+ {
+ 	asm volatile(
++	__LSE_PREAMBLE
+ 	"	neg	%[i], %[i]\n"
+ 	"	stadd	%[i], %[v]"
+ 	: [i] "+&r" (i), [v] "+Q" (v->counter)
+@@ -263,6 +277,7 @@ static inline long __lse_atomic64_sub_return##name(s64 i, atomic64_t *v)	\
+ 	unsigned long tmp;						\
+ 									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ 	"	neg	%[i], %[i]\n"					\
+ 	"	ldadd" #mb "	%[i], %x[tmp], %[v]\n"			\
+ 	"	add	%[i], %[i], %x[tmp]"				\
+@@ -284,6 +299,7 @@ ATOMIC64_OP_SUB_RETURN(        , al, "memory")
+ static inline long __lse_atomic64_fetch_sub##name(s64 i, atomic64_t *v)	\
+ {									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ 	"	neg	%[i], %[i]\n"					\
+ 	"	ldadd" #mb "	%[i], %[i], %[v]"			\
+ 	: [i] "+&r" (i), [v] "+Q" (v->counter)				\
+@@ -305,6 +321,7 @@ static inline s64 __lse_atomic64_dec_if_positive(atomic64_t *v)
+ 	unsigned long tmp;
+ 
+ 	asm volatile(
++	__LSE_PREAMBLE
+ 	"1:	ldr	%x[tmp], %[v]\n"
+ 	"	subs	%[ret], %x[tmp], #1\n"
+ 	"	b.lt	2f\n"
+@@ -332,6 +349,7 @@ __lse__cmpxchg_case_##name##sz(volatile void *ptr,			\
+ 	unsigned long tmp;						\
+ 									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ 	"	mov	%" #w "[tmp], %" #w "[old]\n"			\
+ 	"	cas" #mb #sfx "\t%" #w "[tmp], %" #w "[new], %[v]\n"	\
+ 	"	mov	%" #w "[ret], %" #w "[tmp]"			\
+@@ -379,6 +397,7 @@ __lse__cmpxchg_double##name(unsigned long old1,				\
+ 	register unsigned long x4 asm ("x4") = (unsigned long)ptr;	\
+ 									\
+ 	asm volatile(							\
++	__LSE_PREAMBLE							\
+ 	"	casp" #mb "\t%[old1], %[old2], %[new1], %[new2], %[v]\n"\
+ 	"	eor	%[old1], %[old1], %[oldval1]\n"			\
+ 	"	eor	%[old2], %[old2], %[oldval2]\n"			\
+diff --git a/arch/arm64/include/asm/lse.h b/arch/arm64/include/asm/lse.h
+index 80b3882781496..73834996c4b6d 100644
+--- a/arch/arm64/include/asm/lse.h
++++ b/arch/arm64/include/asm/lse.h
+@@ -6,6 +6,8 @@
+ 
+ #if defined(CONFIG_AS_LSE) && defined(CONFIG_ARM64_LSE_ATOMICS)
+ 
++#define __LSE_PREAMBLE	".arch armv8-a+lse\n"
++
+ #include <linux/compiler_types.h>
+ #include <linux/export.h>
+ #include <linux/jump_label.h>
+@@ -14,8 +16,6 @@
+ #include <asm/atomic_lse.h>
+ #include <asm/cpucaps.h>
+ 
+-__asm__(".arch_extension	lse");
+-
+ extern struct static_key_false cpu_hwcap_keys[ARM64_NCAPS];
+ extern struct static_key_false arm64_const_caps_ready;
+ 
+@@ -34,7 +34,7 @@ static inline bool system_uses_lse_atomics(void)
+ 
+ /* In-line patching at runtime */
+ #define ARM64_LSE_ATOMIC_INSN(llsc, lse)				\
+-	ALTERNATIVE(llsc, lse, ARM64_HAS_LSE_ATOMICS)
++	ALTERNATIVE(llsc, __LSE_PREAMBLE lse, ARM64_HAS_LSE_ATOMICS)
+ 
+ #else	/* CONFIG_AS_LSE && CONFIG_ARM64_LSE_ATOMICS */
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/asm-generic-tlb-add-missing-config-symbol.patch b/queue-5.5/asm-generic-tlb-add-missing-config-symbol.patch
new file mode 100644
index 00000000000..5e98d9f56dc
--- /dev/null
+++ b/queue-5.5/asm-generic-tlb-add-missing-config-symbol.patch
@@ -0,0 +1,40 @@
+From e48479dbf6bc387f5875e929ccb4426e129ff72c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 17:36:59 -0800
+Subject: asm-generic/tlb: add missing CONFIG symbol
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 27796d03c9c4b2b937ed4cc2b10f21559ad5a8c9 ]
+
+Without this the symbol will not actually end up in .config files.
+
+Link: http://lkml.kernel.org/r/20200116064531.483522-6-aneesh.kumar@linux.ibm.com
+Fixes: a30e32bd79e9 ("asm-generic/tlb: Provide generic tlb_flush() based on flush_tlb_mm()")
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/Kconfig | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/Kconfig b/arch/Kconfig
+index 208aad1216300..5e907a954532e 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -399,6 +399,9 @@ config HAVE_RCU_TABLE_FREE
+ config HAVE_MMU_GATHER_PAGE_SIZE
+ 	bool
+ 
++config MMU_GATHER_NO_RANGE
++	bool
++
+ config HAVE_MMU_GATHER_NO_GATHER
+ 	bool
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch b/queue-5.5/asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch
new file mode 100644
index 00000000000..12c70972a75
--- /dev/null
+++ b/queue-5.5/asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch
@@ -0,0 +1,43 @@
+From c9f78a3f581a095160316557af40b2c7322cf39a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 21:32:42 +0800
+Subject: ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m
+
+From: Chen Zhou <chenzhou10@huawei.com>
+
+[ Upstream commit 8fea78029f5e6ed734ae1957bef23cfda1af4354 ]
+
+If CONFIG_SND_ATMEL_SOC_DMA=m, build error:
+
+sound/soc/atmel/atmel_ssc_dai.o: In function `atmel_ssc_set_audio':
+(.text+0x7cd): undefined reference to `atmel_pcm_dma_platform_register'
+
+Function atmel_pcm_dma_platform_register is defined under
+CONFIG SND_ATMEL_SOC_DMA, so select SND_ATMEL_SOC_DMA in
+CONFIG SND_ATMEL_SOC_SSC, same to CONFIG_SND_ATMEL_SOC_PDC.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Chen Zhou <chenzhou10@huawei.com>
+Link: https://lore.kernel.org/r/20200113133242.144550-1-chenzhou10@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig
+index f118c229ed829..d1dc8e6366dcb 100644
+--- a/sound/soc/atmel/Kconfig
++++ b/sound/soc/atmel/Kconfig
+@@ -19,6 +19,8 @@ config SND_ATMEL_SOC_DMA
+ 
+ config SND_ATMEL_SOC_SSC
+ 	tristate
++	select SND_ATMEL_SOC_DMA
++	select SND_ATMEL_SOC_PDC
+ 
+ config SND_ATMEL_SOC_SSC_PDC
+ 	tristate "SoC PCM DAI support for AT91 SSC controller using PDC"
+-- 
+2.20.1
+
diff --git a/queue-5.5/asoc-intel-consistent-hdmi-codec-probing-code.patch b/queue-5.5/asoc-intel-consistent-hdmi-codec-probing-code.patch
new file mode 100644
index 00000000000..992f89e31f1
--- /dev/null
+++ b/queue-5.5/asoc-intel-consistent-hdmi-codec-probing-code.patch
@@ -0,0 +1,226 @@
+From dc02b26a032ab875e627405e734630fde53380aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 15:36:25 -0600
+Subject: ASoC: Intel: consistent HDMI codec probing code
+
+From: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+
+[ Upstream commit 98ff5c262f27aafee077a4c096f71a8566e9e948 ]
+
+Multiple Intel ASoC machine drivers repeat the same pattern in their
+.late_probe() methods: they first check whether the common HDMI codec
+driver is used, if not, they proceed by linking the legacy HDMI
+driver to each HDMI port. While doing that they use some
+inconsistent code:
+
+1. after the loop they check, whether the list contained at least one
+   element and if not, they return an error. However, the earlier
+   code to use the common HDMI driver uses the first element of the
+   same list without checking. To fix this we move the check to the
+   top of the function.
+
+2. some of those .late_probe() implementations execute code, only
+   needed for the common HDMI driver, before checking, whether the
+   driver is used. Move the code to after the check.
+
+3. Some of those functions also perform a redundant initialisation of
+   the "err" variable.
+
+This patch fixes those issues.
+
+Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200124213625.30186-8-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bxt_da7219_max98357a.c | 14 +++++++-------
+ sound/soc/intel/boards/bxt_rt298.c            | 14 +++++++-------
+ sound/soc/intel/boards/cml_rt1011_rt5682.c    | 13 +++++++------
+ sound/soc/intel/boards/glk_rt5682_max98357a.c | 16 ++++++++--------
+ sound/soc/intel/boards/sof_rt5682.c           | 15 ++++++++-------
+ 5 files changed, 37 insertions(+), 35 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bxt_da7219_max98357a.c b/sound/soc/intel/boards/bxt_da7219_max98357a.c
+index 5873abb46441c..749b1c4f1ceec 100644
+--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c
++++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c
+@@ -617,12 +617,15 @@ static int bxt_card_late_probe(struct snd_soc_card *card)
+ 		snd_soc_dapm_add_routes(&card->dapm, broxton_map,
+ 					ARRAY_SIZE(broxton_map));
+ 
+-	pcm = list_first_entry(&ctx->hdmi_pcm_list, struct bxt_hdmi_pcm,
+-			       head);
+-	component = pcm->codec_dai->component;
++	if (list_empty(&ctx->hdmi_pcm_list))
++		return -EINVAL;
+ 
+-	if (ctx->common_hdmi_codec_drv)
++	if (ctx->common_hdmi_codec_drv) {
++		pcm = list_first_entry(&ctx->hdmi_pcm_list, struct bxt_hdmi_pcm,
++				       head);
++		component = pcm->codec_dai->component;
+ 		return hda_dsp_hdmi_build_controls(card, component);
++	}
+ 
+ 	list_for_each_entry(pcm, &ctx->hdmi_pcm_list, head) {
+ 		component = pcm->codec_dai->component;
+@@ -643,9 +646,6 @@ static int bxt_card_late_probe(struct snd_soc_card *card)
+ 		i++;
+ 	}
+ 
+-	if (!component)
+-		return -EINVAL;
+-
+ 	return hdac_hdmi_jack_port_init(component, &card->dapm);
+ }
+ 
+diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c
+index eabf9d8468ae5..becfc4fc1aff3 100644
+--- a/sound/soc/intel/boards/bxt_rt298.c
++++ b/sound/soc/intel/boards/bxt_rt298.c
+@@ -529,12 +529,15 @@ static int bxt_card_late_probe(struct snd_soc_card *card)
+ 	int err, i = 0;
+ 	char jack_name[NAME_SIZE];
+ 
+-	pcm = list_first_entry(&ctx->hdmi_pcm_list, struct bxt_hdmi_pcm,
+-			       head);
+-	component = pcm->codec_dai->component;
++	if (list_empty(&ctx->hdmi_pcm_list))
++		return -EINVAL;
+ 
+-	if (ctx->common_hdmi_codec_drv)
++	if (ctx->common_hdmi_codec_drv) {
++		pcm = list_first_entry(&ctx->hdmi_pcm_list, struct bxt_hdmi_pcm,
++				       head);
++		component = pcm->codec_dai->component;
+ 		return hda_dsp_hdmi_build_controls(card, component);
++	}
+ 
+ 	list_for_each_entry(pcm, &ctx->hdmi_pcm_list, head) {
+ 		component = pcm->codec_dai->component;
+@@ -555,9 +558,6 @@ static int bxt_card_late_probe(struct snd_soc_card *card)
+ 		i++;
+ 	}
+ 
+-	if (!component)
+-		return -EINVAL;
+-
+ 	return hdac_hdmi_jack_port_init(component, &card->dapm);
+ }
+ 
+diff --git a/sound/soc/intel/boards/cml_rt1011_rt5682.c b/sound/soc/intel/boards/cml_rt1011_rt5682.c
+index 5f1bf6d3800c6..a54636f77c8e6 100644
+--- a/sound/soc/intel/boards/cml_rt1011_rt5682.c
++++ b/sound/soc/intel/boards/cml_rt1011_rt5682.c
+@@ -241,12 +241,15 @@ static int sof_card_late_probe(struct snd_soc_card *card)
+ 	struct hdmi_pcm *pcm;
+ 	int ret, i = 0;
+ 
+-	pcm = list_first_entry(&ctx->hdmi_pcm_list, struct hdmi_pcm,
+-			       head);
+-	component = pcm->codec_dai->component;
++	if (list_empty(&ctx->hdmi_pcm_list))
++		return -EINVAL;
+ 
+-	if (ctx->common_hdmi_codec_drv)
++	if (ctx->common_hdmi_codec_drv) {
++		pcm = list_first_entry(&ctx->hdmi_pcm_list, struct hdmi_pcm,
++				       head);
++		component = pcm->codec_dai->component;
+ 		return hda_dsp_hdmi_build_controls(card, component);
++	}
+ 
+ 	list_for_each_entry(pcm, &ctx->hdmi_pcm_list, head) {
+ 		component = pcm->codec_dai->component;
+@@ -265,8 +268,6 @@ static int sof_card_late_probe(struct snd_soc_card *card)
+ 
+ 		i++;
+ 	}
+-	if (!component)
+-		return -EINVAL;
+ 
+ 	return hdac_hdmi_jack_port_init(component, &card->dapm);
+ }
+diff --git a/sound/soc/intel/boards/glk_rt5682_max98357a.c b/sound/soc/intel/boards/glk_rt5682_max98357a.c
+index b36264d1d1cd3..94c6bdfab63bb 100644
+--- a/sound/soc/intel/boards/glk_rt5682_max98357a.c
++++ b/sound/soc/intel/boards/glk_rt5682_max98357a.c
+@@ -544,15 +544,18 @@ static int glk_card_late_probe(struct snd_soc_card *card)
+ 	struct snd_soc_component *component = NULL;
+ 	char jack_name[NAME_SIZE];
+ 	struct glk_hdmi_pcm *pcm;
+-	int err = 0;
++	int err;
+ 	int i = 0;
+ 
+-	pcm = list_first_entry(&ctx->hdmi_pcm_list, struct glk_hdmi_pcm,
+-			       head);
+-	component = pcm->codec_dai->component;
++	if (list_empty(&ctx->hdmi_pcm_list))
++		return -EINVAL;
+ 
+-	if (ctx->common_hdmi_codec_drv)
++	if (ctx->common_hdmi_codec_drv) {
++		pcm = list_first_entry(&ctx->hdmi_pcm_list, struct glk_hdmi_pcm,
++				       head);
++		component = pcm->codec_dai->component;
+ 		return hda_dsp_hdmi_build_controls(card, component);
++	}
+ 
+ 	list_for_each_entry(pcm, &ctx->hdmi_pcm_list, head) {
+ 		component = pcm->codec_dai->component;
+@@ -573,9 +576,6 @@ static int glk_card_late_probe(struct snd_soc_card *card)
+ 		i++;
+ 	}
+ 
+-	if (!component)
+-		return -EINVAL;
+-
+ 	return hdac_hdmi_jack_port_init(component, &card->dapm);
+ }
+ 
+diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
+index 8a13231dee15d..5d878873a8e08 100644
+--- a/sound/soc/intel/boards/sof_rt5682.c
++++ b/sound/soc/intel/boards/sof_rt5682.c
+@@ -273,19 +273,22 @@ static int sof_card_late_probe(struct snd_soc_card *card)
+ 	struct snd_soc_component *component = NULL;
+ 	char jack_name[NAME_SIZE];
+ 	struct sof_hdmi_pcm *pcm;
+-	int err = 0;
++	int err;
+ 	int i = 0;
+ 
+ 	/* HDMI is not supported by SOF on Baytrail/CherryTrail */
+ 	if (is_legacy_cpu)
+ 		return 0;
+ 
+-	pcm = list_first_entry(&ctx->hdmi_pcm_list, struct sof_hdmi_pcm,
+-			       head);
+-	component = pcm->codec_dai->component;
++	if (list_empty(&ctx->hdmi_pcm_list))
++		return -EINVAL;
+ 
+-	if (ctx->common_hdmi_codec_drv)
++	if (ctx->common_hdmi_codec_drv) {
++		pcm = list_first_entry(&ctx->hdmi_pcm_list, struct sof_hdmi_pcm,
++				       head);
++		component = pcm->codec_dai->component;
+ 		return hda_dsp_hdmi_build_controls(card, component);
++	}
+ 
+ 	list_for_each_entry(pcm, &ctx->hdmi_pcm_list, head) {
+ 		component = pcm->codec_dai->component;
+@@ -305,8 +308,6 @@ static int sof_card_late_probe(struct snd_soc_card *card)
+ 
+ 		i++;
+ 	}
+-	if (!component)
+-		return -EINVAL;
+ 
+ 	return hdac_hdmi_jack_port_init(component, &card->dapm);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/asoc-intel-sof_rt5682-add-quirk-for-number-of-hdmi-d.patch b/queue-5.5/asoc-intel-sof_rt5682-add-quirk-for-number-of-hdmi-d.patch
new file mode 100644
index 00000000000..ac5004d9a61
--- /dev/null
+++ b/queue-5.5/asoc-intel-sof_rt5682-add-quirk-for-number-of-hdmi-d.patch
@@ -0,0 +1,66 @@
+From fcd14eea12e7df22eca29f598ad45fecac81889f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 08:32:03 -0600
+Subject: ASoC: intel: sof_rt5682: Add quirk for number of HDMI DAI's
+
+From: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+
+[ Upstream commit c68e07970eca79106b0c35b88a12298569590081 ]
+
+TGL supports one more HDMI DAI than previous models.
+So add quirk support for number of HDMI DAI's.
+
+Signed-off-by: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+Signed-off-by: Jairaj Arava <jairaj.arava@intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191126143205.21987-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_rt5682.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
+index 751b8ea6ae1f5..57adadacbf436 100644
+--- a/sound/soc/intel/boards/sof_rt5682.c
++++ b/sound/soc/intel/boards/sof_rt5682.c
+@@ -35,6 +35,10 @@
+ #define SOF_RT5682_SSP_AMP(quirk)	\
+ 	(((quirk) << SOF_RT5682_SSP_AMP_SHIFT) & SOF_RT5682_SSP_AMP_MASK)
+ #define SOF_RT5682_MCLK_BYTCHT_EN		BIT(9)
++#define SOF_RT5682_NUM_HDMIDEV_SHIFT		10
++#define SOF_RT5682_NUM_HDMIDEV_MASK		(GENMASK(12, 10))
++#define SOF_RT5682_NUM_HDMIDEV(quirk)	\
++	((quirk << SOF_RT5682_NUM_HDMIDEV_SHIFT) & SOF_RT5682_NUM_HDMIDEV_MASK)
+ 
+ /* Default: MCLK on, MCLK 19.2M, SSP0  */
+ static unsigned long sof_rt5682_quirk = SOF_RT5682_MCLK_EN |
+@@ -594,6 +598,8 @@ static int sof_audio_probe(struct platform_device *pdev)
+ 	if (!ctx)
+ 		return -ENOMEM;
+ 
++	dmi_check_system(sof_rt5682_quirk_table);
++
+ 	if (soc_intel_is_byt() || soc_intel_is_cht()) {
+ 		is_legacy_cpu = 1;
+ 		dmic_be_num = 0;
+@@ -604,11 +610,13 @@ static int sof_audio_probe(struct platform_device *pdev)
+ 						SOF_RT5682_SSP_CODEC(2);
+ 	} else {
+ 		dmic_be_num = 2;
+-		hdmi_num = 3;
++		hdmi_num = (sof_rt5682_quirk & SOF_RT5682_NUM_HDMIDEV_MASK) >>
++			 SOF_RT5682_NUM_HDMIDEV_SHIFT;
++		/* default number of HDMI DAI's */
++		if (!hdmi_num)
++			hdmi_num = 3;
+ 	}
+ 
+-	dmi_check_system(sof_rt5682_quirk_table);
+-
+ 	/* need to get main clock from pmc */
+ 	if (sof_rt5682_quirk & SOF_RT5682_MCLK_BYTCHT_EN) {
+ 		ctx->mclk = devm_clk_get(&pdev->dev, "pmc_plt_clk_3");
+-- 
+2.20.1
+
diff --git a/queue-5.5/asoc-intel-sof_rt5682-add-support-for-tgl-max98357a-.patch b/queue-5.5/asoc-intel-sof_rt5682-add-support-for-tgl-max98357a-.patch
new file mode 100644
index 00000000000..62ad7447aa1
--- /dev/null
+++ b/queue-5.5/asoc-intel-sof_rt5682-add-support-for-tgl-max98357a-.patch
@@ -0,0 +1,74 @@
+From 0cc2824f133f8290b4f2823c90eefbd0a093fc97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 08:32:04 -0600
+Subject: ASoC: intel: sof_rt5682: Add support for tgl-max98357a-rt5682
+
+From: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+
+[ Upstream commit 6605f0ca3af3b964635287ec7c9dadc812b78eb0 ]
+
+This patch adds the driver data and updates quirk info
+for tgl with max98357a speaker amp and ALC5682 headset codec.
+
+Signed-off-by: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+Signed-off-by: Jairaj Arava <jairaj.arava@intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191126143205.21987-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_rt5682.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
+index 57adadacbf436..ad8a2b4bc7092 100644
+--- a/sound/soc/intel/boards/sof_rt5682.c
++++ b/sound/soc/intel/boards/sof_rt5682.c
+@@ -598,6 +598,9 @@ static int sof_audio_probe(struct platform_device *pdev)
+ 	if (!ctx)
+ 		return -ENOMEM;
+ 
++	if (pdev->id_entry && pdev->id_entry->driver_data)
++		sof_rt5682_quirk = (unsigned long)pdev->id_entry->driver_data;
++
+ 	dmi_check_system(sof_rt5682_quirk_table);
+ 
+ 	if (soc_intel_is_byt() || soc_intel_is_cht()) {
+@@ -691,6 +694,21 @@ static int sof_rt5682_remove(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
++static const struct platform_device_id board_ids[] = {
++	{
++		.name = "sof_rt5682",
++	},
++	{
++		.name = "tgl_max98357a_rt5682",
++		.driver_data = (kernel_ulong_t)(SOF_RT5682_MCLK_EN |
++					SOF_RT5682_SSP_CODEC(0) |
++					SOF_SPEAKER_AMP_PRESENT |
++					SOF_RT5682_SSP_AMP(1) |
++					SOF_RT5682_NUM_HDMIDEV(4)),
++	},
++	{ }
++};
++
+ static struct platform_driver sof_audio = {
+ 	.probe = sof_audio_probe,
+ 	.remove = sof_rt5682_remove,
+@@ -698,6 +716,7 @@ static struct platform_driver sof_audio = {
+ 		.name = "sof_rt5682",
+ 		.pm = &snd_soc_pm_ops,
+ 	},
++	.id_table = board_ids,
+ };
+ module_platform_driver(sof_audio)
+ 
+@@ -707,3 +726,4 @@ MODULE_AUTHOR("Bard Liao <bard.liao@intel.com>");
+ MODULE_AUTHOR("Sathya Prakash M R <sathya.prakash.m.r@intel.com>");
+ MODULE_LICENSE("GPL v2");
+ MODULE_ALIAS("platform:sof_rt5682");
++MODULE_ALIAS("platform:tgl_max98357a_rt5682");
+-- 
+2.20.1
+
diff --git a/queue-5.5/asoc-intel-sof_rt5682-ignore-the-speaker-amp-when-th.patch b/queue-5.5/asoc-intel-sof_rt5682-ignore-the-speaker-amp-when-th.patch
new file mode 100644
index 00000000000..25a4e4981e9
--- /dev/null
+++ b/queue-5.5/asoc-intel-sof_rt5682-ignore-the-speaker-amp-when-th.patch
@@ -0,0 +1,71 @@
+From 7389e7add27d60ff466777b6da790e7a328da19e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 12:50:19 +1100
+Subject: ASoC: Intel: sof_rt5682: Ignore the speaker amp when there isn't one.
+
+From: Sam McNally <sammc@chromium.org>
+
+[ Upstream commit d4b74e218a8d0d6cf58e546627ab9d4d4f2645ab ]
+
+Some members of the Google_Hatch family include a rt5682 jack codec, but
+no speaker amplifier. This uses the same driver (sof_rt5682) as a
+combination of rt5682 jack codec and max98357a speaker amplifier. Within
+the sof_rt5682 driver, these cases are not currently distinguishable,
+relying on a DMI quirk to decide the configuration. This causes an
+incorrect configuration when only the rt5682 is present on a
+Google_Hatch device.
+
+For CML, the jack codec is used as the primary key when matching,
+with a possible speaker amplifier described in quirk_data. The two cases
+of interest are the second and third 10EC5682 entries in
+snd_soc_acpi_intel_cml_machines[]. The second entry matches the
+combination of rt5682 and max98357a, resulting in the quirk_data field
+in the snd_soc_acpi_mach being non-null, pointing at
+max98357a_spk_codecs, the snd_soc_acpi_codecs for the matched speaker
+amplifier. The third entry matches just the rt5682, resulting in a null
+quirk_data.
+
+The sof_rt5682 driver's DMI data matching identifies that a speaker
+amplifier is present for all Google_Hatch family devices. Detect cases
+where there is no speaker amplifier by checking for a null quirk_data in
+the snd_soc_acpi_mach and remove the speaker amplifier bit in that case.
+
+Signed-off-by: Sam McNally <sammc@chromium.org>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200103124921.v3.1.Ib87c4a7fbb3fc818ea12198e291b87dc2d5bc8c2@changeid
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_rt5682.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
+index ad8a2b4bc7092..8a13231dee15d 100644
+--- a/sound/soc/intel/boards/sof_rt5682.c
++++ b/sound/soc/intel/boards/sof_rt5682.c
+@@ -603,6 +603,14 @@ static int sof_audio_probe(struct platform_device *pdev)
+ 
+ 	dmi_check_system(sof_rt5682_quirk_table);
+ 
++	mach = (&pdev->dev)->platform_data;
++
++	/* A speaker amp might not be present when the quirk claims one is.
++	 * Detect this via whether the machine driver match includes quirk_data.
++	 */
++	if ((sof_rt5682_quirk & SOF_SPEAKER_AMP_PRESENT) && !mach->quirk_data)
++		sof_rt5682_quirk &= ~SOF_SPEAKER_AMP_PRESENT;
++
+ 	if (soc_intel_is_byt() || soc_intel_is_cht()) {
+ 		is_legacy_cpu = 1;
+ 		dmic_be_num = 0;
+@@ -663,7 +671,6 @@ static int sof_audio_probe(struct platform_device *pdev)
+ 	INIT_LIST_HEAD(&ctx->hdmi_pcm_list);
+ 
+ 	sof_audio_card_rt5682.dev = &pdev->dev;
+-	mach = (&pdev->dev)->platform_data;
+ 
+ 	/* set platform name for each dailink */
+ 	ret = snd_soc_fixup_dai_links_platform_name(&sof_audio_card_rt5682,
+-- 
+2.20.1
+
diff --git a/queue-5.5/asoc-soc-topology-fix-endianness-issues.patch b/queue-5.5/asoc-soc-topology-fix-endianness-issues.patch
new file mode 100644
index 00000000000..2a7f0389ff5
--- /dev/null
+++ b/queue-5.5/asoc-soc-topology-fix-endianness-issues.patch
@@ -0,0 +1,144 @@
+From 24fb00d46c67f07cc2adf36837391c38ae1dac15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 13:59:52 -0600
+Subject: ASoC: soc-topology: fix endianness issues
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 72bbeda0222bcd382ee33b3aff71346074410c21 ]
+
+Sparse complains about a series of easy warnings, fix.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200102195952.9465-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 42 +++++++++++++++++++++-------------------
+ 1 file changed, 22 insertions(+), 20 deletions(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 4e1fe623c3908..0119f07cece6f 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -604,9 +604,11 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr,
+ 		ext_ops = tplg->bytes_ext_ops;
+ 		num_ops = tplg->bytes_ext_ops_count;
+ 		for (i = 0; i < num_ops; i++) {
+-			if (!sbe->put && ext_ops[i].id == be->ext_ops.put)
++			if (!sbe->put &&
++			    ext_ops[i].id == le32_to_cpu(be->ext_ops.put))
+ 				sbe->put = ext_ops[i].put;
+-			if (!sbe->get && ext_ops[i].id == be->ext_ops.get)
++			if (!sbe->get &&
++			    ext_ops[i].id == le32_to_cpu(be->ext_ops.get))
+ 				sbe->get = ext_ops[i].get;
+ 		}
+ 
+@@ -621,11 +623,11 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr,
+ 	num_ops = tplg->io_ops_count;
+ 	for (i = 0; i < num_ops; i++) {
+ 
+-		if (k->put == NULL && ops[i].id == hdr->ops.put)
++		if (k->put == NULL && ops[i].id == le32_to_cpu(hdr->ops.put))
+ 			k->put = ops[i].put;
+-		if (k->get == NULL && ops[i].id == hdr->ops.get)
++		if (k->get == NULL && ops[i].id == le32_to_cpu(hdr->ops.get))
+ 			k->get = ops[i].get;
+-		if (k->info == NULL && ops[i].id == hdr->ops.info)
++		if (k->info == NULL && ops[i].id == le32_to_cpu(hdr->ops.info))
+ 			k->info = ops[i].info;
+ 	}
+ 
+@@ -638,11 +640,11 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr,
+ 	num_ops = ARRAY_SIZE(io_ops);
+ 	for (i = 0; i < num_ops; i++) {
+ 
+-		if (k->put == NULL && ops[i].id == hdr->ops.put)
++		if (k->put == NULL && ops[i].id == le32_to_cpu(hdr->ops.put))
+ 			k->put = ops[i].put;
+-		if (k->get == NULL && ops[i].id == hdr->ops.get)
++		if (k->get == NULL && ops[i].id == le32_to_cpu(hdr->ops.get))
+ 			k->get = ops[i].get;
+-		if (k->info == NULL && ops[i].id == hdr->ops.info)
++		if (k->info == NULL && ops[i].id == le32_to_cpu(hdr->ops.info))
+ 			k->info = ops[i].info;
+ 	}
+ 
+@@ -931,7 +933,7 @@ static int soc_tplg_denum_create_texts(struct soc_enum *se,
+ 	if (se->dobj.control.dtexts == NULL)
+ 		return -ENOMEM;
+ 
+-	for (i = 0; i < ec->items; i++) {
++	for (i = 0; i < le32_to_cpu(ec->items); i++) {
+ 
+ 		if (strnlen(ec->texts[i], SNDRV_CTL_ELEM_ID_NAME_MAXLEN) ==
+ 			SNDRV_CTL_ELEM_ID_NAME_MAXLEN) {
+@@ -1325,7 +1327,7 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dmixer_create(
+ 		if (kc[i].name == NULL)
+ 			goto err_sm;
+ 		kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
+-		kc[i].access = mc->hdr.access;
++		kc[i].access = le32_to_cpu(mc->hdr.access);
+ 
+ 		/* we only support FL/FR channel mapping atm */
+ 		sm->reg = tplc_chan_get_reg(tplg, mc->channel,
+@@ -1337,10 +1339,10 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dmixer_create(
+ 		sm->rshift = tplc_chan_get_shift(tplg, mc->channel,
+ 			SNDRV_CHMAP_FR);
+ 
+-		sm->max = mc->max;
+-		sm->min = mc->min;
+-		sm->invert = mc->invert;
+-		sm->platform_max = mc->platform_max;
++		sm->max = le32_to_cpu(mc->max);
++		sm->min = le32_to_cpu(mc->min);
++		sm->invert = le32_to_cpu(mc->invert);
++		sm->platform_max = le32_to_cpu(mc->platform_max);
+ 		sm->dobj.index = tplg->index;
+ 		INIT_LIST_HEAD(&sm->dobj.list);
+ 
+@@ -1401,7 +1403,7 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_denum_create(
+ 			goto err_se;
+ 
+ 		tplg->pos += (sizeof(struct snd_soc_tplg_enum_control) +
+-				ec->priv.size);
++			      le32_to_cpu(ec->priv.size));
+ 
+ 		dev_dbg(tplg->dev, " adding DAPM widget enum control %s\n",
+ 			ec->hdr.name);
+@@ -1411,7 +1413,7 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_denum_create(
+ 		if (kc[i].name == NULL)
+ 			goto err_se;
+ 		kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
+-		kc[i].access = ec->hdr.access;
++		kc[i].access = le32_to_cpu(ec->hdr.access);
+ 
+ 		/* we only support FL/FR channel mapping atm */
+ 		se->reg = tplc_chan_get_reg(tplg, ec->channel, SNDRV_CHMAP_FL);
+@@ -1420,8 +1422,8 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_denum_create(
+ 		se->shift_r = tplc_chan_get_shift(tplg, ec->channel,
+ 						  SNDRV_CHMAP_FR);
+ 
+-		se->items = ec->items;
+-		se->mask = ec->mask;
++		se->items = le32_to_cpu(ec->items);
++		se->mask = le32_to_cpu(ec->mask);
+ 		se->dobj.index = tplg->index;
+ 
+ 		switch (le32_to_cpu(ec->hdr.ops.info)) {
+@@ -1523,9 +1525,9 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dbytes_create(
+ 		if (kc[i].name == NULL)
+ 			goto err_sbe;
+ 		kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
+-		kc[i].access = be->hdr.access;
++		kc[i].access = le32_to_cpu(be->hdr.access);
+ 
+-		sbe->max = be->max;
++		sbe->max = le32_to_cpu(be->max);
+ 		INIT_LIST_HEAD(&sbe->dobj.list);
+ 
+ 		/* map standard io handlers and check for external handlers */
+-- 
+2.20.1
+
diff --git a/queue-5.5/asoc-sof-intel-hda-dai-fix-compilation-warning-in-pc.patch b/queue-5.5/asoc-sof-intel-hda-dai-fix-compilation-warning-in-pc.patch
new file mode 100644
index 00000000000..8eecfc0622b
--- /dev/null
+++ b/queue-5.5/asoc-sof-intel-hda-dai-fix-compilation-warning-in-pc.patch
@@ -0,0 +1,54 @@
+From 20402df30a5542ea0931943aeb9c16c0dfb7cce3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 14:56:20 -0600
+Subject: ASoC: SOF: Intel: hda-dai: fix compilation warning in pcm_prepare
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit d873997192ddcacb5333575502be2f91ea4b47b8 ]
+
+Fix GCC warning with W=1, previous cleanup did not remove unnecessary
+variable.
+
+sound/soc/sof/intel/hda-dai.c: In function ‘hda_link_pcm_prepare’:
+
+sound/soc/sof/intel/hda-dai.c:265:31: warning: variable ‘hda_stream’
+set but not used [-Wunused-but-set-variable]
+  265 |  struct sof_intel_hda_stream *hda_stream;
+      |                               ^~~~~~~~~~
+
+Fixes: a3ebccb52efdf ("ASoC: SOF: Intel: hda: reset link DMA state in prepare")
+Cc: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200113205620.27285-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-dai.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c
+index 896d21984b735..1923b0c36bcef 100644
+--- a/sound/soc/sof/intel/hda-dai.c
++++ b/sound/soc/sof/intel/hda-dai.c
+@@ -261,14 +261,11 @@ static int hda_link_pcm_prepare(struct snd_pcm_substream *substream,
+ {
+ 	struct hdac_ext_stream *link_dev =
+ 				snd_soc_dai_get_dma_data(dai, substream);
+-	struct sof_intel_hda_stream *hda_stream;
+ 	struct snd_sof_dev *sdev =
+ 				snd_soc_component_get_drvdata(dai->component);
+ 	struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream);
+ 	int stream = substream->stream;
+ 
+-	hda_stream = hstream_to_sof_hda_stream(link_dev);
+-
+ 	if (link_dev->link_prepared)
+ 		return 0;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/asoc-sof-intel-hda-fix-skl-dai-count.patch b/queue-5.5/asoc-sof-intel-hda-fix-skl-dai-count.patch
new file mode 100644
index 00000000000..538399ab8d8
--- /dev/null
+++ b/queue-5.5/asoc-sof-intel-hda-fix-skl-dai-count.patch
@@ -0,0 +1,39 @@
+From 719b795b28bc0e82afd95425b7099222b0fe9310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 12:40:54 +0100
+Subject: ASoC: SOF: Intel: hda: Fix SKL dai count
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit a6947c9d86bcfd61b758b5693eba58defe7fd2ae ]
+
+With fourth pin added for iDisp for skl_dai, update SOF_SKL_DAI_NUM to
+account for the change. Without this, dais from the bottom of the list
+are skipped. In current state that's the case for 'Alt Analog CPU DAI'.
+
+Fixes: ac42b142cd76 ("ASoC: SOF: Intel: hda: Add iDisp4 DAI")
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200113114054.9716-1-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda.h b/sound/soc/sof/intel/hda.h
+index 63df888dddb6c..de0115294c74e 100644
+--- a/sound/soc/sof/intel/hda.h
++++ b/sound/soc/sof/intel/hda.h
+@@ -348,7 +348,7 @@
+ 
+ /* Number of DAIs */
+ #if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA)
+-#define SOF_SKL_NUM_DAIS		14
++#define SOF_SKL_NUM_DAIS		15
+ #else
+ #define SOF_SKL_NUM_DAIS		8
+ #endif
+-- 
+2.20.1
+
diff --git a/queue-5.5/asoc-sof-intel-hda-solve-msi-issues-by-merging-ipc-a.patch b/queue-5.5/asoc-sof-intel-hda-solve-msi-issues-by-merging-ipc-a.patch
new file mode 100644
index 00000000000..7cd039b89c8
--- /dev/null
+++ b/queue-5.5/asoc-sof-intel-hda-solve-msi-issues-by-merging-ipc-a.patch
@@ -0,0 +1,340 @@
+From 5125eed105661655dea400443dba120b899cbbd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 15:28:59 -0600
+Subject: ASoC: SOF: Intel: hda: solve MSI issues by merging ipc and stream irq
+ handlers
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 7c11af9fcdc425b80f140a218d4fef9f17734bfc ]
+
+The existing code uses two handlers for a shared edge-based MSI interrupts.
+In corner cases, interrupts are lost, leading to IPC timeouts. Those
+timeouts do not appear in legacy mode.
+
+This patch merges the two handlers and threads into a single one, and
+simplifies the mask/unmask operations by using a single top-level mask
+(Global Interrupt Enable). The handler only checks for interrupt
+sources using the Global Interrupt Status (GIS) field, and all the
+actual work happens in the thread. This also enables us to remove the
+use of spin locks. Stream events are prioritized over IPC ones.
+
+This patch was tested with HDaudio and SoundWire platforms, and all
+known IPC timeout issues are solved in MSI mode. The
+SoundWire-specific patches will be provided in follow-up patches,
+where the SoundWire interrupts are handled in the same thread as IPC
+and stream interrupts.
+
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191204212859.13239-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/apl.c        |  1 -
+ sound/soc/sof/intel/cnl.c        |  5 ---
+ sound/soc/sof/intel/hda-ipc.c    | 23 +++--------
+ sound/soc/sof/intel/hda-stream.c | 20 ++++-----
+ sound/soc/sof/intel/hda.c        | 69 ++++++++++++++++++++++----------
+ sound/soc/sof/intel/hda.h        | 11 ++---
+ 6 files changed, 70 insertions(+), 59 deletions(-)
+
+diff --git a/sound/soc/sof/intel/apl.c b/sound/soc/sof/intel/apl.c
+index 7daa8eb456c8d..6f45e14f2b2e3 100644
+--- a/sound/soc/sof/intel/apl.c
++++ b/sound/soc/sof/intel/apl.c
+@@ -41,7 +41,6 @@ const struct snd_sof_dsp_ops sof_apl_ops = {
+ 	.block_write	= sof_block_write,
+ 
+ 	/* doorbell */
+-	.irq_handler	= hda_dsp_ipc_irq_handler,
+ 	.irq_thread	= hda_dsp_ipc_irq_thread,
+ 
+ 	/* ipc */
+diff --git a/sound/soc/sof/intel/cnl.c b/sound/soc/sof/intel/cnl.c
+index 0e1e265f3f3b3..9bd169e2691e2 100644
+--- a/sound/soc/sof/intel/cnl.c
++++ b/sound/soc/sof/intel/cnl.c
+@@ -106,10 +106,6 @@ static irqreturn_t cnl_ipc_irq_thread(int irq, void *context)
+ 				    "nothing to do in IPC IRQ thread\n");
+ 	}
+ 
+-	/* re-enable IPC interrupt */
+-	snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, HDA_DSP_REG_ADSPIC,
+-				HDA_DSP_ADSPIC_IPC, HDA_DSP_ADSPIC_IPC);
+-
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -231,7 +227,6 @@ const struct snd_sof_dsp_ops sof_cnl_ops = {
+ 	.block_write	= sof_block_write,
+ 
+ 	/* doorbell */
+-	.irq_handler	= hda_dsp_ipc_irq_handler,
+ 	.irq_thread	= cnl_ipc_irq_thread,
+ 
+ 	/* ipc */
+diff --git a/sound/soc/sof/intel/hda-ipc.c b/sound/soc/sof/intel/hda-ipc.c
+index 0fd2153c17695..1837f66e361fd 100644
+--- a/sound/soc/sof/intel/hda-ipc.c
++++ b/sound/soc/sof/intel/hda-ipc.c
+@@ -230,22 +230,15 @@ irqreturn_t hda_dsp_ipc_irq_thread(int irq, void *context)
+ 				    "nothing to do in IPC IRQ thread\n");
+ 	}
+ 
+-	/* re-enable IPC interrupt */
+-	snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, HDA_DSP_REG_ADSPIC,
+-				HDA_DSP_ADSPIC_IPC, HDA_DSP_ADSPIC_IPC);
+-
+ 	return IRQ_HANDLED;
+ }
+ 
+-/* is this IRQ for ADSP ? - we only care about IPC here */
+-irqreturn_t hda_dsp_ipc_irq_handler(int irq, void *context)
++/* Check if an IPC IRQ occurred */
++bool hda_dsp_check_ipc_irq(struct snd_sof_dev *sdev)
+ {
+-	struct snd_sof_dev *sdev = context;
+-	int ret = IRQ_NONE;
++	bool ret = false;
+ 	u32 irq_status;
+ 
+-	spin_lock(&sdev->hw_lock);
+-
+ 	/* store status */
+ 	irq_status = snd_sof_dsp_read(sdev, HDA_DSP_BAR, HDA_DSP_REG_ADSPIS);
+ 	dev_vdbg(sdev->dev, "irq handler: irq_status:0x%x\n", irq_status);
+@@ -255,16 +248,10 @@ irqreturn_t hda_dsp_ipc_irq_handler(int irq, void *context)
+ 		goto out;
+ 
+ 	/* IPC message ? */
+-	if (irq_status & HDA_DSP_ADSPIS_IPC) {
+-		/* disable IPC interrupt */
+-		snd_sof_dsp_update_bits_unlocked(sdev, HDA_DSP_BAR,
+-						 HDA_DSP_REG_ADSPIC,
+-						 HDA_DSP_ADSPIC_IPC, 0);
+-		ret = IRQ_WAKE_THREAD;
+-	}
++	if (irq_status & HDA_DSP_ADSPIS_IPC)
++		ret = true;
+ 
+ out:
+-	spin_unlock(&sdev->hw_lock);
+ 	return ret;
+ }
+ 
+diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c
+index 29ab432816701..927a36f92c242 100644
+--- a/sound/soc/sof/intel/hda-stream.c
++++ b/sound/soc/sof/intel/hda-stream.c
+@@ -549,22 +549,23 @@ int hda_dsp_stream_hw_free(struct snd_sof_dev *sdev,
+ 	return 0;
+ }
+ 
+-irqreturn_t hda_dsp_stream_interrupt(int irq, void *context)
++bool hda_dsp_check_stream_irq(struct snd_sof_dev *sdev)
+ {
+-	struct hdac_bus *bus = context;
+-	int ret = IRQ_WAKE_THREAD;
++	struct hdac_bus *bus = sof_to_bus(sdev);
++	bool ret = false;
+ 	u32 status;
+ 
+-	spin_lock(&bus->reg_lock);
++	/* The function can be called at irq thread, so use spin_lock_irq */
++	spin_lock_irq(&bus->reg_lock);
+ 
+ 	status = snd_hdac_chip_readl(bus, INTSTS);
+ 	dev_vdbg(bus->dev, "stream irq, INTSTS status: 0x%x\n", status);
+ 
+-	/* Register inaccessible, ignore it.*/
+-	if (status == 0xffffffff)
+-		ret = IRQ_NONE;
++	/* if Register inaccessible, ignore it.*/
++	if (status != 0xffffffff)
++		ret = true;
+ 
+-	spin_unlock(&bus->reg_lock);
++	spin_unlock_irq(&bus->reg_lock);
+ 
+ 	return ret;
+ }
+@@ -602,7 +603,8 @@ static bool hda_dsp_stream_check(struct hdac_bus *bus, u32 status)
+ 
+ irqreturn_t hda_dsp_stream_threaded_handler(int irq, void *context)
+ {
+-	struct hdac_bus *bus = context;
++	struct snd_sof_dev *sdev = context;
++	struct hdac_bus *bus = sof_to_bus(sdev);
+ #if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA)
+ 	u32 rirb_status;
+ #endif
+diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
+index fb17b87b684bf..82ecadda886c6 100644
+--- a/sound/soc/sof/intel/hda.c
++++ b/sound/soc/sof/intel/hda.c
+@@ -499,6 +499,49 @@ static const struct sof_intel_dsp_desc
+ 	return chip_info;
+ }
+ 
++static irqreturn_t hda_dsp_interrupt_handler(int irq, void *context)
++{
++	struct snd_sof_dev *sdev = context;
++
++	/*
++	 * Get global interrupt status. It includes all hardware interrupt
++	 * sources in the Intel HD Audio controller.
++	 */
++	if (snd_sof_dsp_read(sdev, HDA_DSP_HDA_BAR, SOF_HDA_INTSTS) &
++	    SOF_HDA_INTSTS_GIS) {
++
++		/* disable GIE interrupt */
++		snd_sof_dsp_update_bits(sdev, HDA_DSP_HDA_BAR,
++					SOF_HDA_INTCTL,
++					SOF_HDA_INT_GLOBAL_EN,
++					0);
++
++		return IRQ_WAKE_THREAD;
++	}
++
++	return IRQ_NONE;
++}
++
++static irqreturn_t hda_dsp_interrupt_thread(int irq, void *context)
++{
++	struct snd_sof_dev *sdev = context;
++
++	/* deal with streams and controller first */
++	if (hda_dsp_check_stream_irq(sdev))
++		hda_dsp_stream_threaded_handler(irq, sdev);
++
++	if (hda_dsp_check_ipc_irq(sdev))
++		sof_ops(sdev)->irq_thread(irq, sdev);
++
++	/* enable GIE interrupt */
++	snd_sof_dsp_update_bits(sdev, HDA_DSP_HDA_BAR,
++				SOF_HDA_INTCTL,
++				SOF_HDA_INT_GLOBAL_EN,
++				SOF_HDA_INT_GLOBAL_EN);
++
++	return IRQ_HANDLED;
++}
++
+ int hda_dsp_probe(struct snd_sof_dev *sdev)
+ {
+ 	struct pci_dev *pci = to_pci_dev(sdev->dev);
+@@ -603,9 +646,7 @@ int hda_dsp_probe(struct snd_sof_dev *sdev)
+ 	 */
+ 	if (hda_use_msi && pci_alloc_irq_vectors(pci, 1, 1, PCI_IRQ_MSI) > 0) {
+ 		dev_info(sdev->dev, "use msi interrupt mode\n");
+-		hdev->irq = pci_irq_vector(pci, 0);
+-		/* ipc irq number is the same of hda irq */
+-		sdev->ipc_irq = hdev->irq;
++		sdev->ipc_irq = pci_irq_vector(pci, 0);
+ 		/* initialised to "false" by kzalloc() */
+ 		sdev->msi_enabled = true;
+ 	}
+@@ -616,28 +657,17 @@ int hda_dsp_probe(struct snd_sof_dev *sdev)
+ 		 * in IO-APIC mode, hda->irq and ipc_irq are using the same
+ 		 * irq number of pci->irq
+ 		 */
+-		hdev->irq = pci->irq;
+ 		sdev->ipc_irq = pci->irq;
+ 	}
+ 
+-	dev_dbg(sdev->dev, "using HDA IRQ %d\n", hdev->irq);
+-	ret = request_threaded_irq(hdev->irq, hda_dsp_stream_interrupt,
+-				   hda_dsp_stream_threaded_handler,
+-				   IRQF_SHARED, "AudioHDA", bus);
+-	if (ret < 0) {
+-		dev_err(sdev->dev, "error: failed to register HDA IRQ %d\n",
+-			hdev->irq);
+-		goto free_irq_vector;
+-	}
+-
+ 	dev_dbg(sdev->dev, "using IPC IRQ %d\n", sdev->ipc_irq);
+-	ret = request_threaded_irq(sdev->ipc_irq, hda_dsp_ipc_irq_handler,
+-				   sof_ops(sdev)->irq_thread, IRQF_SHARED,
+-				   "AudioDSP", sdev);
++	ret = request_threaded_irq(sdev->ipc_irq, hda_dsp_interrupt_handler,
++				   hda_dsp_interrupt_thread,
++				   IRQF_SHARED, "AudioDSP", sdev);
+ 	if (ret < 0) {
+ 		dev_err(sdev->dev, "error: failed to register IPC IRQ %d\n",
+ 			sdev->ipc_irq);
+-		goto free_hda_irq;
++		goto free_irq_vector;
+ 	}
+ 
+ 	pci_set_master(pci);
+@@ -668,8 +698,6 @@ int hda_dsp_probe(struct snd_sof_dev *sdev)
+ 
+ free_ipc_irq:
+ 	free_irq(sdev->ipc_irq, sdev);
+-free_hda_irq:
+-	free_irq(hdev->irq, bus);
+ free_irq_vector:
+ 	if (sdev->msi_enabled)
+ 		pci_free_irq_vectors(pci);
+@@ -715,7 +743,6 @@ int hda_dsp_remove(struct snd_sof_dev *sdev)
+ 				SOF_HDA_PPCTL_GPROCEN, 0);
+ 
+ 	free_irq(sdev->ipc_irq, sdev);
+-	free_irq(hda->irq, bus);
+ 	if (sdev->msi_enabled)
+ 		pci_free_irq_vectors(pci);
+ 
+diff --git a/sound/soc/sof/intel/hda.h b/sound/soc/sof/intel/hda.h
+index 18d7e72bf9b72..63df888dddb6c 100644
+--- a/sound/soc/sof/intel/hda.h
++++ b/sound/soc/sof/intel/hda.h
+@@ -43,11 +43,14 @@
+ /* SOF_HDA_GCTL register bist */
+ #define SOF_HDA_GCTL_RESET		BIT(0)
+ 
+-/* SOF_HDA_INCTL and SOF_HDA_INTSTS regs */
++/* SOF_HDA_INCTL regs */
+ #define SOF_HDA_INT_GLOBAL_EN		BIT(31)
+ #define SOF_HDA_INT_CTRL_EN		BIT(30)
+ #define SOF_HDA_INT_ALL_STREAM		0xff
+ 
++/* SOF_HDA_INTSTS regs */
++#define SOF_HDA_INTSTS_GIS		BIT(31)
++
+ #define SOF_HDA_MAX_CAPS		10
+ #define SOF_HDA_CAP_ID_OFF		16
+ #define SOF_HDA_CAP_ID_MASK		GENMASK(SOF_HDA_CAP_ID_OFF + 11,\
+@@ -406,8 +409,6 @@ struct sof_intel_hda_dev {
+ 	/* the maximum number of streams (playback + capture) supported */
+ 	u32 stream_max;
+ 
+-	int irq;
+-
+ 	/* PM related */
+ 	bool l1_support_changed;/* during suspend, is L1SEN changed or not */
+ 
+@@ -511,11 +512,12 @@ int hda_dsp_stream_hw_params(struct snd_sof_dev *sdev,
+ 			     struct snd_pcm_hw_params *params);
+ int hda_dsp_stream_trigger(struct snd_sof_dev *sdev,
+ 			   struct hdac_ext_stream *stream, int cmd);
+-irqreturn_t hda_dsp_stream_interrupt(int irq, void *context);
+ irqreturn_t hda_dsp_stream_threaded_handler(int irq, void *context);
+ int hda_dsp_stream_setup_bdl(struct snd_sof_dev *sdev,
+ 			     struct snd_dma_buffer *dmab,
+ 			     struct hdac_stream *stream);
++bool hda_dsp_check_ipc_irq(struct snd_sof_dev *sdev);
++bool hda_dsp_check_stream_irq(struct snd_sof_dev *sdev);
+ 
+ struct hdac_ext_stream *
+ 	hda_dsp_stream_get(struct snd_sof_dev *sdev, int direction);
+@@ -540,7 +542,6 @@ void hda_dsp_ipc_get_reply(struct snd_sof_dev *sdev);
+ int hda_dsp_ipc_get_mailbox_offset(struct snd_sof_dev *sdev);
+ int hda_dsp_ipc_get_window_offset(struct snd_sof_dev *sdev, u32 id);
+ 
+-irqreturn_t hda_dsp_ipc_irq_handler(int irq, void *context);
+ irqreturn_t hda_dsp_ipc_irq_thread(int irq, void *context);
+ int hda_dsp_ipc_cmd_done(struct snd_sof_dev *sdev, int dir);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/asoc-txx9-remove-unused-rtd-variable.patch b/queue-5.5/asoc-txx9-remove-unused-rtd-variable.patch
new file mode 100644
index 00000000000..f3a5475b5f3
--- /dev/null
+++ b/queue-5.5/asoc-txx9-remove-unused-rtd-variable.patch
@@ -0,0 +1,52 @@
+From 39a48bfb69be294b9f488392fe5812362e86d86a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2020 11:14:22 -0800
+Subject: ASoC: txx9: Remove unused rtd variable
+
+From: Paul Burton <paulburton@kernel.org>
+
+[ Upstream commit ec0f6a4c4a987aa20b2e77e0db2ae555276e45e6 ]
+
+Commit a857e073ffc6 ("ASoC: txx9: txx9aclc: remove snd_pcm_ops") removed
+the last use of the rtd variable but didn't remove its definition,
+leading to the following warning/error for MIPS rbtx49xx_defconfig
+builds:
+
+sound/soc/txx9/txx9aclc.c: In function 'txx9aclc_pcm_hw_params':
+sound/soc/txx9/txx9aclc.c:54:30: error: unused variable 'rtd'
+    [-Werror=unused-variable]
+  struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream);
+                              ^~~
+
+Resolve this by removing the unused variable.
+
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Fixes: a857e073ffc6 ("ASoC: txx9: txx9aclc: remove snd_pcm_ops")
+Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: alsa-devel@alsa-project.org
+Link: https://lore.kernel.org/r/20200109191422.334516-1-paulburton@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/txx9/txx9aclc.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/sound/soc/txx9/txx9aclc.c b/sound/soc/txx9/txx9aclc.c
+index 33c78d33e5a1d..9a55926ebf07b 100644
+--- a/sound/soc/txx9/txx9aclc.c
++++ b/sound/soc/txx9/txx9aclc.c
+@@ -51,7 +51,6 @@ static int txx9aclc_pcm_hw_params(struct snd_soc_component *component,
+ 				  struct snd_pcm_substream *substream,
+ 				  struct snd_pcm_hw_params *params)
+ {
+-	struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream);
+ 	struct snd_pcm_runtime *runtime = substream->runtime;
+ 	struct txx9aclc_dmadata *dmadata = runtime->private_data;
+ 	int ret;
+-- 
+2.20.1
+
diff --git a/queue-5.5/asoc-wm_adsp-correct-cache-handling-of-new-kernel-co.patch b/queue-5.5/asoc-wm_adsp-correct-cache-handling-of-new-kernel-co.patch
new file mode 100644
index 00000000000..b32e8307e51
--- /dev/null
+++ b/queue-5.5/asoc-wm_adsp-correct-cache-handling-of-new-kernel-co.patch
@@ -0,0 +1,218 @@
+From e5e92bdf7cc51273e58eb3299094d30f17bbbe8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2020 16:18:38 +0000
+Subject: ASoC: wm_adsp: Correct cache handling of new kernel control API
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 73ecf1a673d3502dff1445f06675aba65ff20ce7 ]
+
+The recently added API that exposes firmware mixer controls to the
+kernel is missing cache handling and all writes bypass the cache, this
+obviously causes the cache to get out of sync with the hardware. Factor
+out the cache handling into two new helper functions and call those from
+both the normal ALSA control handlers and the new kernel API.
+
+Fixes: eb65ccdb0836 ("ASoC: wm_adsp: Expose mixer control API")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20200114161841.451-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm_adsp.c | 98 ++++++++++++++++++++------------------
+ 1 file changed, 51 insertions(+), 47 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index 2a9b610f6d435..d3d32b501acae 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -1030,8 +1030,8 @@ static int wm_coeff_write_acked_control(struct wm_coeff_ctl *ctl,
+ 	return -ETIMEDOUT;
+ }
+ 
+-static int wm_coeff_write_control(struct wm_coeff_ctl *ctl,
+-				  const void *buf, size_t len)
++static int wm_coeff_write_ctrl_raw(struct wm_coeff_ctl *ctl,
++				   const void *buf, size_t len)
+ {
+ 	struct wm_adsp *dsp = ctl->dsp;
+ 	void *scratch;
+@@ -1061,6 +1061,23 @@ static int wm_coeff_write_control(struct wm_coeff_ctl *ctl,
+ 	return 0;
+ }
+ 
++static int wm_coeff_write_ctrl(struct wm_coeff_ctl *ctl,
++			       const void *buf, size_t len)
++{
++	int ret = 0;
++
++	if (ctl->flags & WMFW_CTL_FLAG_VOLATILE)
++		ret = -EPERM;
++	else if (buf != ctl->cache)
++		memcpy(ctl->cache, buf, len);
++
++	ctl->set = 1;
++	if (ctl->enabled && ctl->dsp->running)
++		ret = wm_coeff_write_ctrl_raw(ctl, buf, len);
++
++	return ret;
++}
++
+ static int wm_coeff_put(struct snd_kcontrol *kctl,
+ 			struct snd_ctl_elem_value *ucontrol)
+ {
+@@ -1071,16 +1088,7 @@ static int wm_coeff_put(struct snd_kcontrol *kctl,
+ 	int ret = 0;
+ 
+ 	mutex_lock(&ctl->dsp->pwr_lock);
+-
+-	if (ctl->flags & WMFW_CTL_FLAG_VOLATILE)
+-		ret = -EPERM;
+-	else
+-		memcpy(ctl->cache, p, ctl->len);
+-
+-	ctl->set = 1;
+-	if (ctl->enabled && ctl->dsp->running)
+-		ret = wm_coeff_write_control(ctl, p, ctl->len);
+-
++	ret = wm_coeff_write_ctrl(ctl, p, ctl->len);
+ 	mutex_unlock(&ctl->dsp->pwr_lock);
+ 
+ 	return ret;
+@@ -1096,15 +1104,10 @@ static int wm_coeff_tlv_put(struct snd_kcontrol *kctl,
+ 
+ 	mutex_lock(&ctl->dsp->pwr_lock);
+ 
+-	if (copy_from_user(ctl->cache, bytes, size)) {
++	if (copy_from_user(ctl->cache, bytes, size))
+ 		ret = -EFAULT;
+-	} else {
+-		ctl->set = 1;
+-		if (ctl->enabled && ctl->dsp->running)
+-			ret = wm_coeff_write_control(ctl, ctl->cache, size);
+-		else if (ctl->flags & WMFW_CTL_FLAG_VOLATILE)
+-			ret = -EPERM;
+-	}
++	else
++		ret = wm_coeff_write_ctrl(ctl, ctl->cache, size);
+ 
+ 	mutex_unlock(&ctl->dsp->pwr_lock);
+ 
+@@ -1135,8 +1138,8 @@ static int wm_coeff_put_acked(struct snd_kcontrol *kctl,
+ 	return ret;
+ }
+ 
+-static int wm_coeff_read_control(struct wm_coeff_ctl *ctl,
+-				 void *buf, size_t len)
++static int wm_coeff_read_ctrl_raw(struct wm_coeff_ctl *ctl,
++				  void *buf, size_t len)
+ {
+ 	struct wm_adsp *dsp = ctl->dsp;
+ 	void *scratch;
+@@ -1166,29 +1169,37 @@ static int wm_coeff_read_control(struct wm_coeff_ctl *ctl,
+ 	return 0;
+ }
+ 
+-static int wm_coeff_get(struct snd_kcontrol *kctl,
+-			struct snd_ctl_elem_value *ucontrol)
++static int wm_coeff_read_ctrl(struct wm_coeff_ctl *ctl, void *buf, size_t len)
+ {
+-	struct soc_bytes_ext *bytes_ext =
+-		(struct soc_bytes_ext *)kctl->private_value;
+-	struct wm_coeff_ctl *ctl = bytes_ext_to_ctl(bytes_ext);
+-	char *p = ucontrol->value.bytes.data;
+ 	int ret = 0;
+ 
+-	mutex_lock(&ctl->dsp->pwr_lock);
+-
+ 	if (ctl->flags & WMFW_CTL_FLAG_VOLATILE) {
+ 		if (ctl->enabled && ctl->dsp->running)
+-			ret = wm_coeff_read_control(ctl, p, ctl->len);
++			return wm_coeff_read_ctrl_raw(ctl, buf, len);
+ 		else
+-			ret = -EPERM;
++			return -EPERM;
+ 	} else {
+ 		if (!ctl->flags && ctl->enabled && ctl->dsp->running)
+-			ret = wm_coeff_read_control(ctl, ctl->cache, ctl->len);
++			ret = wm_coeff_read_ctrl_raw(ctl, ctl->cache, ctl->len);
+ 
+-		memcpy(p, ctl->cache, ctl->len);
++		if (buf != ctl->cache)
++			memcpy(buf, ctl->cache, len);
+ 	}
+ 
++	return ret;
++}
++
++static int wm_coeff_get(struct snd_kcontrol *kctl,
++			struct snd_ctl_elem_value *ucontrol)
++{
++	struct soc_bytes_ext *bytes_ext =
++		(struct soc_bytes_ext *)kctl->private_value;
++	struct wm_coeff_ctl *ctl = bytes_ext_to_ctl(bytes_ext);
++	char *p = ucontrol->value.bytes.data;
++	int ret;
++
++	mutex_lock(&ctl->dsp->pwr_lock);
++	ret = wm_coeff_read_ctrl(ctl, p, ctl->len);
+ 	mutex_unlock(&ctl->dsp->pwr_lock);
+ 
+ 	return ret;
+@@ -1204,15 +1215,7 @@ static int wm_coeff_tlv_get(struct snd_kcontrol *kctl,
+ 
+ 	mutex_lock(&ctl->dsp->pwr_lock);
+ 
+-	if (ctl->flags & WMFW_CTL_FLAG_VOLATILE) {
+-		if (ctl->enabled && ctl->dsp->running)
+-			ret = wm_coeff_read_control(ctl, ctl->cache, size);
+-		else
+-			ret = -EPERM;
+-	} else {
+-		if (!ctl->flags && ctl->enabled && ctl->dsp->running)
+-			ret = wm_coeff_read_control(ctl, ctl->cache, size);
+-	}
++	ret = wm_coeff_read_ctrl_raw(ctl, ctl->cache, size);
+ 
+ 	if (!ret && copy_to_user(bytes, ctl->cache, size))
+ 		ret = -EFAULT;
+@@ -1340,7 +1343,7 @@ static int wm_coeff_init_control_caches(struct wm_adsp *dsp)
+ 		 * created so we don't need to do anything.
+ 		 */
+ 		if (!ctl->flags || (ctl->flags & WMFW_CTL_FLAG_READABLE)) {
+-			ret = wm_coeff_read_control(ctl, ctl->cache, ctl->len);
++			ret = wm_coeff_read_ctrl_raw(ctl, ctl->cache, ctl->len);
+ 			if (ret < 0)
+ 				return ret;
+ 		}
+@@ -1358,7 +1361,8 @@ static int wm_coeff_sync_controls(struct wm_adsp *dsp)
+ 		if (!ctl->enabled)
+ 			continue;
+ 		if (ctl->set && !(ctl->flags & WMFW_CTL_FLAG_VOLATILE)) {
+-			ret = wm_coeff_write_control(ctl, ctl->cache, ctl->len);
++			ret = wm_coeff_write_ctrl_raw(ctl, ctl->cache,
++						      ctl->len);
+ 			if (ret < 0)
+ 				return ret;
+ 		}
+@@ -2048,7 +2052,7 @@ int wm_adsp_write_ctl(struct wm_adsp *dsp, const char *name, int type,
+ 	if (len > ctl->len)
+ 		return -EINVAL;
+ 
+-	ret = wm_coeff_write_control(ctl, buf, len);
++	ret = wm_coeff_write_ctrl(ctl, buf, len);
+ 
+ 	kcontrol = snd_soc_card_get_kcontrol(dsp->component->card, ctl->name);
+ 	snd_ctl_notify(dsp->component->card->snd_card,
+@@ -2070,7 +2074,7 @@ int wm_adsp_read_ctl(struct wm_adsp *dsp, const char *name, int type,
+ 	if (len > ctl->len)
+ 		return -EINVAL;
+ 
+-	return wm_coeff_read_control(ctl, buf, len);
++	return wm_coeff_read_ctrl(ctl, buf, len);
+ }
+ EXPORT_SYMBOL_GPL(wm_adsp_read_ctl);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/ath10k-correct-the-dma-direction-for-management-tx-b.patch b/queue-5.5/ath10k-correct-the-dma-direction-for-management-tx-b.patch
new file mode 100644
index 00000000000..13af416ae04
--- /dev/null
+++ b/queue-5.5/ath10k-correct-the-dma-direction-for-management-tx-b.patch
@@ -0,0 +1,57 @@
+From aa121e67f56913b2175a539f09f1ec95af9b3065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 12:42:28 +0530
+Subject: ath10k: Correct the DMA direction for management tx buffers
+
+From: Rakesh Pillai <pillair@codeaurora.org>
+
+[ Upstream commit 6ba8b3b6bd772f575f7736c8fd893c6981fcce16 ]
+
+The management packets, send to firmware via WMI, are
+mapped using the direction DMA_TO_DEVICE. Currently in
+case of wmi cleanup, these buffers are being unmapped
+using an incorrect DMA direction. This can cause unwanted
+behavior when the host driver is handling a restart
+of the wlan firmware.
+
+We might see a trace like below
+
+[<ffffff8008098b18>] __dma_inv_area+0x28/0x58
+[<ffffff8001176734>] ath10k_wmi_mgmt_tx_clean_up_pending+0x60/0xb0 [ath10k_core]
+[<ffffff80088c7c50>] idr_for_each+0x78/0xe4
+[<ffffff80011766a4>] ath10k_wmi_detach+0x4c/0x7c [ath10k_core]
+[<ffffff8001163d7c>] ath10k_core_stop+0x58/0x68 [ath10k_core]
+[<ffffff800114fb74>] ath10k_halt+0xec/0x13c [ath10k_core]
+[<ffffff8001165110>] ath10k_core_restart+0x11c/0x1a8 [ath10k_core]
+[<ffffff80080c36bc>] process_one_work+0x16c/0x31c
+
+Fix the incorrect DMA direction during the wmi
+management tx buffer cleanup.
+
+Tested HW: WCN3990
+Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1
+
+Fixes: dc405152bb6 ("ath10k: handle mgmt tx completion event")
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 9f564e2b7a148..214d65108b294 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -9476,7 +9476,7 @@ static int ath10k_wmi_mgmt_tx_clean_up_pending(int msdu_id, void *ptr,
+ 
+ 	msdu = pkt_addr->vaddr;
+ 	dma_unmap_single(ar->dev, pkt_addr->paddr,
+-			 msdu->len, DMA_FROM_DEVICE);
++			 msdu->len, DMA_TO_DEVICE);
+ 	ieee80211_free_txskb(ar->hw, msdu);
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.5/ath10k-correct-the-tlv-len-of-ath10k_wmi_tlv_op_gen_.patch b/queue-5.5/ath10k-correct-the-tlv-len-of-ath10k_wmi_tlv_op_gen_.patch
new file mode 100644
index 00000000000..af46db996f8
--- /dev/null
+++ b/queue-5.5/ath10k-correct-the-tlv-len-of-ath10k_wmi_tlv_op_gen_.patch
@@ -0,0 +1,53 @@
+From a22e69cb78743cddbb815eccd48a9356f326df5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 09:21:32 +0200
+Subject: ath10k: correct the tlv len of ath10k_wmi_tlv_op_gen_config_pno_start
+
+From: Wen Gong <wgong@codeaurora.org>
+
+[ Upstream commit e01cc82c4d1ec3bddcbb7cd991cf5dc0131ed9a1 ]
+
+the tlv len is set to the total len of the wmi cmd, it will trigger
+firmware crash, correct the tlv len.
+
+Tested with QCA6174 SDIO with firmware
+WLAN.RMH.4.4.1-00017-QCARMSWP-1 and QCA6174
+PCIE with firmware WLAN.RM.4.4.1-00110-QCARMSWPZ-1.
+
+Fixes: ce834e280f2f875 ("ath10k: support NET_DETECT WoWLAN feature")
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index 69a1ec53df294..7b358484940ec 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -3707,6 +3707,7 @@ ath10k_wmi_tlv_op_gen_config_pno_start(struct ath10k *ar,
+ 	struct wmi_tlv *tlv;
+ 	struct sk_buff *skb;
+ 	__le32 *channel_list;
++	u16 tlv_len;
+ 	size_t len;
+ 	void *ptr;
+ 	u32 i;
+@@ -3764,10 +3765,12 @@ ath10k_wmi_tlv_op_gen_config_pno_start(struct ath10k *ar,
+ 	/* nlo_configured_parameters(nlo_list) */
+ 	cmd->no_of_ssids = __cpu_to_le32(min_t(u8, pno->uc_networks_count,
+ 					       WMI_NLO_MAX_SSIDS));
++	tlv_len = __le32_to_cpu(cmd->no_of_ssids) *
++		sizeof(struct nlo_configured_parameters);
+ 
+ 	tlv = ptr;
+ 	tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+-	tlv->len = __cpu_to_le16(len);
++	tlv->len = __cpu_to_le16(tlv_len);
+ 
+ 	ptr += sizeof(*tlv);
+ 	nlo_list = ptr;
+-- 
+2.20.1
+
diff --git a/queue-5.5/ath10k-fix-qmi-init-error-handling.patch b/queue-5.5/ath10k-fix-qmi-init-error-handling.patch
new file mode 100644
index 00000000000..6c61d08ae96
--- /dev/null
+++ b/queue-5.5/ath10k-fix-qmi-init-error-handling.patch
@@ -0,0 +1,49 @@
+From 06363e8dfffb7bb3e13450feb0ff6da411c7b969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 07:40:16 -0800
+Subject: ath10k: Fix qmi init error handling
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit f8a595a87e93a33a10879f4b856be818d2f53c84 ]
+
+When ath10k_qmi_init() fails, the error handling does not free the irq
+resources, which causes an issue if we EPROBE_DEFER as we'll attempt to
+(re-)register irqs which are already registered.
+
+Fix this by doing a power off since we just powered on the hardware, and
+freeing the irqs as error handling.
+
+Fixes: ba94c753ccb4 ("ath10k: add QMI message handshake for wcn3990 client")
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/snoc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c
+index 16177497bba76..7e85c4916e7f5 100644
+--- a/drivers/net/wireless/ath/ath10k/snoc.c
++++ b/drivers/net/wireless/ath/ath10k/snoc.c
+@@ -1563,13 +1563,16 @@ static int ath10k_snoc_probe(struct platform_device *pdev)
+ 	ret = ath10k_qmi_init(ar, msa_size);
+ 	if (ret) {
+ 		ath10k_warn(ar, "failed to register wlfw qmi client: %d\n", ret);
+-		goto err_core_destroy;
++		goto err_power_off;
+ 	}
+ 
+ 	ath10k_dbg(ar, ATH10K_DBG_SNOC, "snoc probe\n");
+ 
+ 	return 0;
+ 
++err_power_off:
++	ath10k_hw_power_off(ar);
++
+ err_free_irq:
+ 	ath10k_snoc_free_irq(ar);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/b43legacy-fix-wcast-function-type.patch b/queue-5.5/b43legacy-fix-wcast-function-type.patch
new file mode 100644
index 00000000000..6e6dbef93b7
--- /dev/null
+++ b/queue-5.5/b43legacy-fix-wcast-function-type.patch
@@ -0,0 +1,48 @@
+From 4e2a24941c634d963efc547920e16bb4119def02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:26 +0700
+Subject: b43legacy: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit 475eec112e4267232d10f4afe2f939a241692b6c ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43legacy/main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c
+index 4325e91736eb3..8b6b657c4b85b 100644
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -1275,8 +1275,9 @@ static void handle_irq_ucode_debug(struct b43legacy_wldev *dev)
+ }
+ 
+ /* Interrupt handler bottom-half */
+-static void b43legacy_interrupt_tasklet(struct b43legacy_wldev *dev)
++static void b43legacy_interrupt_tasklet(unsigned long data)
+ {
++	struct b43legacy_wldev *dev = (struct b43legacy_wldev *)data;
+ 	u32 reason;
+ 	u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
+ 	u32 merged_dma_reason = 0;
+@@ -3741,7 +3742,7 @@ static int b43legacy_one_core_attach(struct ssb_device *dev,
+ 	b43legacy_set_status(wldev, B43legacy_STAT_UNINIT);
+ 	wldev->bad_frames_preempt = modparam_bad_frames_preempt;
+ 	tasklet_init(&wldev->isr_tasklet,
+-		     (void (*)(unsigned long))b43legacy_interrupt_tasklet,
++		     b43legacy_interrupt_tasklet,
+ 		     (unsigned long)wldev);
+ 	if (modparam_pio)
+ 		wldev->__using_pio = true;
+-- 
+2.20.1
+
diff --git a/queue-5.5/backlight-qcom-wled-fix-unsigned-comparison-to-zero.patch b/queue-5.5/backlight-qcom-wled-fix-unsigned-comparison-to-zero.patch
new file mode 100644
index 00000000000..830293ab439
--- /dev/null
+++ b/queue-5.5/backlight-qcom-wled-fix-unsigned-comparison-to-zero.patch
@@ -0,0 +1,45 @@
+From e5a75dc4176d71e56924cd78a50ed3a074d35549 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 09:32:40 +0800
+Subject: backlight: qcom-wled: Fix unsigned comparison to zero
+
+From: Chen Zhou <chenzhou10@huawei.com>
+
+[ Upstream commit 7af43a76695db71a57203793fb9dd3c81a5783b1 ]
+
+Fixes coccicheck warning:
+./drivers/video/backlight/qcom-wled.c:1104:5-15:
+	WARNING: Unsigned expression compared with zero: string_len > 0
+
+The unsigned variable string_len is assigned a return value from the call
+to of_property_count_elems_of_size(), which may return negative error code.
+
+Fixes: 775d2ffb4af6 ("backlight: qcom-wled: Restructure the driver for WLED3")
+Signed-off-by: Chen Zhou <chenzhou10@huawei.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
+Reviewed-by: Kiran Gunda <kgunda@codeaurora.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/qcom-wled.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
+index d46052d8ff415..3d276b30a78c9 100644
+--- a/drivers/video/backlight/qcom-wled.c
++++ b/drivers/video/backlight/qcom-wled.c
+@@ -956,8 +956,8 @@ static int wled_configure(struct wled *wled, int version)
+ 	struct wled_config *cfg = &wled->cfg;
+ 	struct device *dev = wled->dev;
+ 	const __be32 *prop_addr;
+-	u32 size, val, c, string_len;
+-	int rc, i, j;
++	u32 size, val, c;
++	int rc, i, j, string_len;
+ 
+ 	const struct wled_u32_opts *u32_opts = NULL;
+ 	const struct wled_u32_opts wled3_opts[] = {
+-- 
+2.20.1
+
diff --git a/queue-5.5/bcache-cached_dev_free-needs-to-put-the-sb-page.patch b/queue-5.5/bcache-cached_dev_free-needs-to-put-the-sb-page.patch
new file mode 100644
index 00000000000..5c4ed162eb2
--- /dev/null
+++ b/queue-5.5/bcache-cached_dev_free-needs-to-put-the-sb-page.patch
@@ -0,0 +1,39 @@
+From cb3c5e1a74aaab89c3df5cc31e6eb5400b5774a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 01:01:26 +0800
+Subject: bcache: cached_dev_free needs to put the sb page
+
+From: Liang Chen <liangchen.linux@gmail.com>
+
+[ Upstream commit e8547d42095e58bee658f00fef8e33d2a185c927 ]
+
+Same as cache device, the buffer page needs to be put while
+freeing cached_dev.  Otherwise a page would be leaked every
+time a cached_dev is stopped.
+
+Signed-off-by: Liang Chen <liangchen.linux@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 77e9869345e70..a573ce1d85aae 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1275,6 +1275,9 @@ static void cached_dev_free(struct closure *cl)
+ 
+ 	mutex_unlock(&bch_register_lock);
+ 
++	if (dc->sb_bio.bi_inline_vecs[0].bv_page)
++		put_page(bio_first_page_all(&dc->sb_bio));
++
+ 	if (!IS_ERR_OR_NULL(dc->bdev))
+ 		blkdev_put(dc->bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/bcache-explicity-type-cast-in-bset_bkey_last.patch b/queue-5.5/bcache-explicity-type-cast-in-bset_bkey_last.patch
new file mode 100644
index 00000000000..ca29bf3dedf
--- /dev/null
+++ b/queue-5.5/bcache-explicity-type-cast-in-bset_bkey_last.patch
@@ -0,0 +1,52 @@
+From 8308acdb29dc5304c54c0095c21c549714ec44f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2020 22:42:32 +0800
+Subject: bcache: explicity type cast in bset_bkey_last()
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit 7c02b0055f774ed9afb6e1c7724f33bf148ffdc0 ]
+
+In bset.h, macro bset_bkey_last() is defined as,
+    bkey_idx((struct bkey *) (i)->d, (i)->keys)
+
+Parameter i can be variable type of data structure, the macro always
+works once the type of struct i has member 'd' and 'keys'.
+
+bset_bkey_last() is also used in macro csum_set() to calculate the
+checksum of a on-disk data structure. When csum_set() is used to
+calculate checksum of on-disk bcache super block, the parameter 'i'
+data type is struct cache_sb_disk. Inside struct cache_sb_disk (also in
+struct cache_sb) the member keys is __u16 type. But bkey_idx() expects
+unsigned int (a 32bit width), so there is problem when sending
+parameters via stack to call bkey_idx().
+
+Sparse tool from Intel 0day kbuild system reports this incompatible
+problem. bkey_idx() is part of user space API, so the simplest fix is
+to cast the (i)->keys to unsigned int type in macro bset_bkey_last().
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/bset.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h
+index c71365e7c1fac..a50dcfda656f5 100644
+--- a/drivers/md/bcache/bset.h
++++ b/drivers/md/bcache/bset.h
+@@ -397,7 +397,8 @@ void bch_btree_keys_stats(struct btree_keys *b, struct bset_stats *state);
+ 
+ /* Bkey utility code */
+ 
+-#define bset_bkey_last(i)	bkey_idx((struct bkey *) (i)->d, (i)->keys)
++#define bset_bkey_last(i)	bkey_idx((struct bkey *) (i)->d, \
++					 (unsigned int)(i)->keys)
+ 
+ static inline struct bkey *bset_bkey_idx(struct bset *i, unsigned int idx)
+ {
+-- 
+2.20.1
+
diff --git a/queue-5.5/bcache-fix-incorrect-data-type-usage-in-btree_flush_.patch b/queue-5.5/bcache-fix-incorrect-data-type-usage-in-btree_flush_.patch
new file mode 100644
index 00000000000..6cb504b5843
--- /dev/null
+++ b/queue-5.5/bcache-fix-incorrect-data-type-usage-in-btree_flush_.patch
@@ -0,0 +1,87 @@
+From 185bb77cc74be2fb110a46488a1a36d5ab4d15dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2020 22:42:34 +0800
+Subject: bcache: fix incorrect data type usage in btree_flush_write()
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit d1c3cc34f5a78b38d2b809b289d912c3560545df ]
+
+Dan Carpenter points out that from commit 2aa8c529387c ("bcache: avoid
+unnecessary btree nodes flushing in btree_flush_write()"), there is a
+incorrect data type usage which leads to the following static checker
+warning:
+	drivers/md/bcache/journal.c:444 btree_flush_write()
+	warn: 'ref_nr' unsigned <= 0
+
+drivers/md/bcache/journal.c
+   422  static void btree_flush_write(struct cache_set *c)
+   423  {
+   424          struct btree *b, *t, *btree_nodes[BTREE_FLUSH_NR];
+   425          unsigned int i, nr, ref_nr;
+                                    ^^^^^^
+
+   426          atomic_t *fifo_front_p, *now_fifo_front_p;
+   427          size_t mask;
+   428
+   429          if (c->journal.btree_flushing)
+   430                  return;
+   431
+   432          spin_lock(&c->journal.flush_write_lock);
+   433          if (c->journal.btree_flushing) {
+   434                  spin_unlock(&c->journal.flush_write_lock);
+   435                  return;
+   436          }
+   437          c->journal.btree_flushing = true;
+   438          spin_unlock(&c->journal.flush_write_lock);
+   439
+   440          /* get the oldest journal entry and check its refcount */
+   441          spin_lock(&c->journal.lock);
+   442          fifo_front_p = &fifo_front(&c->journal.pin);
+   443          ref_nr = atomic_read(fifo_front_p);
+   444          if (ref_nr <= 0) {
+                    ^^^^^^^^^^^
+Unsigned can't be less than zero.
+
+   445                  /*
+   446                   * do nothing if no btree node references
+   447                   * the oldest journal entry
+   448                   */
+   449                  spin_unlock(&c->journal.lock);
+   450                  goto out;
+   451          }
+   452          spin_unlock(&c->journal.lock);
+
+As the warning information indicates, local varaible ref_nr in unsigned
+int type is wrong, which does not matche atomic_read() and the "<= 0"
+checking.
+
+This patch fixes the above error by defining local variable ref_nr as
+int type.
+
+Fixes: 2aa8c529387c ("bcache: avoid unnecessary btree nodes flushing in btree_flush_write()")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/journal.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 33ddc5269e8dc..6730820780b06 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -422,7 +422,8 @@ err:
+ static void btree_flush_write(struct cache_set *c)
+ {
+ 	struct btree *b, *t, *btree_nodes[BTREE_FLUSH_NR];
+-	unsigned int i, nr, ref_nr;
++	unsigned int i, nr;
++	int ref_nr;
+ 	atomic_t *fifo_front_p, *now_fifo_front_p;
+ 	size_t mask;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/bcache-fix-memory-corruption-in-bch_cache_accounting.patch b/queue-5.5/bcache-fix-memory-corruption-in-bch_cache_accounting.patch
new file mode 100644
index 00000000000..7dc583dd971
--- /dev/null
+++ b/queue-5.5/bcache-fix-memory-corruption-in-bch_cache_accounting.patch
@@ -0,0 +1,164 @@
+From 2138fb4faffd478bc1ce069cccd6d9fd188cd8b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2020 22:42:31 +0800
+Subject: bcache: fix memory corruption in bch_cache_accounting_clear()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit 5bebf7486d4f4940b2a8e4009beb1dff5041853d ]
+
+Commit 83ff9318c44ba ("bcache: not use hard coded memset size in
+bch_cache_accounting_clear()") tries to make the code more easy to
+understand by removing the hard coded number with following change,
+	void bch_cache_accounting_clear(...)
+	{
+		memset(&acc->total.cache_hits,
+			0,
+	-		sizeof(unsigned long) * 7);
+	+		sizeof(struct cache_stats));
+	}
+
+Unfortunately the change was wrong (it also tells us the original code
+was not easy to correctly understand). The hard coded number 7 is used
+because in struct cache_stats,
+ 15 struct cache_stats {
+ 16         struct kobject          kobj;
+ 17
+ 18         unsigned long cache_hits;
+ 19         unsigned long cache_misses;
+ 20         unsigned long cache_bypass_hits;
+ 21         unsigned long cache_bypass_misses;
+ 22         unsigned long cache_readaheads;
+ 23         unsigned long cache_miss_collisions;
+ 24         unsigned long sectors_bypassed;
+ 25
+ 26         unsigned int            rescale;
+ 27 };
+only members in LINE 18-24 want to be set to 0. It is wrong to use
+'sizeof(struct cache_stats)' to replace 'sizeof(unsigned long) * 7), the
+memory objects behind acc->total is staled by this change.
+
+Сорокин Артем Сергеевич reports that by the following steps, kernel
+panic will be triggered,
+1. Create new set: make-bcache -B /dev/nvme1n1 -C /dev/sda --wipe-bcache
+2. Run in /sys/fs/bcache/<uuid>:
+   echo 1 > clear_stats && cat stats_five_minute/cache_bypass_hits
+
+I can reproduce the panic and get following dmesg with KASAN enabled,
+[22613.172742] ==================================================================
+[22613.172862] BUG: KASAN: null-ptr-deref in sysfs_kf_seq_show+0x117/0x230
+[22613.172864] Read of size 8 at addr 0000000000000000 by task cat/6753
+
+[22613.172870] CPU: 1 PID: 6753 Comm: cat Not tainted 5.5.0-rc7-lp151.28.16-default+ #11
+[22613.172872] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019
+[22613.172873] Call Trace:
+[22613.172964]  dump_stack+0x8b/0xbb
+[22613.172968]  ? sysfs_kf_seq_show+0x117/0x230
+[22613.172970]  ? sysfs_kf_seq_show+0x117/0x230
+[22613.173031]  __kasan_report+0x176/0x192
+[22613.173064]  ? pr_cont_kernfs_name+0x40/0x60
+[22613.173067]  ? sysfs_kf_seq_show+0x117/0x230
+[22613.173070]  kasan_report+0xe/0x20
+[22613.173072]  sysfs_kf_seq_show+0x117/0x230
+[22613.173105]  seq_read+0x199/0x6d0
+[22613.173110]  vfs_read+0xa5/0x1a0
+[22613.173113]  ksys_read+0x110/0x160
+[22613.173115]  ? kernel_write+0xb0/0xb0
+[22613.173177]  do_syscall_64+0x77/0x290
+[22613.173238]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[22613.173241] RIP: 0033:0x7fc2c886ac61
+[22613.173244] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89
+[22613.173245] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+[22613.173248] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61
+[22613.173249] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003
+[22613.173250] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000
+[22613.173251] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000
+[22613.173253] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000
+[22613.173255] ==================================================================
+[22613.173256] Disabling lock debugging due to kernel taint
+[22613.173350] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[22613.178380] #PF: supervisor read access in kernel mode
+[22613.180959] #PF: error_code(0x0000) - not-present page
+[22613.183444] PGD 0 P4D 0
+[22613.184867] Oops: 0000 [#1] SMP KASAN PTI
+[22613.186797] CPU: 1 PID: 6753 Comm: cat Tainted: G    B             5.5.0-rc7-lp151.28.16-default+ #11
+[22613.191253] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019
+[22613.196706] RIP: 0010:sysfs_kf_seq_show+0x117/0x230
+[22613.199097] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48
+[22613.208016] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246
+[22613.210448] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6
+[22613.213691] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246
+[22613.216893] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd
+[22613.220075] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200
+[22613.223256] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000
+[22613.226290] FS:  00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000
+[22613.229637] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[22613.231993] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0
+[22613.234909] Call Trace:
+[22613.235931]  seq_read+0x199/0x6d0
+[22613.237259]  vfs_read+0xa5/0x1a0
+[22613.239229]  ksys_read+0x110/0x160
+[22613.240590]  ? kernel_write+0xb0/0xb0
+[22613.242040]  do_syscall_64+0x77/0x290
+[22613.243625]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[22613.245450] RIP: 0033:0x7fc2c886ac61
+[22613.246706] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89
+[22613.253296] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+[22613.255835] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61
+[22613.258472] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003
+[22613.260807] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000
+[22613.263188] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000
+[22613.265598] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000
+[22613.268729] Modules linked in: scsi_transport_iscsi af_packet iscsi_ibft iscsi_boot_sysfs vmw_vsock_vmci_transport vsock fuse bnep kvm_intel kvm irqbypass crc32_pclmul crc32c_intel ghash_clmulni_intel snd_ens1371 snd_ac97_codec ac97_bus bcache snd_pcm btusb btrtl btbcm btintel crc64 aesni_intel glue_helper crypto_simd vmw_balloon cryptd bluetooth snd_timer snd_rawmidi snd joydev pcspkr e1000 rfkill vmw_vmci soundcore ecdh_generic ecc gameport i2c_piix4 mptctl ac button hid_generic usbhid sr_mod cdrom ata_generic ehci_pci vmwgfx uhci_hcd drm_kms_helper syscopyarea serio_raw sysfillrect sysimgblt fb_sys_fops ttm ehci_hcd mptspi scsi_transport_spi mptscsih ata_piix mptbase ahci usbcore libahci drm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua
+[22613.292429] CR2: 0000000000000000
+[22613.293563] ---[ end trace a074b26a8508f378 ]---
+[22613.295138] RIP: 0010:sysfs_kf_seq_show+0x117/0x230
+[22613.296769] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48
+[22613.303553] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246
+[22613.305280] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6
+[22613.307924] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246
+[22613.310272] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd
+[22613.312685] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200
+[22613.315076] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000
+[22613.318116] FS:  00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000
+[22613.320743] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[22613.322628] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0
+
+Here this patch fixes the following problem by explicity set all the 7
+members to 0 in bch_cache_accounting_clear().
+
+Reported-by: Сорокин Артем Сергеевич <a.sorokin@bank-hlynov.ru>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/stats.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/bcache/stats.c b/drivers/md/bcache/stats.c
+index ba1c93791d8db..503aafe188dce 100644
+--- a/drivers/md/bcache/stats.c
++++ b/drivers/md/bcache/stats.c
+@@ -109,9 +109,13 @@ int bch_cache_accounting_add_kobjs(struct cache_accounting *acc,
+ 
+ void bch_cache_accounting_clear(struct cache_accounting *acc)
+ {
+-	memset(&acc->total.cache_hits,
+-	       0,
+-	       sizeof(struct cache_stats));
++	acc->total.cache_hits = 0;
++	acc->total.cache_misses = 0;
++	acc->total.cache_bypass_hits = 0;
++	acc->total.cache_bypass_misses = 0;
++	acc->total.cache_readaheads = 0;
++	acc->total.cache_miss_collisions = 0;
++	acc->total.sectors_bypassed = 0;
+ }
+ 
+ void bch_cache_accounting_destroy(struct cache_accounting *acc)
+-- 
+2.20.1
+
diff --git a/queue-5.5/bcache-fix-use-after-free-in-register_bcache.patch b/queue-5.5/bcache-fix-use-after-free-in-register_bcache.patch
new file mode 100644
index 00000000000..463eb673826
--- /dev/null
+++ b/queue-5.5/bcache-fix-use-after-free-in-register_bcache.patch
@@ -0,0 +1,53 @@
+From 3dbe38b7fcae93b953029dc89e534cd92bfa908b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 01:01:30 +0800
+Subject: bcache: fix use-after-free in register_bcache()
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit ae3cd299919af6eb670d5af0bc9d7ba14086bd8e ]
+
+The patch "bcache: rework error unwinding in register_bcache" introduces
+a use-after-free regression in register_bcache(). Here are current code,
+	2510 out_free_path:
+	2511         kfree(path);
+	2512 out_module_put:
+	2513         module_put(THIS_MODULE);
+	2514 out:
+	2515         pr_info("error %s: %s", path, err);
+	2516         return ret;
+If some error happens and the above code path is executed, at line 2511
+path is released, but referenced at line 2515. Then KASAN reports a use-
+after-free error message.
+
+This patch changes line 2515 in the following way to fix the problem,
+	2515         pr_info("error %s: %s", path?path:"", err);
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index bd2ae1d78fe15..05cb94664efee 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2475,10 +2475,11 @@ out_free_sb:
+ 	kfree(sb);
+ out_free_path:
+ 	kfree(path);
++	path = NULL;
+ out_module_put:
+ 	module_put(THIS_MODULE);
+ out:
+-	pr_info("error %s: %s", path, err);
++	pr_info("error %s: %s", path?path:"", err);
+ 	return ret;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/bcache-properly-initialize-path-and-err-in-register_.patch b/queue-5.5/bcache-properly-initialize-path-and-err-in-register_.patch
new file mode 100644
index 00000000000..f73cba49891
--- /dev/null
+++ b/queue-5.5/bcache-properly-initialize-path-and-err-in-register_.patch
@@ -0,0 +1,60 @@
+From 95f921371c9c9c1c9ce5ba033861198a79ea5357 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 01:01:29 +0800
+Subject: bcache: properly initialize 'path' and 'err' in register_bcache()
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit 29cda393bcaad160c4bf3676ddd99855adafc72f ]
+
+Patch "bcache: rework error unwinding in register_bcache" from
+Christoph Hellwig changes the local variables 'path' and 'err'
+in undefined initial state. If the code in register_bcache() jumps
+to label 'out:' or 'out_module_put:' by goto, these two variables
+might be reference with undefined value by the following line,
+
+	out_module_put:
+	        module_put(THIS_MODULE);
+	out:
+	        pr_info("error %s: %s", path, err);
+	        return ret;
+
+Therefore this patch initializes these two local variables properly
+in register_bcache() to avoid such issue.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 05cb94664efee..3b3724285d907 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2376,18 +2376,20 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ 			       const char *buffer, size_t size)
+ {
+ 	const char *err;
+-	char *path;
++	char *path = NULL;
+ 	struct cache_sb *sb;
+ 	struct block_device *bdev = NULL;
+ 	struct page *sb_page;
+ 	ssize_t ret;
+ 
+ 	ret = -EBUSY;
++	err = "failed to reference bcache module";
+ 	if (!try_module_get(THIS_MODULE))
+ 		goto out;
+ 
+ 	/* For latest state of bcache_is_reboot */
+ 	smp_mb();
++	err = "bcache is in reboot";
+ 	if (bcache_is_reboot)
+ 		goto out_module_put;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/bcache-rework-error-unwinding-in-register_bcache.patch b/queue-5.5/bcache-rework-error-unwinding-in-register_bcache.patch
new file mode 100644
index 00000000000..27ca0edee72
--- /dev/null
+++ b/queue-5.5/bcache-rework-error-unwinding-in-register_bcache.patch
@@ -0,0 +1,162 @@
+From cda2c3e3ab3e2b149c8e746a3280266e83820ce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 01:01:28 +0800
+Subject: bcache: rework error unwinding in register_bcache
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 50246693f81fe887f4db78bf7089051d7f1894cc ]
+
+Split the successful and error return path, and use one goto label for each
+resource to unwind.  This also fixes some small errors like leaking the
+module reference count in the reboot case (which seems entirely harmless)
+or printing the wrong warning messages for early failures.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 75 +++++++++++++++++++++++----------------
+ 1 file changed, 45 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index a573ce1d85aae..bd2ae1d78fe15 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2375,29 +2375,33 @@ static bool bch_is_open(struct block_device *bdev)
+ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ 			       const char *buffer, size_t size)
+ {
+-	ssize_t ret = -EINVAL;
+-	const char *err = "cannot allocate memory";
+-	char *path = NULL;
+-	struct cache_sb *sb = NULL;
++	const char *err;
++	char *path;
++	struct cache_sb *sb;
+ 	struct block_device *bdev = NULL;
+-	struct page *sb_page = NULL;
++	struct page *sb_page;
++	ssize_t ret;
+ 
++	ret = -EBUSY;
+ 	if (!try_module_get(THIS_MODULE))
+-		return -EBUSY;
++		goto out;
+ 
+ 	/* For latest state of bcache_is_reboot */
+ 	smp_mb();
+ 	if (bcache_is_reboot)
+-		return -EBUSY;
++		goto out_module_put;
+ 
++	ret = -ENOMEM;
++	err = "cannot allocate memory";
+ 	path = kstrndup(buffer, size, GFP_KERNEL);
+ 	if (!path)
+-		goto err;
++		goto out_module_put;
+ 
+ 	sb = kmalloc(sizeof(struct cache_sb), GFP_KERNEL);
+ 	if (!sb)
+-		goto err;
++		goto out_free_path;
+ 
++	ret = -EINVAL;
+ 	err = "failed to open device";
+ 	bdev = blkdev_get_by_path(strim(path),
+ 				  FMODE_READ|FMODE_WRITE|FMODE_EXCL,
+@@ -2414,57 +2418,68 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ 			if (!IS_ERR(bdev))
+ 				bdput(bdev);
+ 			if (attr == &ksysfs_register_quiet)
+-				goto quiet_out;
++				goto done;
+ 		}
+-		goto err;
++		goto out_free_sb;
+ 	}
+ 
+ 	err = "failed to set blocksize";
+ 	if (set_blocksize(bdev, 4096))
+-		goto err_close;
++		goto out_blkdev_put;
+ 
+ 	err = read_super(sb, bdev, &sb_page);
+ 	if (err)
+-		goto err_close;
++		goto out_blkdev_put;
+ 
+ 	err = "failed to register device";
+ 	if (SB_IS_BDEV(sb)) {
+ 		struct cached_dev *dc = kzalloc(sizeof(*dc), GFP_KERNEL);
+ 
+ 		if (!dc)
+-			goto err_close;
++			goto out_put_sb_page;
+ 
+ 		mutex_lock(&bch_register_lock);
+ 		ret = register_bdev(sb, sb_page, bdev, dc);
+ 		mutex_unlock(&bch_register_lock);
+ 		/* blkdev_put() will be called in cached_dev_free() */
+-		if (ret < 0)
+-			goto err;
++		if (ret < 0) {
++			bdev = NULL;
++			goto out_put_sb_page;
++		}
+ 	} else {
+ 		struct cache *ca = kzalloc(sizeof(*ca), GFP_KERNEL);
+ 
+ 		if (!ca)
+-			goto err_close;
++			goto out_put_sb_page;
+ 
+ 		/* blkdev_put() will be called in bch_cache_release() */
+-		if (register_cache(sb, sb_page, bdev, ca) != 0)
+-			goto err;
++		if (register_cache(sb, sb_page, bdev, ca) != 0) {
++			bdev = NULL;
++			goto out_put_sb_page;
++		}
+ 	}
+-quiet_out:
+-	ret = size;
+-out:
+-	if (sb_page)
+-		put_page(sb_page);
++
++	put_page(sb_page);
++done:
+ 	kfree(sb);
+ 	kfree(path);
+ 	module_put(THIS_MODULE);
+-	return ret;
+-
+-err_close:
+-	blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+-err:
++	return size;
++
++out_put_sb_page:
++	put_page(sb_page);
++out_blkdev_put:
++	if (bdev)
++		blkdev_put(bdev, FMODE_READ | FMODE_WRITE | FMODE_EXCL);
++out_free_sb:
++	kfree(sb);
++out_free_path:
++	kfree(path);
++out_module_put:
++	module_put(THIS_MODULE);
++out:
+ 	pr_info("error %s: %s", path, err);
+-	goto out;
++	return ret;
+ }
+ 
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/block-bfq-do-not-plug-i-o-for-bfq_queues-with-no-pro.patch b/queue-5.5/block-bfq-do-not-plug-i-o-for-bfq_queues-with-no-pro.patch
new file mode 100644
index 00000000000..3a30e02ce9e
--- /dev/null
+++ b/queue-5.5/block-bfq-do-not-plug-i-o-for-bfq_queues-with-no-pro.patch
@@ -0,0 +1,76 @@
+From cfec3b8d4b33e85dbc537e18469fb6964553dc17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 11:40:54 +0100
+Subject: block, bfq: do not plug I/O for bfq_queues with no proc refs
+
+From: Paolo Valente <paolo.valente@linaro.org>
+
+[ Upstream commit f718b093277df582fbf8775548a4f163e664d282 ]
+
+Commit 478de3380c1c ("block, bfq: deschedule empty bfq_queues not
+referred by any process") fixed commit 3726112ec731 ("block, bfq:
+re-schedule empty queues if they deserve I/O plugging") by
+descheduling an empty bfq_queue when it remains with not process
+reference. Yet, this still left a case uncovered: an empty bfq_queue
+with not process reference that remains in service. This happens for
+an in-service sync bfq_queue that is deemed to deserve I/O-dispatch
+plugging when it remains empty. Yet no new requests will arrive for
+such a bfq_queue if no process sends requests to it any longer. Even
+worse, the bfq_queue may happen to be prematurely freed while still in
+service (because there may remain no reference to it any longer).
+
+This commit solves this problem by preventing I/O dispatch from being
+plugged for the in-service bfq_queue, if the latter has no process
+reference (the bfq_queue is then prevented from remaining in service).
+
+Fixes: 3726112ec731 ("block, bfq: re-schedule empty queues if they deserve I/O plugging")
+Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Reported-by: Patrick Dung <patdung100@gmail.com>
+Tested-by: Patrick Dung <patdung100@gmail.com>
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index ad4af4aaf2ced..5c239c540c47a 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -3444,6 +3444,10 @@ static void bfq_dispatch_remove(struct request_queue *q, struct request *rq)
+ static bool idling_needed_for_service_guarantees(struct bfq_data *bfqd,
+ 						 struct bfq_queue *bfqq)
+ {
++	/* No point in idling for bfqq if it won't get requests any longer */
++	if (unlikely(!bfqq_process_refs(bfqq)))
++		return false;
++
+ 	return (bfqq->wr_coeff > 1 &&
+ 		(bfqd->wr_busy_queues <
+ 		 bfq_tot_busy_queues(bfqd) ||
+@@ -4077,6 +4081,10 @@ static bool idling_boosts_thr_without_issues(struct bfq_data *bfqd,
+ 		bfqq_sequential_and_IO_bound,
+ 		idling_boosts_thr;
+ 
++	/* No point in idling for bfqq if it won't get requests any longer */
++	if (unlikely(!bfqq_process_refs(bfqq)))
++		return false;
++
+ 	bfqq_sequential_and_IO_bound = !BFQQ_SEEKY(bfqq) &&
+ 		bfq_bfqq_IO_bound(bfqq) && bfq_bfqq_has_short_ttime(bfqq);
+ 
+@@ -4170,6 +4178,10 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
+ 	struct bfq_data *bfqd = bfqq->bfqd;
+ 	bool idling_boosts_thr_with_no_issue, idling_needed_for_service_guar;
+ 
++	/* No point in idling for bfqq if it won't get requests any longer */
++	if (unlikely(!bfqq_process_refs(bfqq)))
++		return false;
++
+ 	if (unlikely(bfqd->strict_guarantees))
+ 		return true;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/bnxt-detach-page-from-page-pool-before-sending-up-th.patch b/queue-5.5/bnxt-detach-page-from-page-pool-before-sending-up-th.patch
new file mode 100644
index 00000000000..e9b5865d12d
--- /dev/null
+++ b/queue-5.5/bnxt-detach-page-from-page-pool-before-sending-up-th.patch
@@ -0,0 +1,38 @@
+From 82a6ce7d46c44180fa2e964196c279747772d8f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2020 11:35:42 -0800
+Subject: bnxt: Detach page from page pool before sending up the stack
+
+From: Jonathan Lemon <jonathan.lemon@gmail.com>
+
+[ Upstream commit 3071c51783b39d6a676d02a9256c3b3f87804285 ]
+
+When running in XDP mode, pages come from the page pool, and should
+be freed back to the same pool or specifically detached.  Currently,
+when the driver re-initializes, the page pool destruction is delayed
+forever since it thinks there are oustanding pages.
+
+Fixes: 322b87ca55f2 ("bnxt_en: add page_pool support")
+Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 01b603c5e76ad..9d62200b6c335 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -944,6 +944,7 @@ static struct sk_buff *bnxt_rx_page_skb(struct bnxt *bp,
+ 	dma_addr -= bp->rx_dma_offset;
+ 	dma_unmap_page_attrs(&bp->pdev->dev, dma_addr, PAGE_SIZE, bp->rx_dir,
+ 			     DMA_ATTR_WEAK_ORDERING);
++	page_pool_release_page(rxr->page_pool, page);
+ 
+ 	if (unlikely(!payload))
+ 		payload = eth_get_headlen(bp->dev, data_ptr, len);
+-- 
+2.20.1
+
diff --git a/queue-5.5/bpf-btf-always-output-invariant-hit-in-pahole-dwarf-.patch b/queue-5.5/bpf-btf-always-output-invariant-hit-in-pahole-dwarf-.patch
new file mode 100644
index 00000000000..8ba74eaccd0
--- /dev/null
+++ b/queue-5.5/bpf-btf-always-output-invariant-hit-in-pahole-dwarf-.patch
@@ -0,0 +1,61 @@
+From bf9583bcaa6d6f901bb841e710251df763812865 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 00:01:10 +0000
+Subject: bpf, btf: Always output invariant hit in pahole DWARF to BTF
+ transform
+
+From: Chris Down <chris@chrisdown.name>
+
+[ Upstream commit 2a67a6ccb01f21b854715d86ff6432a18b97adb3 ]
+
+When trying to compile with CONFIG_DEBUG_INFO_BTF enabled, I got this
+error:
+
+    % make -s
+    Failed to generate BTF for vmlinux
+    Try to disable CONFIG_DEBUG_INFO_BTF
+    make[3]: *** [vmlinux] Error 1
+
+Compiling again without -s shows the true error (that pahole is
+missing), but since this is fatal, we should show the error
+unconditionally on stderr as well, not silence it using the `info`
+function. With this patch:
+
+    % make -s
+    BTF: .tmp_vmlinux.btf: pahole (pahole) is not available
+    Failed to generate BTF for vmlinux
+    Try to disable CONFIG_DEBUG_INFO_BTF
+    make[3]: *** [vmlinux] Error 1
+
+Signed-off-by: Chris Down <chris@chrisdown.name>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20200122000110.GA310073@chrisdown.name
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/link-vmlinux.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
+index 4363799403561..408b5c0b99b1b 100755
+--- a/scripts/link-vmlinux.sh
++++ b/scripts/link-vmlinux.sh
+@@ -108,13 +108,13 @@ gen_btf()
+ 	local bin_arch
+ 
+ 	if ! [ -x "$(command -v ${PAHOLE})" ]; then
+-		info "BTF" "${1}: pahole (${PAHOLE}) is not available"
++		echo >&2 "BTF: ${1}: pahole (${PAHOLE}) is not available"
+ 		return 1
+ 	fi
+ 
+ 	pahole_ver=$(${PAHOLE} --version | sed -E 's/v([0-9]+)\.([0-9]+)/\1\2/')
+ 	if [ "${pahole_ver}" -lt "113" ]; then
+-		info "BTF" "${1}: pahole version $(${PAHOLE} --version) is too old, need at least v1.13"
++		echo >&2 "BTF: ${1}: pahole version $(${PAHOLE} --version) is too old, need at least v1.13"
+ 		return 1
+ 	fi
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/bpf-map_seq_next-should-always-increase-position-ind.patch b/queue-5.5/bpf-map_seq_next-should-always-increase-position-ind.patch
new file mode 100644
index 00000000000..e009a2b82a6
--- /dev/null
+++ b/queue-5.5/bpf-map_seq_next-should-always-increase-position-ind.patch
@@ -0,0 +1,48 @@
+From f5aa24de5c99efe0bb658beb0d5c7f510d1d8878 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jan 2020 12:10:02 +0300
+Subject: bpf: map_seq_next should always increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 90435a7891a2259b0f74c5a1bc5600d0d64cba8f ]
+
+If seq_file .next fuction does not change position index,
+read after some lseek can generate an unexpected output.
+
+See also: https://bugzilla.kernel.org/show_bug.cgi?id=206283
+
+v1 -> v2: removed missed increment in end of function
+
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/eca84fdd-c374-a154-d874-6c7b55fc3bc4@virtuozzo.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/inode.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index ecf42bec38c00..6f22e0e74ef24 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -196,6 +196,7 @@ static void *map_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ 	void *key = map_iter(m)->key;
+ 	void *prev_key;
+ 
++	(*pos)++;
+ 	if (map_iter(m)->done)
+ 		return NULL;
+ 
+@@ -208,8 +209,6 @@ static void *map_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ 		map_iter(m)->done = true;
+ 		return NULL;
+ 	}
+-
+-	++(*pos);
+ 	return key;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/bpf-print-error-message-for-bpftool-cgroup-show.patch b/queue-5.5/bpf-print-error-message-for-bpftool-cgroup-show.patch
new file mode 100644
index 00000000000..ee06d8b7bd6
--- /dev/null
+++ b/queue-5.5/bpf-print-error-message-for-bpftool-cgroup-show.patch
@@ -0,0 +1,140 @@
+From c9ed2ce3faa4ea35e2a6420ee8f681cd255abac6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Dec 2019 17:17:42 -0800
+Subject: bpf: Print error message for bpftool cgroup show
+
+From: Hechao Li <hechaol@fb.com>
+
+[ Upstream commit 1162f844030ac1ac7321b5e8f6c9badc7a11428f ]
+
+Currently, when bpftool cgroup show <path> has an error, no error
+message is printed. This is confusing because the user may think the
+result is empty.
+
+Before the change:
+
+$ bpftool cgroup show /sys/fs/cgroup
+ID       AttachType      AttachFlags     Name
+$ echo $?
+255
+
+After the change:
+$ ./bpftool cgroup show /sys/fs/cgroup
+Error: can't query bpf programs attached to /sys/fs/cgroup: Operation
+not permitted
+
+v2: Rename check_query_cgroup_progs to cgroup_has_attached_progs
+
+Signed-off-by: Hechao Li <hechaol@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20191224011742.3714301-1-hechaol@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/cgroup.c | 56 ++++++++++++++++++++++++++------------
+ 1 file changed, 39 insertions(+), 17 deletions(-)
+
+diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
+index 1ef45e55039e1..2f017caa678dc 100644
+--- a/tools/bpf/bpftool/cgroup.c
++++ b/tools/bpf/bpftool/cgroup.c
+@@ -117,6 +117,25 @@ static int count_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type)
+ 	return prog_cnt;
+ }
+ 
++static int cgroup_has_attached_progs(int cgroup_fd)
++{
++	enum bpf_attach_type type;
++	bool no_prog = true;
++
++	for (type = 0; type < __MAX_BPF_ATTACH_TYPE; type++) {
++		int count = count_attached_bpf_progs(cgroup_fd, type);
++
++		if (count < 0 && errno != EINVAL)
++			return -1;
++
++		if (count > 0) {
++			no_prog = false;
++			break;
++		}
++	}
++
++	return no_prog ? 0 : 1;
++}
+ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type,
+ 				   int level)
+ {
+@@ -161,6 +180,7 @@ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type,
+ static int do_show(int argc, char **argv)
+ {
+ 	enum bpf_attach_type type;
++	int has_attached_progs;
+ 	const char *path;
+ 	int cgroup_fd;
+ 	int ret = -1;
+@@ -192,6 +212,16 @@ static int do_show(int argc, char **argv)
+ 		goto exit;
+ 	}
+ 
++	has_attached_progs = cgroup_has_attached_progs(cgroup_fd);
++	if (has_attached_progs < 0) {
++		p_err("can't query bpf programs attached to %s: %s",
++		      path, strerror(errno));
++		goto exit_cgroup;
++	} else if (!has_attached_progs) {
++		ret = 0;
++		goto exit_cgroup;
++	}
++
+ 	if (json_output)
+ 		jsonw_start_array(json_wtr);
+ 	else
+@@ -212,6 +242,7 @@ static int do_show(int argc, char **argv)
+ 	if (json_output)
+ 		jsonw_end_array(json_wtr);
+ 
++exit_cgroup:
+ 	close(cgroup_fd);
+ exit:
+ 	return ret;
+@@ -228,7 +259,7 @@ static int do_show_tree_fn(const char *fpath, const struct stat *sb,
+ 			   int typeflag, struct FTW *ftw)
+ {
+ 	enum bpf_attach_type type;
+-	bool skip = true;
++	int has_attached_progs;
+ 	int cgroup_fd;
+ 
+ 	if (typeflag != FTW_D)
+@@ -240,22 +271,13 @@ static int do_show_tree_fn(const char *fpath, const struct stat *sb,
+ 		return SHOW_TREE_FN_ERR;
+ 	}
+ 
+-	for (type = 0; type < __MAX_BPF_ATTACH_TYPE; type++) {
+-		int count = count_attached_bpf_progs(cgroup_fd, type);
+-
+-		if (count < 0 && errno != EINVAL) {
+-			p_err("can't query bpf programs attached to %s: %s",
+-			      fpath, strerror(errno));
+-			close(cgroup_fd);
+-			return SHOW_TREE_FN_ERR;
+-		}
+-		if (count > 0) {
+-			skip = false;
+-			break;
+-		}
+-	}
+-
+-	if (skip) {
++	has_attached_progs = cgroup_has_attached_progs(cgroup_fd);
++	if (has_attached_progs < 0) {
++		p_err("can't query bpf programs attached to %s: %s",
++		      fpath, strerror(errno));
++		close(cgroup_fd);
++		return SHOW_TREE_FN_ERR;
++	} else if (!has_attached_progs) {
+ 		close(cgroup_fd);
+ 		return 0;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.5/bpf-return-ebadrqc-for-invalid-map-type-in-__bpf_tx_.patch b/queue-5.5/bpf-return-ebadrqc-for-invalid-map-type-in-__bpf_tx_.patch
new file mode 100644
index 00000000000..5afc8f4b06f
--- /dev/null
+++ b/queue-5.5/bpf-return-ebadrqc-for-invalid-map-type-in-__bpf_tx_.patch
@@ -0,0 +1,45 @@
+From ba45a094abc6c59e66ebf8637eeccd237850ba0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 09:04:37 +0800
+Subject: bpf: Return -EBADRQC for invalid map type in __bpf_tx_xdp_map
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 0a29275b6300f39f78a87f2038bbfe5bdbaeca47 ]
+
+A negative value should be returned if map->map_type is invalid
+although that is impossible now, but if we run into such situation
+in future, then xdpbuff could be leaked.
+
+Daniel Borkmann suggested:
+
+-EBADRQC should be returned to stay consistent with generic XDP
+for the tracepoint output and not to be confused with -EOPNOTSUPP
+from other locations like dev_map_enqueue() when ndo_xdp_xmit is
+missing and such.
+
+Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/1578618277-18085-1-git-send-email-lirongqing@baidu.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 538f6a735a19f..f797b1599c92f 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3543,7 +3543,7 @@ static int __bpf_tx_xdp_map(struct net_device *dev_rx, void *fwd,
+ 		return err;
+ 	}
+ 	default:
+-		break;
++		return -EBADRQC;
+ 	}
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/bpf-sockhash-synchronize_rcu-before-free-ing-map.patch b/queue-5.5/bpf-sockhash-synchronize_rcu-before-free-ing-map.patch
new file mode 100644
index 00000000000..7611444821a
--- /dev/null
+++ b/queue-5.5/bpf-sockhash-synchronize_rcu-before-free-ing-map.patch
@@ -0,0 +1,44 @@
+From b3b08afacd2e5e7aa3e6d3a355553fc276c19855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2020 12:16:51 +0100
+Subject: bpf, sockhash: Synchronize_rcu before free'ing map
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+[ Upstream commit 0b2dc83906cf1e694e48003eae5df8fa63f76fd9 ]
+
+We need to have a synchronize_rcu before free'ing the sockhash because any
+outstanding psock references will have a pointer to the map and when they
+use it, this could trigger a use after free.
+
+This is a sister fix for sockhash, following commit 2bb90e5cc90e ("bpf:
+sockmap, synchronize_rcu before free'ing map") which addressed sockmap,
+which comes from a manual audit.
+
+Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20200206111652.694507-3-jakub@cloudflare.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index 085cef5857bbf..405397801bb07 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -881,6 +881,9 @@ static void sock_hash_free(struct bpf_map *map)
+ 	/* wait for psock readers accessing its map link */
+ 	synchronize_rcu();
+ 
++	/* wait for psock readers accessing its map link */
++	synchronize_rcu();
++
+ 	bpf_map_area_free(htab->buckets);
+ 	kfree(htab);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/brcmfmac-fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch b/queue-5.5/brcmfmac-fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch
new file mode 100644
index 00000000000..b764f7d3078
--- /dev/null
+++ b/queue-5.5/brcmfmac-fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch
@@ -0,0 +1,39 @@
+From 6d9ae678fb71414bf071d518741acd2f2d9f5bc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2019 13:19:48 -0600
+Subject: brcmfmac: Fix memory leak in brcmf_p2p_create_p2pdev()
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 5cc509aa83c6acd2c5cd94f99065c39d2bd0a490 ]
+
+In the implementation of brcmf_p2p_create_p2pdev() the allocated memory
+for p2p_vif is leaked when the mac address is the same as primary
+interface. To fix this, go to error path to release p2p_vif via
+brcmf_free_vif().
+
+Fixes: cb746e47837a ("brcmfmac: check p2pdev mac address uniqueness")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+index 7ba9f6a686459..1f5deea5a288e 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -2092,7 +2092,8 @@ static struct wireless_dev *brcmf_p2p_create_p2pdev(struct brcmf_p2p_info *p2p,
+ 	/* firmware requires unique mac address for p2pdev interface */
+ 	if (addr && ether_addr_equal(addr, pri_ifp->mac_addr)) {
+ 		bphy_err(drvr, "discovery vif must be different from primary interface\n");
+-		return ERR_PTR(-EINVAL);
++		err = -EINVAL;
++		goto fail;
+ 	}
+ 
+ 	brcmf_p2p_generate_bss_mac(p2p, addr);
+-- 
+2.20.1
+
diff --git a/queue-5.5/brcmfmac-fix-use-after-free-in-brcmf_sdio_readframes.patch b/queue-5.5/brcmfmac-fix-use-after-free-in-brcmf_sdio_readframes.patch
new file mode 100644
index 00000000000..d3d289fc0b3
--- /dev/null
+++ b/queue-5.5/brcmfmac-fix-use-after-free-in-brcmf_sdio_readframes.patch
@@ -0,0 +1,41 @@
+From 667b8e3e94ff0cfab0d1c5bfed349839775a16dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 12:58:55 +0300
+Subject: brcmfmac: Fix use after free in brcmf_sdio_readframes()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 216b44000ada87a63891a8214c347e05a4aea8fe ]
+
+The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
+static checker warning:
+
+    drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
+    error: dereferencing freed memory 'pkt'
+
+It looks like there was supposed to be a continue after we free "pkt".
+
+Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 264ad63232f87..1dea0178832ea 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
+ 					       BRCMF_SDIO_FT_NORMAL)) {
+ 				rd->len = 0;
+ 				brcmu_pkt_buf_free_skb(pkt);
++				continue;
+ 			}
+ 			bus->sdcnt.rx_readahead_cnt++;
+ 			if (rd->len != roundup(rd_new.len, 16)) {
+-- 
+2.20.1
+
diff --git a/queue-5.5/brcmfmac-sdio-fix-oob-interrupt-initialization-on-br.patch b/queue-5.5/brcmfmac-sdio-fix-oob-interrupt-initialization-on-br.patch
new file mode 100644
index 00000000000..df69b6b20e9
--- /dev/null
+++ b/queue-5.5/brcmfmac-sdio-fix-oob-interrupt-initialization-on-br.patch
@@ -0,0 +1,67 @@
+From 86af3b74fa5ecd4b15a2d6c17c17bf66c59671be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Dec 2019 10:20:33 +0100
+Subject: brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362
+
+From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+
+[ Upstream commit 8c8e60fb86a90a30721bbd797f58f96b3980dcc1 ]
+
+Commit 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling
+brcmf_bus_started()") changed the initialization order of the brcmfmac
+SDIO driver. Unfortunately since brcmf_sdiod_intr_register() is now
+called before the sdiodev->bus_if initialization, it reads the wrong
+chip ID and fails to initialize the GPIO on brcm43362. Thus the chip
+cannot send interrupts and fails to probe:
+
+[   12.517023] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
+[   12.531214] ieee80211 phy0: brcmf_bus_started: failed: -110
+[   12.536976] ieee80211 phy0: brcmf_attach: dongle is not responding: err=-110
+[   12.566467] brcmfmac: brcmf_sdio_firmware_callback: brcmf_attach failed
+
+Initialize the bus interface earlier to ensure that
+brcmf_sdiod_intr_register() properly sets up the OOB interrupt.
+
+BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908438
+Fixes: 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling brcmf_bus_started()")
+Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c  | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 1dea0178832ea..a935993a3c514 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4226,6 +4226,12 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ 	}
+ 
+ 	if (err == 0) {
++		/* Assign bus interface call back */
++		sdiod->bus_if->dev = sdiod->dev;
++		sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
++		sdiod->bus_if->chip = bus->ci->chip;
++		sdiod->bus_if->chiprev = bus->ci->chiprev;
++
+ 		/* Allow full data communication using DPC from now on. */
+ 		brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
+ 
+@@ -4242,12 +4248,6 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ 
+ 	sdio_release_host(sdiod->func1);
+ 
+-	/* Assign bus interface call back */
+-	sdiod->bus_if->dev = sdiod->dev;
+-	sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
+-	sdiod->bus_if->chip = bus->ci->chip;
+-	sdiod->bus_if->chiprev = bus->ci->chiprev;
+-
+ 	err = brcmf_alloc(sdiod->dev, sdiod->settings);
+ 	if (err) {
+ 		brcmf_err("brcmf_alloc failed\n");
+-- 
+2.20.1
+
diff --git a/queue-5.5/brd-check-and-limit-max_part-par.patch b/queue-5.5/brd-check-and-limit-max_part-par.patch
new file mode 100644
index 00000000000..8e608fc7b7a
--- /dev/null
+++ b/queue-5.5/brd-check-and-limit-max_part-par.patch
@@ -0,0 +1,109 @@
+From 4ccf8668f18547097018bb897765a8282346debe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Feb 2020 19:30:20 +0800
+Subject: brd: check and limit max_part par
+
+From: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+
+[ Upstream commit c8ab422553c81a0eb070329c63725df1cd1425bc ]
+
+In brd_init func, rd_nr num of brd_device are firstly allocated
+and add in brd_devices, then brd_devices are traversed to add each
+brd_device by calling add_disk func. When allocating brd_device,
+the disk->first_minor is set to i * max_part, if rd_nr * max_part
+is larger than MINORMASK, two different brd_device may have the same
+devt, then only one of them can be successfully added.
+when rmmod brd.ko, it will cause oops when calling brd_exit.
+
+Follow those steps:
+  # modprobe brd rd_nr=3 rd_size=102400 max_part=1048576
+  # rmmod brd
+then, the oops will appear.
+
+Oops log:
+[  726.613722] Call trace:
+[  726.614175]  kernfs_find_ns+0x24/0x130
+[  726.614852]  kernfs_find_and_get_ns+0x44/0x68
+[  726.615749]  sysfs_remove_group+0x38/0xb0
+[  726.616520]  blk_trace_remove_sysfs+0x1c/0x28
+[  726.617320]  blk_unregister_queue+0x98/0x100
+[  726.618105]  del_gendisk+0x144/0x2b8
+[  726.618759]  brd_exit+0x68/0x560 [brd]
+[  726.619501]  __arm64_sys_delete_module+0x19c/0x2a0
+[  726.620384]  el0_svc_common+0x78/0x130
+[  726.621057]  el0_svc_handler+0x38/0x78
+[  726.621738]  el0_svc+0x8/0xc
+[  726.622259] Code: aa0203f6 aa0103f7 aa1e03e0 d503201f (7940e260)
+
+Here, we add brd_check_and_reset_par func to check and limit max_part par.
+
+--
+V5->V6:
+ - remove useless code
+
+V4->V5:(suggested by Ming Lei)
+ - make sure max_part is not larger than DISK_MAX_PARTS
+
+V3->V4:(suggested by Ming Lei)
+ - remove useless change
+ - add one limit of max_part
+
+V2->V3: (suggested by Ming Lei)
+ - clear .minors when running out of consecutive minor space in brd_alloc
+ - remove limit of rd_nr
+
+V1->V2:
+ - add more checks in brd_check_par_valid as suggested by Ming Lei.
+
+Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+Reviewed-by: Bob Liu <bob.liu@oracle.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/brd.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index a8730cc4db10e..220c5e18aba0c 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -473,6 +473,25 @@ static struct kobject *brd_probe(dev_t dev, int *part, void *data)
+ 	return kobj;
+ }
+ 
++static inline void brd_check_and_reset_par(void)
++{
++	if (unlikely(!max_part))
++		max_part = 1;
++
++	/*
++	 * make sure 'max_part' can be divided exactly by (1U << MINORBITS),
++	 * otherwise, it is possiable to get same dev_t when adding partitions.
++	 */
++	if ((1U << MINORBITS) % max_part != 0)
++		max_part = 1UL << fls(max_part);
++
++	if (max_part > DISK_MAX_PARTS) {
++		pr_info("brd: max_part can't be larger than %d, reset max_part = %d.\n",
++			DISK_MAX_PARTS, DISK_MAX_PARTS);
++		max_part = DISK_MAX_PARTS;
++	}
++}
++
+ static int __init brd_init(void)
+ {
+ 	struct brd_device *brd, *next;
+@@ -496,8 +515,7 @@ static int __init brd_init(void)
+ 	if (register_blkdev(RAMDISK_MAJOR, "ramdisk"))
+ 		return -EIO;
+ 
+-	if (unlikely(!max_part))
+-		max_part = 1;
++	brd_check_and_reset_par();
+ 
+ 	for (i = 0; i < rd_nr; i++) {
+ 		brd = brd_alloc(i);
+-- 
+2.20.1
+
diff --git a/queue-5.5/btrfs-device-stats-log-when-stats-are-zeroed.patch b/queue-5.5/btrfs-device-stats-log-when-stats-are-zeroed.patch
new file mode 100644
index 00000000000..7b9fa46ba3c
--- /dev/null
+++ b/queue-5.5/btrfs-device-stats-log-when-stats-are-zeroed.patch
@@ -0,0 +1,47 @@
+From 6f0e90c3cd395b890e0ddec8f17c9e9760bf02d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 12:26:34 +0800
+Subject: btrfs: device stats, log when stats are zeroed
+
+From: Anand Jain <anand.jain@oracle.com>
+
+[ Upstream commit a69976bc69308aa475d0ba3b8b3efd1d013c0460 ]
+
+We had a report indicating that some read errors aren't reported by the
+device stats in the userland. It is important to have the errors
+reported in the device stat as user land scripts might depend on it to
+take the reasonable corrective actions. But to debug these issue we need
+to be really sure that request to reset the device stat did not come
+from the userland itself. So log an info message when device error reset
+happens.
+
+For example:
+ BTRFS info (device sdc): device stats zeroed by btrfs(9223)
+
+Reported-by: philip@philip-seeger.de
+Link: https://www.spinics.net/lists/linux-btrfs/msg96528.html
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Anand Jain <anand.jain@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 72ff80f7f24ca..c5c0dc0cbf517 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -7342,6 +7342,8 @@ int btrfs_get_dev_stats(struct btrfs_fs_info *fs_info,
+ 			else
+ 				btrfs_dev_stat_set(dev, i, 0);
+ 		}
++		btrfs_info(fs_info, "device stats zeroed by %s (%d)",
++			   current->comm, task_pid_nr(current));
+ 	} else {
+ 		for (i = 0; i < BTRFS_DEV_STAT_VALUES_MAX; i++)
+ 			if (stats->nr_items > i)
+-- 
+2.20.1
+
diff --git a/queue-5.5/btrfs-do-not-do-delalloc-reservation-under-page-lock.patch b/queue-5.5/btrfs-do-not-do-delalloc-reservation-under-page-lock.patch
new file mode 100644
index 00000000000..0f83d4363d6
--- /dev/null
+++ b/queue-5.5/btrfs-do-not-do-delalloc-reservation-under-page-lock.patch
@@ -0,0 +1,220 @@
+From 2771570ad3d57ac6f6ab85d88da0a9085a0d99f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 14:34:52 -0500
+Subject: btrfs: do not do delalloc reservation under page lock
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit f4b1363cae43fef7c86c993b7ca7fe7d546b3c68 ]
+
+We ran into a deadlock in production with the fixup worker.  The stack
+traces were as follows:
+
+Thread responsible for the writeout, waiting on the page lock
+
+  [<0>] io_schedule+0x12/0x40
+  [<0>] __lock_page+0x109/0x1e0
+  [<0>] extent_write_cache_pages+0x206/0x360
+  [<0>] extent_writepages+0x40/0x60
+  [<0>] do_writepages+0x31/0xb0
+  [<0>] __writeback_single_inode+0x3d/0x350
+  [<0>] writeback_sb_inodes+0x19d/0x3c0
+  [<0>] __writeback_inodes_wb+0x5d/0xb0
+  [<0>] wb_writeback+0x231/0x2c0
+  [<0>] wb_workfn+0x308/0x3c0
+  [<0>] process_one_work+0x1e0/0x390
+  [<0>] worker_thread+0x2b/0x3c0
+  [<0>] kthread+0x113/0x130
+  [<0>] ret_from_fork+0x35/0x40
+  [<0>] 0xffffffffffffffff
+
+Thread of the fixup worker who is holding the page lock
+
+  [<0>] start_delalloc_inodes+0x241/0x2d0
+  [<0>] btrfs_start_delalloc_roots+0x179/0x230
+  [<0>] btrfs_alloc_data_chunk_ondemand+0x11b/0x2e0
+  [<0>] btrfs_check_data_free_space+0x53/0xa0
+  [<0>] btrfs_delalloc_reserve_space+0x20/0x70
+  [<0>] btrfs_writepage_fixup_worker+0x1fc/0x2a0
+  [<0>] normal_work_helper+0x11c/0x360
+  [<0>] process_one_work+0x1e0/0x390
+  [<0>] worker_thread+0x2b/0x3c0
+  [<0>] kthread+0x113/0x130
+  [<0>] ret_from_fork+0x35/0x40
+  [<0>] 0xffffffffffffffff
+
+Thankfully the stars have to align just right to hit this.  First you
+have to end up in the fixup worker, which is tricky by itself (my
+reproducer does DIO reads into a MMAP'ed region, so not a common
+operation).  Then you have to have less than a page size of free data
+space and 0 unallocated space so you go down the "commit the transaction
+to free up pinned space" path.  This was accomplished by a random
+balance that was running on the host.  Then you get this deadlock.
+
+I'm still in the process of trying to force the deadlock to happen on
+demand, but I've hit other issues.  I can still trigger the fixup worker
+path itself so this patch has been tested in that regard, so the normal
+case is fine.
+
+Fixes: 87826df0ec36 ("btrfs: delalloc for page dirtied out-of-band in fixup worker")
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode.c | 76 ++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 60 insertions(+), 16 deletions(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 27f2c554cac32..537b4c563f09c 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -2191,6 +2191,7 @@ int btrfs_set_extent_delalloc(struct inode *inode, u64 start, u64 end,
+ /* see btrfs_writepage_start_hook for details on why this is required */
+ struct btrfs_writepage_fixup {
+ 	struct page *page;
++	struct inode *inode;
+ 	struct btrfs_work work;
+ };
+ 
+@@ -2205,9 +2206,20 @@ static void btrfs_writepage_fixup_worker(struct btrfs_work *work)
+ 	u64 page_start;
+ 	u64 page_end;
+ 	int ret = 0;
++	bool free_delalloc_space = true;
+ 
+ 	fixup = container_of(work, struct btrfs_writepage_fixup, work);
+ 	page = fixup->page;
++	inode = fixup->inode;
++	page_start = page_offset(page);
++	page_end = page_offset(page) + PAGE_SIZE - 1;
++
++	/*
++	 * This is similar to page_mkwrite, we need to reserve the space before
++	 * we take the page lock.
++	 */
++	ret = btrfs_delalloc_reserve_space(inode, &data_reserved, page_start,
++					   PAGE_SIZE);
+ again:
+ 	lock_page(page);
+ 
+@@ -2216,25 +2228,48 @@ again:
+ 	 * page->mapping may go NULL, but it shouldn't be moved to a different
+ 	 * address space.
+ 	 */
+-	if (!page->mapping || !PageDirty(page) || !PageChecked(page))
++	if (!page->mapping || !PageDirty(page) || !PageChecked(page)) {
++		/*
++		 * Unfortunately this is a little tricky, either
++		 *
++		 * 1) We got here and our page had already been dealt with and
++		 *    we reserved our space, thus ret == 0, so we need to just
++		 *    drop our space reservation and bail.  This can happen the
++		 *    first time we come into the fixup worker, or could happen
++		 *    while waiting for the ordered extent.
++		 * 2) Our page was already dealt with, but we happened to get an
++		 *    ENOSPC above from the btrfs_delalloc_reserve_space.  In
++		 *    this case we obviously don't have anything to release, but
++		 *    because the page was already dealt with we don't want to
++		 *    mark the page with an error, so make sure we're resetting
++		 *    ret to 0.  This is why we have this check _before_ the ret
++		 *    check, because we do not want to have a surprise ENOSPC
++		 *    when the page was already properly dealt with.
++		 */
++		if (!ret) {
++			btrfs_delalloc_release_extents(BTRFS_I(inode),
++						       PAGE_SIZE);
++			btrfs_delalloc_release_space(inode, data_reserved,
++						     page_start, PAGE_SIZE,
++						     true);
++		}
++		ret = 0;
+ 		goto out_page;
++	}
+ 
+ 	/*
+-	 * We keep the PageChecked() bit set until we're done with the
+-	 * btrfs_start_ordered_extent() dance that we do below.  That drops and
+-	 * retakes the page lock, so we don't want new fixup workers queued for
+-	 * this page during the churn.
++	 * We can't mess with the page state unless it is locked, so now that
++	 * it is locked bail if we failed to make our space reservation.
+ 	 */
+-	inode = page->mapping->host;
+-	page_start = page_offset(page);
+-	page_end = page_offset(page) + PAGE_SIZE - 1;
++	if (ret)
++		goto out_page;
+ 
+ 	lock_extent_bits(&BTRFS_I(inode)->io_tree, page_start, page_end,
+ 			 &cached_state);
+ 
+ 	/* already ordered? We're done */
+ 	if (PagePrivate2(page))
+-		goto out;
++		goto out_reserved;
+ 
+ 	ordered = btrfs_lookup_ordered_range(BTRFS_I(inode), page_start,
+ 					PAGE_SIZE);
+@@ -2247,11 +2282,6 @@ again:
+ 		goto again;
+ 	}
+ 
+-	ret = btrfs_delalloc_reserve_space(inode, &data_reserved, page_start,
+-					   PAGE_SIZE);
+-	if (ret)
+-		goto out;
+-
+ 	ret = btrfs_set_extent_delalloc(inode, page_start, page_end, 0,
+ 					&cached_state);
+ 	if (ret)
+@@ -2265,12 +2295,12 @@ again:
+ 	 * The page was dirty when we started, nothing should have cleaned it.
+ 	 */
+ 	BUG_ON(!PageDirty(page));
++	free_delalloc_space = false;
+ out_reserved:
+ 	btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE);
+-	if (ret)
++	if (free_delalloc_space)
+ 		btrfs_delalloc_release_space(inode, data_reserved, page_start,
+ 					     PAGE_SIZE, true);
+-out:
+ 	unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end,
+ 			     &cached_state);
+ out_page:
+@@ -2289,6 +2319,12 @@ out_page:
+ 	put_page(page);
+ 	kfree(fixup);
+ 	extent_changeset_free(data_reserved);
++	/*
++	 * As a precaution, do a delayed iput in case it would be the last iput
++	 * that could need flushing space. Recursing back to fixup worker would
++	 * deadlock.
++	 */
++	btrfs_add_delayed_iput(inode);
+ }
+ 
+ /*
+@@ -2326,10 +2362,18 @@ int btrfs_writepage_cow_fixup(struct page *page, u64 start, u64 end)
+ 	if (!fixup)
+ 		return -EAGAIN;
+ 
++	/*
++	 * We are already holding a reference to this inode from
++	 * write_cache_pages.  We need to hold it because the space reservation
++	 * takes place outside of the page lock, and we can't trust
++	 * page->mapping outside of the page lock.
++	 */
++	ihold(inode);
+ 	SetPageChecked(page);
+ 	get_page(page);
+ 	btrfs_init_work(&fixup->work, btrfs_writepage_fixup_worker, NULL, NULL);
+ 	fixup->page = page;
++	fixup->inode = inode;
+ 	btrfs_queue_work(fs_info->fixup_workers, &fixup->work);
+ 
+ 	return -EAGAIN;
+-- 
+2.20.1
+
diff --git a/queue-5.5/btrfs-fix-possible-null-pointer-dereference-in-integ.patch b/queue-5.5/btrfs-fix-possible-null-pointer-dereference-in-integ.patch
new file mode 100644
index 00000000000..a3d27d1f03a
--- /dev/null
+++ b/queue-5.5/btrfs-fix-possible-null-pointer-dereference-in-integ.patch
@@ -0,0 +1,51 @@
+From ecc5569f3fcd35f58e01d82ecf099df65b30a39b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 14:19:57 +0100
+Subject: btrfs: fix possible NULL-pointer dereference in integrity checks
+
+From: Johannes Thumshirn <jth@kernel.org>
+
+[ Upstream commit 3dbd351df42109902fbcebf27104149226a4fcd9 ]
+
+A user reports a possible NULL-pointer dereference in
+btrfsic_process_superblock(). We are assigning state->fs_info to a local
+fs_info variable and afterwards checking for the presence of state.
+
+While we would BUG_ON() a NULL state anyways, we can also just remove
+the local fs_info copy, as fs_info is only used once as the first
+argument for btrfs_num_copies(). There we can just pass in
+state->fs_info as well.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=205003
+Signed-off-by: Johannes Thumshirn <jth@kernel.org>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/check-integrity.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
+index 0b52ab4cb9649..72c70f59fc605 100644
+--- a/fs/btrfs/check-integrity.c
++++ b/fs/btrfs/check-integrity.c
+@@ -629,7 +629,6 @@ static struct btrfsic_dev_state *btrfsic_dev_state_hashtable_lookup(dev_t dev,
+ static int btrfsic_process_superblock(struct btrfsic_state *state,
+ 				      struct btrfs_fs_devices *fs_devices)
+ {
+-	struct btrfs_fs_info *fs_info = state->fs_info;
+ 	struct btrfs_super_block *selected_super;
+ 	struct list_head *dev_head = &fs_devices->devices;
+ 	struct btrfs_device *device;
+@@ -700,7 +699,7 @@ static int btrfsic_process_superblock(struct btrfsic_state *state,
+ 			break;
+ 		}
+ 
+-		num_copies = btrfs_num_copies(fs_info, next_bytenr,
++		num_copies = btrfs_num_copies(state->fs_info, next_bytenr,
+ 					      state->metablock_size);
+ 		if (state->print_mask & BTRFSIC_PRINT_MASK_NUM_COPIES)
+ 			pr_info("num_copies(log_bytenr=%llu) = %d\n",
+-- 
+2.20.1
+
diff --git a/queue-5.5/btrfs-fix-split-brain-handling-when-changing-fsid-to.patch b/queue-5.5/btrfs-fix-split-brain-handling-when-changing-fsid-to.patch
new file mode 100644
index 00000000000..95516f49353
--- /dev/null
+++ b/queue-5.5/btrfs-fix-split-brain-handling-when-changing-fsid-to.patch
@@ -0,0 +1,108 @@
+From ee36dd7ff2a6ae87154aec91791495bb754d6c09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 14:11:35 +0200
+Subject: btrfs: Fix split-brain handling when changing FSID to metadata uuid
+
+From: Nikolay Borisov <nborisov@suse.com>
+
+[ Upstream commit 1362089d2ad7e20d16371b39d3c11990d4ec23e4 ]
+
+Current code doesn't correctly handle the situation which arises when
+a file system that has METADATA_UUID_INCOMPAT flag set and has its FSID
+changed to the one in metadata uuid. This causes the incompat flag to
+disappear.
+
+In case of a power failure we could end up in a situation where part of
+the disks in a multi-disk filesystem are correctly reverted to
+METADATA_UUID_INCOMPAT flag unset state, while others have
+METADATA_UUID_INCOMPAT set and CHANGING_FSID_V2_IN_PROGRESS.
+
+This patch corrects the behavior required to handle the case where a
+disk of the second type is scanned first, creating the necessary
+btrfs_fs_devices. Subsequently, when a disk which has already completed
+the transition is scanned it should overwrite the data in
+btrfs_fs_devices.
+
+Reported-by: Su Yue <Damenly_Su@gmx.com>
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 42 ++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 38 insertions(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index c5c0dc0cbf517..a8b71ded4d212 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -723,6 +723,32 @@ static struct btrfs_fs_devices *find_fsid_changed(
+ 
+ 	return NULL;
+ }
++
++static struct btrfs_fs_devices *find_fsid_reverted_metadata(
++				struct btrfs_super_block *disk_super)
++{
++	struct btrfs_fs_devices *fs_devices;
++
++	/*
++	 * Handle the case where the scanned device is part of an fs whose last
++	 * metadata UUID change reverted it to the original FSID. At the same
++	 * time * fs_devices was first created by another constitutent device
++	 * which didn't fully observe the operation. This results in an
++	 * btrfs_fs_devices created with metadata/fsid different AND
++	 * btrfs_fs_devices::fsid_change set AND the metadata_uuid of the
++	 * fs_devices equal to the FSID of the disk.
++	 */
++	list_for_each_entry(fs_devices, &fs_uuids, fs_list) {
++		if (memcmp(fs_devices->fsid, fs_devices->metadata_uuid,
++			   BTRFS_FSID_SIZE) != 0 &&
++		    memcmp(fs_devices->metadata_uuid, disk_super->fsid,
++			   BTRFS_FSID_SIZE) == 0 &&
++		    fs_devices->fsid_change)
++			return fs_devices;
++	}
++
++	return NULL;
++}
+ /*
+  * Add new device to list of registered devices
+  *
+@@ -762,7 +788,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ 		fs_devices = find_fsid(disk_super->fsid,
+ 				       disk_super->metadata_uuid);
+ 	} else {
+-		fs_devices = find_fsid(disk_super->fsid, NULL);
++		fs_devices = find_fsid_reverted_metadata(disk_super);
++		if (!fs_devices)
++			fs_devices = find_fsid(disk_super->fsid, NULL);
+ 	}
+ 
+ 
+@@ -792,12 +820,18 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ 		 * a device which had the CHANGING_FSID_V2 flag then replace the
+ 		 * metadata_uuid/fsid values of the fs_devices.
+ 		 */
+-		if (has_metadata_uuid && fs_devices->fsid_change &&
++		if (fs_devices->fsid_change &&
+ 		    found_transid > fs_devices->latest_generation) {
+ 			memcpy(fs_devices->fsid, disk_super->fsid,
+ 					BTRFS_FSID_SIZE);
+-			memcpy(fs_devices->metadata_uuid,
+-					disk_super->metadata_uuid, BTRFS_FSID_SIZE);
++
++			if (has_metadata_uuid)
++				memcpy(fs_devices->metadata_uuid,
++				       disk_super->metadata_uuid,
++				       BTRFS_FSID_SIZE);
++			else
++				memcpy(fs_devices->metadata_uuid,
++				       disk_super->fsid, BTRFS_FSID_SIZE);
+ 
+ 			fs_devices->fsid_change = false;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-5.5/btrfs-keep-pages-dirty-when-using-btrfs_writepage_fi.patch b/queue-5.5/btrfs-keep-pages-dirty-when-using-btrfs_writepage_fi.patch
new file mode 100644
index 00000000000..2c2f2cf322d
--- /dev/null
+++ b/queue-5.5/btrfs-keep-pages-dirty-when-using-btrfs_writepage_fi.patch
@@ -0,0 +1,166 @@
+From 1f20440eed4a7f37f6fde7b5c1be8b1347ed47ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 11:51:42 -0500
+Subject: Btrfs: keep pages dirty when using btrfs_writepage_fixup_worker
+
+From: Chris Mason <clm@fb.com>
+
+[ Upstream commit 25f3c5021985e885292980d04a1423fd83c967bb ]
+
+For COW, btrfs expects pages dirty pages to have been through a few setup
+steps.  This includes reserving space for the new block allocations and marking
+the range in the state tree for delayed allocation.
+
+A few places outside btrfs will dirty pages directly, especially when unmapping
+mmap'd pages.  In order for these to properly go through COW, we run them
+through a fixup worker to wait for stable pages, and do the delalloc prep.
+
+87826df0ec36 added a window where the dirty pages were cleaned, but pending
+more action from the fixup worker.  We clear_page_dirty_for_io() before
+we call into writepage, so the page is no longer dirty.  The commit
+changed it so now we leave the page clean between unlocking it here and
+the fixup worker starting at some point in the future.
+
+During this window, page migration can jump in and relocate the page.  Once our
+fixup work actually starts, it finds page->mapping is NULL and we end up
+freeing the page without ever writing it.
+
+This leads to crc errors and other exciting problems, since it screws up the
+whole statemachine for waiting for ordered extents.  The fix here is to keep
+the page dirty while we're waiting for the fixup worker to get to work.
+This is accomplished by returning -EAGAIN from btrfs_writepage_cow_fixup
+if we queued the page up for fixup, which will cause the writepage
+function to redirty the page.
+
+Because we now expect the page to be dirty once it gets to the fixup
+worker we must adjust the error cases to call clear_page_dirty_for_io()
+on the page.  That is the bulk of the patch, but it is not the fix, the
+fix is the -EAGAIN from btrfs_writepage_cow_fixup.  We cannot separate
+these two changes out because the error conditions change with the new
+expectations.
+
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode.c | 61 ++++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 44 insertions(+), 17 deletions(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index c70baafb2a392..27f2c554cac32 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -2204,17 +2204,27 @@ static void btrfs_writepage_fixup_worker(struct btrfs_work *work)
+ 	struct inode *inode;
+ 	u64 page_start;
+ 	u64 page_end;
+-	int ret;
++	int ret = 0;
+ 
+ 	fixup = container_of(work, struct btrfs_writepage_fixup, work);
+ 	page = fixup->page;
+ again:
+ 	lock_page(page);
+-	if (!page->mapping || !PageDirty(page) || !PageChecked(page)) {
+-		ClearPageChecked(page);
++
++	/*
++	 * Before we queued this fixup, we took a reference on the page.
++	 * page->mapping may go NULL, but it shouldn't be moved to a different
++	 * address space.
++	 */
++	if (!page->mapping || !PageDirty(page) || !PageChecked(page))
+ 		goto out_page;
+-	}
+ 
++	/*
++	 * We keep the PageChecked() bit set until we're done with the
++	 * btrfs_start_ordered_extent() dance that we do below.  That drops and
++	 * retakes the page lock, so we don't want new fixup workers queued for
++	 * this page during the churn.
++	 */
+ 	inode = page->mapping->host;
+ 	page_start = page_offset(page);
+ 	page_end = page_offset(page) + PAGE_SIZE - 1;
+@@ -2239,24 +2249,22 @@ again:
+ 
+ 	ret = btrfs_delalloc_reserve_space(inode, &data_reserved, page_start,
+ 					   PAGE_SIZE);
+-	if (ret) {
+-		mapping_set_error(page->mapping, ret);
+-		end_extent_writepage(page, ret, page_start, page_end);
+-		ClearPageChecked(page);
++	if (ret)
+ 		goto out;
+-	 }
+ 
+ 	ret = btrfs_set_extent_delalloc(inode, page_start, page_end, 0,
+ 					&cached_state);
+-	if (ret) {
+-		mapping_set_error(page->mapping, ret);
+-		end_extent_writepage(page, ret, page_start, page_end);
+-		ClearPageChecked(page);
++	if (ret)
+ 		goto out_reserved;
+-	}
+ 
+-	ClearPageChecked(page);
+-	set_page_dirty(page);
++	/*
++	 * Everything went as planned, we're now the owner of a dirty page with
++	 * delayed allocation bits set and space reserved for our COW
++	 * destination.
++	 *
++	 * The page was dirty when we started, nothing should have cleaned it.
++	 */
++	BUG_ON(!PageDirty(page));
+ out_reserved:
+ 	btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE);
+ 	if (ret)
+@@ -2266,6 +2274,17 @@ out:
+ 	unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end,
+ 			     &cached_state);
+ out_page:
++	if (ret) {
++		/*
++		 * We hit ENOSPC or other errors.  Update the mapping and page
++		 * to reflect the errors and clean the page.
++		 */
++		mapping_set_error(page->mapping, ret);
++		end_extent_writepage(page, ret, page_start, page_end);
++		clear_page_dirty_for_io(page);
++		SetPageError(page);
++	}
++	ClearPageChecked(page);
+ 	unlock_page(page);
+ 	put_page(page);
+ 	kfree(fixup);
+@@ -2293,6 +2312,13 @@ int btrfs_writepage_cow_fixup(struct page *page, u64 start, u64 end)
+ 	if (TestClearPagePrivate2(page))
+ 		return 0;
+ 
++	/*
++	 * PageChecked is set below when we create a fixup worker for this page,
++	 * don't try to create another one if we're already PageChecked()
++	 *
++	 * The extent_io writepage code will redirty the page if we send back
++	 * EAGAIN.
++	 */
+ 	if (PageChecked(page))
+ 		return -EAGAIN;
+ 
+@@ -2305,7 +2331,8 @@ int btrfs_writepage_cow_fixup(struct page *page, u64 start, u64 end)
+ 	btrfs_init_work(&fixup->work, btrfs_writepage_fixup_worker, NULL, NULL);
+ 	fixup->page = page;
+ 	btrfs_queue_work(fs_info->fixup_workers, &fixup->work);
+-	return -EBUSY;
++
++	return -EAGAIN;
+ }
+ 
+ static int insert_reserved_file_extent(struct btrfs_trans_handle *trans,
+-- 
+2.20.1
+
diff --git a/queue-5.5/btrfs-safely-advance-counter-when-looking-up-bio-csu.patch b/queue-5.5/btrfs-safely-advance-counter-when-looking-up-bio-csu.patch
new file mode 100644
index 00000000000..bece7d6d561
--- /dev/null
+++ b/queue-5.5/btrfs-safely-advance-counter-when-looking-up-bio-csu.patch
@@ -0,0 +1,53 @@
+From 9bb3a3daecc35694d28f70d0486ab2f64859d2b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 15:29:53 +0100
+Subject: btrfs: safely advance counter when looking up bio csums
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit 4babad10198fa73fe73239d02c2e99e3333f5f5c ]
+
+Dan's smatch tool reports
+
+  fs/btrfs/file-item.c:295 btrfs_lookup_bio_sums()
+  warn: should this be 'count == -1'
+
+which points to the while (count--) loop. With count == 0 the check
+itself could decrement it to -1. There's a WARN_ON a few lines below
+that has never been seen in practice though.
+
+It turns out that the value of page_bytes_left matches the count (by
+sectorsize multiples). The loop never reaches the state where count
+would go to -1, because page_bytes_left == 0 is found first and this
+breaks out.
+
+For clarity, use only plain check on count (and only for positive
+value), decrement safely inside the loop. Any other discrepancy after
+the whole bio list processing should be reported by the exising
+WARN_ON_ONCE as well.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file-item.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index b1bfdc5c1387a..6f18333e83c33 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -274,7 +274,8 @@ found:
+ 		csum += count * csum_size;
+ 		nblocks -= count;
+ next:
+-		while (count--) {
++		while (count > 0) {
++			count--;
+ 			disk_bytenr += fs_info->sectorsize;
+ 			offset += fs_info->sectorsize;
+ 			page_bytes_left -= fs_info->sectorsize;
+-- 
+2.20.1
+
diff --git a/queue-5.5/btrfs-separate-definition-of-assertion-failure-handl.patch b/queue-5.5/btrfs-separate-definition-of-assertion-failure-handl.patch
new file mode 100644
index 00000000000..df942c2f50d
--- /dev/null
+++ b/queue-5.5/btrfs-separate-definition-of-assertion-failure-handl.patch
@@ -0,0 +1,70 @@
+From 854127c4eebb22f04ce518e3cf053fd6ba494c16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 20:00:48 +0100
+Subject: btrfs: separate definition of assertion failure handlers
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit 68c467cbb2f389b6c933e235bce0d1756fc8cc34 ]
+
+There's a report where objtool detects unreachable instructions, eg.:
+
+  fs/btrfs/ctree.o: warning: objtool: btrfs_search_slot()+0x2d4: unreachable instruction
+
+This seems to be a false positive due to compiler version. The cause is
+in the ASSERT macro implementation that does the conditional check as
+IS_DEFINED(CONFIG_BTRFS_ASSERT) and not an #ifdef.
+
+To avoid that, use the ifdefs directly.
+
+There are still 2 reports that aren't fixed:
+
+  fs/btrfs/extent_io.o: warning: objtool: __set_extent_bit()+0x71f: unreachable instruction
+  fs/btrfs/relocation.o: warning: objtool: find_data_references()+0x4e0: unreachable instruction
+
+Co-developed-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ctree.h | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index ba7292435c14c..2e9f938508e9b 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -3108,17 +3108,21 @@ do {								\
+ 	rcu_read_unlock();					\
+ } while (0)
+ 
+-__cold
+-static inline void assfail(const char *expr, const char *file, int line)
++#ifdef CONFIG_BTRFS_ASSERT
++__cold __noreturn
++static inline void assertfail(const char *expr, const char *file, int line)
+ {
+-	if (IS_ENABLED(CONFIG_BTRFS_ASSERT)) {
+-		pr_err("assertion failed: %s, in %s:%d\n", expr, file, line);
+-		BUG();
+-	}
++	pr_err("assertion failed: %s, in %s:%d\n", expr, file, line);
++	BUG();
+ }
+ 
+-#define ASSERT(expr)	\
+-	(likely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
++#define ASSERT(expr)						\
++	(likely(expr) ? (void)0 : assertfail(#expr, __FILE__, __LINE__))
++
++#else
++static inline void assertfail(const char *expr, const char* file, int line) { }
++#define ASSERT(expr)	(void)(expr)
++#endif
+ 
+ /*
+  * Use that for functions that are conditionally exported for sanity tests but
+-- 
+2.20.1
+
diff --git a/queue-5.5/bus-fsl-mc-properly-empty-initialize-structure.patch b/queue-5.5/bus-fsl-mc-properly-empty-initialize-structure.patch
new file mode 100644
index 00000000000..5524aa818b6
--- /dev/null
+++ b/queue-5.5/bus-fsl-mc-properly-empty-initialize-structure.patch
@@ -0,0 +1,44 @@
+From 8a44afabb00e5b91c1ccac602f66ee9a222614c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 16:29:50 +0200
+Subject: bus: fsl-mc: properly empty-initialize structure
+
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+
+[ Upstream commit cff081ea9d0962defd733daf6778f62b1dac3daa ]
+
+Use the proper form of the empty initializer when working with
+structures that contain an array. Otherwise, older gcc versions (eg gcc
+4.9) will complain about this.
+
+Fixes: 1ac210d128ef ("bus: fsl-mc: add the fsl_mc_get_endpoint function")
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Acked-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Link: https://lore.kernel.org/r/20191204142950.30206-1-ioana.ciornei@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
+index a07cc19becdba..c78d10ea641fb 100644
+--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
++++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
+@@ -715,9 +715,9 @@ EXPORT_SYMBOL_GPL(fsl_mc_device_remove);
+ struct fsl_mc_device *fsl_mc_get_endpoint(struct fsl_mc_device *mc_dev)
+ {
+ 	struct fsl_mc_device *mc_bus_dev, *endpoint;
+-	struct fsl_mc_obj_desc endpoint_desc = { 0 };
+-	struct dprc_endpoint endpoint1 = { 0 };
+-	struct dprc_endpoint endpoint2 = { 0 };
++	struct fsl_mc_obj_desc endpoint_desc = {{ 0 }};
++	struct dprc_endpoint endpoint1 = {{ 0 }};
++	struct dprc_endpoint endpoint2 = {{ 0 }};
+ 	int state, err;
+ 
+ 	mc_bus_dev = to_fsl_mc_device(mc_dev->dev.parent);
+-- 
+2.20.1
+
diff --git a/queue-5.5/bus-ti-sysc-implement-quirk-handling-for-clkdm_noaut.patch b/queue-5.5/bus-ti-sysc-implement-quirk-handling-for-clkdm_noaut.patch
new file mode 100644
index 00000000000..1a966f636a9
--- /dev/null
+++ b/queue-5.5/bus-ti-sysc-implement-quirk-handling-for-clkdm_noaut.patch
@@ -0,0 +1,73 @@
+From 843884f32e3f792834f72145f5791a773f5db160 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 08:57:58 -0800
+Subject: bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 94f6345712b37e4bb23cb265ce4c65b9d177e75a ]
+
+For dra7 dcan and dwc3 instances we need to block clockdomain autoidle.
+Let's do this with CLKDM_NOAUTO quirk flag and enable it for dcan and
+dwc3.
+
+Cc: Keerthy <j-keerthy@ti.com>
+Cc: Roger Quadros <rogerq@ti.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c                 | 10 ++++++++--
+ include/linux/platform_data/ti-sysc.h |  1 +
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index ccb44fe790a71..3d79b074f9581 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -479,7 +479,7 @@ static void sysc_clkdm_deny_idle(struct sysc *ddata)
+ {
+ 	struct ti_sysc_platform_data *pdata;
+ 
+-	if (ddata->legacy_mode)
++	if (ddata->legacy_mode || (ddata->cfg.quirks & SYSC_QUIRK_CLKDM_NOAUTO))
+ 		return;
+ 
+ 	pdata = dev_get_platdata(ddata->dev);
+@@ -491,7 +491,7 @@ static void sysc_clkdm_allow_idle(struct sysc *ddata)
+ {
+ 	struct ti_sysc_platform_data *pdata;
+ 
+-	if (ddata->legacy_mode)
++	if (ddata->legacy_mode || (ddata->cfg.quirks & SYSC_QUIRK_CLKDM_NOAUTO))
+ 		return;
+ 
+ 	pdata = dev_get_platdata(ddata->dev);
+@@ -1251,6 +1251,12 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
+ 	/* Quirks that need to be set based on detected module */
+ 	SYSC_QUIRK("aess", 0, 0, 0x10, -1, 0x40000000, 0xffffffff,
+ 		   SYSC_MODULE_QUIRK_AESS),
++	SYSC_QUIRK("dcan", 0x48480000, 0x20, -1, -1, 0xa3170504, 0xffffffff,
++		   SYSC_QUIRK_CLKDM_NOAUTO),
++	SYSC_QUIRK("dwc3", 0x48880000, 0, 0x10, -1, 0x500a0200, 0xffffffff,
++		   SYSC_QUIRK_CLKDM_NOAUTO),
++	SYSC_QUIRK("dwc3", 0x488c0000, 0, 0x10, -1, 0x500a0200, 0xffffffff,
++		   SYSC_QUIRK_CLKDM_NOAUTO),
+ 	SYSC_QUIRK("hdq1w", 0, 0, 0x14, 0x18, 0x00000006, 0xffffffff,
+ 		   SYSC_MODULE_QUIRK_HDQ1W),
+ 	SYSC_QUIRK("hdq1w", 0, 0, 0x14, 0x18, 0x0000000a, 0xffffffff,
+diff --git a/include/linux/platform_data/ti-sysc.h b/include/linux/platform_data/ti-sysc.h
+index 8cfe570fdece6..2cbde6542849d 100644
+--- a/include/linux/platform_data/ti-sysc.h
++++ b/include/linux/platform_data/ti-sysc.h
+@@ -49,6 +49,7 @@ struct sysc_regbits {
+ 	s8 emufree_shift;
+ };
+ 
++#define SYSC_QUIRK_CLKDM_NOAUTO		BIT(21)
+ #define SYSC_QUIRK_FORCE_MSTANDBY	BIT(20)
+ #define SYSC_MODULE_QUIRK_AESS		BIT(19)
+ #define SYSC_MODULE_QUIRK_SGX		BIT(18)
+-- 
+2.20.1
+
diff --git a/queue-5.5/ceph-check-availability-of-mds-cluster-on-mount-afte.patch b/queue-5.5/ceph-check-availability-of-mds-cluster-on-mount-afte.patch
new file mode 100644
index 00000000000..1f1d13a15b5
--- /dev/null
+++ b/queue-5.5/ceph-check-availability-of-mds-cluster-on-mount-afte.patch
@@ -0,0 +1,59 @@
+From 5abc17e502deba0e49a9d8e8fdc865ff0369bd53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 20:29:40 -0500
+Subject: ceph: check availability of mds cluster on mount after wait timeout
+
+From: Xiubo Li <xiubli@redhat.com>
+
+[ Upstream commit 97820058fb2831a4b203981fa2566ceaaa396103 ]
+
+If all the MDS daemons are down for some reason, then the first mount
+attempt will fail with EIO after the mount request times out.  A mount
+attempt will also fail with EIO if all of the MDS's are laggy.
+
+This patch changes the code to return -EHOSTUNREACH in these situations
+and adds a pr_info error message to help the admin determine the cause.
+
+URL: https://tracker.ceph.com/issues/4386
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/mds_client.c | 3 +--
+ fs/ceph/super.c      | 5 +++++
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 145d46ba25ae2..816d49aed96bc 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -2558,8 +2558,7 @@ static void __do_request(struct ceph_mds_client *mdsc,
+ 		if (!(mdsc->fsc->mount_options->flags &
+ 		      CEPH_MOUNT_OPT_MOUNTWAIT) &&
+ 		    !ceph_mdsmap_is_cluster_available(mdsc->mdsmap)) {
+-			err = -ENOENT;
+-			pr_info("probably no mds server is up\n");
++			err = -EHOSTUNREACH;
+ 			goto finish;
+ 		}
+ 	}
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index 9b5536451528b..5a708ac9a54c3 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -1066,6 +1066,11 @@ static int ceph_get_tree(struct fs_context *fc)
+ 	return 0;
+ 
+ out_splat:
++	if (!ceph_mdsmap_is_cluster_available(fsc->mdsc->mdsmap)) {
++		pr_info("No mds server is up or the cluster is laggy\n");
++		err = -EHOSTUNREACH;
++	}
++
+ 	ceph_mdsc_close_sessions(fsc->mdsc);
+ 	deactivate_locked_super(sb);
+ 	goto out_final;
+-- 
+2.20.1
+
diff --git a/queue-5.5/char-hpet-fix-out-of-bounds-read-bug.patch b/queue-5.5/char-hpet-fix-out-of-bounds-read-bug.patch
new file mode 100644
index 00000000000..a5fd452c424
--- /dev/null
+++ b/queue-5.5/char-hpet-fix-out-of-bounds-read-bug.patch
@@ -0,0 +1,56 @@
+From 731c4259c506b81fa34e150b53a90c0b46f745b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 20:26:13 -0600
+Subject: char: hpet: Fix out-of-bounds read bug
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit 98c49f1746ac44ccc164e914b9a44183fad09f51 ]
+
+Currently, there is an out-of-bounds read on array hpetp->hp_dev
+in the following for loop:
+
+870         for (i = 0; i < hdp->hd_nirqs; i++)
+871                 hpetp->hp_dev[i].hd_hdwirq = hdp->hd_irq[i];
+
+This is due to the recent change from one-element array to
+flexible-array member in struct hpets:
+
+104 struct hpets {
+	...
+113         struct hpet_dev hp_dev[];
+114 };
+
+This change affected the total size of the dynamic memory
+allocation, decreasing it by one time the size of struct hpet_dev.
+
+Fix this by adjusting the allocation size when calling
+struct_size().
+
+Fixes: 987f028b8637c ("char: hpet: Use flexible-array member")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Acked-by: Eric Biggers <ebiggers@kernel.org>
+Link: https://lore.kernel.org/r/20200129022613.GA24281@embeddedor.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hpet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
+index 9ac6671bb5141..f69609b47fef8 100644
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -855,7 +855,7 @@ int hpet_alloc(struct hpet_data *hdp)
+ 		return 0;
+ 	}
+ 
+-	hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs - 1),
++	hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs),
+ 			GFP_KERNEL);
+ 
+ 	if (!hpetp)
+-- 
+2.20.1
+
diff --git a/queue-5.5/char-random-silence-a-lockdep-splat-with-printk.patch b/queue-5.5/char-random-silence-a-lockdep-splat-with-printk.patch
new file mode 100644
index 00000000000..cbf822987f4
--- /dev/null
+++ b/queue-5.5/char-random-silence-a-lockdep-splat-with-printk.patch
@@ -0,0 +1,278 @@
+From 2f103e799d393101e42080d20211ec99cd7b4df8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 16:16:25 -0500
+Subject: char/random: silence a lockdep splat with printk()
+
+From: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+
+[ Upstream commit 1b710b1b10eff9d46666064ea25f079f70bc67a8 ]
+
+Sergey didn't like the locking order,
+
+uart_port->lock  ->  tty_port->lock
+
+uart_write (uart_port->lock)
+  __uart_start
+    pl011_start_tx
+      pl011_tx_chars
+        uart_write_wakeup
+          tty_port_tty_wakeup
+            tty_port_default
+              tty_port_tty_get (tty_port->lock)
+
+but those code is so old, and I have no clue how to de-couple it after
+checking other locks in the splat. There is an onging effort to make all
+printk() as deferred, so until that happens, workaround it for now as a
+short-term fix.
+
+LTP: starting iogen01 (export LTPROOT; rwtest -N iogen01 -i 120s -s
+read,write -Da -Dv -n 2 500b:$TMPDIR/doio.f1.$$
+1000b:$TMPDIR/doio.f2.$$)
+WARNING: possible circular locking dependency detected
+------------------------------------------------------
+doio/49441 is trying to acquire lock:
+ffff008b7cff7290 (&(&zone->lock)->rlock){..-.}, at: rmqueue+0x138/0x2050
+
+but task is already holding lock:
+60ff000822352818 (&pool->lock/1){-.-.}, at: start_flush_work+0xd8/0x3f0
+
+  which lock already depends on the new lock.
+
+  the existing dependency chain (in reverse order) is:
+
+  -> #4 (&pool->lock/1){-.-.}:
+       lock_acquire+0x320/0x360
+       _raw_spin_lock+0x64/0x80
+       __queue_work+0x4b4/0xa10
+       queue_work_on+0xac/0x11c
+       tty_schedule_flip+0x84/0xbc
+       tty_flip_buffer_push+0x1c/0x28
+       pty_write+0x98/0xd0
+       n_tty_write+0x450/0x60c
+       tty_write+0x338/0x474
+       __vfs_write+0x88/0x214
+       vfs_write+0x12c/0x1a4
+       redirected_tty_write+0x90/0xdc
+       do_loop_readv_writev+0x140/0x180
+       do_iter_write+0xe0/0x10c
+       vfs_writev+0x134/0x1cc
+       do_writev+0xbc/0x130
+       __arm64_sys_writev+0x58/0x8c
+       el0_svc_handler+0x170/0x240
+       el0_sync_handler+0x150/0x250
+       el0_sync+0x164/0x180
+
+  -> #3 (&(&port->lock)->rlock){-.-.}:
+       lock_acquire+0x320/0x360
+       _raw_spin_lock_irqsave+0x7c/0x9c
+       tty_port_tty_get+0x24/0x60
+       tty_port_default_wakeup+0x1c/0x3c
+       tty_port_tty_wakeup+0x34/0x40
+       uart_write_wakeup+0x28/0x44
+       pl011_tx_chars+0x1b8/0x270
+       pl011_start_tx+0x24/0x70
+       __uart_start+0x5c/0x68
+       uart_write+0x164/0x1c8
+       do_output_char+0x33c/0x348
+       n_tty_write+0x4bc/0x60c
+       tty_write+0x338/0x474
+       redirected_tty_write+0xc0/0xdc
+       do_loop_readv_writev+0x140/0x180
+       do_iter_write+0xe0/0x10c
+       vfs_writev+0x134/0x1cc
+       do_writev+0xbc/0x130
+       __arm64_sys_writev+0x58/0x8c
+       el0_svc_handler+0x170/0x240
+       el0_sync_handler+0x150/0x250
+       el0_sync+0x164/0x180
+
+  -> #2 (&port_lock_key){-.-.}:
+       lock_acquire+0x320/0x360
+       _raw_spin_lock+0x64/0x80
+       pl011_console_write+0xec/0x2cc
+       console_unlock+0x794/0x96c
+       vprintk_emit+0x260/0x31c
+       vprintk_default+0x54/0x7c
+       vprintk_func+0x218/0x254
+       printk+0x7c/0xa4
+       register_console+0x734/0x7b0
+       uart_add_one_port+0x734/0x834
+       pl011_register_port+0x6c/0xac
+       sbsa_uart_probe+0x234/0x2ec
+       platform_drv_probe+0xd4/0x124
+       really_probe+0x250/0x71c
+       driver_probe_device+0xb4/0x200
+       __device_attach_driver+0xd8/0x188
+       bus_for_each_drv+0xbc/0x110
+       __device_attach+0x120/0x220
+       device_initial_probe+0x20/0x2c
+       bus_probe_device+0x54/0x100
+       device_add+0xae8/0xc2c
+       platform_device_add+0x278/0x3b8
+       platform_device_register_full+0x238/0x2ac
+       acpi_create_platform_device+0x2dc/0x3a8
+       acpi_bus_attach+0x390/0x3cc
+       acpi_bus_attach+0x108/0x3cc
+       acpi_bus_attach+0x108/0x3cc
+       acpi_bus_attach+0x108/0x3cc
+       acpi_bus_scan+0x7c/0xb0
+       acpi_scan_init+0xe4/0x304
+       acpi_init+0x100/0x114
+       do_one_initcall+0x348/0x6a0
+       do_initcall_level+0x190/0x1fc
+       do_basic_setup+0x34/0x4c
+       kernel_init_freeable+0x19c/0x260
+       kernel_init+0x18/0x338
+       ret_from_fork+0x10/0x18
+
+  -> #1 (console_owner){-...}:
+       lock_acquire+0x320/0x360
+       console_lock_spinning_enable+0x6c/0x7c
+       console_unlock+0x4f8/0x96c
+       vprintk_emit+0x260/0x31c
+       vprintk_default+0x54/0x7c
+       vprintk_func+0x218/0x254
+       printk+0x7c/0xa4
+       get_random_u64+0x1c4/0x1dc
+       shuffle_pick_tail+0x40/0xac
+       __free_one_page+0x424/0x710
+       free_one_page+0x70/0x120
+       __free_pages_ok+0x61c/0xa94
+       __free_pages_core+0x1bc/0x294
+       memblock_free_pages+0x38/0x48
+       __free_pages_memory+0xcc/0xfc
+       __free_memory_core+0x70/0x78
+       free_low_memory_core_early+0x148/0x18c
+       memblock_free_all+0x18/0x54
+       mem_init+0xb4/0x17c
+       mm_init+0x14/0x38
+       start_kernel+0x19c/0x530
+
+  -> #0 (&(&zone->lock)->rlock){..-.}:
+       validate_chain+0xf6c/0x2e2c
+       __lock_acquire+0x868/0xc2c
+       lock_acquire+0x320/0x360
+       _raw_spin_lock+0x64/0x80
+       rmqueue+0x138/0x2050
+       get_page_from_freelist+0x474/0x688
+       __alloc_pages_nodemask+0x3b4/0x18dc
+       alloc_pages_current+0xd0/0xe0
+       alloc_slab_page+0x2b4/0x5e0
+       new_slab+0xc8/0x6bc
+       ___slab_alloc+0x3b8/0x640
+       kmem_cache_alloc+0x4b4/0x588
+       __debug_object_init+0x778/0x8b4
+       debug_object_init_on_stack+0x40/0x50
+       start_flush_work+0x16c/0x3f0
+       __flush_work+0xb8/0x124
+       flush_work+0x20/0x30
+       xlog_cil_force_lsn+0x88/0x204 [xfs]
+       xfs_log_force_lsn+0x128/0x1b8 [xfs]
+       xfs_file_fsync+0x3c4/0x488 [xfs]
+       vfs_fsync_range+0xb0/0xd0
+       generic_write_sync+0x80/0xa0 [xfs]
+       xfs_file_buffered_aio_write+0x66c/0x6e4 [xfs]
+       xfs_file_write_iter+0x1a0/0x218 [xfs]
+       __vfs_write+0x1cc/0x214
+       vfs_write+0x12c/0x1a4
+       ksys_write+0xb0/0x120
+       __arm64_sys_write+0x54/0x88
+       el0_svc_handler+0x170/0x240
+       el0_sync_handler+0x150/0x250
+       el0_sync+0x164/0x180
+
+       other info that might help us debug this:
+
+ Chain exists of:
+   &(&zone->lock)->rlock --> &(&port->lock)->rlock --> &pool->lock/1
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  lock(&pool->lock/1);
+                               lock(&(&port->lock)->rlock);
+                               lock(&pool->lock/1);
+  lock(&(&zone->lock)->rlock);
+
+                *** DEADLOCK ***
+
+4 locks held by doio/49441:
+ #0: a0ff00886fc27408 (sb_writers#8){.+.+}, at: vfs_write+0x118/0x1a4
+ #1: 8fff00080810dfe0 (&xfs_nondir_ilock_class){++++}, at:
+xfs_ilock+0x2a8/0x300 [xfs]
+ #2: ffff9000129f2390 (rcu_read_lock){....}, at:
+rcu_lock_acquire+0x8/0x38
+ #3: 60ff000822352818 (&pool->lock/1){-.-.}, at:
+start_flush_work+0xd8/0x3f0
+
+               stack backtrace:
+CPU: 48 PID: 49441 Comm: doio Tainted: G        W
+Hardware name: HPE Apollo 70             /C01_APACHE_MB         , BIOS
+L50_5.13_1.11 06/18/2019
+Call trace:
+ dump_backtrace+0x0/0x248
+ show_stack+0x20/0x2c
+ dump_stack+0xe8/0x150
+ print_circular_bug+0x368/0x380
+ check_noncircular+0x28c/0x294
+ validate_chain+0xf6c/0x2e2c
+ __lock_acquire+0x868/0xc2c
+ lock_acquire+0x320/0x360
+ _raw_spin_lock+0x64/0x80
+ rmqueue+0x138/0x2050
+ get_page_from_freelist+0x474/0x688
+ __alloc_pages_nodemask+0x3b4/0x18dc
+ alloc_pages_current+0xd0/0xe0
+ alloc_slab_page+0x2b4/0x5e0
+ new_slab+0xc8/0x6bc
+ ___slab_alloc+0x3b8/0x640
+ kmem_cache_alloc+0x4b4/0x588
+ __debug_object_init+0x778/0x8b4
+ debug_object_init_on_stack+0x40/0x50
+ start_flush_work+0x16c/0x3f0
+ __flush_work+0xb8/0x124
+ flush_work+0x20/0x30
+ xlog_cil_force_lsn+0x88/0x204 [xfs]
+ xfs_log_force_lsn+0x128/0x1b8 [xfs]
+ xfs_file_fsync+0x3c4/0x488 [xfs]
+ vfs_fsync_range+0xb0/0xd0
+ generic_write_sync+0x80/0xa0 [xfs]
+ xfs_file_buffered_aio_write+0x66c/0x6e4 [xfs]
+ xfs_file_write_iter+0x1a0/0x218 [xfs]
+ __vfs_write+0x1cc/0x214
+ vfs_write+0x12c/0x1a4
+ ksys_write+0xb0/0x120
+ __arm64_sys_write+0x54/0x88
+ el0_svc_handler+0x170/0x240
+ el0_sync_handler+0x150/0x250
+ el0_sync+0x164/0x180
+
+Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+Signed-off-by: Qian Cai <cai@lca.pw>
+Link: https://lore.kernel.org/r/1573679785-21068-1-git-send-email-cai@lca.pw
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/random.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index cda12933a17da..ea1973d358430 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1687,8 +1687,9 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
+ 	print_once = true;
+ #endif
+ 	if (__ratelimit(&unseeded_warning))
+-		pr_notice("random: %s called from %pS with crng_init=%d\n",
+-			  func_name, caller, crng_init);
++		printk_deferred(KERN_NOTICE "random: %s called from %pS "
++				"with crng_init=%d\n", func_name, caller,
++				crng_init);
+ }
+ 
+ /*
+-- 
+2.20.1
+
diff --git a/queue-5.5/cifs-fix-mount-options-set-in-automount.patch b/queue-5.5/cifs-fix-mount-options-set-in-automount.patch
new file mode 100644
index 00000000000..f67436be7fb
--- /dev/null
+++ b/queue-5.5/cifs-fix-mount-options-set-in-automount.patch
@@ -0,0 +1,215 @@
+From 12521c2982d7acb232913be68ee3bf9a97df2fa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2020 10:03:19 -0300
+Subject: cifs: Fix mount options set in automount
+
+From: Paulo Alcantara (SUSE) <pc@cjr.nz>
+
+[ Upstream commit 5739375ee4230980166807d347cc21c305532bbc ]
+
+Starting from 4a367dc04435, we must set the mount options based on the
+DFS full path rather than the resolved target, that is, cifs_mount()
+will be responsible for resolving the DFS link (cached) as well as
+performing failover to any other targets in the referral.
+
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reported-by: Martijn de Gouw <martijn.de.gouw@prodrive-technologies.com>
+Fixes: 4a367dc04435 ("cifs: Add support for failover in cifs_mount()")
+Link: https://lore.kernel.org/linux-cifs/39643d7d-2abb-14d3-ced6-c394fab9a777@prodrive-technologies.com
+Tested-by: Martijn de Gouw <martijn.de.gouw@prodrive-technologies.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifs_dfs_ref.c | 97 +++++++++++++++++++-----------------------
+ 1 file changed, 43 insertions(+), 54 deletions(-)
+
+diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
+index 41957b82d7960..606f26d862dc1 100644
+--- a/fs/cifs/cifs_dfs_ref.c
++++ b/fs/cifs/cifs_dfs_ref.c
+@@ -120,17 +120,17 @@ cifs_build_devname(char *nodename, const char *prepath)
+ 
+ 
+ /**
+- * cifs_compose_mount_options	-	creates mount options for refferral
++ * cifs_compose_mount_options	-	creates mount options for referral
+  * @sb_mountdata:	parent/root DFS mount options (template)
+  * @fullpath:		full path in UNC format
+- * @ref:		server's referral
++ * @ref:		optional server's referral
+  * @devname:		optional pointer for saving device name
+  *
+  * creates mount options for submount based on template options sb_mountdata
+  * and replacing unc,ip,prefixpath options with ones we've got form ref_unc.
+  *
+  * Returns: pointer to new mount options or ERR_PTR.
+- * Caller is responcible for freeing retunrned value if it is not error.
++ * Caller is responsible for freeing returned value if it is not error.
+  */
+ char *cifs_compose_mount_options(const char *sb_mountdata,
+ 				   const char *fullpath,
+@@ -150,18 +150,27 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
+ 	if (sb_mountdata == NULL)
+ 		return ERR_PTR(-EINVAL);
+ 
+-	if (strlen(fullpath) - ref->path_consumed) {
+-		prepath = fullpath + ref->path_consumed;
+-		/* skip initial delimiter */
+-		if (*prepath == '/' || *prepath == '\\')
+-			prepath++;
+-	}
++	if (ref) {
++		if (strlen(fullpath) - ref->path_consumed) {
++			prepath = fullpath + ref->path_consumed;
++			/* skip initial delimiter */
++			if (*prepath == '/' || *prepath == '\\')
++				prepath++;
++		}
+ 
+-	name = cifs_build_devname(ref->node_name, prepath);
+-	if (IS_ERR(name)) {
+-		rc = PTR_ERR(name);
+-		name = NULL;
+-		goto compose_mount_options_err;
++		name = cifs_build_devname(ref->node_name, prepath);
++		if (IS_ERR(name)) {
++			rc = PTR_ERR(name);
++			name = NULL;
++			goto compose_mount_options_err;
++		}
++	} else {
++		name = cifs_build_devname((char *)fullpath, NULL);
++		if (IS_ERR(name)) {
++			rc = PTR_ERR(name);
++			name = NULL;
++			goto compose_mount_options_err;
++		}
+ 	}
+ 
+ 	rc = dns_resolve_server_name_to_ip(name, &srvIP);
+@@ -225,6 +234,8 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
+ 
+ 	if (devname)
+ 		*devname = name;
++	else
++		kfree(name);
+ 
+ 	/*cifs_dbg(FYI, "%s: parent mountdata: %s\n", __func__, sb_mountdata);*/
+ 	/*cifs_dbg(FYI, "%s: submount mountdata: %s\n", __func__, mountdata );*/
+@@ -241,23 +252,23 @@ compose_mount_options_err:
+ }
+ 
+ /**
+- * cifs_dfs_do_refmount - mounts specified path using provided refferal
++ * cifs_dfs_do_mount - mounts specified path using DFS full path
++ *
++ * Always pass down @fullpath to smb3_do_mount() so we can use the root server
++ * to perform failover in case we failed to connect to the first target in the
++ * referral.
++ *
+  * @cifs_sb:		parent/root superblock
+  * @fullpath:		full path in UNC format
+- * @ref:		server's referral
+  */
+-static struct vfsmount *cifs_dfs_do_refmount(struct dentry *mntpt,
+-		struct cifs_sb_info *cifs_sb,
+-		const char *fullpath, const struct dfs_info3_param *ref)
++static struct vfsmount *cifs_dfs_do_mount(struct dentry *mntpt,
++					  struct cifs_sb_info *cifs_sb,
++					  const char *fullpath)
+ {
+ 	struct vfsmount *mnt;
+ 	char *mountdata;
+ 	char *devname;
+ 
+-	/*
+-	 * Always pass down the DFS full path to smb3_do_mount() so we
+-	 * can use it later for failover.
+-	 */
+ 	devname = kstrndup(fullpath, strlen(fullpath), GFP_KERNEL);
+ 	if (!devname)
+ 		return ERR_PTR(-ENOMEM);
+@@ -266,7 +277,7 @@ static struct vfsmount *cifs_dfs_do_refmount(struct dentry *mntpt,
+ 
+ 	/* strip first '\' from fullpath */
+ 	mountdata = cifs_compose_mount_options(cifs_sb->mountdata,
+-					       fullpath + 1, ref, NULL);
++					       fullpath + 1, NULL, NULL);
+ 	if (IS_ERR(mountdata)) {
+ 		kfree(devname);
+ 		return (struct vfsmount *)mountdata;
+@@ -278,28 +289,16 @@ static struct vfsmount *cifs_dfs_do_refmount(struct dentry *mntpt,
+ 	return mnt;
+ }
+ 
+-static void dump_referral(const struct dfs_info3_param *ref)
+-{
+-	cifs_dbg(FYI, "DFS: ref path: %s\n", ref->path_name);
+-	cifs_dbg(FYI, "DFS: node path: %s\n", ref->node_name);
+-	cifs_dbg(FYI, "DFS: fl: %d, srv_type: %d\n",
+-		 ref->flags, ref->server_type);
+-	cifs_dbg(FYI, "DFS: ref_flags: %d, path_consumed: %d\n",
+-		 ref->ref_flag, ref->path_consumed);
+-}
+-
+ /*
+  * Create a vfsmount that we can automount
+  */
+ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
+ {
+-	struct dfs_info3_param referral = {0};
+ 	struct cifs_sb_info *cifs_sb;
+ 	struct cifs_ses *ses;
+ 	struct cifs_tcon *tcon;
+ 	char *full_path, *root_path;
+ 	unsigned int xid;
+-	int len;
+ 	int rc;
+ 	struct vfsmount *mnt;
+ 
+@@ -357,7 +356,7 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
+ 	if (!rc) {
+ 		rc = dfs_cache_find(xid, ses, cifs_sb->local_nls,
+ 				    cifs_remap(cifs_sb), full_path + 1,
+-				    &referral, NULL);
++				    NULL, NULL);
+ 	}
+ 
+ 	free_xid(xid);
+@@ -366,26 +365,16 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
+ 		mnt = ERR_PTR(rc);
+ 		goto free_root_path;
+ 	}
+-
+-	dump_referral(&referral);
+-
+-	len = strlen(referral.node_name);
+-	if (len < 2) {
+-		cifs_dbg(VFS, "%s: Net Address path too short: %s\n",
+-			 __func__, referral.node_name);
+-		mnt = ERR_PTR(-EINVAL);
+-		goto free_dfs_ref;
+-	}
+ 	/*
+-	 * cifs_mount() will retry every available node server in case
+-	 * of failures.
++	 * OK - we were able to get and cache a referral for @full_path.
++	 *
++	 * Now, pass it down to cifs_mount() and it will retry every available
++	 * node server in case of failures - no need to do it here.
+ 	 */
+-	mnt = cifs_dfs_do_refmount(mntpt, cifs_sb, full_path, &referral);
+-	cifs_dbg(FYI, "%s: cifs_dfs_do_refmount:%s , mnt:%p\n", __func__,
+-		 referral.node_name, mnt);
++	mnt = cifs_dfs_do_mount(mntpt, cifs_sb, full_path);
++	cifs_dbg(FYI, "%s: cifs_dfs_do_mount:%s , mnt:%p\n", __func__,
++		 full_path + 1, mnt);
+ 
+-free_dfs_ref:
+-	free_dfs_info_param(&referral);
+ free_root_path:
+ 	kfree(root_path);
+ free_full_path:
+-- 
+2.20.1
+
diff --git a/queue-5.5/cifs-fix-null-dereference-in-match_prepath.patch b/queue-5.5/cifs-fix-null-dereference-in-match_prepath.patch
new file mode 100644
index 00000000000..88b905cbaaa
--- /dev/null
+++ b/queue-5.5/cifs-fix-null-dereference-in-match_prepath.patch
@@ -0,0 +1,43 @@
+From 0b296ff4ed3a57c1f148ed659390d2c158cbc28c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 11:07:56 +1000
+Subject: cifs: fix NULL dereference in match_prepath
+
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+
+[ Upstream commit fe1292686333d1dadaf84091f585ee903b9ddb84 ]
+
+RHBZ: 1760879
+
+Fix an oops in match_prepath() by making sure that the prepath string is not
+NULL before we pass it into strcmp().
+
+This is similar to other checks we make for example in cifs_root_iget()
+
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 05ea0e2b7e0e8..0aa3623ae0e16 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3709,8 +3709,10 @@ match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data)
+ {
+ 	struct cifs_sb_info *old = CIFS_SB(sb);
+ 	struct cifs_sb_info *new = mnt_data->cifs_sb;
+-	bool old_set = old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
+-	bool new_set = new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
++	bool old_set = (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
++		old->prepath;
++	bool new_set = (new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
++		new->prepath;
+ 
+ 	if (old_set && new_set && !strcmp(new->prepath, old->prepath))
+ 		return 1;
+-- 
+2.20.1
+
diff --git a/queue-5.5/cifs-fix-unitialized-variable-poential-problem-with-.patch b/queue-5.5/cifs-fix-unitialized-variable-poential-problem-with-.patch
new file mode 100644
index 00000000000..40d7a9b93b4
--- /dev/null
+++ b/queue-5.5/cifs-fix-unitialized-variable-poential-problem-with-.patch
@@ -0,0 +1,43 @@
+From 5688fb7cef0806f8bd4b243101958b5ec923fbd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 15:58:00 -0600
+Subject: cifs: fix unitialized variable poential problem with network I/O
+ cache lock patch
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit 463a7b457c02250a84faa1d23c52da9e3364aed2 ]
+
+static analysis with Coverity detected an issue with the following
+commit:
+
+ Author: Paulo Alcantara (SUSE) <pc@cjr.nz>
+ Date:   Wed Dec 4 17:38:03 2019 -0300
+
+    cifs: Avoid doing network I/O while holding cache lock
+
+Addresses-Coverity: ("Uninitialized pointer read")
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/dfs_cache.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/dfs_cache.c b/fs/cifs/dfs_cache.c
+index 2faa05860a483..cf6cec59696c2 100644
+--- a/fs/cifs/dfs_cache.c
++++ b/fs/cifs/dfs_cache.c
+@@ -1319,7 +1319,7 @@ static struct cifs_ses *find_root_ses(struct dfs_cache_vol_info *vi,
+ 	char *mdata = NULL, *devname = NULL;
+ 	struct TCP_Server_Info *server;
+ 	struct cifs_ses *ses;
+-	struct smb_vol vol;
++	struct smb_vol vol = {NULL};
+ 
+ 	rpath = get_dfs_root(path);
+ 	if (IS_ERR(rpath))
+-- 
+2.20.1
+
diff --git a/queue-5.5/cifs-log-warning-message-once-if-out-of-disk-space.patch b/queue-5.5/cifs-log-warning-message-once-if-out-of-disk-space.patch
new file mode 100644
index 00000000000..c498f58c75f
--- /dev/null
+++ b/queue-5.5/cifs-log-warning-message-once-if-out-of-disk-space.patch
@@ -0,0 +1,42 @@
+From b43fd33a9b3270b558358a009bcddfb50835d1ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2020 16:52:11 -0600
+Subject: cifs: log warning message (once) if out of disk space
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit d6fd41905ec577851734623fb905b1763801f5ef ]
+
+We ran into a confusing problem where an application wasn't checking
+return code on close and so user didn't realize that the application
+ran out of disk space.  log a warning message (once) in these
+cases. For example:
+
+  [ 8407.391909] Out of space writing to \\oleg-server\small-share
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reported-by: Oleg Kravtsov <oleg@tuxera.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 0a3b37abc5e12..6c9497c18f0b8 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -4029,6 +4029,9 @@ smb2_writev_callback(struct mid_q_entry *mid)
+ 				     wdata->cfile->fid.persistent_fid,
+ 				     tcon->tid, tcon->ses->Suid, wdata->offset,
+ 				     wdata->bytes, wdata->result);
++		if (wdata->result == -ENOSPC)
++			printk_once(KERN_WARNING "Out of space writing to %s\n",
++				    tcon->treeName);
+ 	} else
+ 		trace_smb3_write_done(0 /* no xid */,
+ 				      wdata->cfile->fid.persistent_fid,
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-actually-call-the-clock-init-before-any-other-ca.patch b/queue-5.5/clk-actually-call-the-clock-init-before-any-other-ca.patch
new file mode 100644
index 00000000000..4c846d212f0
--- /dev/null
+++ b/queue-5.5/clk-actually-call-the-clock-init-before-any-other-ca.patch
@@ -0,0 +1,69 @@
+From b3dcd5964e2c438711aba7bf637f32215f863bea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 14:39:52 +0200
+Subject: clk: actually call the clock init before any other callback of the
+ clock
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit f6fa75ca912be6021335de63a32aa4d295f3c524 ]
+
+ __clk_init_parent() will call the .get_parent() callback of the clock
+ so .init() must run before.
+
+Fixes: 541debae0adf ("clk: call the clock init() callback before any other ops callback")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lkml.kernel.org/r/20190924123954.31561-2-jbrunet@baylibre.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 772258de2d1f3..53585cfc4b9ba 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3338,6 +3338,21 @@ static int __clk_core_init(struct clk_core *core)
+ 		goto out;
+ 	}
+ 
++	/*
++	 * optional platform-specific magic
++	 *
++	 * The .init callback is not used by any of the basic clock types, but
++	 * exists for weird hardware that must perform initialization magic.
++	 * Please consider other ways of solving initialization problems before
++	 * using this callback, as its use is discouraged.
++	 *
++	 * If it exist, this callback should called before any other callback of
++	 * the clock
++	 */
++	if (core->ops->init)
++		core->ops->init(core->hw);
++
++
+ 	core->parent = __clk_init_parent(core);
+ 
+ 	/*
+@@ -3362,17 +3377,6 @@ static int __clk_core_init(struct clk_core *core)
+ 		core->orphan = true;
+ 	}
+ 
+-	/*
+-	 * optional platform-specific magic
+-	 *
+-	 * The .init callback is not used by any of the basic clock types, but
+-	 * exists for weird hardware that must perform initialization magic.
+-	 * Please consider other ways of solving initialization problems before
+-	 * using this callback, as its use is discouraged.
+-	 */
+-	if (core->ops->init)
+-		core->ops->init(core->hw);
+-
+ 	/*
+ 	 * Set clk's accuracy.  The preferred method is to use
+ 	 * .recalc_accuracy. For simple clocks and lazy developers the default
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-at91-sam9x60-fix-programmable-clock-prescaler.patch b/queue-5.5/clk-at91-sam9x60-fix-programmable-clock-prescaler.patch
new file mode 100644
index 00000000000..f5bff5f6383
--- /dev/null
+++ b/queue-5.5/clk-at91-sam9x60-fix-programmable-clock-prescaler.patch
@@ -0,0 +1,41 @@
+From f70cd95db7d656a6e28eb12add04007da24ec0c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 11:25:19 +0000
+Subject: clk: at91: sam9x60: fix programmable clock prescaler
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit 66d9f5214c9ba1c151478f99520b6817302d50dc ]
+
+The prescaler works as parent rate divided by (PRES + 1) (is_pres_direct == 1)
+It does not work in the way of parent rate shifted to the right by (PRES + 1),
+which means division by 2^(PRES + 1) (is_pres_direct == 0)
+Thus is_pres_direct must be enabled for this SoC, to make the right computation.
+This field was added in
+commit 45b06682113b ("clk: at91: fix programmable clock for sama5d2")
+SAM9X60 has the same field as SAMA5D2 in the PCK
+
+Fixes: 01e2113de9a5 ("clk: at91: add sam9x60 pmc driver")
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Link: https://lkml.kernel.org/r/1575977088-16781-1-git-send-email-eugen.hristev@microchip.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/sam9x60.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c
+index 86238d5ecb4da..77398aefeb6db 100644
+--- a/drivers/clk/at91/sam9x60.c
++++ b/drivers/clk/at91/sam9x60.c
+@@ -47,6 +47,7 @@ static const struct clk_programmable_layout sam9x60_programmable_layout = {
+ 	.pres_shift = 8,
+ 	.css_mask = 0x1f,
+ 	.have_slck_mck = 0,
++	.is_pres_direct = 1,
+ };
+ 
+ static const struct clk_pcr_layout sam9x60_pcr_layout = {
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-bm1800-remove-set-but-not-used-variable-fref.patch b/queue-5.5/clk-bm1800-remove-set-but-not-used-variable-fref.patch
new file mode 100644
index 00000000000..c178e7971df
--- /dev/null
+++ b/queue-5.5/clk-bm1800-remove-set-but-not-used-variable-fref.patch
@@ -0,0 +1,46 @@
+From 01db19367bdc0d823a6d09bba2c01ba04bbe4cb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2019 03:35:34 +0000
+Subject: clk: bm1800: Remove set but not used variable 'fref'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 59ef4da4e4084d323dd4c3aa4b2fc64ce9e25625 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/clk/clk-bm1880.c: In function 'bm1880_pll_rate_calc':
+drivers/clk/clk-bm1880.c:477:13: warning:
+ variable 'fref' set but not used [-Wunused-but-set-variable]
+
+It is never used, so remove it.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Link: https://lkml.kernel.org/r/20191129033534.188257-1-yuehaibing@huawei.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-bm1880.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk-bm1880.c b/drivers/clk/clk-bm1880.c
+index 4cd175afce9b1..e6d6599d310a1 100644
+--- a/drivers/clk/clk-bm1880.c
++++ b/drivers/clk/clk-bm1880.c
+@@ -474,11 +474,10 @@ static struct bm1880_composite_clock bm1880_composite_clks[] = {
+ static unsigned long bm1880_pll_rate_calc(u32 regval, unsigned long parent_rate)
+ {
+ 	u64 numerator;
+-	u32 fbdiv, fref, refdiv;
++	u32 fbdiv, refdiv;
+ 	u32 postdiv1, postdiv2, denominator;
+ 
+ 	fbdiv = (regval >> 16) & 0xfff;
+-	fref = parent_rate;
+ 	refdiv = regval & 0x1f;
+ 	postdiv1 = (regval >> 8) & 0x7;
+ 	postdiv2 = (regval >> 12) & 0x7;
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-imx-add-correct-failure-handling-for-clk-based-h.patch b/queue-5.5/clk-imx-add-correct-failure-handling-for-clk-based-h.patch
new file mode 100644
index 00000000000..4d93349a172
--- /dev/null
+++ b/queue-5.5/clk-imx-add-correct-failure-handling-for-clk-based-h.patch
@@ -0,0 +1,109 @@
+From 3eb222ab3de76e7bc5da5b36b5d77ba71056d6a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 11:25:40 +0200
+Subject: clk: imx: Add correct failure handling for clk based helpers
+
+From: Abel Vesa <abel.vesa@nxp.com>
+
+[ Upstream commit f60f1c62c3188fcca945581e35e3440ee3fdcc95 ]
+
+If the clk_hw based API returns an error, trying to return the clk from
+hw will end up in a NULL pointer dereference. So adding the to_clk
+checker and using it inside every clk based macro helper we handle that
+case correctly.
+
+This to_clk is also temporary and will go away along with the clk based
+macro helpers once there is no user that need them anymore.
+
+Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk.h | 37 ++++++++++++++++++++++---------------
+ 1 file changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/clk/imx/clk.h b/drivers/clk/imx/clk.h
+index bc5bb6ac86364..30ddbc1ced2ee 100644
+--- a/drivers/clk/imx/clk.h
++++ b/drivers/clk/imx/clk.h
+@@ -54,48 +54,48 @@ extern struct imx_pll14xx_clk imx_1416x_pll;
+ extern struct imx_pll14xx_clk imx_1443x_pll;
+ 
+ #define imx_clk_cpu(name, parent_name, div, mux, pll, step) \
+-	imx_clk_hw_cpu(name, parent_name, div, mux, pll, step)->clk
++	to_clk(imx_clk_hw_cpu(name, parent_name, div, mux, pll, step))
+ 
+ #define clk_register_gate2(dev, name, parent_name, flags, reg, bit_idx, \
+ 				cgr_val, clk_gate_flags, lock, share_count) \
+-	clk_hw_register_gate2(dev, name, parent_name, flags, reg, bit_idx, \
+-				cgr_val, clk_gate_flags, lock, share_count)->clk
++	to_clk(clk_hw_register_gate2(dev, name, parent_name, flags, reg, bit_idx, \
++				cgr_val, clk_gate_flags, lock, share_count))
+ 
+ #define imx_clk_pllv3(type, name, parent_name, base, div_mask) \
+-	imx_clk_hw_pllv3(type, name, parent_name, base, div_mask)->clk
++	to_clk(imx_clk_hw_pllv3(type, name, parent_name, base, div_mask))
+ 
+ #define imx_clk_pfd(name, parent_name, reg, idx) \
+-	imx_clk_hw_pfd(name, parent_name, reg, idx)->clk
++	to_clk(imx_clk_hw_pfd(name, parent_name, reg, idx))
+ 
+ #define imx_clk_gate_exclusive(name, parent, reg, shift, exclusive_mask) \
+-	imx_clk_hw_gate_exclusive(name, parent, reg, shift, exclusive_mask)->clk
++	to_clk(imx_clk_hw_gate_exclusive(name, parent, reg, shift, exclusive_mask))
+ 
+ #define imx_clk_fixed_factor(name, parent, mult, div) \
+-	imx_clk_hw_fixed_factor(name, parent, mult, div)->clk
++	to_clk(imx_clk_hw_fixed_factor(name, parent, mult, div))
+ 
+ #define imx_clk_divider2(name, parent, reg, shift, width) \
+-	imx_clk_hw_divider2(name, parent, reg, shift, width)->clk
++	to_clk(imx_clk_hw_divider2(name, parent, reg, shift, width))
+ 
+ #define imx_clk_gate_dis(name, parent, reg, shift) \
+-	imx_clk_hw_gate_dis(name, parent, reg, shift)->clk
++	to_clk(imx_clk_hw_gate_dis(name, parent, reg, shift))
+ 
+ #define imx_clk_gate2(name, parent, reg, shift) \
+-	imx_clk_hw_gate2(name, parent, reg, shift)->clk
++	to_clk(imx_clk_hw_gate2(name, parent, reg, shift))
+ 
+ #define imx_clk_gate2_flags(name, parent, reg, shift, flags) \
+-	imx_clk_hw_gate2_flags(name, parent, reg, shift, flags)->clk
++	to_clk(imx_clk_hw_gate2_flags(name, parent, reg, shift, flags))
+ 
+ #define imx_clk_gate2_shared2(name, parent, reg, shift, share_count) \
+-	imx_clk_hw_gate2_shared2(name, parent, reg, shift, share_count)->clk
++	to_clk(imx_clk_hw_gate2_shared2(name, parent, reg, shift, share_count))
+ 
+ #define imx_clk_gate3(name, parent, reg, shift) \
+-	imx_clk_hw_gate3(name, parent, reg, shift)->clk
++	to_clk(imx_clk_hw_gate3(name, parent, reg, shift))
+ 
+ #define imx_clk_gate4(name, parent, reg, shift) \
+-	imx_clk_hw_gate4(name, parent, reg, shift)->clk
++	to_clk(imx_clk_hw_gate4(name, parent, reg, shift))
+ 
+ #define imx_clk_mux(name, reg, shift, width, parents, num_parents) \
+-	imx_clk_hw_mux(name, reg, shift, width, parents, num_parents)->clk
++	to_clk(imx_clk_hw_mux(name, reg, shift, width, parents, num_parents))
+ 
+ struct clk *imx_clk_pll14xx(const char *name, const char *parent_name,
+ 		 void __iomem *base, const struct imx_pll14xx_clk *pll_clk);
+@@ -198,6 +198,13 @@ struct clk_hw *imx_clk_hw_fixup_mux(const char *name, void __iomem *reg,
+ 			      u8 shift, u8 width, const char * const *parents,
+ 			      int num_parents, void (*fixup)(u32 *val));
+ 
++static inline struct clk *to_clk(struct clk_hw *hw)
++{
++	if (IS_ERR_OR_NULL(hw))
++		return ERR_CAST(hw);
++	return hw->clk;
++}
++
+ static inline struct clk *imx_clk_fixed(const char *name, int rate)
+ {
+ 	return clk_register_fixed_rate(NULL, name, NULL, 0, rate);
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-meson-meson8b-make-the-ccf-use-the-glitch-free-m.patch b/queue-5.5/clk-meson-meson8b-make-the-ccf-use-the-glitch-free-m.patch
new file mode 100644
index 00000000000..4dcb1236596
--- /dev/null
+++ b/queue-5.5/clk-meson-meson8b-make-the-ccf-use-the-glitch-free-m.patch
@@ -0,0 +1,65 @@
+From a2aae75e567fc8d03729ed9fb3e8345c82b18707 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Dec 2019 20:12:23 +0100
+Subject: clk: meson: meson8b: make the CCF use the glitch-free mali mux
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 8daeaea99caabe24a0929fac17977ebfb882fa86 ]
+
+The "mali_0" or "mali_1" clock trees should not be updated while the
+clock is running. Enforce this by setting CLK_SET_RATE_GATE on the
+"mali_0" and "mali_1" gates. This makes the CCF switch to the "mali_1"
+tree when "mali_0" is currently active and vice versa, which is exactly
+what the vendor driver does when updating the frequency of the mali
+clock.
+
+This fixes a potential hang when changing the GPU frequency at runtime.
+
+Fixes: 74e1f2521f16ff ("clk: meson: meson8b: add the GPU clock tree")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/meson8b.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
+index 67e6691e080c1..8856ce476ccfa 100644
+--- a/drivers/clk/meson/meson8b.c
++++ b/drivers/clk/meson/meson8b.c
+@@ -1764,8 +1764,11 @@ static struct clk_regmap meson8b_hdmi_sys = {
+ 
+ /*
+  * The MALI IP is clocked by two identical clocks (mali_0 and mali_1)
+- * muxed by a glitch-free switch on Meson8b and Meson8m2. Meson8 only
+- * has mali_0 and no glitch-free mux.
++ * muxed by a glitch-free switch on Meson8b and Meson8m2. The CCF can
++ * actually manage this glitch-free mux because it does top-to-bottom
++ * updates the each clock tree and switches to the "inactive" one when
++ * CLK_SET_RATE_GATE is set.
++ * Meson8 only has mali_0 and no glitch-free mux.
+  */
+ static const struct clk_hw *meson8b_mali_0_1_parent_hws[] = {
+ 	&meson8b_xtal.hw,
+@@ -1830,7 +1833,7 @@ static struct clk_regmap meson8b_mali_0 = {
+ 			&meson8b_mali_0_div.hw
+ 		},
+ 		.num_parents = 1,
+-		.flags = CLK_SET_RATE_PARENT,
++		.flags = CLK_SET_RATE_GATE | CLK_SET_RATE_PARENT,
+ 	},
+ };
+ 
+@@ -1885,7 +1888,7 @@ static struct clk_regmap meson8b_mali_1 = {
+ 			&meson8b_mali_1_div.hw
+ 		},
+ 		.num_parents = 1,
+-		.flags = CLK_SET_RATE_PARENT,
++		.flags = CLK_SET_RATE_GATE | CLK_SET_RATE_PARENT,
+ 	},
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-meson-pll-fix-by-0-division-in-__pll_params_to_r.patch b/queue-5.5/clk-meson-pll-fix-by-0-division-in-__pll_params_to_r.patch
new file mode 100644
index 00000000000..cb8ad52c3bb
--- /dev/null
+++ b/queue-5.5/clk-meson-pll-fix-by-0-division-in-__pll_params_to_r.patch
@@ -0,0 +1,77 @@
+From 00c233bb83efa15aa5ab9e8a512dbdf2de67e003 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 12:47:05 +0100
+Subject: clk: meson: pll: Fix by 0 division in __pll_params_to_rate()
+
+From: Remi Pommarel <repk@triplefau.lt>
+
+[ Upstream commit d8488a41800d9f5c80bc0d17b9cc2c91b4841464 ]
+
+Some meson pll registers can be initialized with 0 as N value, introducing
+the following division by 0 when computing rate :
+
+  UBSAN: Undefined behaviour in drivers/clk/meson/clk-pll.c:75:9
+  division by zero
+  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.0-rc3-608075-g86c9af8630e1-dirty #400
+  Call trace:
+   dump_backtrace+0x0/0x1c0
+   show_stack+0x14/0x20
+   dump_stack+0xc4/0x100
+   ubsan_epilogue+0x14/0x68
+   __ubsan_handle_divrem_overflow+0x98/0xb8
+   __pll_params_to_rate+0xdc/0x140
+   meson_clk_pll_recalc_rate+0x278/0x3a0
+   __clk_register+0x7c8/0xbb0
+   devm_clk_hw_register+0x54/0xc0
+   meson_eeclkc_probe+0xf4/0x1a0
+   platform_drv_probe+0x54/0xd8
+   really_probe+0x16c/0x438
+   driver_probe_device+0xb0/0xf0
+   device_driver_attach+0x94/0xa0
+   __driver_attach+0x70/0x108
+   bus_for_each_dev+0xd8/0x128
+   driver_attach+0x30/0x40
+   bus_add_driver+0x1b0/0x2d8
+   driver_register+0xbc/0x1d0
+   __platform_driver_register+0x78/0x88
+   axg_driver_init+0x18/0x20
+   do_one_initcall+0xc8/0x24c
+   kernel_init_freeable+0x2b0/0x344
+   kernel_init+0x10/0x128
+   ret_from_fork+0x10/0x18
+
+This checks if N is null before doing the division.
+
+Fixes: 7a29a869434e ("clk: meson: Add support for Meson clock controller")
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Remi Pommarel <repk@triplefau.lt>
+[jbrunet@baylibre.com: update the comment in above the fix]
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/clk-pll.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
+index ddb1e56347395..3a5853ca98c6c 100644
+--- a/drivers/clk/meson/clk-pll.c
++++ b/drivers/clk/meson/clk-pll.c
+@@ -77,6 +77,15 @@ static unsigned long meson_clk_pll_recalc_rate(struct clk_hw *hw,
+ 	unsigned int m, n, frac;
+ 
+ 	n = meson_parm_read(clk->map, &pll->n);
++
++	/*
++	 * On some HW, N is set to zero on init. This value is invalid as
++	 * it would result in a division by zero. The rate can't be
++	 * calculated in this case
++	 */
++	if (n == 0)
++		return 0;
++
+ 	m = meson_parm_read(clk->map, &pll->m);
+ 
+ 	frac = MESON_PARM_APPLICABLE(&pll->frac) ?
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-qcom-add-missing-msm8998-gcc_bimc_gfx_clk.patch b/queue-5.5/clk-qcom-add-missing-msm8998-gcc_bimc_gfx_clk.patch
new file mode 100644
index 00000000000..bc4a077314c
--- /dev/null
+++ b/queue-5.5/clk-qcom-add-missing-msm8998-gcc_bimc_gfx_clk.patch
@@ -0,0 +1,68 @@
+From 2f86f7e6834b6cb8dd70364516ff0e5f7c83b627 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 08:49:13 -0800
+Subject: clk: qcom: Add missing msm8998 gcc_bimc_gfx_clk
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit db2c7c0a04b11753f5741d00b784b5380ddeee72 ]
+
+gcc_bimc_gfx_clk is a required clock for booting the GPU and GPU SMMU.
+
+Fixes: 4807c71cc688 (arm64: dts: Add msm8998 SoC and MTP board support)
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Link: https://lkml.kernel.org/r/20191217164913.4783-1-jeffrey.l.hugo@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8998.c               | 14 ++++++++++++++
+ include/dt-bindings/clock/qcom,gcc-msm8998.h |  1 +
+ 2 files changed, 15 insertions(+)
+
+diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
+index cf31b5d03270f..df1d7056436cd 100644
+--- a/drivers/clk/qcom/gcc-msm8998.c
++++ b/drivers/clk/qcom/gcc-msm8998.c
+@@ -1996,6 +1996,19 @@ static struct clk_branch gcc_gp3_clk = {
+ 	},
+ };
+ 
++static struct clk_branch gcc_bimc_gfx_clk = {
++	.halt_reg = 0x46040,
++	.halt_check = BRANCH_HALT,
++	.clkr = {
++		.enable_reg = 0x46040,
++		.enable_mask = BIT(0),
++		.hw.init = &(struct clk_init_data){
++			.name = "gcc_bimc_gfx_clk",
++			.ops = &clk_branch2_ops,
++		},
++	},
++};
++
+ static struct clk_branch gcc_gpu_bimc_gfx_clk = {
+ 	.halt_reg = 0x71010,
+ 	.halt_check = BRANCH_HALT,
+@@ -2810,6 +2823,7 @@ static struct clk_regmap *gcc_msm8998_clocks[] = {
+ 	[GCC_GP1_CLK] = &gcc_gp1_clk.clkr,
+ 	[GCC_GP2_CLK] = &gcc_gp2_clk.clkr,
+ 	[GCC_GP3_CLK] = &gcc_gp3_clk.clkr,
++	[GCC_BIMC_GFX_CLK] = &gcc_bimc_gfx_clk.clkr,
+ 	[GCC_GPU_BIMC_GFX_CLK] = &gcc_gpu_bimc_gfx_clk.clkr,
+ 	[GCC_GPU_BIMC_GFX_SRC_CLK] = &gcc_gpu_bimc_gfx_src_clk.clkr,
+ 	[GCC_GPU_CFG_AHB_CLK] = &gcc_gpu_cfg_ahb_clk.clkr,
+diff --git a/include/dt-bindings/clock/qcom,gcc-msm8998.h b/include/dt-bindings/clock/qcom,gcc-msm8998.h
+index de1d8a1f59665..63e02dc32a0bb 100644
+--- a/include/dt-bindings/clock/qcom,gcc-msm8998.h
++++ b/include/dt-bindings/clock/qcom,gcc-msm8998.h
+@@ -182,6 +182,7 @@
+ #define GCC_MSS_GPLL0_DIV_CLK_SRC				173
+ #define GCC_MSS_SNOC_AXI_CLK					174
+ #define GCC_MSS_MNOC_BIMC_AXI_CLK				175
++#define GCC_BIMC_GFX_CLK					176
+ 
+ #define PCIE_0_GDSC						0
+ #define UFS_GDSC						1
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-qcom-don-t-overwrite-cfg-in-clk_rcg2_dfs_populat.patch b/queue-5.5/clk-qcom-don-t-overwrite-cfg-in-clk_rcg2_dfs_populat.patch
new file mode 100644
index 00000000000..c92ed86127d
--- /dev/null
+++ b/queue-5.5/clk-qcom-don-t-overwrite-cfg-in-clk_rcg2_dfs_populat.patch
@@ -0,0 +1,60 @@
+From e5ab04d0b10abbfe1b4bb121f00e9aa4a5411010 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 11:33:29 -0800
+Subject: clk: qcom: Don't overwrite 'cfg' in clk_rcg2_dfs_populate_freq()
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit 21e157c62eeded8b1558a991b4820b761d48a730 ]
+
+The DFS frequency table logic overwrites 'cfg' while detecting the
+parent clk and then later on in clk_rcg2_dfs_populate_freq() we use that
+same variable to figure out the mode of the clk, either MND or not. Add
+a new variable to hold the parent clk bit so that 'cfg' is left
+untouched for use later.
+
+This fixes problems in detecting the supported frequencies for any clks
+in DFS mode.
+
+Fixes: cc4f6944d0e3 ("clk: qcom: Add support for RCG to register for DFS")
+Reported-by: Rajendra Nayak <rnayak@codeaurora.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lkml.kernel.org/r/20200128193329.45635-1-sboyd@kernel.org
+Tested-by: Rajendra Nayak <rnayak@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rcg2.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index 8f4b9bec29565..5e0f7d8f168dd 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -952,7 +952,7 @@ static void clk_rcg2_dfs_populate_freq(struct clk_hw *hw, unsigned int l,
+ 	struct clk_rcg2 *rcg = to_clk_rcg2(hw);
+ 	struct clk_hw *p;
+ 	unsigned long prate = 0;
+-	u32 val, mask, cfg, mode;
++	u32 val, mask, cfg, mode, src;
+ 	int i, num_parents;
+ 
+ 	regmap_read(rcg->clkr.regmap, rcg->cmd_rcgr + SE_PERF_DFSR(l), &cfg);
+@@ -962,12 +962,12 @@ static void clk_rcg2_dfs_populate_freq(struct clk_hw *hw, unsigned int l,
+ 	if (cfg & mask)
+ 		f->pre_div = cfg & mask;
+ 
+-	cfg &= CFG_SRC_SEL_MASK;
+-	cfg >>= CFG_SRC_SEL_SHIFT;
++	src = cfg & CFG_SRC_SEL_MASK;
++	src >>= CFG_SRC_SEL_SHIFT;
+ 
+ 	num_parents = clk_hw_get_num_parents(hw);
+ 	for (i = 0; i < num_parents; i++) {
+-		if (cfg == rcg->parent_map[i].cfg) {
++		if (src == rcg->parent_map[i].cfg) {
+ 			f->src = rcg->parent_map[i].src;
+ 			p = clk_hw_get_parent_by_index(&rcg->clkr.hw, i);
+ 			prate = clk_hw_get_rate(p);
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-qcom-rcg2-don-t-crash-if-our-parent-can-t-be-fou.patch b/queue-5.5/clk-qcom-rcg2-don-t-crash-if-our-parent-can-t-be-fou.patch
new file mode 100644
index 00000000000..4da9a6cce92
--- /dev/null
+++ b/queue-5.5/clk-qcom-rcg2-don-t-crash-if-our-parent-can-t-be-fou.patch
@@ -0,0 +1,71 @@
+From 44d468dd47c7bbfe45ec0d81a1f9e15b5a414100 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 10:31:34 -0800
+Subject: clk: qcom: rcg2: Don't crash if our parent can't be found; return an
+ error
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 908b050114d8fefdddc57ec9fbc213c3690e7f5f ]
+
+When I got my clock parenting slightly wrong I ended up with a crash
+that looked like this:
+
+  Unable to handle kernel NULL pointer dereference at virtual
+  address 0000000000000000
+  ...
+  pc : clk_hw_get_rate+0x14/0x44
+  ...
+  Call trace:
+   clk_hw_get_rate+0x14/0x44
+   _freq_tbl_determine_rate+0x94/0xfc
+   clk_rcg2_determine_rate+0x2c/0x38
+   clk_core_determine_round_nolock+0x4c/0x88
+   clk_core_round_rate_nolock+0x6c/0xa8
+   clk_core_round_rate_nolock+0x9c/0xa8
+   clk_core_set_rate_nolock+0x70/0x180
+   clk_set_rate+0x3c/0x6c
+   of_clk_set_defaults+0x254/0x360
+   platform_drv_probe+0x28/0xb0
+   really_probe+0x120/0x2dc
+   driver_probe_device+0x64/0xfc
+   device_driver_attach+0x4c/0x6c
+   __driver_attach+0xac/0xc0
+   bus_for_each_dev+0x84/0xcc
+   driver_attach+0x2c/0x38
+   bus_add_driver+0xfc/0x1d0
+   driver_register+0x64/0xf8
+   __platform_driver_register+0x4c/0x58
+   msm_drm_register+0x5c/0x60
+   ...
+
+It turned out that clk_hw_get_parent_by_index() was returning NULL and
+we weren't checking.  Let's check it so that we don't crash.
+
+Fixes: ac269395cdd8 ("clk: qcom: Convert to clk_hw based provider APIs")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Link: https://lkml.kernel.org/r/20200203103049.v4.1.I7487325fe8e701a68a07d3be8a6a4b571eca9cfa@changeid
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rcg2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index 5e0f7d8f168dd..cecdb07ce13ba 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -217,6 +217,9 @@ static int _freq_tbl_determine_rate(struct clk_hw *hw, const struct freq_tbl *f,
+ 
+ 	clk_flags = clk_hw_get_flags(hw);
+ 	p = clk_hw_get_parent_by_index(hw, index);
++	if (!p)
++		return -EINVAL;
++
+ 	if (clk_flags & CLK_SET_RATE_PARENT) {
+ 		rate = f->freq;
+ 		if (f->pre_div) {
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-qcom-smd-add-missing-bimc-clock.patch b/queue-5.5/clk-qcom-smd-add-missing-bimc-clock.patch
new file mode 100644
index 00000000000..6ebef2d1c74
--- /dev/null
+++ b/queue-5.5/clk-qcom-smd-add-missing-bimc-clock.patch
@@ -0,0 +1,48 @@
+From 767fb89254ccf8bf864722b89d6250acfed0ae0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 08:54:09 -0800
+Subject: clk: qcom: smd: Add missing bimc clock
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit 87ec9adcca71801a44ddb311185b17df09839ab5 ]
+
+It turns out booting the modem is dependent on a bimc vote from Linux on
+msm8998.  To make the modem happy, add the bimc clock to rely on the
+default vote from rpmcc.  Once we have interconnect support, bimc should
+be controlled properly.
+
+Fixes: 6131dc81211c ("clk: qcom: smd: Add support for MSM8998 rpm clocks")
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Link: https://lkml.kernel.org/r/20191217165409.4919-1-jeffrey.l.hugo@gmail.com
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-smd-rpm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/qcom/clk-smd-rpm.c b/drivers/clk/qcom/clk-smd-rpm.c
+index 930fa4a4c52a8..e5c3db11bf26c 100644
+--- a/drivers/clk/qcom/clk-smd-rpm.c
++++ b/drivers/clk/qcom/clk-smd-rpm.c
+@@ -648,6 +648,7 @@ static const struct rpm_smd_clk_desc rpm_clk_qcs404 = {
+ };
+ 
+ /* msm8998 */
++DEFINE_CLK_SMD_RPM(msm8998, bimc_clk, bimc_a_clk, QCOM_SMD_RPM_MEM_CLK, 0);
+ DEFINE_CLK_SMD_RPM(msm8998, pcnoc_clk, pcnoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 0);
+ DEFINE_CLK_SMD_RPM(msm8998, snoc_clk, snoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 1);
+ DEFINE_CLK_SMD_RPM(msm8998, cnoc_clk, cnoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 2);
+@@ -671,6 +672,8 @@ DEFINE_CLK_SMD_RPM_XO_BUFFER_PINCTRL(msm8998, rf_clk2_pin, rf_clk2_a_pin, 5);
+ DEFINE_CLK_SMD_RPM_XO_BUFFER(msm8998, rf_clk3, rf_clk3_a, 6);
+ DEFINE_CLK_SMD_RPM_XO_BUFFER_PINCTRL(msm8998, rf_clk3_pin, rf_clk3_a_pin, 6);
+ static struct clk_smd_rpm *msm8998_clks[] = {
++	[RPM_SMD_BIMC_CLK] = &msm8998_bimc_clk,
++	[RPM_SMD_BIMC_A_CLK] = &msm8998_bimc_a_clk,
+ 	[RPM_SMD_PCNOC_CLK] = &msm8998_pcnoc_clk,
+ 	[RPM_SMD_PCNOC_A_CLK] = &msm8998_pcnoc_a_clk,
+ 	[RPM_SMD_SNOC_CLK] = &msm8998_snoc_clk,
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-renesas-rcar-gen3-allow-changing-the-rpc-d2-cloc.patch b/queue-5.5/clk-renesas-rcar-gen3-allow-changing-the-rpc-d2-cloc.patch
new file mode 100644
index 00000000000..b118d97c179
--- /dev/null
+++ b/queue-5.5/clk-renesas-rcar-gen3-allow-changing-the-rpc-d2-cloc.patch
@@ -0,0 +1,49 @@
+From 16f625fce8db883295b30759b10eb2857905eea6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2019 21:09:21 +0300
+Subject: clk: renesas: rcar-gen3: Allow changing the RPC[D2] clocks
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+[ Upstream commit 0d67c0340a60829c5c1b7d09629d23bbd67696f3 ]
+
+I was unable to get clk_set_rate() setting a lower RPC-IF clock frequency
+and that issue boiled down to me not passing CLK_SET_RATE_PARENT flag to
+clk_register_composite() when registering the RPC[D2] clocks...
+
+Fixes: db4a0073cc82 ("clk: renesas: rcar-gen3: Add RPC clocks")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Link: https://lore.kernel.org/r/be27a344-d8bf-9e0c-8950-2d1b48498496@cogentembedded.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rcar-gen3-cpg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/renesas/rcar-gen3-cpg.c b/drivers/clk/renesas/rcar-gen3-cpg.c
+index c97b647db9b68..488f8b3980c55 100644
+--- a/drivers/clk/renesas/rcar-gen3-cpg.c
++++ b/drivers/clk/renesas/rcar-gen3-cpg.c
+@@ -470,7 +470,8 @@ static struct clk * __init cpg_rpc_clk_register(const char *name,
+ 
+ 	clk = clk_register_composite(NULL, name, &parent_name, 1, NULL, NULL,
+ 				     &rpc->div.hw,  &clk_divider_ops,
+-				     &rpc->gate.hw, &clk_gate_ops, 0);
++				     &rpc->gate.hw, &clk_gate_ops,
++				     CLK_SET_RATE_PARENT);
+ 	if (IS_ERR(clk)) {
+ 		kfree(rpc);
+ 		return clk;
+@@ -506,7 +507,8 @@ static struct clk * __init cpg_rpcd2_clk_register(const char *name,
+ 
+ 	clk = clk_register_composite(NULL, name, &parent_name, 1, NULL, NULL,
+ 				     &rpcd2->fixed.hw, &clk_fixed_factor_ops,
+-				     &rpcd2->gate.hw, &clk_gate_ops, 0);
++				     &rpcd2->gate.hw, &clk_gate_ops,
++				     CLK_SET_RATE_PARENT);
+ 	if (IS_ERR(clk))
+ 		kfree(rpcd2);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-sunxi-ng-add-mux-and-pll-notifiers-for-a64-cpu-c.patch b/queue-5.5/clk-sunxi-ng-add-mux-and-pll-notifiers-for-a64-cpu-c.patch
new file mode 100644
index 00000000000..0d1760f140d
--- /dev/null
+++ b/queue-5.5/clk-sunxi-ng-add-mux-and-pll-notifiers-for-a64-cpu-c.patch
@@ -0,0 +1,79 @@
+From 8e60646f585bc211fd7de2a2eca52fbb4c709885 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 22:35:03 -0800
+Subject: clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock
+
+From: Icenowy Zheng <icenowy@aosc.io>
+
+[ Upstream commit ec97faff743b398e21f74a54c81333f3390093aa ]
+
+The A64 PLL_CPU clock has the same instability if some factor changed
+without the PLL gated like other SoCs with sun6i-style CCU, e.g. A33,
+H3.
+
+Add the mux and pll notifiers for A64 CPU clock to workaround the
+problem.
+
+Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks")
+Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
+Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 28 ++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index 49bd7a4c015c4..5f66bf8797723 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -921,11 +921,26 @@ static const struct sunxi_ccu_desc sun50i_a64_ccu_desc = {
+ 	.num_resets	= ARRAY_SIZE(sun50i_a64_ccu_resets),
+ };
+ 
++static struct ccu_pll_nb sun50i_a64_pll_cpu_nb = {
++	.common	= &pll_cpux_clk.common,
++	/* copy from pll_cpux_clk */
++	.enable	= BIT(31),
++	.lock	= BIT(28),
++};
++
++static struct ccu_mux_nb sun50i_a64_cpu_nb = {
++	.common		= &cpux_clk.common,
++	.cm		= &cpux_clk.mux,
++	.delay_us	= 1, /* > 8 clock cycles at 24 MHz */
++	.bypass_index	= 1, /* index of 24 MHz oscillator */
++};
++
+ static int sun50i_a64_ccu_probe(struct platform_device *pdev)
+ {
+ 	struct resource *res;
+ 	void __iomem *reg;
+ 	u32 val;
++	int ret;
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	reg = devm_ioremap_resource(&pdev->dev, res);
+@@ -939,7 +954,18 @@ static int sun50i_a64_ccu_probe(struct platform_device *pdev)
+ 
+ 	writel(0x515, reg + SUN50I_A64_PLL_MIPI_REG);
+ 
+-	return sunxi_ccu_probe(pdev->dev.of_node, reg, &sun50i_a64_ccu_desc);
++	ret = sunxi_ccu_probe(pdev->dev.of_node, reg, &sun50i_a64_ccu_desc);
++	if (ret)
++		return ret;
++
++	/* Gate then ungate PLL CPU after any rate changes */
++	ccu_pll_notifier_register(&sun50i_a64_pll_cpu_nb);
++
++	/* Reparent CPU during PLL CPU rate changes */
++	ccu_mux_notifier_register(pll_cpux_clk.common.hw.clk,
++				  &sun50i_a64_cpu_nb);
++
++	return 0;
+ }
+ 
+ static const struct of_device_id sun50i_a64_ccu_ids[] = {
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-ti-dra7-fix-parent-for-gmac_clkctrl.patch b/queue-5.5/clk-ti-dra7-fix-parent-for-gmac_clkctrl.patch
new file mode 100644
index 00000000000..2f5d3a86816
--- /dev/null
+++ b/queue-5.5/clk-ti-dra7-fix-parent-for-gmac_clkctrl.patch
@@ -0,0 +1,37 @@
+From b1d04de55069b16c487795596ea255267d6538b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Dec 2019 13:00:04 +0200
+Subject: clk: ti: dra7: fix parent for gmac_clkctrl
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 69e300283796dae7e8c2e6acdabcd31336c0c93e ]
+
+The parent clk for gmac clk ctrl has to be gmac_main_clk (125MHz) instead
+of dpll_gmac_ck (1GHz). This is caused incorrect CPSW MDIO operation.
+Hence, fix it.
+
+Fixes: dffa9051d546 ('clk: ti: dra7: add new clkctrl data')
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-7xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/ti/clk-7xx.c b/drivers/clk/ti/clk-7xx.c
+index 5f46782cebeb2..b656ba2abcf7e 100644
+--- a/drivers/clk/ti/clk-7xx.c
++++ b/drivers/clk/ti/clk-7xx.c
+@@ -405,7 +405,7 @@ static const struct omap_clkctrl_bit_data dra7_gmac_bit_data[] __initconst = {
+ };
+ 
+ static const struct omap_clkctrl_reg_data dra7_gmac_clkctrl_regs[] __initconst = {
+-	{ DRA7_GMAC_GMAC_CLKCTRL, dra7_gmac_bit_data, CLKF_SW_SUP, "dpll_gmac_ck" },
++	{ DRA7_GMAC_GMAC_CLKCTRL, dra7_gmac_bit_data, CLKF_SW_SUP, "gmac_main_clk" },
+ 	{ 0 },
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-uniphier-add-scssi-clock-gate-for-each-channel.patch b/queue-5.5/clk-uniphier-add-scssi-clock-gate-for-each-channel.patch
new file mode 100644
index 00000000000..9d9e725a806
--- /dev/null
+++ b/queue-5.5/clk-uniphier-add-scssi-clock-gate-for-each-channel.patch
@@ -0,0 +1,63 @@
+From 49f4c3e1b6fd1b6178f86aa0d5225b07dbb494a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Dec 2019 10:42:05 +0900
+Subject: clk: uniphier: Add SCSSI clock gate for each channel
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 1ec09a2ec67a0baa46a3ccac041dbcdbc6db2cb9 ]
+
+SCSSI has clock gates for each channel in the SoCs newer than Pro4,
+so this adds missing clock gates for channel 1, 2 and 3. And more, this
+moves MCSSI clock ID after SCSSI.
+
+Fixes: ff388ee36516 ("clk: uniphier: add clock frequency support for SPI")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Link: https://lkml.kernel.org/r/1577410925-22021-1-git-send-email-hayashi.kunihiko@socionext.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/uniphier/clk-uniphier-peri.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/uniphier/clk-uniphier-peri.c b/drivers/clk/uniphier/clk-uniphier-peri.c
+index 9caa52944b1c5..3e32db9dad815 100644
+--- a/drivers/clk/uniphier/clk-uniphier-peri.c
++++ b/drivers/clk/uniphier/clk-uniphier-peri.c
+@@ -18,8 +18,8 @@
+ #define UNIPHIER_PERI_CLK_FI2C(idx, ch)					\
+ 	UNIPHIER_CLK_GATE("i2c" #ch, (idx), "i2c", 0x24, 24 + (ch))
+ 
+-#define UNIPHIER_PERI_CLK_SCSSI(idx)					\
+-	UNIPHIER_CLK_GATE("scssi", (idx), "spi", 0x20, 17)
++#define UNIPHIER_PERI_CLK_SCSSI(idx, ch)				\
++	UNIPHIER_CLK_GATE("scssi" #ch, (idx), "spi", 0x20, 17 + (ch))
+ 
+ #define UNIPHIER_PERI_CLK_MCSSI(idx)					\
+ 	UNIPHIER_CLK_GATE("mcssi", (idx), "spi", 0x24, 14)
+@@ -35,7 +35,7 @@ const struct uniphier_clk_data uniphier_ld4_peri_clk_data[] = {
+ 	UNIPHIER_PERI_CLK_I2C(6, 2),
+ 	UNIPHIER_PERI_CLK_I2C(7, 3),
+ 	UNIPHIER_PERI_CLK_I2C(8, 4),
+-	UNIPHIER_PERI_CLK_SCSSI(11),
++	UNIPHIER_PERI_CLK_SCSSI(11, 0),
+ 	{ /* sentinel */ }
+ };
+ 
+@@ -51,7 +51,10 @@ const struct uniphier_clk_data uniphier_pro4_peri_clk_data[] = {
+ 	UNIPHIER_PERI_CLK_FI2C(8, 4),
+ 	UNIPHIER_PERI_CLK_FI2C(9, 5),
+ 	UNIPHIER_PERI_CLK_FI2C(10, 6),
+-	UNIPHIER_PERI_CLK_SCSSI(11),
+-	UNIPHIER_PERI_CLK_MCSSI(12),
++	UNIPHIER_PERI_CLK_SCSSI(11, 0),
++	UNIPHIER_PERI_CLK_SCSSI(12, 1),
++	UNIPHIER_PERI_CLK_SCSSI(13, 2),
++	UNIPHIER_PERI_CLK_SCSSI(14, 3),
++	UNIPHIER_PERI_CLK_MCSSI(15),
+ 	{ /* sentinel */ }
+ };
+-- 
+2.20.1
+
diff --git a/queue-5.5/clk-use-parent-node-pointer-during-registration-if-n.patch b/queue-5.5/clk-use-parent-node-pointer-during-registration-if-n.patch
new file mode 100644
index 00000000000..b1efe010c53
--- /dev/null
+++ b/queue-5.5/clk-use-parent-node-pointer-during-registration-if-n.patch
@@ -0,0 +1,94 @@
+From 5529e1d46d8e556ade8a8e56e82c6682d525cc62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2019 10:29:35 -0800
+Subject: clk: Use parent node pointer during registration if necessary
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit 9011f92622e5ef2d075f45e5fa818776d4feb8c0 ]
+
+Sometimes clk drivers are attached to devices which are children of a
+parent device that is connected to a node in DT. This happens when
+devices are MFD-ish and the parent device driver mostly registers child
+devices to match against drivers placed in their respective subsystem
+directories like drivers/clk, drivers/regulator, etc. When the clk
+driver calls clk_register() with a device pointer, that struct device
+pointer won't have a device_node associated with it because it was
+created purely in software as a way to partition logic to a subsystem.
+
+This causes problems for the way we find parent clks for the clks
+registered by these child devices because we look at the registering
+device's device_node pointer to lookup 'clocks' and 'clock-names'
+properties. Let's use the parent device's device_node pointer if the
+registering device doesn't have a device_node but the parent does. This
+simplifies clk registration code by avoiding the need to assign some
+device_node to the device registering the clk.
+
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reported-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lkml.kernel.org/r/20191230190455.141339-1-sboyd@kernel.org
+[sboyd@kernel.org: Fixup kernel-doc notation]
+Reviewed-by: Niklas Cassel <nks@flawful.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Tested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 27 +++++++++++++++++++++++++--
+ 1 file changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 53585cfc4b9ba..66f056ac4c156 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3736,6 +3736,28 @@ fail_out:
+ 	return ERR_PTR(ret);
+ }
+ 
++/**
++ * dev_or_parent_of_node() - Get device node of @dev or @dev's parent
++ * @dev: Device to get device node of
++ *
++ * Return: device node pointer of @dev, or the device node pointer of
++ * @dev->parent if dev doesn't have a device node, or NULL if neither
++ * @dev or @dev->parent have a device node.
++ */
++static struct device_node *dev_or_parent_of_node(struct device *dev)
++{
++	struct device_node *np;
++
++	if (!dev)
++		return NULL;
++
++	np = dev_of_node(dev);
++	if (!np)
++		np = dev_of_node(dev->parent);
++
++	return np;
++}
++
+ /**
+  * clk_register - allocate a new clock, register it and return an opaque cookie
+  * @dev: device that is registering this clock
+@@ -3751,7 +3773,7 @@ fail_out:
+  */
+ struct clk *clk_register(struct device *dev, struct clk_hw *hw)
+ {
+-	return __clk_register(dev, dev_of_node(dev), hw);
++	return __clk_register(dev, dev_or_parent_of_node(dev), hw);
+ }
+ EXPORT_SYMBOL_GPL(clk_register);
+ 
+@@ -3767,7 +3789,8 @@ EXPORT_SYMBOL_GPL(clk_register);
+  */
+ int clk_hw_register(struct device *dev, struct clk_hw *hw)
+ {
+-	return PTR_ERR_OR_ZERO(__clk_register(dev, dev_of_node(dev), hw));
++	return PTR_ERR_OR_ZERO(__clk_register(dev, dev_or_parent_of_node(dev),
++			       hw));
+ }
+ EXPORT_SYMBOL_GPL(clk_hw_register);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/clocksource-davinci-only-enable-clockevents-once-tim.patch b/queue-5.5/clocksource-davinci-only-enable-clockevents-once-tim.patch
new file mode 100644
index 00000000000..93e6adc51b4
--- /dev/null
+++ b/queue-5.5/clocksource-davinci-only-enable-clockevents-once-tim.patch
@@ -0,0 +1,58 @@
+From a70a79dca58a06cc4b57c5e09569df7f883af7d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 18:16:41 +0100
+Subject: clocksource: davinci: only enable clockevents once tim34 is
+ initialized
+
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+
+[ Upstream commit cea931c25104e6bddc42eb067f58193f355dbdd7 ]
+
+The DM365 platform has a strange quirk (only present when using ancient
+u-boot - mainline u-boot v2013.01 and later works fine) where if we
+enable the second half of the timer in periodic mode before we do its
+initialization - the time won't start flowing and we can't boot.
+
+When using more recent u-boot, we can enable the timer, then reinitialize
+it and all works fine.
+
+To work around this issue only enable clockevents once tim34 is
+initialized i.e. move clockevents_config_and_register() below tim34
+initialization.
+
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-davinci.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c
+index 62745c9620498..e421946a91c5a 100644
+--- a/drivers/clocksource/timer-davinci.c
++++ b/drivers/clocksource/timer-davinci.c
+@@ -302,10 +302,6 @@ int __init davinci_timer_register(struct clk *clk,
+ 		return rv;
+ 	}
+ 
+-	clockevents_config_and_register(&clockevent->dev, tick_rate,
+-					DAVINCI_TIMER_MIN_DELTA,
+-					DAVINCI_TIMER_MAX_DELTA);
+-
+ 	davinci_clocksource.dev.rating = 300;
+ 	davinci_clocksource.dev.read = davinci_clocksource_read;
+ 	davinci_clocksource.dev.mask =
+@@ -323,6 +319,10 @@ int __init davinci_timer_register(struct clk *clk,
+ 		davinci_clocksource_init_tim34(base);
+ 	}
+ 
++	clockevents_config_and_register(&clockevent->dev, tick_rate,
++					DAVINCI_TIMER_MIN_DELTA,
++					DAVINCI_TIMER_MAX_DELTA);
++
+ 	rv = clocksource_register_hz(&davinci_clocksource.dev, tick_rate);
+ 	if (rv) {
+ 		pr_err("Unable to register clocksource");
+-- 
+2.20.1
+
diff --git a/queue-5.5/clocksource-drivers-bcm2835_timer-fix-memory-leak-of.patch b/queue-5.5/clocksource-drivers-bcm2835_timer-fix-memory-leak-of.patch
new file mode 100644
index 00000000000..c404716eec4
--- /dev/null
+++ b/queue-5.5/clocksource-drivers-bcm2835_timer-fix-memory-leak-of.patch
@@ -0,0 +1,51 @@
+From 0b0906ad42ab65fee27ecc86e088cf13212bf098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 21:32:46 +0000
+Subject: clocksource/drivers/bcm2835_timer: Fix memory leak of timer
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 2052d032c06761330bca4944bb7858b00960e868 ]
+
+Currently when setup_irq fails the error exit path will leak the
+recently allocated timer structure.  Originally the code would
+throw a panic but a later commit changed the behaviour to return
+via the err_iounmap path and hence we now have a memory leak. Fix
+this by adding a err_timer_free error path that kfree's timer.
+
+Addresses-Coverity: ("Resource Leak")
+Fixes: 524a7f08983d ("clocksource/drivers/bcm2835_timer: Convert init function to return error")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20191219213246.34437-1-colin.king@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/bcm2835_timer.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/bcm2835_timer.c b/drivers/clocksource/bcm2835_timer.c
+index 2b196cbfadb62..b235f446ee50f 100644
+--- a/drivers/clocksource/bcm2835_timer.c
++++ b/drivers/clocksource/bcm2835_timer.c
+@@ -121,7 +121,7 @@ static int __init bcm2835_timer_init(struct device_node *node)
+ 	ret = setup_irq(irq, &timer->act);
+ 	if (ret) {
+ 		pr_err("Can't set up timer IRQ\n");
+-		goto err_iounmap;
++		goto err_timer_free;
+ 	}
+ 
+ 	clockevents_config_and_register(&timer->evt, freq, 0xf, 0xffffffff);
+@@ -130,6 +130,9 @@ static int __init bcm2835_timer_init(struct device_node *node)
+ 
+ 	return 0;
+ 
++err_timer_free:
++	kfree(timer);
++
+ err_iounmap:
+ 	iounmap(base);
+ 	return ret;
+-- 
+2.20.1
+
diff --git a/queue-5.5/cmd64x-potential-buffer-overflow-in-cmd64x_program_t.patch b/queue-5.5/cmd64x-potential-buffer-overflow-in-cmd64x_program_t.patch
new file mode 100644
index 00000000000..6044c74e9bd
--- /dev/null
+++ b/queue-5.5/cmd64x-potential-buffer-overflow-in-cmd64x_program_t.patch
@@ -0,0 +1,36 @@
+From 1f1b4871e684ffb016ee1d32371d247ddc43f6d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 16:04:41 +0300
+Subject: cmd64x: potential buffer overflow in cmd64x_program_timings()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 117fcc3053606d8db5cef8821dca15022ae578bb ]
+
+The "drive->dn" value is a u8 and it is controlled by root only, but
+it could be out of bounds here so let's check.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ide/cmd64x.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
+index a1898e11b04e6..943bf944bf722 100644
+--- a/drivers/ide/cmd64x.c
++++ b/drivers/ide/cmd64x.c
+@@ -66,6 +66,9 @@ static void cmd64x_program_timings(ide_drive_t *drive, u8 mode)
+ 	struct ide_timing t;
+ 	u8 arttim = 0;
+ 
++	if (drive->dn >= ARRAY_SIZE(drwtim_regs))
++		return;
++
+ 	ide_timing_compute(drive, mode, &t, T, 0);
+ 
+ 	/*
+-- 
+2.20.1
+
diff --git a/queue-5.5/cpu-hotplug-stop_machine-fix-stop_machine-vs-hotplug.patch b/queue-5.5/cpu-hotplug-stop_machine-fix-stop_machine-vs-hotplug.patch
new file mode 100644
index 00000000000..ec2e8653eb1
--- /dev/null
+++ b/queue-5.5/cpu-hotplug-stop_machine-fix-stop_machine-vs-hotplug.patch
@@ -0,0 +1,91 @@
+From fba09f587511b652f881a2be1a50e4da193c0954 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 09:34:54 +0100
+Subject: cpu/hotplug, stop_machine: Fix stop_machine vs hotplug order
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 45178ac0cea853fe0e405bf11e101bdebea57b15 ]
+
+Paul reported a very sporadic, rcutorture induced, workqueue failure.
+When the planets align, the workqueue rescuer's self-migrate fails and
+then triggers a WARN for running a work on the wrong CPU.
+
+Tejun then figured that set_cpus_allowed_ptr()'s stop_one_cpu() call
+could be ignored! When stopper->enabled is false, stop_machine will
+insta complete the work, without actually doing the work. Worse, it
+will not WARN about this (we really should fix this).
+
+It turns out there is a small window where a freshly online'ed CPU is
+marked 'online' but doesn't yet have the stopper task running:
+
+	BP				AP
+
+	bringup_cpu()
+	  __cpu_up(cpu, idle)	 -->	start_secondary()
+					...
+					cpu_startup_entry()
+	  bringup_wait_for_ap()
+	    wait_for_ap_thread() <--	  cpuhp_online_idle()
+					  while (1)
+					    do_idle()
+
+					... available to run kthreads ...
+
+	    stop_machine_unpark()
+	      stopper->enable = true;
+
+Close this by moving the stop_machine_unpark() into
+cpuhp_online_idle(), such that the stopper thread is ready before we
+start the idle loop and schedule.
+
+Reported-by: "Paul E. McKenney" <paulmck@kernel.org>
+Debugged-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: "Paul E. McKenney" <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cpu.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 4dc279ed3b2d7..9c706af713fbc 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -525,8 +525,7 @@ static int bringup_wait_for_ap(unsigned int cpu)
+ 	if (WARN_ON_ONCE((!cpu_online(cpu))))
+ 		return -ECANCELED;
+ 
+-	/* Unpark the stopper thread and the hotplug thread of the target cpu */
+-	stop_machine_unpark(cpu);
++	/* Unpark the hotplug thread of the target cpu */
+ 	kthread_unpark(st->thread);
+ 
+ 	/*
+@@ -1089,8 +1088,8 @@ void notify_cpu_starting(unsigned int cpu)
+ 
+ /*
+  * Called from the idle task. Wake up the controlling task which brings the
+- * stopper and the hotplug thread of the upcoming CPU up and then delegates
+- * the rest of the online bringup to the hotplug thread.
++ * hotplug thread of the upcoming CPU up and then delegates the rest of the
++ * online bringup to the hotplug thread.
+  */
+ void cpuhp_online_idle(enum cpuhp_state state)
+ {
+@@ -1100,6 +1099,12 @@ void cpuhp_online_idle(enum cpuhp_state state)
+ 	if (state != CPUHP_AP_ONLINE_IDLE)
+ 		return;
+ 
++	/*
++	 * Unpart the stopper thread before we start the idle loop (and start
++	 * scheduling); this ensures the stopper task is always available.
++	 */
++	stop_machine_unpark(smp_processor_id());
++
+ 	st->state = CPUHP_AP_ONLINE_IDLE;
+ 	complete_ap_thread(st, true);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/crypto-amlogic-add-unspecified-has_iomem-dependency.patch b/queue-5.5/crypto-amlogic-add-unspecified-has_iomem-dependency.patch
new file mode 100644
index 00000000000..1ca651693e1
--- /dev/null
+++ b/queue-5.5/crypto-amlogic-add-unspecified-has_iomem-dependency.patch
@@ -0,0 +1,41 @@
+From ad2874514c947cc90ed37d3d04ebd3a16cad856d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 11:27:40 -0800
+Subject: crypto: amlogic - add unspecified HAS_IOMEM dependency
+
+From: Brendan Higgins <brendanhiggins@google.com>
+
+[ Upstream commit 7d07de2c18abd95f72efb28f78a4825e0fc1aa6a ]
+
+Currently CONFIG_CRYPTO_DEV_AMLOGIC_GXL=y implicitly depends on
+CONFIG_HAS_IOMEM=y; consequently, on architectures without IOMEM we get
+the following build error:
+
+ld: drivers/crypto/amlogic/amlogic-gxl-core.o: in function `meson_crypto_probe':
+drivers/crypto/amlogic/amlogic-gxl-core.c:240: undefined reference to `devm_platform_ioremap_resource'
+
+Fix the build error by adding the unspecified dependency.
+
+Reported-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
+Acked-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/amlogic/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/amlogic/Kconfig b/drivers/crypto/amlogic/Kconfig
+index b90850d18965f..cf95476026708 100644
+--- a/drivers/crypto/amlogic/Kconfig
++++ b/drivers/crypto/amlogic/Kconfig
+@@ -1,5 +1,6 @@
+ config CRYPTO_DEV_AMLOGIC_GXL
+ 	tristate "Support for amlogic cryptographic offloader"
++	depends on HAS_IOMEM
+ 	default y if ARCH_MESON
+ 	select CRYPTO_SKCIPHER
+ 	select CRYPTO_ENGINE
+-- 
+2.20.1
+
diff --git a/queue-5.5/crypto-chtls-fixed-memory-leak.patch b/queue-5.5/crypto-chtls-fixed-memory-leak.patch
new file mode 100644
index 00000000000..ae28fa3fb77
--- /dev/null
+++ b/queue-5.5/crypto-chtls-fixed-memory-leak.patch
@@ -0,0 +1,145 @@
+From 1450c36e69cfbe5a186806264aa55a212b96b3bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 16:21:48 +0530
+Subject: crypto: chtls - Fixed memory leak
+
+From: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
+
+[ Upstream commit 93e23eb2ed6c11b4f483c8111ac155ec2b1f3042 ]
+
+Freed work request skbs when connection terminates.
+enqueue_wr()/ dequeue_wr() is shared between softirq
+and application contexts, should be protected by socket
+lock. Moved dequeue_wr() to appropriate file.
+
+Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/chelsio/chtls/chtls_cm.c | 27 +++++++++++++------------
+ drivers/crypto/chelsio/chtls/chtls_cm.h | 21 +++++++++++++++++++
+ drivers/crypto/chelsio/chtls/chtls_hw.c |  3 +++
+ 3 files changed, 38 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index aca75237bbcf8..dffa2aa855fdd 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -727,6 +727,14 @@ static int chtls_close_listsrv_rpl(struct chtls_dev *cdev, struct sk_buff *skb)
+ 	return 0;
+ }
+ 
++static void chtls_purge_wr_queue(struct sock *sk)
++{
++	struct sk_buff *skb;
++
++	while ((skb = dequeue_wr(sk)) != NULL)
++		kfree_skb(skb);
++}
++
+ static void chtls_release_resources(struct sock *sk)
+ {
+ 	struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
+@@ -741,6 +749,11 @@ static void chtls_release_resources(struct sock *sk)
+ 	kfree_skb(csk->txdata_skb_cache);
+ 	csk->txdata_skb_cache = NULL;
+ 
++	if (csk->wr_credits != csk->wr_max_credits) {
++		chtls_purge_wr_queue(sk);
++		chtls_reset_wr_list(csk);
++	}
++
+ 	if (csk->l2t_entry) {
+ 		cxgb4_l2t_release(csk->l2t_entry);
+ 		csk->l2t_entry = NULL;
+@@ -1735,6 +1748,7 @@ static void chtls_peer_close(struct sock *sk, struct sk_buff *skb)
+ 		else
+ 			sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
+ 	}
++	kfree_skb(skb);
+ }
+ 
+ static void chtls_close_con_rpl(struct sock *sk, struct sk_buff *skb)
+@@ -2062,19 +2076,6 @@ rel_skb:
+ 	return 0;
+ }
+ 
+-static struct sk_buff *dequeue_wr(struct sock *sk)
+-{
+-	struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
+-	struct sk_buff *skb = csk->wr_skb_head;
+-
+-	if (likely(skb)) {
+-	/* Don't bother clearing the tail */
+-		csk->wr_skb_head = WR_SKB_CB(skb)->next_wr;
+-		WR_SKB_CB(skb)->next_wr = NULL;
+-	}
+-	return skb;
+-}
+-
+ static void chtls_rx_ack(struct sock *sk, struct sk_buff *skb)
+ {
+ 	struct cpl_fw4_ack *hdr = cplhdr(skb) + RSS_HDR;
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.h b/drivers/crypto/chelsio/chtls/chtls_cm.h
+index 129d7ac649a93..3fac0c74a41fa 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.h
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.h
+@@ -185,6 +185,12 @@ static inline void chtls_kfree_skb(struct sock *sk, struct sk_buff *skb)
+ 	kfree_skb(skb);
+ }
+ 
++static inline void chtls_reset_wr_list(struct chtls_sock *csk)
++{
++	csk->wr_skb_head = NULL;
++	csk->wr_skb_tail = NULL;
++}
++
+ static inline void enqueue_wr(struct chtls_sock *csk, struct sk_buff *skb)
+ {
+ 	WR_SKB_CB(skb)->next_wr = NULL;
+@@ -197,4 +203,19 @@ static inline void enqueue_wr(struct chtls_sock *csk, struct sk_buff *skb)
+ 		WR_SKB_CB(csk->wr_skb_tail)->next_wr = skb;
+ 	csk->wr_skb_tail = skb;
+ }
++
++static inline struct sk_buff *dequeue_wr(struct sock *sk)
++{
++	struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
++	struct sk_buff *skb = NULL;
++
++	skb = csk->wr_skb_head;
++
++	if (likely(skb)) {
++	 /* Don't bother clearing the tail */
++		csk->wr_skb_head = WR_SKB_CB(skb)->next_wr;
++		WR_SKB_CB(skb)->next_wr = NULL;
++	}
++	return skb;
++}
+ #endif
+diff --git a/drivers/crypto/chelsio/chtls/chtls_hw.c b/drivers/crypto/chelsio/chtls/chtls_hw.c
+index 2a34035d3cfbc..a217fe72602d4 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_hw.c
++++ b/drivers/crypto/chelsio/chtls/chtls_hw.c
+@@ -350,6 +350,7 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, u32 optname)
+ 	kwr->sc_imm.cmd_more = cpu_to_be32(ULPTX_CMD_V(ULP_TX_SC_IMM));
+ 	kwr->sc_imm.len = cpu_to_be32(klen);
+ 
++	lock_sock(sk);
+ 	/* key info */
+ 	kctx = (struct _key_ctx *)(kwr + 1);
+ 	ret = chtls_key_info(csk, kctx, keylen, optname);
+@@ -388,8 +389,10 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, u32 optname)
+ 		csk->tlshws.txkey = keyid;
+ 	}
+ 
++	release_sock(sk);
+ 	return ret;
+ out_notcb:
++	release_sock(sk);
+ 	free_tls_keyid(sk);
+ out_nokey:
+ 	kfree_skb(skb);
+-- 
+2.20.1
+
diff --git a/queue-5.5/crypto-essiv-fix-aead-capitalization-and-preposition.patch b/queue-5.5/crypto-essiv-fix-aead-capitalization-and-preposition.patch
new file mode 100644
index 00000000000..8faa8dd3606
--- /dev/null
+++ b/queue-5.5/crypto-essiv-fix-aead-capitalization-and-preposition.patch
@@ -0,0 +1,41 @@
+From fbdde77c976b7a9684030e1071b0dc586d4649a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 17:58:58 +0100
+Subject: crypto: essiv - fix AEAD capitalization and preposition use in help
+ text
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit ab3d436bf3e9d05f58ceaa85ff7475bfcd6e45af ]
+
+"AEAD" is capitalized everywhere else.
+Use "an" when followed by a written or spoken vowel.
+
+Fixes: be1eb7f78aa8fbe3 ("crypto: essiv - create wrapper template for ESSIV generation")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/crypto/Kconfig b/crypto/Kconfig
+index 5575d48473bd4..cdb51d4272d0c 100644
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -511,10 +511,10 @@ config CRYPTO_ESSIV
+ 	  encryption.
+ 
+ 	  This driver implements a crypto API template that can be
+-	  instantiated either as a skcipher or as a aead (depending on the
++	  instantiated either as an skcipher or as an AEAD (depending on the
+ 	  type of the first template argument), and which defers encryption
+ 	  and decryption requests to the encapsulated cipher after applying
+-	  ESSIV to the input IV. Note that in the aead case, it is assumed
++	  ESSIV to the input IV. Note that in the AEAD case, it is assumed
+ 	  that the keys are presented in the same format used by the authenc
+ 	  template, and that the IV appears at the end of the authenticated
+ 	  associated data (AAD) region (which is how dm-crypt uses it.)
+-- 
+2.20.1
+
diff --git a/queue-5.5/crypto-hisilicon-bugfixed-tfm-leak.patch b/queue-5.5/crypto-hisilicon-bugfixed-tfm-leak.patch
new file mode 100644
index 00000000000..f7b47841dbb
--- /dev/null
+++ b/queue-5.5/crypto-hisilicon-bugfixed-tfm-leak.patch
@@ -0,0 +1,83 @@
+From 7a3208b13003696490a8fb590e6555b3de23c819 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 16:58:15 +0800
+Subject: crypto: hisilicon - Bugfixed tfm leak
+
+From: Zaibo Xu <xuzaibo@huawei.com>
+
+[ Upstream commit dfee9955abc7ec9364413d16316181322cf44f2f ]
+
+1.Fixed the bug of software tfm leakage.
+2.Update HW error log message.
+
+Signed-off-by: Zaibo Xu <xuzaibo@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_crypto.c |  7 +++++-
+ drivers/crypto/hisilicon/hpre/hpre_main.c   | 24 ++++++++++-----------
+ 2 files changed, 18 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_crypto.c b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+index 98f037e6ea3e4..d8b015266ee49 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_crypto.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_crypto.c
+@@ -1043,6 +1043,7 @@ static unsigned int hpre_rsa_max_size(struct crypto_akcipher *tfm)
+ static int hpre_rsa_init_tfm(struct crypto_akcipher *tfm)
+ {
+ 	struct hpre_ctx *ctx = akcipher_tfm_ctx(tfm);
++	int ret;
+ 
+ 	ctx->rsa.soft_tfm = crypto_alloc_akcipher("rsa-generic", 0, 0);
+ 	if (IS_ERR(ctx->rsa.soft_tfm)) {
+@@ -1050,7 +1051,11 @@ static int hpre_rsa_init_tfm(struct crypto_akcipher *tfm)
+ 		return PTR_ERR(ctx->rsa.soft_tfm);
+ 	}
+ 
+-	return hpre_ctx_init(ctx);
++	ret = hpre_ctx_init(ctx);
++	if (ret)
++		crypto_free_akcipher(ctx->rsa.soft_tfm);
++
++	return ret;
+ }
+ 
+ static void hpre_rsa_exit_tfm(struct crypto_akcipher *tfm)
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 34e0424410bfc..0c98c37e39f4a 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -106,18 +106,18 @@ static const char * const hpre_debug_file_name[] = {
+ };
+ 
+ static const struct hpre_hw_error hpre_hw_errors[] = {
+-	{ .int_msk = BIT(0), .msg = "hpre_ecc_1bitt_err" },
+-	{ .int_msk = BIT(1), .msg = "hpre_ecc_2bit_err" },
+-	{ .int_msk = BIT(2), .msg = "hpre_data_wr_err" },
+-	{ .int_msk = BIT(3), .msg = "hpre_data_rd_err" },
+-	{ .int_msk = BIT(4), .msg = "hpre_bd_rd_err" },
+-	{ .int_msk = BIT(5), .msg = "hpre_ooo_2bit_ecc_err" },
+-	{ .int_msk = BIT(6), .msg = "hpre_cltr1_htbt_tm_out_err" },
+-	{ .int_msk = BIT(7), .msg = "hpre_cltr2_htbt_tm_out_err" },
+-	{ .int_msk = BIT(8), .msg = "hpre_cltr3_htbt_tm_out_err" },
+-	{ .int_msk = BIT(9), .msg = "hpre_cltr4_htbt_tm_out_err" },
+-	{ .int_msk = GENMASK(15, 10), .msg = "hpre_ooo_rdrsp_err" },
+-	{ .int_msk = GENMASK(21, 16), .msg = "hpre_ooo_wrrsp_err" },
++	{ .int_msk = BIT(0), .msg = "core_ecc_1bit_err_int_set" },
++	{ .int_msk = BIT(1), .msg = "core_ecc_2bit_err_int_set" },
++	{ .int_msk = BIT(2), .msg = "dat_wb_poison_int_set" },
++	{ .int_msk = BIT(3), .msg = "dat_rd_poison_int_set" },
++	{ .int_msk = BIT(4), .msg = "bd_rd_poison_int_set" },
++	{ .int_msk = BIT(5), .msg = "ooo_ecc_2bit_err_int_set" },
++	{ .int_msk = BIT(6), .msg = "cluster1_shb_timeout_int_set" },
++	{ .int_msk = BIT(7), .msg = "cluster2_shb_timeout_int_set" },
++	{ .int_msk = BIT(8), .msg = "cluster3_shb_timeout_int_set" },
++	{ .int_msk = BIT(9), .msg = "cluster4_shb_timeout_int_set" },
++	{ .int_msk = GENMASK(15, 10), .msg = "ooo_rdrsp_err_int_set" },
++	{ .int_msk = GENMASK(21, 16), .msg = "ooo_wrrsp_err_int_set" },
+ 	{ /* sentinel */ }
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/crypto-hisilicon-update-debugfs-usage-of-sec-v2.patch b/queue-5.5/crypto-hisilicon-update-debugfs-usage-of-sec-v2.patch
new file mode 100644
index 00000000000..6541845bf4e
--- /dev/null
+++ b/queue-5.5/crypto-hisilicon-update-debugfs-usage-of-sec-v2.patch
@@ -0,0 +1,112 @@
+From c1096e1f19bf2be58d9ca2bd3e3502cb004a8513 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 10:41:48 +0800
+Subject: crypto: hisilicon - Update debugfs usage of SEC V2
+
+From: Zaibo Xu <xuzaibo@huawei.com>
+
+[ Upstream commit ca0d158dc9e5dc0902c1d507d82178d97f6f5709 ]
+
+Applied some advices of Marco Elver on atomic usage of Debugfs,
+which is carried out by basing on Arnd Bergmann's fixing patch.
+
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Reported-by: Marco Elver <elver@google.com>
+Signed-off-by: Zaibo Xu <xuzaibo@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec.h        |  2 +-
+ drivers/crypto/hisilicon/sec2/sec_crypto.c |  8 ++++----
+ drivers/crypto/hisilicon/sec2/sec_main.c   | 18 +++++++++---------
+ 3 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h
+index b846d73d9a855..841f4c56ca73c 100644
+--- a/drivers/crypto/hisilicon/sec2/sec.h
++++ b/drivers/crypto/hisilicon/sec2/sec.h
+@@ -40,7 +40,7 @@ struct sec_req {
+ 	int req_id;
+ 
+ 	/* Status of the SEC request */
+-	atomic_t fake_busy;
++	bool fake_busy;
+ };
+ 
+ /**
+diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+index 0a5391fff485c..2475aaf0d59b9 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c
++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+@@ -141,7 +141,7 @@ static int sec_bd_send(struct sec_ctx *ctx, struct sec_req *req)
+ 		return -ENOBUFS;
+ 
+ 	if (!ret) {
+-		if (atomic_read(&req->fake_busy))
++		if (req->fake_busy)
+ 			ret = -EBUSY;
+ 		else
+ 			ret = -EINPROGRESS;
+@@ -641,7 +641,7 @@ static void sec_skcipher_callback(struct sec_ctx *ctx, struct sec_req *req)
+ 	if (ctx->c_ctx.c_mode == SEC_CMODE_CBC && req->c_req.encrypt)
+ 		sec_update_iv(req);
+ 
+-	if (atomic_cmpxchg(&req->fake_busy, 1, 0) != 1)
++	if (req->fake_busy)
+ 		sk_req->base.complete(&sk_req->base, -EINPROGRESS);
+ 
+ 	sk_req->base.complete(&sk_req->base, req->err_type);
+@@ -672,9 +672,9 @@ static int sec_request_init(struct sec_ctx *ctx, struct sec_req *req)
+ 	}
+ 
+ 	if (ctx->fake_req_limit <= atomic_inc_return(&qp_ctx->pending_reqs))
+-		atomic_set(&req->fake_busy, 1);
++		req->fake_busy = true;
+ 	else
+-		atomic_set(&req->fake_busy, 0);
++		req->fake_busy = false;
+ 
+ 	ret = ctx->req_op->get_res(ctx, req);
+ 	if (ret) {
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index ab742dfbab997..d40e2da3b05da 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -608,13 +608,13 @@ static const struct file_operations sec_dbg_fops = {
+ 	.write = sec_debug_write,
+ };
+ 
+-static int debugfs_atomic64_t_get(void *data, u64 *val)
++static int sec_debugfs_atomic64_get(void *data, u64 *val)
+ {
+-        *val = atomic64_read((atomic64_t *)data);
+-        return 0;
++	*val = atomic64_read((atomic64_t *)data);
++	return 0;
+ }
+-DEFINE_DEBUGFS_ATTRIBUTE(fops_atomic64_t_ro, debugfs_atomic64_t_get, NULL,
+-                        "%lld\n");
++DEFINE_DEBUGFS_ATTRIBUTE(sec_atomic64_ops, sec_debugfs_atomic64_get,
++			 NULL, "%lld\n");
+ 
+ static int sec_core_debug_init(struct sec_dev *sec)
+ {
+@@ -636,11 +636,11 @@ static int sec_core_debug_init(struct sec_dev *sec)
+ 
+ 	debugfs_create_regset32("regs", 0444, tmp_d, regset);
+ 
+-	debugfs_create_file("send_cnt", 0444, tmp_d, &dfx->send_cnt,
+-			    &fops_atomic64_t_ro);
++	debugfs_create_file("send_cnt", 0444, tmp_d,
++			    &dfx->send_cnt, &sec_atomic64_ops);
+ 
+-	debugfs_create_file("recv_cnt", 0444, tmp_d, &dfx->recv_cnt,
+-			    &fops_atomic64_t_ro);
++	debugfs_create_file("recv_cnt", 0444, tmp_d,
++			    &dfx->recv_cnt, &sec_atomic64_ops);
+ 
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/crypto-inside-secure-add-unspecified-has_iomem-depen.patch b/queue-5.5/crypto-inside-secure-add-unspecified-has_iomem-depen.patch
new file mode 100644
index 00000000000..c303772360e
--- /dev/null
+++ b/queue-5.5/crypto-inside-secure-add-unspecified-has_iomem-depen.patch
@@ -0,0 +1,42 @@
+From c5b49e7a89e8b7247d359160a68d081d7e47dfdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 11:27:39 -0800
+Subject: crypto: inside-secure - add unspecified HAS_IOMEM dependency
+
+From: Brendan Higgins <brendanhiggins@google.com>
+
+[ Upstream commit 6dc0e310623fdcb27a1486eb436f0118c45e95a5 ]
+
+Currently CONFIG_CRYPTO_DEV_SAFEXCEL=y implicitly depends on
+CONFIG_HAS_IOMEM=y; consequently, on architectures without IOMEM we get
+the following build error:
+
+ld: drivers/crypto/inside-secure/safexcel.o: in function `safexcel_probe':
+drivers/crypto/inside-secure/safexcel.c:1692: undefined reference to `devm_platform_ioremap_resource'
+
+Fix the build error by adding the unspecified dependency.
+
+Reported-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
+index 91eb768d4221a..0a73bebd04e5d 100644
+--- a/drivers/crypto/Kconfig
++++ b/drivers/crypto/Kconfig
+@@ -716,7 +716,7 @@ source "drivers/crypto/stm32/Kconfig"
+ 
+ config CRYPTO_DEV_SAFEXCEL
+ 	tristate "Inside Secure's SafeXcel cryptographic engine driver"
+-	depends on OF || PCI || COMPILE_TEST
++	depends on (OF || PCI || COMPILE_TEST) && HAS_IOMEM
+ 	select CRYPTO_LIB_AES
+ 	select CRYPTO_AUTHENC
+ 	select CRYPTO_SKCIPHER
+-- 
+2.20.1
+
diff --git a/queue-5.5/debugobjects-fix-various-data-races.patch b/queue-5.5/debugobjects-fix-various-data-races.patch
new file mode 100644
index 00000000000..3ee2104769f
--- /dev/null
+++ b/queue-5.5/debugobjects-fix-various-data-races.patch
@@ -0,0 +1,238 @@
+From ce1c9b8c2b4979ef680db01b8b7e2c0d0f5fca27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 19:55:29 +0100
+Subject: debugobjects: Fix various data races
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 35fd7a637c42bb54ba4608f4d40ae6e55fc88781 ]
+
+The counters obj_pool_free, and obj_nr_tofree, and the flag obj_freeing are
+read locklessly outside the pool_lock critical sections. If read with plain
+accesses, this would result in data races.
+
+This is addressed as follows:
+
+ * reads outside critical sections become READ_ONCE()s (pairing with
+   WRITE_ONCE()s added);
+
+ * writes become WRITE_ONCE()s (pairing with READ_ONCE()s added); since
+   writes happen inside critical sections, only the write and not the read
+   of RMWs needs to be atomic, thus WRITE_ONCE(var, var +/- X) is
+   sufficient.
+
+The data races were reported by KCSAN:
+
+  BUG: KCSAN: data-race in __free_object / fill_pool
+
+  write to 0xffffffff8beb04f8 of 4 bytes by interrupt on cpu 1:
+   __free_object+0x1ee/0x8e0 lib/debugobjects.c:404
+   __debug_check_no_obj_freed+0x199/0x330 lib/debugobjects.c:969
+   debug_check_no_obj_freed+0x3c/0x44 lib/debugobjects.c:994
+   slab_free_hook mm/slub.c:1422 [inline]
+
+  read to 0xffffffff8beb04f8 of 4 bytes by task 1 on cpu 2:
+   fill_pool+0x3d/0x520 lib/debugobjects.c:135
+   __debug_object_init+0x3c/0x810 lib/debugobjects.c:536
+   debug_object_init lib/debugobjects.c:591 [inline]
+   debug_object_activate+0x228/0x320 lib/debugobjects.c:677
+   debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline]
+
+  BUG: KCSAN: data-race in __debug_object_init / fill_pool
+
+  read to 0xffffffff8beb04f8 of 4 bytes by task 10 on cpu 6:
+   fill_pool+0x3d/0x520 lib/debugobjects.c:135
+   __debug_object_init+0x3c/0x810 lib/debugobjects.c:536
+   debug_object_init_on_stack+0x39/0x50 lib/debugobjects.c:606
+   init_timer_on_stack_key kernel/time/timer.c:742 [inline]
+
+  write to 0xffffffff8beb04f8 of 4 bytes by task 1 on cpu 3:
+   alloc_object lib/debugobjects.c:258 [inline]
+   __debug_object_init+0x717/0x810 lib/debugobjects.c:544
+   debug_object_init lib/debugobjects.c:591 [inline]
+   debug_object_activate+0x228/0x320 lib/debugobjects.c:677
+   debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline]
+
+  BUG: KCSAN: data-race in free_obj_work / free_object
+
+  read to 0xffffffff9140c190 of 4 bytes by task 10 on cpu 6:
+   free_object+0x4b/0xd0 lib/debugobjects.c:426
+   debug_object_free+0x190/0x210 lib/debugobjects.c:824
+   destroy_timer_on_stack kernel/time/timer.c:749 [inline]
+
+  write to 0xffffffff9140c190 of 4 bytes by task 93 on cpu 1:
+   free_obj_work+0x24f/0x480 lib/debugobjects.c:313
+   process_one_work+0x454/0x8d0 kernel/workqueue.c:2264
+   worker_thread+0x9a/0x780 kernel/workqueue.c:2410
+
+Reported-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Marco Elver <elver@google.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20200116185529.11026-1-elver@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/debugobjects.c | 46 +++++++++++++++++++++++++---------------------
+ 1 file changed, 25 insertions(+), 21 deletions(-)
+
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 61261195f5b60..48054dbf1b51f 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -132,14 +132,18 @@ static void fill_pool(void)
+ 	struct debug_obj *obj;
+ 	unsigned long flags;
+ 
+-	if (likely(obj_pool_free >= debug_objects_pool_min_level))
++	if (likely(READ_ONCE(obj_pool_free) >= debug_objects_pool_min_level))
+ 		return;
+ 
+ 	/*
+ 	 * Reuse objs from the global free list; they will be reinitialized
+ 	 * when allocating.
++	 *
++	 * Both obj_nr_tofree and obj_pool_free are checked locklessly; the
++	 * READ_ONCE()s pair with the WRITE_ONCE()s in pool_lock critical
++	 * sections.
+ 	 */
+-	while (obj_nr_tofree && (obj_pool_free < obj_pool_min_free)) {
++	while (READ_ONCE(obj_nr_tofree) && (READ_ONCE(obj_pool_free) < obj_pool_min_free)) {
+ 		raw_spin_lock_irqsave(&pool_lock, flags);
+ 		/*
+ 		 * Recheck with the lock held as the worker thread might have
+@@ -148,9 +152,9 @@ static void fill_pool(void)
+ 		while (obj_nr_tofree && (obj_pool_free < obj_pool_min_free)) {
+ 			obj = hlist_entry(obj_to_free.first, typeof(*obj), node);
+ 			hlist_del(&obj->node);
+-			obj_nr_tofree--;
++			WRITE_ONCE(obj_nr_tofree, obj_nr_tofree - 1);
+ 			hlist_add_head(&obj->node, &obj_pool);
+-			obj_pool_free++;
++			WRITE_ONCE(obj_pool_free, obj_pool_free + 1);
+ 		}
+ 		raw_spin_unlock_irqrestore(&pool_lock, flags);
+ 	}
+@@ -158,7 +162,7 @@ static void fill_pool(void)
+ 	if (unlikely(!obj_cache))
+ 		return;
+ 
+-	while (obj_pool_free < debug_objects_pool_min_level) {
++	while (READ_ONCE(obj_pool_free) < debug_objects_pool_min_level) {
+ 		struct debug_obj *new[ODEBUG_BATCH_SIZE];
+ 		int cnt;
+ 
+@@ -174,7 +178,7 @@ static void fill_pool(void)
+ 		while (cnt) {
+ 			hlist_add_head(&new[--cnt]->node, &obj_pool);
+ 			debug_objects_allocated++;
+-			obj_pool_free++;
++			WRITE_ONCE(obj_pool_free, obj_pool_free + 1);
+ 		}
+ 		raw_spin_unlock_irqrestore(&pool_lock, flags);
+ 	}
+@@ -236,7 +240,7 @@ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
+ 	obj = __alloc_object(&obj_pool);
+ 	if (obj) {
+ 		obj_pool_used++;
+-		obj_pool_free--;
++		WRITE_ONCE(obj_pool_free, obj_pool_free - 1);
+ 
+ 		/*
+ 		 * Looking ahead, allocate one batch of debug objects and
+@@ -255,7 +259,7 @@ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
+ 					       &percpu_pool->free_objs);
+ 				percpu_pool->obj_free++;
+ 				obj_pool_used++;
+-				obj_pool_free--;
++				WRITE_ONCE(obj_pool_free, obj_pool_free - 1);
+ 			}
+ 		}
+ 
+@@ -309,8 +313,8 @@ static void free_obj_work(struct work_struct *work)
+ 		obj = hlist_entry(obj_to_free.first, typeof(*obj), node);
+ 		hlist_del(&obj->node);
+ 		hlist_add_head(&obj->node, &obj_pool);
+-		obj_pool_free++;
+-		obj_nr_tofree--;
++		WRITE_ONCE(obj_pool_free, obj_pool_free + 1);
++		WRITE_ONCE(obj_nr_tofree, obj_nr_tofree - 1);
+ 	}
+ 	raw_spin_unlock_irqrestore(&pool_lock, flags);
+ 	return;
+@@ -324,7 +328,7 @@ free_objs:
+ 	if (obj_nr_tofree) {
+ 		hlist_move_list(&obj_to_free, &tofree);
+ 		debug_objects_freed += obj_nr_tofree;
+-		obj_nr_tofree = 0;
++		WRITE_ONCE(obj_nr_tofree, 0);
+ 	}
+ 	raw_spin_unlock_irqrestore(&pool_lock, flags);
+ 
+@@ -375,10 +379,10 @@ free_to_obj_pool:
+ 	obj_pool_used--;
+ 
+ 	if (work) {
+-		obj_nr_tofree++;
++		WRITE_ONCE(obj_nr_tofree, obj_nr_tofree + 1);
+ 		hlist_add_head(&obj->node, &obj_to_free);
+ 		if (lookahead_count) {
+-			obj_nr_tofree += lookahead_count;
++			WRITE_ONCE(obj_nr_tofree, obj_nr_tofree + lookahead_count);
+ 			obj_pool_used -= lookahead_count;
+ 			while (lookahead_count) {
+ 				hlist_add_head(&objs[--lookahead_count]->node,
+@@ -396,15 +400,15 @@ free_to_obj_pool:
+ 			for (i = 0; i < ODEBUG_BATCH_SIZE; i++) {
+ 				obj = __alloc_object(&obj_pool);
+ 				hlist_add_head(&obj->node, &obj_to_free);
+-				obj_pool_free--;
+-				obj_nr_tofree++;
++				WRITE_ONCE(obj_pool_free, obj_pool_free - 1);
++				WRITE_ONCE(obj_nr_tofree, obj_nr_tofree + 1);
+ 			}
+ 		}
+ 	} else {
+-		obj_pool_free++;
++		WRITE_ONCE(obj_pool_free, obj_pool_free + 1);
+ 		hlist_add_head(&obj->node, &obj_pool);
+ 		if (lookahead_count) {
+-			obj_pool_free += lookahead_count;
++			WRITE_ONCE(obj_pool_free, obj_pool_free + lookahead_count);
+ 			obj_pool_used -= lookahead_count;
+ 			while (lookahead_count) {
+ 				hlist_add_head(&objs[--lookahead_count]->node,
+@@ -423,7 +427,7 @@ free_to_obj_pool:
+ static void free_object(struct debug_obj *obj)
+ {
+ 	__free_object(obj);
+-	if (!obj_freeing && obj_nr_tofree) {
++	if (!READ_ONCE(obj_freeing) && READ_ONCE(obj_nr_tofree)) {
+ 		WRITE_ONCE(obj_freeing, true);
+ 		schedule_delayed_work(&debug_obj_work, ODEBUG_FREE_WORK_DELAY);
+ 	}
+@@ -982,7 +986,7 @@ repeat:
+ 		debug_objects_maxchecked = objs_checked;
+ 
+ 	/* Schedule work to actually kmem_cache_free() objects */
+-	if (!obj_freeing && obj_nr_tofree) {
++	if (!READ_ONCE(obj_freeing) && READ_ONCE(obj_nr_tofree)) {
+ 		WRITE_ONCE(obj_freeing, true);
+ 		schedule_delayed_work(&debug_obj_work, ODEBUG_FREE_WORK_DELAY);
+ 	}
+@@ -1008,12 +1012,12 @@ static int debug_stats_show(struct seq_file *m, void *v)
+ 	seq_printf(m, "max_checked   :%d\n", debug_objects_maxchecked);
+ 	seq_printf(m, "warnings      :%d\n", debug_objects_warnings);
+ 	seq_printf(m, "fixups        :%d\n", debug_objects_fixups);
+-	seq_printf(m, "pool_free     :%d\n", obj_pool_free + obj_percpu_free);
++	seq_printf(m, "pool_free     :%d\n", READ_ONCE(obj_pool_free) + obj_percpu_free);
+ 	seq_printf(m, "pool_pcp_free :%d\n", obj_percpu_free);
+ 	seq_printf(m, "pool_min_free :%d\n", obj_pool_min_free);
+ 	seq_printf(m, "pool_used     :%d\n", obj_pool_used - obj_percpu_free);
+ 	seq_printf(m, "pool_max_used :%d\n", obj_pool_max_used);
+-	seq_printf(m, "on_free_list  :%d\n", obj_nr_tofree);
++	seq_printf(m, "on_free_list  :%d\n", READ_ONCE(obj_nr_tofree));
+ 	seq_printf(m, "objs_allocated:%d\n", debug_objects_allocated);
+ 	seq_printf(m, "objs_freed    :%d\n", debug_objects_freed);
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.5/dm-raid-table-line-rebuild-status-fixes.patch b/queue-5.5/dm-raid-table-line-rebuild-status-fixes.patch
new file mode 100644
index 00000000000..5f6ba92b55c
--- /dev/null
+++ b/queue-5.5/dm-raid-table-line-rebuild-status-fixes.patch
@@ -0,0 +1,137 @@
+From d9ab02e1fbcda4a5879695ce302b60c75c9662ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 17:58:46 +0100
+Subject: dm raid: table line rebuild status fixes
+
+From: Heinz Mauelshagen <heinzm@redhat.com>
+
+[ Upstream commit 43f3952a51f8198d365acb7f51fe42d578fe5d0a ]
+
+raid_status() wasn't emitting rebuild flags on the table line properly
+because the rdev number was not yet set properly; index raid component
+devices array directly to solve.
+
+Also fix wrong argument count on emitted table line caused by 1 too
+many rebuild/write_mostly argument and consider any journal_(dev|mode)
+pairs.
+
+Link: https://bugzilla.redhat.com/1782045
+Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../admin-guide/device-mapper/dm-raid.rst     |  2 +
+ drivers/md/dm-raid.c                          | 43 ++++++++++---------
+ 2 files changed, 24 insertions(+), 21 deletions(-)
+
+diff --git a/Documentation/admin-guide/device-mapper/dm-raid.rst b/Documentation/admin-guide/device-mapper/dm-raid.rst
+index f6344675e3951..695a2ea1d1ae2 100644
+--- a/Documentation/admin-guide/device-mapper/dm-raid.rst
++++ b/Documentation/admin-guide/device-mapper/dm-raid.rst
+@@ -419,3 +419,5 @@ Version History
+ 	rebuild errors.
+  1.15.0 Fix size extensions not being synchronized in case of new MD bitmap
+         pages allocated;  also fix those not occuring after previous reductions
++ 1.15.1 Fix argument count and arguments for rebuild/write_mostly/journal_(dev|mode)
++        on the status line.
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index c412eaa975fc0..9a18bef0a5ff0 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -129,7 +129,9 @@ struct raid_dev {
+ 				  CTR_FLAG_RAID10_COPIES | \
+ 				  CTR_FLAG_RAID10_FORMAT | \
+ 				  CTR_FLAG_DELTA_DISKS | \
+-				  CTR_FLAG_DATA_OFFSET)
++				  CTR_FLAG_DATA_OFFSET | \
++				  CTR_FLAG_JOURNAL_DEV | \
++				  CTR_FLAG_JOURNAL_MODE)
+ 
+ /* Valid options definitions per raid level... */
+ 
+@@ -3001,7 +3003,6 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ 		{ 1, 254, "Cannot understand number of raid devices parameters" }
+ 	};
+ 
+-	/* Must have <raid_type> */
+ 	arg = dm_shift_arg(&as);
+ 	if (!arg) {
+ 		ti->error = "No arguments";
+@@ -3508,8 +3509,7 @@ static void raid_status(struct dm_target *ti, status_type_t type,
+ 	unsigned long recovery;
+ 	unsigned int raid_param_cnt = 1; /* at least 1 for chunksize */
+ 	unsigned int sz = 0;
+-	unsigned int rebuild_disks;
+-	unsigned int write_mostly_params = 0;
++	unsigned int rebuild_writemostly_count = 0;
+ 	sector_t progress, resync_max_sectors, resync_mismatches;
+ 	enum sync_state state;
+ 	struct raid_type *rt;
+@@ -3593,18 +3593,20 @@ static void raid_status(struct dm_target *ti, status_type_t type,
+ 	case STATUSTYPE_TABLE:
+ 		/* Report the table line string you would use to construct this raid set */
+ 
+-		/* Calculate raid parameter count */
+-		for (i = 0; i < rs->raid_disks; i++)
+-			if (test_bit(WriteMostly, &rs->dev[i].rdev.flags))
+-				write_mostly_params += 2;
+-		rebuild_disks = memweight(rs->rebuild_disks, DISKS_ARRAY_ELEMS * sizeof(*rs->rebuild_disks));
+-		raid_param_cnt += rebuild_disks * 2 +
+-				  write_mostly_params +
++		/*
++		 * Count any rebuild or writemostly argument pairs and subtract the
++		 * hweight count being added below of any rebuild and writemostly ctr flags.
++		 */
++		for (i = 0; i < rs->raid_disks; i++) {
++			rebuild_writemostly_count += (test_bit(i, (void *) rs->rebuild_disks) ? 2 : 0) +
++						     (test_bit(WriteMostly, &rs->dev[i].rdev.flags) ? 2 : 0);
++		}
++		rebuild_writemostly_count -= (test_bit(__CTR_FLAG_REBUILD, &rs->ctr_flags) ? 2 : 0) +
++					     (test_bit(__CTR_FLAG_WRITE_MOSTLY, &rs->ctr_flags) ? 2 : 0);
++		/* Calculate raid parameter count based on ^ rebuild/writemostly argument counts and ctr flags set. */
++		raid_param_cnt += rebuild_writemostly_count +
+ 				  hweight32(rs->ctr_flags & CTR_FLAG_OPTIONS_NO_ARGS) +
+-				  hweight32(rs->ctr_flags & CTR_FLAG_OPTIONS_ONE_ARG) * 2 +
+-				  (test_bit(__CTR_FLAG_JOURNAL_DEV, &rs->ctr_flags) ? 2 : 0) +
+-				  (test_bit(__CTR_FLAG_JOURNAL_MODE, &rs->ctr_flags) ? 2 : 0);
+-
++				  hweight32(rs->ctr_flags & CTR_FLAG_OPTIONS_ONE_ARG) * 2;
+ 		/* Emit table line */
+ 		/* This has to be in the documented order for userspace! */
+ 		DMEMIT("%s %u %u", rs->raid_type->name, raid_param_cnt, mddev->new_chunk_sectors);
+@@ -3612,11 +3614,10 @@ static void raid_status(struct dm_target *ti, status_type_t type,
+ 			DMEMIT(" %s", dm_raid_arg_name_by_flag(CTR_FLAG_SYNC));
+ 		if (test_bit(__CTR_FLAG_NOSYNC, &rs->ctr_flags))
+ 			DMEMIT(" %s", dm_raid_arg_name_by_flag(CTR_FLAG_NOSYNC));
+-		if (rebuild_disks)
++		if (test_bit(__CTR_FLAG_REBUILD, &rs->ctr_flags))
+ 			for (i = 0; i < rs->raid_disks; i++)
+-				if (test_bit(rs->dev[i].rdev.raid_disk, (void *) rs->rebuild_disks))
+-					DMEMIT(" %s %u", dm_raid_arg_name_by_flag(CTR_FLAG_REBUILD),
+-							 rs->dev[i].rdev.raid_disk);
++				if (test_bit(i, (void *) rs->rebuild_disks))
++					DMEMIT(" %s %u", dm_raid_arg_name_by_flag(CTR_FLAG_REBUILD), i);
+ 		if (test_bit(__CTR_FLAG_DAEMON_SLEEP, &rs->ctr_flags))
+ 			DMEMIT(" %s %lu", dm_raid_arg_name_by_flag(CTR_FLAG_DAEMON_SLEEP),
+ 					  mddev->bitmap_info.daemon_sleep);
+@@ -3626,7 +3627,7 @@ static void raid_status(struct dm_target *ti, status_type_t type,
+ 		if (test_bit(__CTR_FLAG_MAX_RECOVERY_RATE, &rs->ctr_flags))
+ 			DMEMIT(" %s %d", dm_raid_arg_name_by_flag(CTR_FLAG_MAX_RECOVERY_RATE),
+ 					 mddev->sync_speed_max);
+-		if (write_mostly_params)
++		if (test_bit(__CTR_FLAG_WRITE_MOSTLY, &rs->ctr_flags))
+ 			for (i = 0; i < rs->raid_disks; i++)
+ 				if (test_bit(WriteMostly, &rs->dev[i].rdev.flags))
+ 					DMEMIT(" %s %d", dm_raid_arg_name_by_flag(CTR_FLAG_WRITE_MOSTLY),
+@@ -4029,7 +4030,7 @@ static void raid_resume(struct dm_target *ti)
+ 
+ static struct target_type raid_target = {
+ 	.name = "raid",
+-	.version = {1, 15, 0},
++	.version = {1, 15, 1},
+ 	.module = THIS_MODULE,
+ 	.ctr = raid_ctr,
+ 	.dtr = raid_dtr,
+-- 
+2.20.1
+
diff --git a/queue-5.5/dm-thin-don-t-allow-changing-data-device-during-thin.patch b/queue-5.5/dm-thin-don-t-allow-changing-data-device-during-thin.patch
new file mode 100644
index 00000000000..6617e9d318c
--- /dev/null
+++ b/queue-5.5/dm-thin-don-t-allow-changing-data-device-during-thin.patch
@@ -0,0 +1,122 @@
+From c59f8f1c6f7538a9c7935cf56a8e733b798123dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 15:04:37 -0500
+Subject: dm thin: don't allow changing data device during thin-pool reload
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 873937e75f9a8ea231a502c3d29d9cb6ad91b3ef ]
+
+The existing code allows changing the data device when the thin-pool
+target is reloaded.
+
+This capability is not required and only complicates device lifetime
+guarantees. This can cause crashes like the one reported here:
+	https://bugzilla.redhat.com/show_bug.cgi?id=1788596
+where the kernel tries to issue a flush bio located in a structure that
+was already freed.
+
+Take the first step to simplifying the thin-pool's data device lifetime
+by disallowing changing it. Like the thin-pool's metadata device, the
+data device is now set in pool_create() and it cannot be changed for a
+given thin-pool.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-thin.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index a2bb2622cdbd5..4fb6e89c87862 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -231,6 +231,7 @@ struct pool {
+ 	struct dm_target *ti;	/* Only set if a pool target is bound */
+ 
+ 	struct mapped_device *pool_md;
++	struct block_device *data_dev;
+ 	struct block_device *md_dev;
+ 	struct dm_pool_metadata *pmd;
+ 
+@@ -2933,6 +2934,7 @@ static struct kmem_cache *_new_mapping_cache;
+ 
+ static struct pool *pool_create(struct mapped_device *pool_md,
+ 				struct block_device *metadata_dev,
++				struct block_device *data_dev,
+ 				unsigned long block_size,
+ 				int read_only, char **error)
+ {
+@@ -3040,6 +3042,7 @@ static struct pool *pool_create(struct mapped_device *pool_md,
+ 	pool->last_commit_jiffies = jiffies;
+ 	pool->pool_md = pool_md;
+ 	pool->md_dev = metadata_dev;
++	pool->data_dev = data_dev;
+ 	__pool_table_insert(pool);
+ 
+ 	return pool;
+@@ -3081,6 +3084,7 @@ static void __pool_dec(struct pool *pool)
+ 
+ static struct pool *__pool_find(struct mapped_device *pool_md,
+ 				struct block_device *metadata_dev,
++				struct block_device *data_dev,
+ 				unsigned long block_size, int read_only,
+ 				char **error, int *created)
+ {
+@@ -3091,19 +3095,23 @@ static struct pool *__pool_find(struct mapped_device *pool_md,
+ 			*error = "metadata device already in use by a pool";
+ 			return ERR_PTR(-EBUSY);
+ 		}
++		if (pool->data_dev != data_dev) {
++			*error = "data device already in use by a pool";
++			return ERR_PTR(-EBUSY);
++		}
+ 		__pool_inc(pool);
+ 
+ 	} else {
+ 		pool = __pool_table_lookup(pool_md);
+ 		if (pool) {
+-			if (pool->md_dev != metadata_dev) {
++			if (pool->md_dev != metadata_dev || pool->data_dev != data_dev) {
+ 				*error = "different pool cannot replace a pool";
+ 				return ERR_PTR(-EINVAL);
+ 			}
+ 			__pool_inc(pool);
+ 
+ 		} else {
+-			pool = pool_create(pool_md, metadata_dev, block_size, read_only, error);
++			pool = pool_create(pool_md, metadata_dev, data_dev, block_size, read_only, error);
+ 			*created = 1;
+ 		}
+ 	}
+@@ -3356,7 +3364,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ 		goto out;
+ 	}
+ 
+-	pool = __pool_find(dm_table_get_md(ti->table), metadata_dev->bdev,
++	pool = __pool_find(dm_table_get_md(ti->table), metadata_dev->bdev, data_dev->bdev,
+ 			   block_size, pf.mode == PM_READ_ONLY, &ti->error, &pool_created);
+ 	if (IS_ERR(pool)) {
+ 		r = PTR_ERR(pool);
+@@ -4098,7 +4106,7 @@ static struct target_type pool_target = {
+ 	.name = "thin-pool",
+ 	.features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
+ 		    DM_TARGET_IMMUTABLE,
+-	.version = {1, 21, 0},
++	.version = {1, 22, 0},
+ 	.module = THIS_MODULE,
+ 	.ctr = pool_ctr,
+ 	.dtr = pool_dtr,
+@@ -4475,7 +4483,7 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
+ 
+ static struct target_type thin_target = {
+ 	.name = "thin",
+-	.version = {1, 21, 0},
++	.version = {1, 22, 0},
+ 	.module	= THIS_MODULE,
+ 	.ctr = thin_ctr,
+ 	.dtr = thin_dtr,
+-- 
+2.20.1
+
diff --git a/queue-5.5/dmaengine-fsl-qdma-fix-duplicated-argument-to.patch b/queue-5.5/dmaengine-fsl-qdma-fix-duplicated-argument-to.patch
new file mode 100644
index 00000000000..8dd76ea2815
--- /dev/null
+++ b/queue-5.5/dmaengine-fsl-qdma-fix-duplicated-argument-to.patch
@@ -0,0 +1,41 @@
+From 3b462d20deaf826a9b14205b27c64b136c078902 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 20:58:43 +0800
+Subject: dmaengine: fsl-qdma: fix duplicated argument to &&
+
+From: Chen Zhou <chenzhou10@huawei.com>
+
+[ Upstream commit 4b048178854da11656596d36a107577d66fd1e08 ]
+
+There is duplicated argument to && in function fsl_qdma_free_chan_resources,
+which looks like a typo, pointer fsl_queue->desc_pool also needs NULL check,
+fix it.
+Detected with coccinelle.
+
+Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs")
+Signed-off-by: Chen Zhou <chenzhou10@huawei.com>
+Reviewed-by: Peng Ma <peng.ma@nxp.com>
+Tested-by: Peng Ma <peng.ma@nxp.com>
+Link: https://lore.kernel.org/r/20200120125843.34398-1-chenzhou10@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/fsl-qdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c
+index 89792083d62c5..95cc0256b3878 100644
+--- a/drivers/dma/fsl-qdma.c
++++ b/drivers/dma/fsl-qdma.c
+@@ -304,7 +304,7 @@ static void fsl_qdma_free_chan_resources(struct dma_chan *chan)
+ 
+ 	vchan_dma_desc_free_list(&fsl_chan->vchan, &head);
+ 
+-	if (!fsl_queue->comp_pool && !fsl_queue->comp_pool)
++	if (!fsl_queue->comp_pool && !fsl_queue->desc_pool)
+ 		return;
+ 
+ 	list_for_each_entry_safe(comp_temp, _comp_temp,
+-- 
+2.20.1
+
diff --git a/queue-5.5/dmaengine-imx-sdma-fix-memory-leak.patch b/queue-5.5/dmaengine-imx-sdma-fix-memory-leak.patch
new file mode 100644
index 00000000000..15dcb9818a8
--- /dev/null
+++ b/queue-5.5/dmaengine-imx-sdma-fix-memory-leak.patch
@@ -0,0 +1,78 @@
+From 832bb1c807cc180a1b4a7e427d12a18372f2d370 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 11:53:28 +0100
+Subject: dmaengine: imx-sdma: Fix memory leak
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit 02939cd167095f16328a1bd5cab5a90b550606df ]
+
+The current descriptor is not on any list of the virtual DMA channel.
+Once sdma_terminate_all() is called when a descriptor is currently
+in flight then this one is forgotten to be freed. We have to call
+vchan_terminate_vdesc() on this descriptor to re-add it to the lists.
+Now that we also free the currently running descriptor we can (and
+actually have to) remove the current descriptor from its list also
+for the cyclic case.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Reviewed-by: Robin Gong <yibin.gong@nxp.com>
+Tested-by: Robin Gong <yibin.gong@nxp.com>
+Link: https://lore.kernel.org/r/20191216105328.15198-10-s.hauer@pengutronix.de
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/imx-sdma.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index c27e206a764c3..66f1b2ac5cde4 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -760,12 +760,8 @@ static void sdma_start_desc(struct sdma_channel *sdmac)
+ 		return;
+ 	}
+ 	sdmac->desc = desc = to_sdma_desc(&vd->tx);
+-	/*
+-	 * Do not delete the node in desc_issued list in cyclic mode, otherwise
+-	 * the desc allocated will never be freed in vchan_dma_desc_free_list
+-	 */
+-	if (!(sdmac->flags & IMX_DMA_SG_LOOP))
+-		list_del(&vd->node);
++
++	list_del(&vd->node);
+ 
+ 	sdma->channel_control[channel].base_bd_ptr = desc->bd_phys;
+ 	sdma->channel_control[channel].current_bd_ptr = desc->bd_phys;
+@@ -1071,7 +1067,6 @@ static void sdma_channel_terminate_work(struct work_struct *work)
+ 
+ 	spin_lock_irqsave(&sdmac->vc.lock, flags);
+ 	vchan_get_all_descriptors(&sdmac->vc, &head);
+-	sdmac->desc = NULL;
+ 	spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+ 	vchan_dma_desc_free_list(&sdmac->vc, &head);
+ 	sdmac->context_loaded = false;
+@@ -1080,11 +1075,19 @@ static void sdma_channel_terminate_work(struct work_struct *work)
+ static int sdma_disable_channel_async(struct dma_chan *chan)
+ {
+ 	struct sdma_channel *sdmac = to_sdma_chan(chan);
++	unsigned long flags;
++
++	spin_lock_irqsave(&sdmac->vc.lock, flags);
+ 
+ 	sdma_disable_channel(chan);
+ 
+-	if (sdmac->desc)
++	if (sdmac->desc) {
++		vchan_terminate_vdesc(&sdmac->desc->vd);
++		sdmac->desc = NULL;
+ 		schedule_work(&sdmac->terminate_worker);
++	}
++
++	spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+ 
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/dmaengine-store-module-owner-in-dma_device-struct.patch b/queue-5.5/dmaengine-store-module-owner-in-dma_device-struct.patch
new file mode 100644
index 00000000000..358a0b3230a
--- /dev/null
+++ b/queue-5.5/dmaengine-store-module-owner-in-dma_device-struct.patch
@@ -0,0 +1,80 @@
+From 40e6725f24ec99a71b3a520f72d1b151340997d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 12:01:16 -0700
+Subject: dmaengine: Store module owner in dma_device struct
+
+From: Logan Gunthorpe <logang@deltatee.com>
+
+[ Upstream commit dae7a589c18a4d979d5f14b09374e871b995ceb1 ]
+
+dma_chan_to_owner() dereferences the driver from the struct device to
+obtain the owner and call module_[get|put](). However, if the backing
+device is unbound before the dma_device is unregistered, the driver
+will be cleared and this will cause a NULL pointer dereference.
+
+Instead, store a pointer to the owner module in the dma_device struct
+so the module reference can be properly put when the channel is put, even
+if the backing device was destroyed first.
+
+This change helps to support a safer unbind of DMA engines.
+If the dma_device is unregistered in the driver's remove function,
+there's no guarantee that there are no existing clients and a users
+action may trigger the WARN_ONCE in dma_async_device_unregister()
+which is unlikely to leave the system in a consistent state.
+Instead, a better approach is to allow the backing driver to go away
+and fail any subsequent requests to it.
+
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Link: https://lore.kernel.org/r/20191216190120.21374-2-logang@deltatee.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dmaengine.c   | 4 +++-
+ include/linux/dmaengine.h | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
+index 03ac4b96117cd..4b604086b1b3a 100644
+--- a/drivers/dma/dmaengine.c
++++ b/drivers/dma/dmaengine.c
+@@ -179,7 +179,7 @@ __dma_device_satisfies_mask(struct dma_device *device,
+ 
+ static struct module *dma_chan_to_owner(struct dma_chan *chan)
+ {
+-	return chan->device->dev->driver->owner;
++	return chan->device->owner;
+ }
+ 
+ /**
+@@ -919,6 +919,8 @@ int dma_async_device_register(struct dma_device *device)
+ 		return -EIO;
+ 	}
+ 
++	device->owner = device->dev->driver->owner;
++
+ 	if (dma_has_cap(DMA_MEMCPY, device->cap_mask) && !device->device_prep_dma_memcpy) {
+ 		dev_err(device->dev,
+ 			"Device claims capability %s, but op is not defined\n",
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index dad4a68fa0094..8013562751a50 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -674,6 +674,7 @@ struct dma_filter {
+  * @fill_align: alignment shift for memset operations
+  * @dev_id: unique device ID
+  * @dev: struct device reference for dma mapping api
++ * @owner: owner module (automatically set based on the provided dev)
+  * @src_addr_widths: bit mask of src addr widths the device supports
+  *	Width is specified in bytes, e.g. for a device supporting
+  *	a width of 4 the mask should have BIT(4) set.
+@@ -737,6 +738,7 @@ struct dma_device {
+ 
+ 	int dev_id;
+ 	struct device *dev;
++	struct module *owner;
+ 
+ 	u32 src_addr_widths;
+ 	u32 dst_addr_widths;
+-- 
+2.20.1
+
diff --git a/queue-5.5/dmaengine-ti-edma-add-missed-operations.patch b/queue-5.5/dmaengine-ti-edma-add-missed-operations.patch
new file mode 100644
index 00000000000..88ef3f79fed
--- /dev/null
+++ b/queue-5.5/dmaengine-ti-edma-add-missed-operations.patch
@@ -0,0 +1,133 @@
+From 8c332ac31bf52b7b2a19e76340ca73fdcf310244 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Nov 2019 13:28:55 +0800
+Subject: dmaengine: ti: edma: add missed operations
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 2a03c1314506557277829562dd2ec5c11a6ea914 ]
+
+The driver forgets to call pm_runtime_disable and pm_runtime_put_sync in
+probe failure and remove.
+Add the calls and modify probe failure handling to fix it.
+
+To simplify the fix, the patch adjusts the calling order and merges checks
+for devm_kcalloc.
+
+Fixes: 2b6b3b742019 ("ARM/dmaengine: edma: Merge the two drivers under drivers/dma/")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lore.kernel.org/r/20191124052855.6472-1-hslester96@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/edma.c | 37 ++++++++++++++++++++-----------------
+ 1 file changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
+index 756a3c951dc72..0628ee4bf1b41 100644
+--- a/drivers/dma/ti/edma.c
++++ b/drivers/dma/ti/edma.c
+@@ -2289,13 +2289,6 @@ static int edma_probe(struct platform_device *pdev)
+ 	if (!info)
+ 		return -ENODEV;
+ 
+-	pm_runtime_enable(dev);
+-	ret = pm_runtime_get_sync(dev);
+-	if (ret < 0) {
+-		dev_err(dev, "pm_runtime_get_sync() failed\n");
+-		return ret;
+-	}
+-
+ 	ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
+ 	if (ret)
+ 		return ret;
+@@ -2326,27 +2319,31 @@ static int edma_probe(struct platform_device *pdev)
+ 
+ 	platform_set_drvdata(pdev, ecc);
+ 
++	pm_runtime_enable(dev);
++	ret = pm_runtime_get_sync(dev);
++	if (ret < 0) {
++		dev_err(dev, "pm_runtime_get_sync() failed\n");
++		pm_runtime_disable(dev);
++		return ret;
++	}
++
+ 	/* Get eDMA3 configuration from IP */
+ 	ret = edma_setup_from_hw(dev, info, ecc);
+ 	if (ret)
+-		return ret;
++		goto err_disable_pm;
+ 
+ 	/* Allocate memory based on the information we got from the IP */
+ 	ecc->slave_chans = devm_kcalloc(dev, ecc->num_channels,
+ 					sizeof(*ecc->slave_chans), GFP_KERNEL);
+-	if (!ecc->slave_chans)
+-		return -ENOMEM;
+ 
+ 	ecc->slot_inuse = devm_kcalloc(dev, BITS_TO_LONGS(ecc->num_slots),
+ 				       sizeof(unsigned long), GFP_KERNEL);
+-	if (!ecc->slot_inuse)
+-		return -ENOMEM;
+ 
+ 	ecc->channels_mask = devm_kcalloc(dev,
+ 					   BITS_TO_LONGS(ecc->num_channels),
+ 					   sizeof(unsigned long), GFP_KERNEL);
+-	if (!ecc->channels_mask)
+-		return -ENOMEM;
++	if (!ecc->slave_chans || !ecc->slot_inuse || !ecc->channels_mask)
++		goto err_disable_pm;
+ 
+ 	/* Mark all channels available initially */
+ 	bitmap_fill(ecc->channels_mask, ecc->num_channels);
+@@ -2388,7 +2385,7 @@ static int edma_probe(struct platform_device *pdev)
+ 				       ecc);
+ 		if (ret) {
+ 			dev_err(dev, "CCINT (%d) failed --> %d\n", irq, ret);
+-			return ret;
++			goto err_disable_pm;
+ 		}
+ 		ecc->ccint = irq;
+ 	}
+@@ -2404,7 +2401,7 @@ static int edma_probe(struct platform_device *pdev)
+ 				       ecc);
+ 		if (ret) {
+ 			dev_err(dev, "CCERRINT (%d) failed --> %d\n", irq, ret);
+-			return ret;
++			goto err_disable_pm;
+ 		}
+ 		ecc->ccerrint = irq;
+ 	}
+@@ -2412,7 +2409,8 @@ static int edma_probe(struct platform_device *pdev)
+ 	ecc->dummy_slot = edma_alloc_slot(ecc, EDMA_SLOT_ANY);
+ 	if (ecc->dummy_slot < 0) {
+ 		dev_err(dev, "Can't allocate PaRAM dummy slot\n");
+-		return ecc->dummy_slot;
++		ret = ecc->dummy_slot;
++		goto err_disable_pm;
+ 	}
+ 
+ 	queue_priority_mapping = info->queue_priority_mapping;
+@@ -2512,6 +2510,9 @@ static int edma_probe(struct platform_device *pdev)
+ 
+ err_reg1:
+ 	edma_free_slot(ecc, ecc->dummy_slot);
++err_disable_pm:
++	pm_runtime_put_sync(dev);
++	pm_runtime_disable(dev);
+ 	return ret;
+ }
+ 
+@@ -2542,6 +2543,8 @@ static int edma_remove(struct platform_device *pdev)
+ 	if (ecc->dma_memcpy)
+ 		dma_async_device_unregister(ecc->dma_memcpy);
+ 	edma_free_slot(ecc, ecc->dummy_slot);
++	pm_runtime_put_sync(dev);
++	pm_runtime_disable(dev);
+ 
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/dmaengine-ti-edma-fix-error-return-code-in-edma_prob.patch b/queue-5.5/dmaengine-ti-edma-fix-error-return-code-in-edma_prob.patch
new file mode 100644
index 00000000000..023a798a7fc
--- /dev/null
+++ b/queue-5.5/dmaengine-ti-edma-fix-error-return-code-in-edma_prob.patch
@@ -0,0 +1,41 @@
+From 8af572451e63b7f460cde22edffbbe6bcee2dfb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:46:22 +0000
+Subject: dmaengine: ti: edma: Fix error return code in edma_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit d1fd03a35efc6285e43f4ef35ef04dbf2c9389c6 ]
+
+Fix to return negative error code -ENOMEM from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 2a03c1314506 ("dmaengine: ti: edma: add missed operations")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lore.kernel.org/r/20191212114622.127322-1-weiyongjun1@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/edma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
+index 0628ee4bf1b41..03a7f647f7b2c 100644
+--- a/drivers/dma/ti/edma.c
++++ b/drivers/dma/ti/edma.c
+@@ -2342,8 +2342,10 @@ static int edma_probe(struct platform_device *pdev)
+ 	ecc->channels_mask = devm_kcalloc(dev,
+ 					   BITS_TO_LONGS(ecc->num_channels),
+ 					   sizeof(unsigned long), GFP_KERNEL);
+-	if (!ecc->slave_chans || !ecc->slot_inuse || !ecc->channels_mask)
++	if (!ecc->slave_chans || !ecc->slot_inuse || !ecc->channels_mask) {
++		ret = -ENOMEM;
+ 		goto err_disable_pm;
++	}
+ 
+ 	/* Mark all channels available initially */
+ 	bitmap_fill(ecc->channels_mask, ecc->num_channels);
+-- 
+2.20.1
+
diff --git a/queue-5.5/driver-core-platform-fix-u32-greater-or-equal-to-zer.patch b/queue-5.5/driver-core-platform-fix-u32-greater-or-equal-to-zer.patch
new file mode 100644
index 00000000000..69f59976381
--- /dev/null
+++ b/queue-5.5/driver-core-platform-fix-u32-greater-or-equal-to-zer.patch
@@ -0,0 +1,41 @@
+From 9f61a33b898e6fa984c6a65631be488e31e621c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 17:57:58 +0000
+Subject: driver core: platform: fix u32 greater or equal to zero comparison
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 0707cfa5c3ef58effb143db9db6d6e20503f9dec ]
+
+Currently the check that a u32 variable i is >= 0 is always true because
+the unsigned variable will never be negative, causing the loop to run
+forever.  Fix this by changing the pre-decrement check to a zero check on
+i followed by a decrement of i.
+
+Addresses-Coverity: ("Unsigned compared against 0")
+Fixes: 39cc539f90d0 ("driver core: platform: Prevent resouce overflow from causing infinite loops")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lore.kernel.org/r/20200116175758.88396-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 864b53b3d5980..7fa654f1288b8 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -571,7 +571,7 @@ int platform_device_add(struct platform_device *pdev)
+ 		pdev->id = PLATFORM_DEVID_AUTO;
+ 	}
+ 
+-	while (--i >= 0) {
++	while (i--) {
+ 		struct resource *r = &pdev->resource[i];
+ 		if (r->parent)
+ 			release_resource(r);
+-- 
+2.20.1
+
diff --git a/queue-5.5/driver-core-platform-prevent-resouce-overflow-from-c.patch b/queue-5.5/driver-core-platform-prevent-resouce-overflow-from-c.patch
new file mode 100644
index 00000000000..495645ebe91
--- /dev/null
+++ b/queue-5.5/driver-core-platform-prevent-resouce-overflow-from-c.patch
@@ -0,0 +1,75 @@
+From 769cb2d4d178edc670e083a9b1979c31982d15d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 17:41:37 -0500
+Subject: driver core: platform: Prevent resouce overflow from causing infinite
+ loops
+
+From: Simon Schwartz <kern.simon@theschwartz.xyz>
+
+[ Upstream commit 39cc539f90d035a293240c9443af50be55ee81b8 ]
+
+num_resources in the platform_device struct is declared as a u32.  The
+for loops that iterate over num_resources use an int as the counter,
+which can cause infinite loops on architectures with smaller ints.
+Change the loop counters to u32.
+
+Signed-off-by: Simon Schwartz <kern.simon@theschwartz.xyz>
+Link: https://lore.kernel.org/r/2201ce63a2a171ffd2ed14e867875316efcf71db.camel@theschwartz.xyz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/platform.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index cf6b6b722e5c9..864b53b3d5980 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -27,6 +27,7 @@
+ #include <linux/limits.h>
+ #include <linux/property.h>
+ #include <linux/kmemleak.h>
++#include <linux/types.h>
+ 
+ #include "base.h"
+ #include "power/power.h"
+@@ -48,7 +49,7 @@ EXPORT_SYMBOL_GPL(platform_bus);
+ struct resource *platform_get_resource(struct platform_device *dev,
+ 				       unsigned int type, unsigned int num)
+ {
+-	int i;
++	u32 i;
+ 
+ 	for (i = 0; i < dev->num_resources; i++) {
+ 		struct resource *r = &dev->resource[i];
+@@ -255,7 +256,7 @@ struct resource *platform_get_resource_byname(struct platform_device *dev,
+ 					      unsigned int type,
+ 					      const char *name)
+ {
+-	int i;
++	u32 i;
+ 
+ 	for (i = 0; i < dev->num_resources; i++) {
+ 		struct resource *r = &dev->resource[i];
+@@ -501,7 +502,8 @@ EXPORT_SYMBOL_GPL(platform_device_add_properties);
+  */
+ int platform_device_add(struct platform_device *pdev)
+ {
+-	int i, ret;
++	u32 i;
++	int ret;
+ 
+ 	if (!pdev)
+ 		return -EINVAL;
+@@ -590,7 +592,7 @@ EXPORT_SYMBOL_GPL(platform_device_add);
+  */
+ void platform_device_del(struct platform_device *pdev)
+ {
+-	int i;
++	u32 i;
+ 
+ 	if (!IS_ERR_OR_NULL(pdev)) {
+ 		device_del(&pdev->dev);
+-- 
+2.20.1
+
diff --git a/queue-5.5/driver-core-print-device-when-resources-present-in-r.patch b/queue-5.5/driver-core-print-device-when-resources-present-in-r.patch
new file mode 100644
index 00000000000..2398789f004
--- /dev/null
+++ b/queue-5.5/driver-core-print-device-when-resources-present-in-r.patch
@@ -0,0 +1,45 @@
+From 680b0348239ab0be2feba835e92cd6cbc7a4ab3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 14:22:19 +0100
+Subject: driver core: Print device when resources present in really_probe()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 7c35e699c88bd60734277b26962783c60e04b494 ]
+
+If a device already has devres items attached before probing, a warning
+backtrace is printed.  However, this backtrace does not reveal the
+offending device, leaving the user uninformed.  Furthermore, using
+WARN_ON() causes systems with panic-on-warn to reboot.
+
+Fix this by replacing the WARN_ON() by a dev_crit() message.
+Abort probing the device, to prevent doing more damage to the device's
+resources.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191206132219.28908-1-geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/dd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index d811e60610d33..b25bcab2a26bd 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -516,7 +516,10 @@ static int really_probe(struct device *dev, struct device_driver *drv)
+ 	atomic_inc(&probe_count);
+ 	pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
+ 		 drv->bus->name, __func__, drv->name, dev_name(dev));
+-	WARN_ON(!list_empty(&dev->devres_head));
++	if (!list_empty(&dev->devres_head)) {
++		dev_crit(dev, "Resources present before probing\n");
++		return -EBUSY;
++	}
+ 
+ re_probe:
+ 	dev->driver = drv;
+-- 
+2.20.1
+
diff --git a/queue-5.5/drivers-block-zram-zram_drv.c-fix-error-return-codes.patch b/queue-5.5/drivers-block-zram-zram_drv.c-fix-error-return-codes.patch
new file mode 100644
index 00000000000..3b4f9703489
--- /dev/null
+++ b/queue-5.5/drivers-block-zram-zram_drv.c-fix-error-return-codes.patch
@@ -0,0 +1,56 @@
+From a2de2dd8fc5adbcfa857086c8f4ab4bf239ee0b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:15:25 -0800
+Subject: drivers/block/zram/zram_drv.c: fix error return codes not being
+ returned in writeback_store
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 3b82a051c10143639a378dcd12019f2353cc9054 ]
+
+Currently when an error code -EIO or -ENOSPC in the for-loop of
+writeback_store the error code is being overwritten by a ret = len
+assignment at the end of the function and the error codes are being
+lost.  Fix this by assigning ret = len at the start of the function and
+remove the assignment from the end, hence allowing ret to be preserved
+when error codes are assigned to it.
+
+Addresses Coverity ("Unused value")
+
+Link: http://lkml.kernel.org/r/20191128122958.178290-1-colin.king@canonical.com
+Fixes: a939888ec38b ("zram: support idle/huge page writeback")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Minchan Kim <minchan@kernel.org>
+Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/zram/zram_drv.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 4285e75e52c34..1bf4a908a0bd9 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -626,7 +626,7 @@ static ssize_t writeback_store(struct device *dev,
+ 	struct bio bio;
+ 	struct bio_vec bio_vec;
+ 	struct page *page;
+-	ssize_t ret;
++	ssize_t ret = len;
+ 	int mode;
+ 	unsigned long blk_idx = 0;
+ 
+@@ -762,7 +762,6 @@ next:
+ 
+ 	if (blk_idx)
+ 		free_block_bdev(zram, blk_idx);
+-	ret = len;
+ 	__free_page(page);
+ release_init_lock:
+ 	up_read(&zram->init_lock);
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amd-display-clear-state-after-exiting-fixed-acti.patch b/queue-5.5/drm-amd-display-clear-state-after-exiting-fixed-acti.patch
new file mode 100644
index 00000000000..6aed4141297
--- /dev/null
+++ b/queue-5.5/drm-amd-display-clear-state-after-exiting-fixed-acti.patch
@@ -0,0 +1,49 @@
+From 3e7ce2e6542beb5d29b4c6a75be1a9a076f8a044 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 15:12:30 -0500
+Subject: drm/amd/display: Clear state after exiting fixed active VRR state
+
+From: Amanda Liu <amanda.liu@amd.com>
+
+[ Upstream commit 6f8f76444baf405bacb0591d97549a71a9aaa1ac ]
+
+[why]
+Upon exiting a fixed active VRR state, the state isn't cleared. This
+leads to the variable VRR range to be calculated incorrectly.
+
+[how]
+Set fixed active state to false when updating vrr params
+
+Signed-off-by: Amanda Liu <amanda.liu@amd.com>
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/modules/freesync/freesync.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+index 5437b50e9f90d..d9ea4ae690af6 100644
+--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
++++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+@@ -807,6 +807,7 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync,
+ 			2 * in_out_vrr->min_refresh_in_uhz)
+ 		in_out_vrr->btr.btr_enabled = false;
+ 
++	in_out_vrr->fixed.fixed_active = false;
+ 	in_out_vrr->btr.btr_active = false;
+ 	in_out_vrr->btr.inserted_duration_in_us = 0;
+ 	in_out_vrr->btr.frames_to_insert = 0;
+@@ -826,6 +827,7 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync,
+ 		in_out_vrr->adjust.v_total_max = stream->timing.v_total;
+ 	} else if (in_out_vrr->state == VRR_STATE_ACTIVE_VARIABLE &&
+ 			refresh_range >= MIN_REFRESH_RANGE_IN_US) {
++
+ 		in_out_vrr->adjust.v_total_min =
+ 			calc_v_total_from_refresh(stream,
+ 				in_out_vrr->max_refresh_in_uhz);
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amd-display-do-not-allocate-display_mode_lib-unn.patch b/queue-5.5/drm-amd-display-do-not-allocate-display_mode_lib-unn.patch
new file mode 100644
index 00000000000..3f9b513cd76
--- /dev/null
+++ b/queue-5.5/drm-amd-display-do-not-allocate-display_mode_lib-unn.patch
@@ -0,0 +1,67 @@
+From f66c25ed629ddd4533d61e99d4ecb570f2ec1ea9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2020 14:22:15 +0200
+Subject: drm/amd/display: do not allocate display_mode_lib unnecessarily
+
+From: Dor Askayo <dor.askayo@gmail.com>
+
+[ Upstream commit bb67bfd2e7101bf2ac5327b0b7a847cd9fb9723f ]
+
+This allocation isn't required and can fail when resuming from suspend.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/1009
+Signed-off-by: Dor Askayo <dor.askayo@gmail.com>
+Reviewed-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 32f31bf919151..8904a85186aab 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -2396,12 +2396,7 @@ void dc_set_power_state(
+ 	enum dc_acpi_cm_power_state power_state)
+ {
+ 	struct kref refcount;
+-	struct display_mode_lib *dml = kzalloc(sizeof(struct display_mode_lib),
+-						GFP_KERNEL);
+-
+-	ASSERT(dml);
+-	if (!dml)
+-		return;
++	struct display_mode_lib *dml;
+ 
+ 	switch (power_state) {
+ 	case DC_ACPI_CM_POWER_STATE_D0:
+@@ -2423,6 +2418,12 @@ void dc_set_power_state(
+ 		 * clean state, and dc hw programming optimizations will not
+ 		 * cause any trouble.
+ 		 */
++		dml = kzalloc(sizeof(struct display_mode_lib),
++				GFP_KERNEL);
++
++		ASSERT(dml);
++		if (!dml)
++			return;
+ 
+ 		/* Preserve refcount */
+ 		refcount = dc->current_state->refcount;
+@@ -2436,10 +2437,10 @@ void dc_set_power_state(
+ 		dc->current_state->refcount = refcount;
+ 		dc->current_state->bw_ctx.dml = *dml;
+ 
++		kfree(dml);
++
+ 		break;
+ 	}
+-
+-	kfree(dml);
+ }
+ 
+ void dc_resume(struct dc *dc)
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amd-display-fix-update_bw_bounding_box-calcs.patch b/queue-5.5/drm-amd-display-fix-update_bw_bounding_box-calcs.patch
new file mode 100644
index 00000000000..157c38ae2d4
--- /dev/null
+++ b/queue-5.5/drm-amd-display-fix-update_bw_bounding_box-calcs.patch
@@ -0,0 +1,62 @@
+From 304996fdfc15ea44f93a377e35712b8cbdb5884c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2019 16:45:16 -0500
+Subject: drm/amd/display: Fix update_bw_bounding_box Calcs
+
+From: Sung Lee <sung.lee@amd.com>
+
+[ Upstream commit 615b9b585eb57c1d49382d16a62de768f2c6a340 ]
+
+[Why]
+Previously update_bw_bounding_box for RN was commented out
+due to incorrect values causing BSOD on Hybrid Graphics.
+However, commenting out this function also may cause issues
+such as underflow in certain cases such as 2x4K displays.
+
+[How]
+Fix dram_speed_mts calculations.
+Update from proper index of clock_limits[]
+
+Signed-off-by: Sung Lee <sung.lee@amd.com>
+Reviewed-by: Yongqiang Sun <yongqiang.sun@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+index fe0ed4c09ad0a..83cda43a1b6b3 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+@@ -1352,12 +1352,6 @@ struct display_stream_compressor *dcn21_dsc_create(
+ 
+ static void update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_params)
+ {
+-	/*
+-	TODO: Fix this function to calcualte correct values.
+-	There are known issues with this function currently
+-	that will need to be investigated. Use hardcoded known good values for now.
+-
+-
+ 	struct dcn21_resource_pool *pool = TO_DCN21_RES_POOL(dc->res_pool);
+ 	struct clk_limit_table *clk_table = &bw_params->clk_table;
+ 	int i;
+@@ -1372,11 +1366,10 @@ static void update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param
+ 		dcn2_1_soc.clock_limits[i].dcfclk_mhz = clk_table->entries[i].dcfclk_mhz;
+ 		dcn2_1_soc.clock_limits[i].fabricclk_mhz = clk_table->entries[i].fclk_mhz;
+ 		dcn2_1_soc.clock_limits[i].socclk_mhz = clk_table->entries[i].socclk_mhz;
+-		dcn2_1_soc.clock_limits[i].dram_speed_mts = clk_table->entries[i].memclk_mhz * 16 / 1000;
++		dcn2_1_soc.clock_limits[i].dram_speed_mts = clk_table->entries[i].memclk_mhz * 2;
+ 	}
+-	dcn2_1_soc.clock_limits[i] = dcn2_1_soc.clock_limits[i - i];
++	dcn2_1_soc.clock_limits[i] = dcn2_1_soc.clock_limits[i - 1];
+ 	dcn2_1_soc.num_states = i;
+-	*/
+ }
+ 
+ /* Temporary Place holder until we can get them from fuse */
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amd-display-fixup-dml-dependencies.patch b/queue-5.5/drm-amd-display-fixup-dml-dependencies.patch
new file mode 100644
index 00000000000..36c221bc426
--- /dev/null
+++ b/queue-5.5/drm-amd-display-fixup-dml-dependencies.patch
@@ -0,0 +1,62 @@
+From 4ac355167ba66428490c64ca0862a57a9dde607a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 14:40:56 -0500
+Subject: drm/amd/display: fixup DML dependencies
+
+From: Jun Lei <Jun.Lei@amd.com>
+
+[ Upstream commit 34ad0230062c39cdcba564d16d122c0fb467a7d6 ]
+
+[why]
+Need to fix DML portability issues to enable SW unit testing around DML
+
+[how]
+Move calcs into dc include folder since multiple components reference it
+Remove relative paths to external dependencies
+
+Signed-off-by: Jun Lei <Jun.Lei@amd.com>
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c          | 2 +-
+ drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h          | 2 +-
+ drivers/gpu/drm/amd/display/dc/{calcs => inc}/dcn_calc_math.h | 0
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+ rename drivers/gpu/drm/amd/display/dc/{calcs => inc}/dcn_calc_math.h (100%)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c b/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
+index b953b02a15121..723af0b2dda04 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
+@@ -24,7 +24,7 @@
+  */
+ 
+ #include "dml_common_defs.h"
+-#include "../calcs/dcn_calc_math.h"
++#include "dcn_calc_math.h"
+ 
+ #include "dml_inline_defs.h"
+ 
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
+index eca140da13d82..ded71ea82413d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
++++ b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
+@@ -27,7 +27,7 @@
+ #define __DML_INLINE_DEFS_H__
+ 
+ #include "dml_common_defs.h"
+-#include "../calcs/dcn_calc_math.h"
++#include "dcn_calc_math.h"
+ #include "dml_logger.h"
+ 
+ static inline double dml_min(double a, double b)
+diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calc_math.h b/drivers/gpu/drm/amd/display/dc/inc/dcn_calc_math.h
+similarity index 100%
+rename from drivers/gpu/drm/amd/display/dc/calcs/dcn_calc_math.h
+rename to drivers/gpu/drm/amd/display/dc/inc/dcn_calc_math.h
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amd-display-lower-dpp-dto-only-when-safe.patch b/queue-5.5/drm-amd-display-lower-dpp-dto-only-when-safe.patch
new file mode 100644
index 00000000000..f0bcbd134f2
--- /dev/null
+++ b/queue-5.5/drm-amd-display-lower-dpp-dto-only-when-safe.patch
@@ -0,0 +1,124 @@
+From 0a912bd84c9bb96b1b666986dd309b40eceee082 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 18:36:07 -0500
+Subject: drm/amd/display: Lower DPP DTO only when safe
+
+From: Sung Lee <sung.lee@amd.com>
+
+[ Upstream commit 5479034576ec8b7166a66efe5de1d911feb43d4a ]
+
+[Why]
+A corner case currently exists where DPP DTO is lowered before
+pipes are updated to a higher viewport. This causes underflow
+as the DPPCLK is too low for the current viewport.
+
+[How]
+Only lower DPP DTO when it is safe to lower, or if
+the newer clocks are higher than the current ones.
+
+Signed-off-by: Sung Lee <sung.lee@amd.com>
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c | 16 ++++++++++------
+ .../amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.h |  2 +-
+ .../amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c    |  8 ++++----
+ 3 files changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
+index 25d7b7c6681cc..7dca2e6eb3bc9 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
+@@ -100,13 +100,13 @@ uint32_t dentist_get_did_from_divider(int divider)
+ }
+ 
+ void dcn20_update_clocks_update_dpp_dto(struct clk_mgr_internal *clk_mgr,
+-		struct dc_state *context)
++		struct dc_state *context, bool safe_to_lower)
+ {
+ 	int i;
+ 
+ 	clk_mgr->dccg->ref_dppclk = clk_mgr->base.clks.dppclk_khz;
+ 	for (i = 0; i < clk_mgr->base.ctx->dc->res_pool->pipe_count; i++) {
+-		int dpp_inst, dppclk_khz;
++		int dpp_inst, dppclk_khz, prev_dppclk_khz;
+ 
+ 		/* Loop index will match dpp->inst if resource exists,
+ 		 * and we want to avoid dependency on dpp object
+@@ -114,8 +114,12 @@ void dcn20_update_clocks_update_dpp_dto(struct clk_mgr_internal *clk_mgr,
+ 		dpp_inst = i;
+ 		dppclk_khz = context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz;
+ 
+-		clk_mgr->dccg->funcs->update_dpp_dto(
+-				clk_mgr->dccg, dpp_inst, dppclk_khz);
++		prev_dppclk_khz = clk_mgr->base.ctx->dc->current_state->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz;
++
++		if (safe_to_lower || prev_dppclk_khz < dppclk_khz) {
++			clk_mgr->dccg->funcs->update_dpp_dto(
++							clk_mgr->dccg, dpp_inst, dppclk_khz);
++		}
+ 	}
+ }
+ 
+@@ -240,7 +244,7 @@ void dcn2_update_clocks(struct clk_mgr *clk_mgr_base,
+ 	if (dc->config.forced_clocks == false || (force_reset && safe_to_lower)) {
+ 		if (dpp_clock_lowered) {
+ 			// if clock is being lowered, increase DTO before lowering refclk
+-			dcn20_update_clocks_update_dpp_dto(clk_mgr, context);
++			dcn20_update_clocks_update_dpp_dto(clk_mgr, context, safe_to_lower);
+ 			dcn20_update_clocks_update_dentist(clk_mgr);
+ 		} else {
+ 			// if clock is being raised, increase refclk before lowering DTO
+@@ -248,7 +252,7 @@ void dcn2_update_clocks(struct clk_mgr *clk_mgr_base,
+ 				dcn20_update_clocks_update_dentist(clk_mgr);
+ 			// always update dtos unless clock is lowered and not safe to lower
+ 			if (new_clocks->dppclk_khz >= dc->current_state->bw_ctx.bw.dcn.clk.dppclk_khz)
+-				dcn20_update_clocks_update_dpp_dto(clk_mgr, context);
++				dcn20_update_clocks_update_dpp_dto(clk_mgr, context, safe_to_lower);
+ 		}
+ 	}
+ 
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.h b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.h
+index c9fd824f3c231..74ccd6c04134a 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.h
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.h
+@@ -34,7 +34,7 @@ void dcn2_update_clocks_fpga(struct clk_mgr *clk_mgr,
+ 			struct dc_state *context,
+ 			bool safe_to_lower);
+ void dcn20_update_clocks_update_dpp_dto(struct clk_mgr_internal *clk_mgr,
+-		struct dc_state *context);
++		struct dc_state *context, bool safe_to_lower);
+ 
+ void dcn2_init_clocks(struct clk_mgr *clk_mgr);
+ 
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
+index 35c55e54eac01..dbf063856846e 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
+@@ -164,16 +164,16 @@ void rn_update_clocks(struct clk_mgr *clk_mgr_base,
+ 	}
+ 
+ 	if (dpp_clock_lowered) {
+-		// if clock is being lowered, increase DTO before lowering refclk
+-		dcn20_update_clocks_update_dpp_dto(clk_mgr, context);
++		// increase per DPP DTO before lowering global dppclk
++		dcn20_update_clocks_update_dpp_dto(clk_mgr, context, safe_to_lower);
+ 		rn_vbios_smu_set_dppclk(clk_mgr, clk_mgr_base->clks.dppclk_khz);
+ 	} else {
+-		// if clock is being raised, increase refclk before lowering DTO
++		// increase global DPPCLK before lowering per DPP DTO
+ 		if (update_dppclk || update_dispclk)
+ 			rn_vbios_smu_set_dppclk(clk_mgr, clk_mgr_base->clks.dppclk_khz);
+ 		// always update dtos unless clock is lowered and not safe to lower
+ 		if (new_clocks->dppclk_khz >= dc->current_state->bw_ctx.bw.dcn.clk.dppclk_khz)
+-			dcn20_update_clocks_update_dpp_dto(clk_mgr, context);
++			dcn20_update_clocks_update_dpp_dto(clk_mgr, context, safe_to_lower);
+ 	}
+ 
+ 	if (update_dispclk &&
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amd-display-map-odm-memory-correctly-when-doing-.patch b/queue-5.5/drm-amd-display-map-odm-memory-correctly-when-doing-.patch
new file mode 100644
index 00000000000..7ad8ec86c6b
--- /dev/null
+++ b/queue-5.5/drm-amd-display-map-odm-memory-correctly-when-doing-.patch
@@ -0,0 +1,89 @@
+From 87c725277ec19e3fef4091f15bf65f0e99f6ea87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 15:18:31 -0500
+Subject: drm/amd/display: Map ODM memory correctly when doing ODM combine
+
+From: Nikola Cornij <nikola.cornij@amd.com>
+
+[ Upstream commit ec5b356c58941bb8930858155d9ce14ceb3d30a0 ]
+
+[why]
+Up to 4 ODM memory pieces are required per ODM combine and cannot
+overlap, i.e. each ODM "session" has to use its own memory pieces.
+The ODM-memory mapping is currently broken for generic case.
+
+The maximum number of memory pieces is ASIC-dependent, but it's always
+big enough to satisfy maximum number of ODM combines. Memory pieces
+are mapped as a bit-map, i.e. one memory piece corresponds to one bit.
+The OPTC doing ODM needs to select memory pieces by setting the
+corresponding bits, making sure there's no overlap with other OPTC
+instances that might be doing ODM.
+
+The current mapping works only for OPTC instance indexes smaller than
+3. For instance indexes 3 and up it practically maps no ODM memory,
+causing black, gray or white screen in display configs that include
+ODM on OPTC instance 3 or up.
+
+[how]
+Statically map two unique ODM memory pieces for each OPTC instance
+and piece them together when programming ODM combine mode.
+
+Signed-off-by: Nikola Cornij <nikola.cornij@amd.com>
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dcn20/dcn20_optc.c    | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
+index 3b613fb93ef80..0162d3ffe268f 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
+@@ -233,12 +233,13 @@ void optc2_set_odm_combine(struct timing_generator *optc, int *opp_id, int opp_c
+ 		struct dc_crtc_timing *timing)
+ {
+ 	struct optc *optc1 = DCN10TG_FROM_TG(optc);
+-	/* 2 pieces of memory required for up to 5120 displays, 4 for up to 8192 */
+ 	int mpcc_hactive = (timing->h_addressable + timing->h_border_left + timing->h_border_right)
+ 			/ opp_cnt;
+-	int memory_mask = mpcc_hactive <= 2560 ? 0x3 : 0xf;
++	uint32_t memory_mask;
+ 	uint32_t data_fmt = 0;
+ 
++	ASSERT(opp_cnt == 2);
++
+ 	/* TODO: In pseudocode but does not affect maximus, delete comment if we dont need on asic
+ 	 * REG_SET(OTG_GLOBAL_CONTROL2, 0, GLOBAL_UPDATE_LOCK_EN, 1);
+ 	 * Program OTG register MASTER_UPDATE_LOCK_DB_X/Y to the position before DP frame start
+@@ -246,9 +247,17 @@ void optc2_set_odm_combine(struct timing_generator *optc, int *opp_id, int opp_c
+ 	 *		MASTER_UPDATE_LOCK_DB_X, 160,
+ 	 *		MASTER_UPDATE_LOCK_DB_Y, 240);
+ 	 */
++
++	/* 2 pieces of memory required for up to 5120 displays, 4 for up to 8192,
++	 * however, for ODM combine we can simplify by always using 4.
++	 * To make sure there's no overlap, each instance "reserves" 2 memories and
++	 * they are uniquely combined here.
++	 */
++	memory_mask = 0x3 << (opp_id[0] * 2) | 0x3 << (opp_id[1] * 2);
++
+ 	if (REG(OPTC_MEMORY_CONFIG))
+ 		REG_SET(OPTC_MEMORY_CONFIG, 0,
+-			OPTC_MEM_SEL, memory_mask << (optc->inst * 4));
++			OPTC_MEM_SEL, memory_mask);
+ 
+ 	if (timing->pixel_encoding == PIXEL_ENCODING_YCBCR422)
+ 		data_fmt = 1;
+@@ -257,7 +266,6 @@ void optc2_set_odm_combine(struct timing_generator *optc, int *opp_id, int opp_c
+ 
+ 	REG_UPDATE(OPTC_DATA_FORMAT_CONTROL, OPTC_DATA_FORMAT, data_fmt);
+ 
+-	ASSERT(opp_cnt == 2);
+ 	REG_SET_3(OPTC_DATA_SOURCE_SELECT, 0,
+ 			OPTC_NUM_OF_INPUT_SEGMENT, 1,
+ 			OPTC_SEG0_SRC_SEL, opp_id[0],
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amd-display-renoir-chroma-viewport-wa.patch b/queue-5.5/drm-amd-display-renoir-chroma-viewport-wa.patch
new file mode 100644
index 00000000000..f6216483cc9
--- /dev/null
+++ b/queue-5.5/drm-amd-display-renoir-chroma-viewport-wa.patch
@@ -0,0 +1,141 @@
+From 5e32d50cd2c926f6181af825dd1f170077d4f86a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 15:34:20 -0400
+Subject: drm/amd/display: Renoir chroma viewport WA
+
+From: Eric Yang <Eric.Yang2@amd.com>
+
+[ Upstream commit 1cad8ff7ecc6b70a062b8e8b74a0cd08c928341d ]
+
+[Why]
+For unknown reason, immediate flip with host VM translation on NV12
+surface will underflow on last row of PTE.
+
+[How]
+Hack chroma viewport height to make fetch one more row of PTE.
+Note that this will cause hubp underflow on all video underlay
+cases, but the underflow is not user visible since it is in
+blank region.
+
+Signed-off-by: Eric Yang <Eric.Yang2@amd.com>
+Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
+Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dc.h           |  2 +
+ .../gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c | 65 ++++++++++++++++++-
+ .../drm/amd/display/dc/dcn21/dcn21_resource.c |  1 +
+ 3 files changed, 67 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
+index 0416a17b0897c..320f4eeebf84c 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc.h
++++ b/drivers/gpu/drm/amd/display/dc/dc.h
+@@ -417,6 +417,8 @@ struct dc_debug_options {
+ 	bool cm_in_bypass;
+ #endif
+ 	int force_clock_mode;/*every mode change.*/
++
++	bool nv12_iflip_vm_wa;
+ };
+ 
+ struct dc_debug_data {
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c
+index 2f5a5867e6749..1ddd6ae221558 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c
+@@ -164,6 +164,69 @@ static void hubp21_setup(
+ 
+ }
+ 
++void hubp21_set_viewport(
++	struct hubp *hubp,
++	const struct rect *viewport,
++	const struct rect *viewport_c)
++{
++	struct dcn21_hubp *hubp21 = TO_DCN21_HUBP(hubp);
++	int patched_viewport_height = 0;
++	struct dc_debug_options *debug = &hubp->ctx->dc->debug;
++
++	REG_SET_2(DCSURF_PRI_VIEWPORT_DIMENSION, 0,
++		  PRI_VIEWPORT_WIDTH, viewport->width,
++		  PRI_VIEWPORT_HEIGHT, viewport->height);
++
++	REG_SET_2(DCSURF_PRI_VIEWPORT_START, 0,
++		  PRI_VIEWPORT_X_START, viewport->x,
++		  PRI_VIEWPORT_Y_START, viewport->y);
++
++	/*for stereo*/
++	REG_SET_2(DCSURF_SEC_VIEWPORT_DIMENSION, 0,
++		  SEC_VIEWPORT_WIDTH, viewport->width,
++		  SEC_VIEWPORT_HEIGHT, viewport->height);
++
++	REG_SET_2(DCSURF_SEC_VIEWPORT_START, 0,
++		  SEC_VIEWPORT_X_START, viewport->x,
++		  SEC_VIEWPORT_Y_START, viewport->y);
++
++	/*
++	 *	Work around for underflow issue with NV12 + rIOMMU translation
++	 *	+ immediate flip. This will cause hubp underflow, but will not
++	 *	be user visible since underflow is in blank region
++	 */
++	patched_viewport_height = viewport_c->height;
++	if (viewport_c->height != 0 && debug->nv12_iflip_vm_wa) {
++		int pte_row_height = 0;
++		int pte_rows = 0;
++
++		REG_GET(DCHUBP_REQ_SIZE_CONFIG,
++			PTE_ROW_HEIGHT_LINEAR, &pte_row_height);
++
++		pte_row_height = 1 << (pte_row_height + 3);
++		pte_rows = (viewport_c->height + pte_row_height - 1) / pte_row_height;
++		patched_viewport_height = pte_rows * pte_row_height + 3;
++	}
++
++
++	/* DC supports NV12 only at the moment */
++	REG_SET_2(DCSURF_PRI_VIEWPORT_DIMENSION_C, 0,
++		  PRI_VIEWPORT_WIDTH_C, viewport_c->width,
++		  PRI_VIEWPORT_HEIGHT_C, patched_viewport_height);
++
++	REG_SET_2(DCSURF_PRI_VIEWPORT_START_C, 0,
++		  PRI_VIEWPORT_X_START_C, viewport_c->x,
++		  PRI_VIEWPORT_Y_START_C, viewport_c->y);
++
++	REG_SET_2(DCSURF_SEC_VIEWPORT_DIMENSION_C, 0,
++		  SEC_VIEWPORT_WIDTH_C, viewport_c->width,
++		  SEC_VIEWPORT_HEIGHT_C, patched_viewport_height);
++
++	REG_SET_2(DCSURF_SEC_VIEWPORT_START_C, 0,
++		  SEC_VIEWPORT_X_START_C, viewport_c->x,
++		  SEC_VIEWPORT_Y_START_C, viewport_c->y);
++}
++
+ void hubp21_set_vm_system_aperture_settings(struct hubp *hubp,
+ 		struct vm_system_aperture_param *apt)
+ {
+@@ -211,7 +274,7 @@ static struct hubp_funcs dcn21_hubp_funcs = {
+ 	.hubp_set_vm_system_aperture_settings = hubp21_set_vm_system_aperture_settings,
+ 	.set_blank = hubp1_set_blank,
+ 	.dcc_control = hubp1_dcc_control,
+-	.mem_program_viewport = min_set_viewport,
++	.mem_program_viewport = hubp21_set_viewport,
+ 	.set_cursor_attributes	= hubp2_cursor_set_attributes,
+ 	.set_cursor_position	= hubp1_cursor_set_position,
+ 	.hubp_clk_cntl = hubp1_clk_cntl,
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+index b29b2c99a564e..fe0ed4c09ad0a 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+@@ -847,6 +847,7 @@ static const struct dc_debug_options debug_defaults_drv = {
+ 		.scl_reset_length10 = true,
+ 		.sanity_checks = true,
+ 		.disable_48mhz_pwrdwn = false,
++		.nv12_iflip_vm_wa = true
+ };
+ 
+ static const struct dc_debug_options debug_defaults_diags = {
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amd-display-retrain-dongles-when-sink_count-beco.patch b/queue-5.5/drm-amd-display-retrain-dongles-when-sink_count-beco.patch
new file mode 100644
index 00000000000..9e1b2846d5f
--- /dev/null
+++ b/queue-5.5/drm-amd-display-retrain-dongles-when-sink_count-beco.patch
@@ -0,0 +1,71 @@
+From 481030f21a6b6756240b8fc1b2e3d000093a9309 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 16:12:45 -0500
+Subject: drm/amd/display: Retrain dongles when SINK_COUNT becomes non-zero
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+[ Upstream commit 3eb6d7aca53d81ce888624f09cd44dc0302161e8 ]
+
+[WHY]
+Two years ago the patch referenced by the Fixes tag stopped running
+dp_verify_link_cap_with_retries during DP detection when the reason
+for the detection was a short-pulse interrupt. This effectively meant
+that we were no longer doing the verify_link_cap training on active
+dongles when their SINK_COUNT changed from 0 to 1.
+
+A year ago this was partly remedied with:
+commit 80adaebd2d41 ("drm/amd/display: Don't skip link training for empty dongle")
+
+This made sure that we trained the dongle on initial hotplug (without
+connected downstream devices).
+
+This is all fine and dandy if it weren't for the fact that there are
+some dongles on the market that don't like link training when SINK_COUNT
+is 0 These dongles will in fact indicate a SINK_COUNT of 0 immediately
+after hotplug, even when a downstream device is connected, and then
+trigger a shortpulse interrupt indicating a SINK_COUNT change to 1.
+
+In order to play nicely we will need our policy to not link train an
+active DP dongle when SINK_COUNT is 0 but ensure we train it when the
+SINK_COUNT changes to 1.
+
+[HOW]
+Call dp_verify_link_cap_with_retries on detection even when the detection
+is triggered from a short pulse interrupt.
+
+With this change we can also revert this commit which we'll do in a separate
+follow-up change:
+commit 80adaebd2d41 ("drm/amd/display: Don't skip link training for empty dongle")
+
+Fixes: 0301ccbaf67d ("drm/amd/display: DP Compliance 400.1.1 failure")
+Suggested-by: Louis Li <Ching-shih.Li@amd.com>
+Tested-by: Louis Li <Ching-shih.Li@amd.com>
+Cc: Wenjing Liu <Wenjing.Liu@amd.com>
+Cc: Hersen Wu <hersenxs.wu@amd.com>
+Cc: Eric Yang <Eric.Yang2@amd.com>
+Reviewed-by: Wenjing Liu <Wenjing.Liu@amd.com>
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 4619f94f0ac78..70846ae7d854d 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -968,8 +968,7 @@ static bool dc_link_detect_helper(struct dc_link *link,
+ 			same_edid = is_same_edid(&prev_sink->dc_edid, &sink->dc_edid);
+ 
+ 		if (link->connector_signal == SIGNAL_TYPE_DISPLAY_PORT &&
+-			sink_caps.transaction_type == DDC_TRANSACTION_TYPE_I2C_OVER_AUX &&
+-			reason != DETECT_REASON_HPDRX) {
++			sink_caps.transaction_type == DDC_TRANSACTION_TYPE_I2C_OVER_AUX) {
+ 			/*
+ 			 * TODO debug why Dell 2413 doesn't like
+ 			 *  two link trainings
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amdgpu-display-handle-multiple-numbers-of-fclks-.patch b/queue-5.5/drm-amdgpu-display-handle-multiple-numbers-of-fclks-.patch
new file mode 100644
index 00000000000..1b5076f68ff
--- /dev/null
+++ b/queue-5.5/drm-amdgpu-display-handle-multiple-numbers-of-fclks-.patch
@@ -0,0 +1,78 @@
+From b101ae67234e4a1bb4a6eb84b2c63c6281e7889a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 14:39:45 -0500
+Subject: drm/amdgpu/display: handle multiple numbers of fclks in dcn_calcs.c
+ (v2)
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit c37243579d6c881c575dcfb54cf31c9ded88f946 ]
+
+We might get different numbers of clocks from powerplay depending
+on what the OEM has populated.
+
+v2: add assert for at least one level
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/963
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/calcs/dcn_calcs.c  | 34 +++++++++++++------
+ 1 file changed, 23 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+index 9b2cb57bf2bad..c9a241fe46cf4 100644
+--- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
++++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+@@ -1438,6 +1438,7 @@ void dcn_bw_update_from_pplib(struct dc *dc)
+ 	struct dc_context *ctx = dc->ctx;
+ 	struct dm_pp_clock_levels_with_voltage fclks = {0}, dcfclks = {0};
+ 	bool res;
++	unsigned vmin0p65_idx, vmid0p72_idx, vnom0p8_idx, vmax0p9_idx;
+ 
+ 	/* TODO: This is not the proper way to obtain fabric_and_dram_bandwidth, should be min(fclk, memclk) */
+ 	res = dm_pp_get_clock_levels_by_type_with_voltage(
+@@ -1449,17 +1450,28 @@ void dcn_bw_update_from_pplib(struct dc *dc)
+ 		res = verify_clock_values(&fclks);
+ 
+ 	if (res) {
+-		ASSERT(fclks.num_levels >= 3);
+-		dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 = 32 * (fclks.data[0].clocks_in_khz / 1000.0) / 1000.0;
+-		dc->dcn_soc->fabric_and_dram_bandwidth_vmid0p72 = dc->dcn_soc->number_of_channels *
+-				(fclks.data[fclks.num_levels - (fclks.num_levels > 2 ? 3 : 2)].clocks_in_khz / 1000.0)
+-				* ddr4_dram_factor_single_Channel / 1000.0;
+-		dc->dcn_soc->fabric_and_dram_bandwidth_vnom0p8 = dc->dcn_soc->number_of_channels *
+-				(fclks.data[fclks.num_levels - 2].clocks_in_khz / 1000.0)
+-				* ddr4_dram_factor_single_Channel / 1000.0;
+-		dc->dcn_soc->fabric_and_dram_bandwidth_vmax0p9 = dc->dcn_soc->number_of_channels *
+-				(fclks.data[fclks.num_levels - 1].clocks_in_khz / 1000.0)
+-				* ddr4_dram_factor_single_Channel / 1000.0;
++		ASSERT(fclks.num_levels);
++
++		vmin0p65_idx = 0;
++		vmid0p72_idx = fclks.num_levels -
++			(fclks.num_levels > 2 ? 3 : (fclks.num_levels > 1 ? 2 : 1));
++		vnom0p8_idx = fclks.num_levels - (fclks.num_levels > 1 ? 2 : 1);
++		vmax0p9_idx = fclks.num_levels - 1;
++
++		dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 =
++			32 * (fclks.data[vmin0p65_idx].clocks_in_khz / 1000.0) / 1000.0;
++		dc->dcn_soc->fabric_and_dram_bandwidth_vmid0p72 =
++			dc->dcn_soc->number_of_channels *
++			(fclks.data[vmid0p72_idx].clocks_in_khz / 1000.0)
++			* ddr4_dram_factor_single_Channel / 1000.0;
++		dc->dcn_soc->fabric_and_dram_bandwidth_vnom0p8 =
++			dc->dcn_soc->number_of_channels *
++			(fclks.data[vnom0p8_idx].clocks_in_khz / 1000.0)
++			* ddr4_dram_factor_single_Channel / 1000.0;
++		dc->dcn_soc->fabric_and_dram_bandwidth_vmax0p9 =
++			dc->dcn_soc->number_of_channels *
++			(fclks.data[vmax0p9_idx].clocks_in_khz / 1000.0)
++			* ddr4_dram_factor_single_Channel / 1000.0;
+ 	} else
+ 		BREAK_TO_DEBUGGER();
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amdgpu-dm-do-not-throw-an-error-for-a-display-wi.patch b/queue-5.5/drm-amdgpu-dm-do-not-throw-an-error-for-a-display-wi.patch
new file mode 100644
index 00000000000..d2ce3f51c66
--- /dev/null
+++ b/queue-5.5/drm-amdgpu-dm-do-not-throw-an-error-for-a-display-wi.patch
@@ -0,0 +1,42 @@
+From 52ff3abcf712bf41d72fa9e5baced5d9e87d588b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 20:44:13 +0000
+Subject: drm/amdgpu/dm: Do not throw an error for a display with no audio
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+[ Upstream commit 852a91d627e9ce849d68df9d3f5336689003bdc7 ]
+
+An old display with no audio may not have an EDID with a CEA block, or
+it may simply be too old to support audio. This is not a driver error,
+so don't flag it as such.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112140
+References: ae2a3495973e ("drm/amd: be quiet when no SAD block is found")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Jean Delvare <jdelvare@suse.de>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+index 0b401dfbe98a9..34f483ac36ca4 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+@@ -97,8 +97,6 @@ enum dc_edid_status dm_helpers_parse_edid_caps(
+ 			(struct edid *) edid->raw_edid);
+ 
+ 	sad_count = drm_edid_to_sad((struct edid *) edid->raw_edid, &sads);
+-	if (sad_count < 0)
+-		DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
+ 	if (sad_count <= 0)
+ 		return result;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amdgpu-ensure-ret-is-always-initialized-when-usi.patch b/queue-5.5/drm-amdgpu-ensure-ret-is-always-initialized-when-usi.patch
new file mode 100644
index 00000000000..b55529c942d
--- /dev/null
+++ b/queue-5.5/drm-amdgpu-ensure-ret-is-always-initialized-when-usi.patch
@@ -0,0 +1,69 @@
+From 40ed1dc679ff8737cbb9aea4d978744a8bb543bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Nov 2019 12:23:36 -0700
+Subject: drm/amdgpu: Ensure ret is always initialized when using
+ SOC15_WAIT_ON_RREG
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit a63141e31764f8daf3f29e8e2d450dcf9199d1c8 ]
+
+Commit b0f3cd3191cd ("drm/amdgpu: remove unnecessary JPEG2.0 code from
+VCN2.0") introduced a new clang warning in the vcn_v2_0_stop function:
+
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1082:2: warning: variable 'r'
+is used uninitialized whenever 'while' loop exits because its condition
+is false [-Wsometimes-uninitialized]
+        SOC15_WAIT_ON_RREG(VCN, 0, mmUVD_STATUS, UVD_STATUS__IDLE, 0x7, r);
+        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+../drivers/gpu/drm/amd/amdgpu/../amdgpu/soc15_common.h:55:10: note:
+expanded from macro 'SOC15_WAIT_ON_RREG'
+                while ((tmp_ & (mask)) != (expected_value)) {   \
+                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1083:6: note: uninitialized use
+occurs here
+        if (r)
+            ^
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1082:2: note: remove the
+condition if it is always true
+        SOC15_WAIT_ON_RREG(VCN, 0, mmUVD_STATUS, UVD_STATUS__IDLE, 0x7, r);
+        ^
+../drivers/gpu/drm/amd/amdgpu/../amdgpu/soc15_common.h:55:10: note:
+expanded from macro 'SOC15_WAIT_ON_RREG'
+                while ((tmp_ & (mask)) != (expected_value)) {   \
+                       ^
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1072:7: note: initialize the
+variable 'r' to silence this warning
+        int r;
+             ^
+              = 0
+1 warning generated.
+
+To prevent warnings like this from happening in the future, make the
+SOC15_WAIT_ON_RREG macro initialize its ret variable before the while
+loop that can time out. This macro's return value is always checked so
+it should set ret in both the success and fail path.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/776
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc15_common.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15_common.h b/drivers/gpu/drm/amd/amdgpu/soc15_common.h
+index 839f186e1182a..19e870c798967 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15_common.h
++++ b/drivers/gpu/drm/amd/amdgpu/soc15_common.h
+@@ -52,6 +52,7 @@
+ 		uint32_t old_ = 0;	\
+ 		uint32_t tmp_ = RREG32(adev->reg_offset[ip##_HWIP][inst][reg##_BASE_IDX] + reg); \
+ 		uint32_t loop = adev->usec_timeout;		\
++		ret = 0;					\
+ 		while ((tmp_ & (mask)) != (expected_value)) {	\
+ 			if (old_ != tmp_) {			\
+ 				loop = adev->usec_timeout;	\
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amdgpu-fix-double-gpu_recovery-for-nv-of-sriov.patch b/queue-5.5/drm-amdgpu-fix-double-gpu_recovery-for-nv-of-sriov.patch
new file mode 100644
index 00000000000..165928abe5d
--- /dev/null
+++ b/queue-5.5/drm-amdgpu-fix-double-gpu_recovery-for-nv-of-sriov.patch
@@ -0,0 +1,47 @@
+From e4d17853d4751828b6e33e97aed6ed6085abca60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 18:18:31 +0800
+Subject: drm/amdgpu: fix double gpu_recovery for NV of SRIOV
+
+From: Monk Liu <Monk.Liu@amd.com>
+
+[ Upstream commit 1512d064f55bace6a8e32d65009c7ea112e76a31 ]
+
+issues:
+gpu_recover() is re-entered by the mailbox interrupt
+handler mxgpu_nv.c
+
+fix:
+we need to bypass the gpu_recover() invoke in mailbox
+interrupt as long as the timeout is not infinite (thus the TDR
+will be triggered automatically after time out, no need to invoke
+gpu_recover() through mailbox interrupt.
+
+Signed-off-by: Monk Liu <Monk.Liu@amd.com>
+Reviewed-by: Emily Deng <Emily.Deng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c b/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c
+index 0d8767eb7a709..1c3a7d4bb65d2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c
++++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c
+@@ -269,7 +269,11 @@ flr_done:
+ 	}
+ 
+ 	/* Trigger recovery for world switch failure if no TDR */
+-	if (amdgpu_device_should_recover_gpu(adev))
++	if (amdgpu_device_should_recover_gpu(adev)
++		&& (adev->sdma_timeout == MAX_SCHEDULE_TIMEOUT ||
++		adev->gfx_timeout == MAX_SCHEDULE_TIMEOUT ||
++		adev->compute_timeout == MAX_SCHEDULE_TIMEOUT ||
++		adev->video_timeout == MAX_SCHEDULE_TIMEOUT))
+ 		amdgpu_device_gpu_recover(adev, NULL);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amdgpu-fix-kiq-ring-test-fail-in-tdr-of-sriov.patch b/queue-5.5/drm-amdgpu-fix-kiq-ring-test-fail-in-tdr-of-sriov.patch
new file mode 100644
index 00000000000..2ece6dffdfb
--- /dev/null
+++ b/queue-5.5/drm-amdgpu-fix-kiq-ring-test-fail-in-tdr-of-sriov.patch
@@ -0,0 +1,46 @@
+From bb04e321086e6d42b91788883f0c1e5612eebedb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 18:16:44 +0800
+Subject: drm/amdgpu: fix KIQ ring test fail in TDR of SRIOV
+
+From: Monk Liu <Monk.Liu@amd.com>
+
+[ Upstream commit 5a7489a7e189ee2be889485f90c8cf24ea4b9a40 ]
+
+issues:
+MEC is ruined by the amdkfd_pre_reset after VF FLR done
+
+fix:
+amdkfd_pre_reset() would ruin MEC after hypervisor finished the VF FLR,
+the correct sequence is do amdkfd_pre_reset before VF FLR but there is
+a limitation to block this sequence:
+if we do pre_reset() before VF FLR, it would go KIQ way to do register
+access and stuck there, because KIQ probably won't work by that time
+(e.g. you already made GFX hang)
+
+so the best way right now is to simply remove it.
+
+Signed-off-by: Monk Liu <Monk.Liu@amd.com>
+Reviewed-by: Emily Deng <Emily.Deng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index c17505fba9884..332b9c24a2cd0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3639,8 +3639,6 @@ static int amdgpu_device_reset_sriov(struct amdgpu_device *adev,
+ 	if (r)
+ 		return r;
+ 
+-	amdgpu_amdkfd_pre_reset(adev);
+-
+ 	/* Resume IP prior to SMC */
+ 	r = amdgpu_device_ip_reinit_early_sriov(adev);
+ 	if (r)
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amdgpu-remove-4-set-but-not-used-variable-in-amd.patch b/queue-5.5/drm-amdgpu-remove-4-set-but-not-used-variable-in-amd.patch
new file mode 100644
index 00000000000..efd3d77503c
--- /dev/null
+++ b/queue-5.5/drm-amdgpu-remove-4-set-but-not-used-variable-in-amd.patch
@@ -0,0 +1,75 @@
+From 8e4b0e6914d47850236e2a03671a30f401f7e784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 21:27:20 +0800
+Subject: drm/amdgpu: remove 4 set but not used variable in
+ amdgpu_atombios_get_connector_info_from_object_table
+
+From: yu kuai <yukuai3@huawei.com>
+
+[ Upstream commit bae028e3e521e8cb8caf2cc16a455ce4c55f2332 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c: In function
+'amdgpu_atombios_get_connector_info_from_object_table':
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:376:26: warning: variable
+'grph_obj_num' set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:376:13: warning: variable
+'grph_obj_id' set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:341:37: warning: variable
+'con_obj_type' set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:341:24: warning: variable
+'con_obj_num' set but not used [-Wunused-but-set-variable]
+
+They are never used, so can be removed.
+
+Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
+Signed-off-by: yu kuai <yukuai3@huawei.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+index 72232fccf61a7..be6d0cfe41aec 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+@@ -338,17 +338,9 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
+ 		path_size += le16_to_cpu(path->usSize);
+ 
+ 		if (device_support & le16_to_cpu(path->usDeviceTag)) {
+-			uint8_t con_obj_id, con_obj_num, con_obj_type;
+-
+-			con_obj_id =
++			uint8_t con_obj_id =
+ 			    (le16_to_cpu(path->usConnObjectId) & OBJECT_ID_MASK)
+ 			    >> OBJECT_ID_SHIFT;
+-			con_obj_num =
+-			    (le16_to_cpu(path->usConnObjectId) & ENUM_ID_MASK)
+-			    >> ENUM_ID_SHIFT;
+-			con_obj_type =
+-			    (le16_to_cpu(path->usConnObjectId) &
+-			     OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+ 
+ 			/* Skip TV/CV support */
+ 			if ((le16_to_cpu(path->usDeviceTag) ==
+@@ -373,14 +365,7 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
+ 			router.ddc_valid = false;
+ 			router.cd_valid = false;
+ 			for (j = 0; j < ((le16_to_cpu(path->usSize) - 8) / 2); j++) {
+-				uint8_t grph_obj_id, grph_obj_num, grph_obj_type;
+-
+-				grph_obj_id =
+-				    (le16_to_cpu(path->usGraphicObjIds[j]) &
+-				     OBJECT_ID_MASK) >> OBJECT_ID_SHIFT;
+-				grph_obj_num =
+-				    (le16_to_cpu(path->usGraphicObjIds[j]) &
+-				     ENUM_ID_MASK) >> ENUM_ID_SHIFT;
++				uint8_t grph_obj_type=
+ 				grph_obj_type =
+ 				    (le16_to_cpu(path->usGraphicObjIds[j]) &
+ 				     OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_la.patch b/queue-5.5/drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_la.patch
new file mode 100644
index 00000000000..2f4280a25f6
--- /dev/null
+++ b/queue-5.5/drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_la.patch
@@ -0,0 +1,49 @@
+From ef7faac006850b95fc9b27a23494e1021a0f2880 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 13:19:51 -0500
+Subject: drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_latency
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 4d0a72b66065dd7e274bad6aa450196d42fd8f84 ]
+
+Only send non-0 clocks to DC for validation.  This mirrors
+what the windows driver does.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/963
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+index 1115761982a78..627a42e8fd318 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+@@ -1026,12 +1026,15 @@ static int smu10_get_clock_by_type_with_latency(struct pp_hwmgr *hwmgr,
+ 
+ 	clocks->num_levels = 0;
+ 	for (i = 0; i < pclk_vol_table->count; i++) {
+-		clocks->data[i].clocks_in_khz = pclk_vol_table->entries[i].clk * 10;
+-		clocks->data[i].latency_in_us = latency_required ?
+-						smu10_get_mem_latency(hwmgr,
+-						pclk_vol_table->entries[i].clk) :
+-						0;
+-		clocks->num_levels++;
++		if (pclk_vol_table->entries[i].clk) {
++			clocks->data[clocks->num_levels].clocks_in_khz =
++				pclk_vol_table->entries[i].clk * 10;
++			clocks->data[clocks->num_levels].latency_in_us = latency_required ?
++				smu10_get_mem_latency(hwmgr,
++						      pclk_vol_table->entries[i].clk) :
++				0;
++			clocks->num_levels++;
++		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_vo.patch b/queue-5.5/drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_vo.patch
new file mode 100644
index 00000000000..e11ee8a5cef
--- /dev/null
+++ b/queue-5.5/drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_vo.patch
@@ -0,0 +1,41 @@
+From 03abbe4efd1f0ef25fbc5c8417755e32c85dfb81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 12:42:57 -0500
+Subject: drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_voltage
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1064ad4aeef94f51ca230ac639a9e996fb7867a0 ]
+
+Cull out 0 clocks to avoid a warning in DC.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/963
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+index 627a42e8fd318..fed3fc4bb57a9 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+@@ -1080,9 +1080,11 @@ static int smu10_get_clock_by_type_with_voltage(struct pp_hwmgr *hwmgr,
+ 
+ 	clocks->num_levels = 0;
+ 	for (i = 0; i < pclk_vol_table->count; i++) {
+-		clocks->data[i].clocks_in_khz = pclk_vol_table->entries[i].clk  * 10;
+-		clocks->data[i].voltage_in_mv = pclk_vol_table->entries[i].vol;
+-		clocks->num_levels++;
++		if (pclk_vol_table->entries[i].clk) {
++			clocks->data[clocks->num_levels].clocks_in_khz = pclk_vol_table->entries[i].clk  * 10;
++			clocks->data[clocks->num_levels].voltage_in_mv = pclk_vol_table->entries[i].vol;
++			clocks->num_levels++;
++		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amdgpu-sriov-workaround-on-rev_id-for-navi12-und.patch b/queue-5.5/drm-amdgpu-sriov-workaround-on-rev_id-for-navi12-und.patch
new file mode 100644
index 00000000000..e88d55ed79a
--- /dev/null
+++ b/queue-5.5/drm-amdgpu-sriov-workaround-on-rev_id-for-navi12-und.patch
@@ -0,0 +1,44 @@
+From 27a02e37cc60e564e4a1a446ccf73ad54f6469de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 13:44:29 +0800
+Subject: drm/amdgpu/sriov: workaround on rev_id for Navi12 under sriov
+
+From: Tiecheng Zhou <Tiecheng.Zhou@amd.com>
+
+[ Upstream commit df5e984c8bd414561c320d6cbbb66d53abf4c7e2 ]
+
+guest vm gets 0xffffffff when reading RCC_DEV0_EPF0_STRAP0,
+as a consequence, the rev_id and external_rev_id are wrong.
+
+workaround it by hardcoding the rev_id to 0, which is the default value.
+
+v2. add comment in the code
+
+Signed-off-by: Tiecheng Zhou <Tiecheng.Zhou@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/nv.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c
+index 0ba66bef57468..de40bf12c4a8c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/nv.c
++++ b/drivers/gpu/drm/amd/amdgpu/nv.c
+@@ -701,6 +701,12 @@ static int nv_common_early_init(void *handle)
+ 		adev->pg_flags = AMD_PG_SUPPORT_VCN |
+ 			AMD_PG_SUPPORT_VCN_DPG |
+ 			AMD_PG_SUPPORT_ATHUB;
++		/* guest vm gets 0xffffffff when reading RCC_DEV0_EPF0_STRAP0,
++		 * as a consequence, the rev_id and external_rev_id are wrong.
++		 * workaround it by hardcoding rev_id to 0 (default value).
++		 */
++		if (amdgpu_sriov_vf(adev))
++			adev->rev_id = 0;
+ 		adev->external_rev_id = adev->rev_id + 0xa;
+ 		break;
+ 	default:
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amdkfd-fix-a-bug-in-sdma-rlc-queue-counting-unde.patch b/queue-5.5/drm-amdkfd-fix-a-bug-in-sdma-rlc-queue-counting-unde.patch
new file mode 100644
index 00000000000..7361c2c6868
--- /dev/null
+++ b/queue-5.5/drm-amdkfd-fix-a-bug-in-sdma-rlc-queue-counting-unde.patch
@@ -0,0 +1,57 @@
+From fe7c495773a7145766efb45f67b343fe438152f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 19:55:47 -0500
+Subject: drm/amdkfd: Fix a bug in SDMA RLC queue counting under HWS mode
+
+From: Yong Zhao <Yong.Zhao@amd.com>
+
+[ Upstream commit f38abc15d157b7b31fa7f651dc8bf92858c963f8 ]
+
+The sdma_queue_count increment should be done before
+execute_queues_cpsch(), which calls pm_calc_rlib_size() where
+sdma_queue_count is used to calculate whether over_subscription is
+triggered.
+
+With the previous code, when a SDMA queue is created,
+compute_queue_count in pm_calc_rlib_size() is one more than the
+actual compute queue number, because the queue_count has been
+incremented while sdma_queue_count has not. This patch fixes that.
+
+Signed-off-by: Yong Zhao <Yong.Zhao@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+index 984c2f2b24b60..d128a8bbe19d0 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -1225,16 +1225,18 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
+ 
+ 	list_add(&q->list, &qpd->queues_list);
+ 	qpd->queue_count++;
++
++	if (q->properties.type == KFD_QUEUE_TYPE_SDMA)
++		dqm->sdma_queue_count++;
++	else if (q->properties.type == KFD_QUEUE_TYPE_SDMA_XGMI)
++		dqm->xgmi_sdma_queue_count++;
++
+ 	if (q->properties.is_active) {
+ 		dqm->queue_count++;
+ 		retval = execute_queues_cpsch(dqm,
+ 				KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0);
+ 	}
+ 
+-	if (q->properties.type == KFD_QUEUE_TYPE_SDMA)
+-		dqm->sdma_queue_count++;
+-	else if (q->properties.type == KFD_QUEUE_TYPE_SDMA_XGMI)
+-		dqm->xgmi_sdma_queue_count++;
+ 	/*
+ 	 * Unconditionally increment this counter, regardless of the queue's
+ 	 * type or whether the queue is active.
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-amdkfd-fix-permissions-of-hang_hws.patch b/queue-5.5/drm-amdkfd-fix-permissions-of-hang_hws.patch
new file mode 100644
index 00000000000..7c115ea54e8
--- /dev/null
+++ b/queue-5.5/drm-amdkfd-fix-permissions-of-hang_hws.patch
@@ -0,0 +1,37 @@
+From 06ce013a55489b01f4487b15b6d6cf2c3d6503ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 22:36:55 -0500
+Subject: drm/amdkfd: Fix permissions of hang_hws
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+[ Upstream commit 2bdac179e217a0c0b548a8c60524977586621b19 ]
+
+Reading from /sys/kernel/debug/kfd/hang_hws would cause a kernel
+oops because we didn't implement a read callback. Set the permission
+to write-only to prevent that.
+
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: shaoyunl  <shaoyun.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c b/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c
+index 15c523027285c..511712c2e382d 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c
+@@ -93,7 +93,7 @@ void kfd_debugfs_init(void)
+ 			    kfd_debugfs_hqds_by_device, &kfd_debugfs_fops);
+ 	debugfs_create_file("rls", S_IFREG | 0444, debugfs_root,
+ 			    kfd_debugfs_rls_by_device, &kfd_debugfs_fops);
+-	debugfs_create_file("hang_hws", S_IFREG | 0644, debugfs_root,
++	debugfs_create_file("hang_hws", S_IFREG | 0200, debugfs_root,
+ 			    NULL, &kfd_debugfs_hang_hws_fops);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-dp_mst-fix-multiple-frees-of-tx-bytes.patch b/queue-5.5/drm-dp_mst-fix-multiple-frees-of-tx-bytes.patch
new file mode 100644
index 00000000000..bfe54394539
--- /dev/null
+++ b/queue-5.5/drm-dp_mst-fix-multiple-frees-of-tx-bytes.patch
@@ -0,0 +1,43 @@
+From 768c4aa40ed72c8599fe3631202abcff20850aa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 17:35:09 +0000
+Subject: drm/dp_mst: fix multiple frees of tx->bytes
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 2c8bc91488fc57438c43b3bb19deb7fdbc1e5119 ]
+
+Currently tx->bytes is being freed r->num_transactions number of
+times because tx is not being set correctly. Fix this by setting
+tx to &r->transactions[i] so that the correct objects are being
+freed on each loop iteration.
+
+Addresses-Coverity: ("Double free")
+Fixes: 2f015ec6eab6 ("drm/dp_mst: Add sideband down request tracing + selftests")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191120173509.347490-1-colin.king@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 6cd90cb4b6b10..4a65ef8d8bff3 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -517,8 +517,10 @@ drm_dp_decode_sideband_req(const struct drm_dp_sideband_msg_tx *raw,
+ 			}
+ 
+ 			if (failed) {
+-				for (i = 0; i < r->num_transactions; i++)
++				for (i = 0; i < r->num_transactions; i++) {
++					tx = &r->transactions[i];
+ 					kfree(tx->bytes);
++				}
+ 				return -ENOMEM;
+ 			}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-fbdev-fallback-to-non-tiled-mode-if-all-tiles-no.patch b/queue-5.5/drm-fbdev-fallback-to-non-tiled-mode-if-all-tiles-no.patch
new file mode 100644
index 00000000000..43e79130ce9
--- /dev/null
+++ b/queue-5.5/drm-fbdev-fallback-to-non-tiled-mode-if-all-tiles-no.patch
@@ -0,0 +1,169 @@
+From df80b222cb96775b68df64ac48cb3dfb17019db1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 13:24:33 -0800
+Subject: drm/fbdev: Fallback to non tiled mode if all tiles not present
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Manasi Navare <manasi.d.navare@intel.com>
+
+[ Upstream commit f25c7a006cd1c07254780e3406e45cee4842b933 ]
+
+In case of tiled displays, if we hotplug just one connector,
+fbcon currently just selects the preferred mode and if it is
+tiled mode then that becomes a problem if rest of the tiles are
+not present.
+So in the fbdev driver on hotplug when we probe the client modeset,
+if we dont find all the connectors for all tiles, then on a connector
+with one tile, just fallback to the first available non tiled mode
+to display over a single connector.
+On the hotplug of the consecutive tiled connectors, if the tiled mode
+no longer exists because of fbcon size limitation, then return
+no modes for consecutive tiles but retain the non tiled mode
+on the 0th tile.
+Use the same logic in case of connected boot case as well.
+This has been tested with Dell UP328K tiled monitor.
+
+v2:
+* Set the modes on consecutive hotplugged tiles to no mode
+if tiled mode is pruned (Dave)
+v1:
+* Just handle the 1st connector hotplug case
+* v1 Reviewed-by: Dave Airlie <airlied@redhat.com>
+
+Suggested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Suggested-by: Dave Airlie <airlied@redhat.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Manasi Navare <manasi.d.navare@intel.com>
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191113222952.9231-1-manasi.d.navare@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_client_modeset.c | 72 ++++++++++++++++++++++++++++
+ 1 file changed, 72 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c
+index 895b73f23079a..6d4a29e99ae26 100644
+--- a/drivers/gpu/drm/drm_client_modeset.c
++++ b/drivers/gpu/drm/drm_client_modeset.c
+@@ -114,6 +114,33 @@ drm_client_find_modeset(struct drm_client_dev *client, struct drm_crtc *crtc)
+ 	return NULL;
+ }
+ 
++static struct drm_display_mode *
++drm_connector_get_tiled_mode(struct drm_connector *connector)
++{
++	struct drm_display_mode *mode;
++
++	list_for_each_entry(mode, &connector->modes, head) {
++		if (mode->hdisplay == connector->tile_h_size &&
++		    mode->vdisplay == connector->tile_v_size)
++			return mode;
++	}
++	return NULL;
++}
++
++static struct drm_display_mode *
++drm_connector_fallback_non_tiled_mode(struct drm_connector *connector)
++{
++	struct drm_display_mode *mode;
++
++	list_for_each_entry(mode, &connector->modes, head) {
++		if (mode->hdisplay == connector->tile_h_size &&
++		    mode->vdisplay == connector->tile_v_size)
++			continue;
++		return mode;
++	}
++	return NULL;
++}
++
+ static struct drm_display_mode *
+ drm_connector_has_preferred_mode(struct drm_connector *connector, int width, int height)
+ {
+@@ -348,8 +375,15 @@ static bool drm_client_target_preferred(struct drm_connector **connectors,
+ 	struct drm_connector *connector;
+ 	u64 conn_configured = 0;
+ 	int tile_pass = 0;
++	int num_tiled_conns = 0;
+ 	int i;
+ 
++	for (i = 0; i < connector_count; i++) {
++		if (connectors[i]->has_tile &&
++		    connectors[i]->status == connector_status_connected)
++			num_tiled_conns++;
++	}
++
+ retry:
+ 	for (i = 0; i < connector_count; i++) {
+ 		connector = connectors[i];
+@@ -399,6 +433,28 @@ retry:
+ 			list_for_each_entry(modes[i], &connector->modes, head)
+ 				break;
+ 		}
++		/*
++		 * In case of tiled mode if all tiles not present fallback to
++		 * first available non tiled mode.
++		 * After all tiles are present, try to find the tiled mode
++		 * for all and if tiled mode not present due to fbcon size
++		 * limitations, use first non tiled mode only for
++		 * tile 0,0 and set to no mode for all other tiles.
++		 */
++		if (connector->has_tile) {
++			if (num_tiled_conns <
++			    connector->num_h_tile * connector->num_v_tile ||
++			    (connector->tile_h_loc == 0 &&
++			     connector->tile_v_loc == 0 &&
++			     !drm_connector_get_tiled_mode(connector))) {
++				DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n",
++					      connector->base.id);
++				modes[i] = drm_connector_fallback_non_tiled_mode(connector);
++			} else {
++				modes[i] = drm_connector_get_tiled_mode(connector);
++			}
++		}
++
+ 		DRM_DEBUG_KMS("found mode %s\n", modes[i] ? modes[i]->name :
+ 			  "none");
+ 		conn_configured |= BIT_ULL(i);
+@@ -515,6 +571,7 @@ static bool drm_client_firmware_config(struct drm_client_dev *client,
+ 	bool fallback = true, ret = true;
+ 	int num_connectors_enabled = 0;
+ 	int num_connectors_detected = 0;
++	int num_tiled_conns = 0;
+ 	struct drm_modeset_acquire_ctx ctx;
+ 
+ 	if (!drm_drv_uses_atomic_modeset(dev))
+@@ -532,6 +589,11 @@ static bool drm_client_firmware_config(struct drm_client_dev *client,
+ 	memcpy(save_enabled, enabled, count);
+ 	mask = GENMASK(count - 1, 0);
+ 	conn_configured = 0;
++	for (i = 0; i < count; i++) {
++		if (connectors[i]->has_tile &&
++		    connectors[i]->status == connector_status_connected)
++			num_tiled_conns++;
++	}
+ retry:
+ 	conn_seq = conn_configured;
+ 	for (i = 0; i < count; i++) {
+@@ -631,6 +693,16 @@ retry:
+ 				      connector->name);
+ 			modes[i] = &connector->state->crtc->mode;
+ 		}
++		/*
++		 * In case of tiled modes, if all tiles are not present
++		 * then fallback to a non tiled mode.
++		 */
++		if (connector->has_tile &&
++		    num_tiled_conns < connector->num_h_tile * connector->num_v_tile) {
++			DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n",
++				      connector->base.id);
++			modes[i] = drm_connector_fallback_non_tiled_mode(connector);
++		}
+ 		crtcs[i] = new_crtc;
+ 
+ 		DRM_DEBUG_KMS("connector %s on [CRTC:%d:%s]: %dx%d%s\n",
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-gma500-fixup-fbdev-stolen-size-usage-evaluation.patch b/queue-5.5/drm-gma500-fixup-fbdev-stolen-size-usage-evaluation.patch
new file mode 100644
index 00000000000..ca988c4c972
--- /dev/null
+++ b/queue-5.5/drm-gma500-fixup-fbdev-stolen-size-usage-evaluation.patch
@@ -0,0 +1,61 @@
+From bde3cd5153e447d2db5e4b3b9c23fed9a0846cc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 16:30:48 +0100
+Subject: drm/gma500: Fixup fbdev stolen size usage evaluation
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit fd1a5e521c3c083bb43ea731aae0f8b95f12b9bd ]
+
+psbfb_probe performs an evaluation of the required size from the stolen
+GTT memory, but gets it wrong in two distinct ways:
+- The resulting size must be page-size-aligned;
+- The size to allocate is derived from the surface dimensions, not the fb
+  dimensions.
+
+When two connectors are connected with different modes, the smallest will
+be stored in the fb dimensions, but the size that needs to be allocated must
+match the largest (surface) dimensions. This is what is used in the actual
+allocation code.
+
+Fix this by correcting the evaluation to conform to the two points above.
+It allows correctly switching to 16bpp when one connector is e.g. 1920x1080
+and the other is 1024x768.
+
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191107153048.843881-1-paul.kocialkowski@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/framebuffer.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
+index 218f3bb15276e..90237abee0885 100644
+--- a/drivers/gpu/drm/gma500/framebuffer.c
++++ b/drivers/gpu/drm/gma500/framebuffer.c
+@@ -462,6 +462,7 @@ static int psbfb_probe(struct drm_fb_helper *helper,
+ 		container_of(helper, struct psb_fbdev, psb_fb_helper);
+ 	struct drm_device *dev = psb_fbdev->psb_fb_helper.dev;
+ 	struct drm_psb_private *dev_priv = dev->dev_private;
++	unsigned int fb_size;
+ 	int bytespp;
+ 
+ 	bytespp = sizes->surface_bpp / 8;
+@@ -471,8 +472,11 @@ static int psbfb_probe(struct drm_fb_helper *helper,
+ 	/* If the mode will not fit in 32bit then switch to 16bit to get
+ 	   a console on full resolution. The X mode setting server will
+ 	   allocate its own 32bit GEM framebuffer */
+-	if (ALIGN(sizes->fb_width * bytespp, 64) * sizes->fb_height >
+-	                dev_priv->vram_stolen_size) {
++	fb_size = ALIGN(sizes->surface_width * bytespp, 64) *
++		  sizes->surface_height;
++	fb_size = ALIGN(fb_size, PAGE_SIZE);
++
++	if (fb_size > dev_priv->vram_stolen_size) {
+                 sizes->surface_bpp = 16;
+                 sizes->surface_depth = 16;
+         }
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-mediatek-add-gamma-property-according-to-hardwar.patch b/queue-5.5/drm-mediatek-add-gamma-property-according-to-hardwar.patch
new file mode 100644
index 00000000000..095ad8ba610
--- /dev/null
+++ b/queue-5.5/drm-mediatek-add-gamma-property-according-to-hardwar.patch
@@ -0,0 +1,60 @@
+From bf572e23e96078c73fbd18378af5ade1d1f037c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 15:28:51 +0800
+Subject: drm/mediatek: Add gamma property according to hardware capability
+
+From: Yongqiang Niu <yongqiang.niu@mediatek.com>
+
+[ Upstream commit 4cebc1de506fa753301266a5a23bb21bca52ad3a ]
+
+If there is no gamma function in the crtc
+display path, don't add gamma property
+for crtc
+
+Fixes: 2f3f4dda747c ("drm/mediatek: Add gamma correction.")
+Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com>
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index 4132cd114a037..c3f5111fd563f 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -641,6 +641,7 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
+ 	int pipe = priv->num_pipes;
+ 	int ret;
+ 	int i;
++	uint gamma_lut_size = 0;
+ 
+ 	if (!path)
+ 		return 0;
+@@ -691,6 +692,9 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
+ 		}
+ 
+ 		mtk_crtc->ddp_comp[i] = comp;
++
++		if (comp->funcs && comp->funcs->gamma_set)
++			gamma_lut_size = MTK_LUT_SIZE;
+ 	}
+ 
+ 	for (i = 0; i < mtk_crtc->ddp_comp_nr; i++)
+@@ -711,8 +715,10 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
+ 				NULL, pipe);
+ 	if (ret < 0)
+ 		return ret;
+-	drm_mode_crtc_set_gamma_size(&mtk_crtc->base, MTK_LUT_SIZE);
+-	drm_crtc_enable_color_mgmt(&mtk_crtc->base, 0, false, MTK_LUT_SIZE);
++
++	if (gamma_lut_size)
++		drm_mode_crtc_set_gamma_size(&mtk_crtc->base, gamma_lut_size);
++	drm_crtc_enable_color_mgmt(&mtk_crtc->base, 0, false, gamma_lut_size);
+ 	priv->num_pipes++;
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-mediatek-handle-events-when-enabling-disabling-c.patch b/queue-5.5/drm-mediatek-handle-events-when-enabling-disabling-c.patch
new file mode 100644
index 00000000000..a1ab8d755b6
--- /dev/null
+++ b/queue-5.5/drm-mediatek-handle-events-when-enabling-disabling-c.patch
@@ -0,0 +1,51 @@
+From 8c0a51b4ce0379b02ff24ab9dd799ed3b580f659 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 13:05:21 +0800
+Subject: drm/mediatek: handle events when enabling/disabling crtc
+
+From: Bibby Hsieh <bibby.hsieh@mediatek.com>
+
+[ Upstream commit 411f5c1eacfebb1f6e40b653d29447cdfe7282aa ]
+
+The driver currently handles vblank events only when updating planes on
+an already enabled CRTC. The atomic update API however allows requesting
+an event when enabling or disabling a CRTC. This currently leads to
+event objects being leaked in the kernel and to events not being sent
+out. Fix it.
+
+Signed-off-by: Bibby Hsieh <bibby.hsieh@mediatek.com>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index 3305a94fc9305..4132cd114a037 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -328,6 +328,7 @@ err_pm_runtime_put:
+ static void mtk_crtc_ddp_hw_fini(struct mtk_drm_crtc *mtk_crtc)
+ {
+ 	struct drm_device *drm = mtk_crtc->base.dev;
++	struct drm_crtc *crtc = &mtk_crtc->base;
+ 	int i;
+ 
+ 	DRM_DEBUG_DRIVER("%s\n", __func__);
+@@ -353,6 +354,13 @@ static void mtk_crtc_ddp_hw_fini(struct mtk_drm_crtc *mtk_crtc)
+ 	mtk_disp_mutex_unprepare(mtk_crtc->mutex);
+ 
+ 	pm_runtime_put(drm->dev);
++
++	if (crtc->state->event && !crtc->state->active) {
++		spin_lock_irq(&crtc->dev->event_lock);
++		drm_crtc_send_vblank_event(crtc, crtc->state->event);
++		crtc->state->event = NULL;
++		spin_unlock_irq(&crtc->dev->event_lock);
++	}
+ }
+ 
+ static void mtk_crtc_ddp_config(struct drm_crtc *crtc)
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-mipi_dbi-fix-off-by-one-bugs-in-mipi_dbi_blank.patch b/queue-5.5/drm-mipi_dbi-fix-off-by-one-bugs-in-mipi_dbi_blank.patch
new file mode 100644
index 00000000000..e2ee5923e34
--- /dev/null
+++ b/queue-5.5/drm-mipi_dbi-fix-off-by-one-bugs-in-mipi_dbi_blank.patch
@@ -0,0 +1,51 @@
+From 8daa78039043c8aaaf69143f37183dd40624a3ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2019 14:06:04 +0100
+Subject: drm/mipi_dbi: Fix off-by-one bugs in mipi_dbi_blank()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2ce18249af5a28031b3f909cfafccc88ea966c9d ]
+
+When configuring the frame memory window, the last column and row
+numbers are written to the column resp. page address registers.  These
+numbers are thus one less than the actual window width resp. height.
+
+While this is handled correctly in mipi_dbi_fb_dirty() since commit
+03ceb1c8dfd1e293 ("drm/tinydrm: Fix setting of the column/page end
+addresses."), it is not in mipi_dbi_blank().  The latter still forgets
+to subtract one when calculating the most significant bytes of the
+column and row numbers, thus programming wrong values when the display
+width or height is a multiple of 256.
+
+Fixes: 02dd95fe31693626 ("drm/tinydrm: Add MIPI DBI support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191230130604.31006-1-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_mipi_dbi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c
+index e34058c721bec..16bff1be4b8ac 100644
+--- a/drivers/gpu/drm/drm_mipi_dbi.c
++++ b/drivers/gpu/drm/drm_mipi_dbi.c
+@@ -367,9 +367,9 @@ static void mipi_dbi_blank(struct mipi_dbi_dev *dbidev)
+ 	memset(dbidev->tx_buf, 0, len);
+ 
+ 	mipi_dbi_command(dbi, MIPI_DCS_SET_COLUMN_ADDRESS, 0, 0,
+-			 (width >> 8) & 0xFF, (width - 1) & 0xFF);
++			 ((width - 1) >> 8) & 0xFF, (width - 1) & 0xFF);
+ 	mipi_dbi_command(dbi, MIPI_DCS_SET_PAGE_ADDRESS, 0, 0,
+-			 (height >> 8) & 0xFF, (height - 1) & 0xFF);
++			 ((height - 1) >> 8) & 0xFF, (height - 1) & 0xFF);
+ 	mipi_dbi_command_buf(dbi, MIPI_DCS_WRITE_MEMORY_START,
+ 			     (u8 *)dbidev->tx_buf, len);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-msm-adreno-fix-zap-vs-no-zap-handling.patch b/queue-5.5/drm-msm-adreno-fix-zap-vs-no-zap-handling.patch
new file mode 100644
index 00000000000..9edac2b1d50
--- /dev/null
+++ b/queue-5.5/drm-msm-adreno-fix-zap-vs-no-zap-handling.patch
@@ -0,0 +1,86 @@
+From fccc8fabce7854d56a4e3ba6c3f4f2500fd34ab5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Nov 2019 14:23:38 -0800
+Subject: drm/msm/adreno: fix zap vs no-zap handling
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 15ab987c423df561e0949d77fb5043921ae59956 ]
+
+We can have two cases, when it comes to "zap" fw.  Either the fw
+requires zap fw to take the GPU out of secure mode at boot, or it does
+not and we can write RBBM_SECVID_TRUST_CNTL directly.  Previously we
+decided based on whether zap fw load succeeded, but this is not a great
+plan because:
+
+1) we could have zap fw in the filesystem on a device where it is not
+   required
+2) we could have the inverse case
+
+Instead, shift to deciding based on whether we have a 'zap-shader' node
+in dt.  In practice, there is only one device (currently) with upstream
+dt that does not use zap (cheza), and it already has a /delete-node/ for
+the zap-shader node.
+
+Fixes: abccb9fe3267 ("drm/msm/a6xx: Add zap shader load")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 11 +++++++++--
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 11 +++++++++--
+ 2 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index b02e2042547f6..7d9e63e20dedd 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -753,11 +753,18 @@ static int a5xx_hw_init(struct msm_gpu *gpu)
+ 		gpu->funcs->flush(gpu, gpu->rb[0]);
+ 		if (!a5xx_idle(gpu, gpu->rb[0]))
+ 			return -EINVAL;
+-	} else {
+-		/* Print a warning so if we die, we know why */
++	} else if (ret == -ENODEV) {
++		/*
++		 * This device does not use zap shader (but print a warning
++		 * just in case someone got their dt wrong.. hopefully they
++		 * have a debug UART to realize the error of their ways...
++		 * if you mess this up you are about to crash horribly)
++		 */
+ 		dev_warn_once(gpu->dev->dev,
+ 			"Zap shader not enabled - using SECVID_TRUST_CNTL instead\n");
+ 		gpu_write(gpu, REG_A5XX_RBBM_SECVID_TRUST_CNTL, 0x0);
++	} else {
++		return ret;
+ 	}
+ 
+ 	/* Last step - yield the ringbuffer */
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index dc8ec2c94301b..686c34d706b0d 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -537,12 +537,19 @@ static int a6xx_hw_init(struct msm_gpu *gpu)
+ 		a6xx_flush(gpu, gpu->rb[0]);
+ 		if (!a6xx_idle(gpu, gpu->rb[0]))
+ 			return -EINVAL;
+-	} else {
+-		/* Print a warning so if we die, we know why */
++	} else if (ret == -ENODEV) {
++		/*
++		 * This device does not use zap shader (but print a warning
++		 * just in case someone got their dt wrong.. hopefully they
++		 * have a debug UART to realize the error of their ways...
++		 * if you mess this up you are about to crash horribly)
++		 */
+ 		dev_warn_once(gpu->dev->dev,
+ 			"Zap shader not enabled - using SECVID_TRUST_CNTL instead\n");
+ 		gpu_write(gpu, REG_A6XX_RBBM_SECVID_TRUST_CNTL, 0x0);
+ 		ret = 0;
++	} else {
++		return ret;
+ 	}
+ 
+ out:
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-nouveau-disp-nv50-prevent-oops-when-no-channel-m.patch b/queue-5.5/drm-nouveau-disp-nv50-prevent-oops-when-no-channel-m.patch
new file mode 100644
index 00000000000..4949126cd11
--- /dev/null
+++ b/queue-5.5/drm-nouveau-disp-nv50-prevent-oops-when-no-channel-m.patch
@@ -0,0 +1,41 @@
+From 317691350a0c60aeff1e1992f7fba3a25684093c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 14:39:26 +1000
+Subject: drm/nouveau/disp/nv50-: prevent oops when no channel method map
+ provided
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 0e6176c6d286316e9431b4f695940cfac4ffe6c2 ]
+
+The implementations for most channel types contains a map of methods to
+priv registers in order to provide debugging info when a disp exception
+has been raised.
+
+This info is missing from the implementation of PIO channels as they're
+rather simplistic already, however, if an exception is raised by one of
+them, we'd end up triggering a NULL-pointer deref.  Not ideal...
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206299
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
+index bcf32d92ee5a9..50e3539f33d22 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
+@@ -74,6 +74,8 @@ nv50_disp_chan_mthd(struct nv50_disp_chan *chan, int debug)
+ 
+ 	if (debug > subdev->debug)
+ 		return;
++	if (!mthd)
++		return;
+ 
+ 	for (i = 0; (list = mthd->data[i].mthd) != NULL; i++) {
+ 		u32 base = chan->head * mthd->addr;
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-nouveau-drm-ttm-remove-set-but-not-used-variable.patch b/queue-5.5/drm-nouveau-drm-ttm-remove-set-but-not-used-variable.patch
new file mode 100644
index 00000000000..8aef498a905
--- /dev/null
+++ b/queue-5.5/drm-nouveau-drm-ttm-remove-set-but-not-used-variable.patch
@@ -0,0 +1,58 @@
+From 78f6c7450d3e7b6a74f60ceaba42e7ccb26e4bdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 15:28:37 +0800
+Subject: drm/nouveau/drm/ttm: Remove set but not used variable 'mem'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2e4534a22794746b11a794b2229b8d58797eccce ]
+
+drivers/gpu/drm/nouveau/nouveau_ttm.c: In function nouveau_vram_manager_new:
+drivers/gpu/drm/nouveau/nouveau_ttm.c:66:22: warning: variable mem set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/nouveau/nouveau_ttm.c: In function nouveau_gart_manager_new:
+drivers/gpu/drm/nouveau/nouveau_ttm.c:106:22: warning: variable mem set but not used [-Wunused-but-set-variable]
+
+They are not used any more, so remove it.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_ttm.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+index 77a0c6ad3cef5..7ca0a24985327 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+@@ -63,14 +63,12 @@ nouveau_vram_manager_new(struct ttm_mem_type_manager *man,
+ {
+ 	struct nouveau_bo *nvbo = nouveau_bo(bo);
+ 	struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
+-	struct nouveau_mem *mem;
+ 	int ret;
+ 
+ 	if (drm->client.device.info.ram_size == 0)
+ 		return -ENOMEM;
+ 
+ 	ret = nouveau_mem_new(&drm->master, nvbo->kind, nvbo->comp, reg);
+-	mem = nouveau_mem(reg);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -103,11 +101,9 @@ nouveau_gart_manager_new(struct ttm_mem_type_manager *man,
+ {
+ 	struct nouveau_bo *nvbo = nouveau_bo(bo);
+ 	struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
+-	struct nouveau_mem *mem;
+ 	int ret;
+ 
+ 	ret = nouveau_mem_new(&drm->master, nvbo->kind, nvbo->comp, reg);
+-	mem = nouveau_mem(reg);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-nouveau-fault-gv100-fix-memory-leak-on-module-un.patch b/queue-5.5/drm-nouveau-fault-gv100-fix-memory-leak-on-module-un.patch
new file mode 100644
index 00000000000..82e6d857973
--- /dev/null
+++ b/queue-5.5/drm-nouveau-fault-gv100-fix-memory-leak-on-module-un.patch
@@ -0,0 +1,30 @@
+From 863bf81a0dc1f810ccaedb505fba9b3394cfed5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 06:34:21 +1000
+Subject: drm/nouveau/fault/gv100-: fix memory leak on module unload
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 633cc9beeb6f9b5fa2f17a2a9d0e2790cb6c3de7 ]
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
+index ca251560d3e09..bb4a4266897c3 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
+@@ -146,6 +146,7 @@ nvkm_fault_dtor(struct nvkm_subdev *subdev)
+ 	struct nvkm_fault *fault = nvkm_fault(subdev);
+ 	int i;
+ 
++	nvkm_notify_fini(&fault->nrpfb);
+ 	nvkm_event_fini(&fault->event);
+ 
+ 	for (i = 0; i < fault->buffer_nr; i++) {
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-nouveau-fix-copy-paste-error-in-nouveau_fence_wa.patch b/queue-5.5/drm-nouveau-fix-copy-paste-error-in-nouveau_fence_wa.patch
new file mode 100644
index 00000000000..4781c74268a
--- /dev/null
+++ b/queue-5.5/drm-nouveau-fix-copy-paste-error-in-nouveau_fence_wa.patch
@@ -0,0 +1,37 @@
+From daa1084c4c2839bbce75540bd99c53181d0227a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 14:32:01 +0800
+Subject: drm/nouveau: Fix copy-paste error in
+ nouveau_fence_wait_uevent_handler
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 1eb013473bff5f95b6fe1ca4dd7deda47257b9c2 ]
+
+Like other cases, it should use rcu protected 'chan' rather
+than 'fence->channel' in nouveau_fence_wait_uevent_handler.
+
+Fixes: 0ec5f02f0e2c ("drm/nouveau: prevent stale fence->channel pointers, and protect with rcu")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
+index 9118df035b28d..70bb6bb97af87 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
+@@ -156,7 +156,7 @@ nouveau_fence_wait_uevent_handler(struct nvif_notify *notify)
+ 
+ 		fence = list_entry(fctx->pending.next, typeof(*fence), head);
+ 		chan = rcu_dereference_protected(fence->channel, lockdep_is_held(&fctx->lock));
+-		if (nouveau_fence_update(fence->channel, fctx))
++		if (nouveau_fence_update(chan, fctx))
+ 			ret = NVIF_NOTIFY_DROP;
+ 	}
+ 	spin_unlock_irqrestore(&fctx->lock, flags);
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-nouveau-gr-gk20a-gm200-add-terminators-to-method.patch b/queue-5.5/drm-nouveau-gr-gk20a-gm200-add-terminators-to-method.patch
new file mode 100644
index 00000000000..5e82d7eda97
--- /dev/null
+++ b/queue-5.5/drm-nouveau-gr-gk20a-gm200-add-terminators-to-method.patch
@@ -0,0 +1,76 @@
+From d2fa9ceced69a83a507dd048eff180d37b57105f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2020 11:46:15 +1000
+Subject: drm/nouveau/gr/gk20a,gm200-: add terminators to method lists read
+ from fw
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 7adc77aa0e11f25b0e762859219c70852cd8d56f ]
+
+Method init is typically ordered by class in the FW image as ThreeD,
+TwoD, Compute.
+
+Due to a bug in parsing the FW into our internal format, we've been
+accidentally sending Twod + Compute methods to the ThreeD class, as
+well as Compute methods to the TwoD class - oops.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/nouveau/nvkm/engine/gr/gk20a.c    | 21 ++++++++++---------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
+index 500cb08dd6080..b57ab5cea9a10 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
+@@ -143,23 +143,24 @@ gk20a_gr_av_to_method(struct gf100_gr *gr, const char *fw_name,
+ 
+ 	nent = (fuc.size / sizeof(struct gk20a_fw_av));
+ 
+-	pack = vzalloc((sizeof(*pack) * max_classes) +
+-		       (sizeof(*init) * (nent + 1)));
++	pack = vzalloc((sizeof(*pack) * (max_classes + 1)) +
++		       (sizeof(*init) * (nent + max_classes + 1)));
+ 	if (!pack) {
+ 		ret = -ENOMEM;
+ 		goto end;
+ 	}
+ 
+-	init = (void *)(pack + max_classes);
++	init = (void *)(pack + max_classes + 1);
+ 
+-	for (i = 0; i < nent; i++) {
+-		struct gf100_gr_init *ent = &init[i];
++	for (i = 0; i < nent; i++, init++) {
+ 		struct gk20a_fw_av *av = &((struct gk20a_fw_av *)fuc.data)[i];
+ 		u32 class = av->addr & 0xffff;
+ 		u32 addr = (av->addr & 0xffff0000) >> 14;
+ 
+ 		if (prevclass != class) {
+-			pack[classidx].init = ent;
++			if (prevclass) /* Add terminator to the method list. */
++				init++;
++			pack[classidx].init = init;
+ 			pack[classidx].type = class;
+ 			prevclass = class;
+ 			if (++classidx >= max_classes) {
+@@ -169,10 +170,10 @@ gk20a_gr_av_to_method(struct gf100_gr *gr, const char *fw_name,
+ 			}
+ 		}
+ 
+-		ent->addr = addr;
+-		ent->data = av->data;
+-		ent->count = 1;
+-		ent->pitch = 1;
++		init->addr = addr;
++		init->data = av->data;
++		init->count = 1;
++		init->pitch = 1;
+ 	}
+ 
+ 	*ppack = pack;
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-nouveau-mmu-fix-comptag-memory-leak.patch b/queue-5.5/drm-nouveau-mmu-fix-comptag-memory-leak.patch
new file mode 100644
index 00000000000..1ad62834b82
--- /dev/null
+++ b/queue-5.5/drm-nouveau-mmu-fix-comptag-memory-leak.patch
@@ -0,0 +1,32 @@
+From 63836886e105744b784132568886228f9e527ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 08:23:06 +1000
+Subject: drm/nouveau/mmu: fix comptag memory leak
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 35e4909b6a2b4005ced3c4238da60d926b78fdea ]
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/core/memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/memory.c b/drivers/gpu/drm/nouveau/nvkm/core/memory.c
+index e85a08ecd9da5..4cc186262d344 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/memory.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/memory.c
+@@ -91,8 +91,8 @@ nvkm_memory_tags_get(struct nvkm_memory *memory, struct nvkm_device *device,
+ 	}
+ 
+ 	refcount_set(&tags->refcount, 1);
++	*ptags = memory->tags = tags;
+ 	mutex_unlock(&fb->subdev.mutex);
+-	*ptags = tags;
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-nouveau-nouveau-fix-incorrect-sizeof-on-args.src.patch b/queue-5.5/drm-nouveau-nouveau-fix-incorrect-sizeof-on-args.src.patch
new file mode 100644
index 00000000000..6267b1ee8d9
--- /dev/null
+++ b/queue-5.5/drm-nouveau-nouveau-fix-incorrect-sizeof-on-args.src.patch
@@ -0,0 +1,43 @@
+From 8be204623b6c7a84d7790f3effa67f91f1e6cb2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2019 16:28:28 +0000
+Subject: drm/nouveau/nouveau: fix incorrect sizeof on args.src an args.dst
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f42e4b337b327b1336c978c4b5174990a25f68a0 ]
+
+The sizeof is currently on args.src and args.dst and should be on
+*args.src and *args.dst. Fortunately these sizes just so happen
+to be the same size so it worked, however, this should be fixed
+and it also cleans up static analysis warnings
+
+Addresses-Coverity: ("sizeof not portable")
+Fixes: f268307ec7c7 ("nouveau: simplify nouveau_dmem_migrate_vma")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_dmem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_dmem.c b/drivers/gpu/drm/nouveau/nouveau_dmem.c
+index fa14399415965..0ad5d87b5a8e5 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_dmem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_dmem.c
+@@ -635,10 +635,10 @@ nouveau_dmem_migrate_vma(struct nouveau_drm *drm,
+ 	unsigned long c, i;
+ 	int ret = -ENOMEM;
+ 
+-	args.src = kcalloc(max, sizeof(args.src), GFP_KERNEL);
++	args.src = kcalloc(max, sizeof(*args.src), GFP_KERNEL);
+ 	if (!args.src)
+ 		goto out;
+-	args.dst = kcalloc(max, sizeof(args.dst), GFP_KERNEL);
++	args.dst = kcalloc(max, sizeof(*args.dst), GFP_KERNEL);
+ 	if (!args.dst)
+ 		goto out_free_src;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-nouveau-secboot-gm20b-initialize-pointer-in-gm20.patch b/queue-5.5/drm-nouveau-secboot-gm20b-initialize-pointer-in-gm20.patch
new file mode 100644
index 00000000000..174f65e68ed
--- /dev/null
+++ b/queue-5.5/drm-nouveau-secboot-gm20b-initialize-pointer-in-gm20.patch
@@ -0,0 +1,48 @@
+From 610360528a5d1e9f2974399b0aa31637018822b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 08:46:01 +0300
+Subject: drm/nouveau/secboot/gm20b: initialize pointer in gm20b_secboot_new()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 3613a9bea95a1470dd42e4ed1cc7d86ebe0a2dc0 ]
+
+We accidentally set "psb" which is a no-op instead of "*psb" so it
+generates a static checker warning.  We should probably set it before
+the first error return so that it's always initialized.
+
+Fixes: 923f1bd27bf1 ("drm/nouveau/secboot/gm20b: add secure boot support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
+index df8b919dcf09b..ace6fefba4280 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
+@@ -108,6 +108,7 @@ gm20b_secboot_new(struct nvkm_device *device, int index,
+ 	struct gm200_secboot *gsb;
+ 	struct nvkm_acr *acr;
+ 
++	*psb = NULL;
+ 	acr = acr_r352_new(BIT(NVKM_SECBOOT_FALCON_FECS) |
+ 			   BIT(NVKM_SECBOOT_FALCON_PMU));
+ 	if (IS_ERR(acr))
+@@ -116,10 +117,8 @@ gm20b_secboot_new(struct nvkm_device *device, int index,
+ 	acr->optional_falcons = BIT(NVKM_SECBOOT_FALCON_PMU);
+ 
+ 	gsb = kzalloc(sizeof(*gsb), GFP_KERNEL);
+-	if (!gsb) {
+-		psb = NULL;
++	if (!gsb)
+ 		return -ENOMEM;
+-	}
+ 	*psb = &gsb->base;
+ 
+ 	ret = nvkm_secboot_ctor(&gm20b_secboot, acr, device, index, &gsb->base);
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-panel-simple-add-logic-pd-type-28-display-suppor.patch b/queue-5.5/drm-panel-simple-add-logic-pd-type-28-display-suppor.patch
new file mode 100644
index 00000000000..19c899fc36e
--- /dev/null
+++ b/queue-5.5/drm-panel-simple-add-logic-pd-type-28-display-suppor.patch
@@ -0,0 +1,84 @@
+From 04f4707bc99da70701876a6c792a4e3c991e3bc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 08:51:45 -0500
+Subject: drm/panel: simple: Add Logic PD Type 28 display support
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 0d35408afbeb603bc9972ae91e4dd2638bcffe52 ]
+
+Previously, there was an omap panel-dpi driver that would
+read generic timings from the device tree and set the display
+timing accordingly.  This driver was removed so the screen
+no longer functions.  This patch modifies the panel-simple
+file to setup the timings to the same values previously used.
+
+Fixes: 8bf4b1621178 ("drm/omap: Remove panel-dpi driver")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191016135147.7743-1-aford173@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 37 ++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 5d487686d25c5..72f69709f3493 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -2061,6 +2061,40 @@ static const struct drm_display_mode mitsubishi_aa070mc01_mode = {
+ 	.flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC,
+ };
+ 
++static const struct drm_display_mode logicpd_type_28_mode = {
++	.clock = 9000,
++	.hdisplay = 480,
++	.hsync_start = 480 + 3,
++	.hsync_end = 480 + 3 + 42,
++	.htotal = 480 + 3 + 42 + 2,
++
++	.vdisplay = 272,
++	.vsync_start = 272 + 2,
++	.vsync_end = 272 + 2 + 11,
++	.vtotal = 272 + 2 + 11 + 3,
++	.vrefresh = 60,
++	.flags = DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC,
++};
++
++static const struct panel_desc logicpd_type_28 = {
++	.modes = &logicpd_type_28_mode,
++	.num_modes = 1,
++	.bpc = 8,
++	.size = {
++		.width = 105,
++		.height = 67,
++	},
++	.delay = {
++		.prepare = 200,
++		.enable = 200,
++		.unprepare = 200,
++		.disable = 200,
++	},
++	.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
++	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE |
++		     DRM_BUS_FLAG_SYNC_DRIVE_NEGEDGE,
++};
++
+ static const struct panel_desc mitsubishi_aa070mc01 = {
+ 	.modes = &mitsubishi_aa070mc01_mode,
+ 	.num_modes = 1,
+@@ -3287,6 +3321,9 @@ static const struct of_device_id platform_of_match[] = {
+ 	}, {
+ 		.compatible = "lg,lp129qe",
+ 		.data = &lg_lp129qe,
++	}, {
++		.compatible = "logicpd,type28",
++		.data = &logicpd_type_28,
+ 	}, {
+ 		.compatible = "mitsubishi,aa070mc01-ca1",
+ 		.data = &mitsubishi_aa070mc01,
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-qxl-complete-exception-handling-in-qxl_device_in.patch b/queue-5.5/drm-qxl-complete-exception-handling-in-qxl_device_in.patch
new file mode 100644
index 00000000000..fde6919679b
--- /dev/null
+++ b/queue-5.5/drm-qxl-complete-exception-handling-in-qxl_device_in.patch
@@ -0,0 +1,49 @@
+From a6969716e7b2c882fec23a441266ca5d99a4e978 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 18:05:08 +0100
+Subject: drm/qxl: Complete exception handling in qxl_device_init()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Elfring <elfring@users.sourceforge.net>
+
+[ Upstream commit dbe3ad61dcebc49fe3efca70a0f752a95b4600f2 ]
+
+A coccicheck run provided information like the following.
+
+drivers/gpu/drm/qxl/qxl_kms.c:295:1-7: ERROR: missing iounmap;
+ioremap on line 178 and execution via conditional on line 185
+
+Generated by: scripts/coccinelle/free/iounmap.cocci
+
+A jump target was specified in an if branch. The corresponding function
+call did not release the desired system resource then.
+Thus use the label “rom_unmap” instead to fix the exception handling
+for this function implementation.
+
+Fixes: 5043348a4969ae1661c008efe929abd0d76e3792 ("drm: qxl: Fix error handling at qxl_device_init")
+Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
+Link: http://patchwork.freedesktop.org/patch/msgid/5e5ef9c4-4d85-3c93-cf28-42cfcb5b0649@web.de
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/qxl/qxl_kms.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c
+index 611cbe7aee690..bfc1631093e9b 100644
+--- a/drivers/gpu/drm/qxl/qxl_kms.c
++++ b/drivers/gpu/drm/qxl/qxl_kms.c
+@@ -184,7 +184,7 @@ int qxl_device_init(struct qxl_device *qdev,
+ 
+ 	if (!qxl_check_device(qdev)) {
+ 		r = -ENODEV;
+-		goto surface_mapping_free;
++		goto rom_unmap;
+ 	}
+ 
+ 	r = qxl_bo_init(qdev);
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-rcar-du-recognize-renesas-vsps-in-addition-to-vs.patch b/queue-5.5/drm-rcar-du-recognize-renesas-vsps-in-addition-to-vs.patch
new file mode 100644
index 00000000000..1abb7d76c15
--- /dev/null
+++ b/queue-5.5/drm-rcar-du-recognize-renesas-vsps-in-addition-to-vs.patch
@@ -0,0 +1,74 @@
+From 7581c7bc58ead0d18217bf5d8316e1b23129ffd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 19:35:03 +0100
+Subject: drm: rcar-du: Recognize "renesas,vsps" in addition to "vsps"
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 7b627ce80fbd05885b27f711a5f9820f2b40749a ]
+
+The Renesas-specific "vsps" property lacks a vendor prefix.
+Add a "renesas," prefix to comply with DT best practises.
+Retain backward compatibility with old DTBs by falling back to "vsps"
+when needed.
+
+Fixes: 6d62ef3ac30be756 ("drm: rcar-du: Expose the VSP1 compositor through KMS planes")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_kms.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+index 0d59f390de19a..662d8075f4116 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+@@ -542,6 +542,7 @@ static int rcar_du_properties_init(struct rcar_du_device *rcdu)
+ static int rcar_du_vsps_init(struct rcar_du_device *rcdu)
+ {
+ 	const struct device_node *np = rcdu->dev->of_node;
++	const char *vsps_prop_name = "renesas,vsps";
+ 	struct of_phandle_args args;
+ 	struct {
+ 		struct device_node *np;
+@@ -557,15 +558,21 @@ static int rcar_du_vsps_init(struct rcar_du_device *rcdu)
+ 	 * entry contains a pointer to the VSP DT node and a bitmask of the
+ 	 * connected DU CRTCs.
+ 	 */
+-	cells = of_property_count_u32_elems(np, "vsps") / rcdu->num_crtcs - 1;
++	ret = of_property_count_u32_elems(np, vsps_prop_name);
++	if (ret < 0) {
++		/* Backward compatibility with old DTBs. */
++		vsps_prop_name = "vsps";
++		ret = of_property_count_u32_elems(np, vsps_prop_name);
++	}
++	cells = ret / rcdu->num_crtcs - 1;
+ 	if (cells > 1)
+ 		return -EINVAL;
+ 
+ 	for (i = 0; i < rcdu->num_crtcs; ++i) {
+ 		unsigned int j;
+ 
+-		ret = of_parse_phandle_with_fixed_args(np, "vsps", cells, i,
+-						       &args);
++		ret = of_parse_phandle_with_fixed_args(np, vsps_prop_name,
++						       cells, i, &args);
+ 		if (ret < 0)
+ 			goto error;
+ 
+@@ -587,8 +594,8 @@ static int rcar_du_vsps_init(struct rcar_du_device *rcdu)
+ 
+ 		/*
+ 		 * Store the VSP pointer and pipe index in the CRTC. If the
+-		 * second cell of the 'vsps' specifier isn't present, default
+-		 * to 0 to remain compatible with older DT bindings.
++		 * second cell of the 'renesas,vsps' specifier isn't present,
++		 * default to 0 to remain compatible with older DT bindings.
+ 		 */
+ 		rcdu->crtcs[i].vsp = &rcdu->vsps[j];
+ 		rcdu->crtcs[i].vsp_pipe = cells >= 1 ? args.args[0] : 0;
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-remove-the-newline-for-crc-source-name.patch b/queue-5.5/drm-remove-the-newline-for-crc-source-name.patch
new file mode 100644
index 00000000000..c22c2a97763
--- /dev/null
+++ b/queue-5.5/drm-remove-the-newline-for-crc-source-name.patch
@@ -0,0 +1,48 @@
+From 57d1d0196bc0cf1466b11a32247cd3f4138ac1ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jun 2019 09:47:51 -0400
+Subject: drm: remove the newline for CRC source name.
+
+From: Dingchen Zhang <dingchen.zhang@amd.com>
+
+[ Upstream commit 72a848f5c46bab4c921edc9cbffd1ab273b2be17 ]
+
+userspace may transfer a newline, and this terminating newline
+is replaced by a '\0' to avoid followup issues.
+
+'len-1' is the index to replace the newline of CRC source name.
+
+v3: typo fix (Sam)
+
+v2: update patch subject, body and format. (Sam)
+
+Cc: Leo Li <sunpeng.li@amd.com>
+Cc: Harry Wentland <Harry.Wentland@amd.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Dingchen Zhang <dingchen.zhang@amd.com>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190610134751.14356-1-dingchen.zhang@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_debugfs_crc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_debugfs_crc.c b/drivers/gpu/drm/drm_debugfs_crc.c
+index ca3c55c6b8155..2ece2957da1af 100644
+--- a/drivers/gpu/drm/drm_debugfs_crc.c
++++ b/drivers/gpu/drm/drm_debugfs_crc.c
+@@ -140,8 +140,8 @@ static ssize_t crc_control_write(struct file *file, const char __user *ubuf,
+ 	if (IS_ERR(source))
+ 		return PTR_ERR(source);
+ 
+-	if (source[len] == '\n')
+-		source[len] = '\0';
++	if (source[len - 1] == '\n')
++		source[len - 1] = '\0';
+ 
+ 	ret = crtc->funcs->verify_crc_source(crtc, source, &values_cnt);
+ 	if (ret)
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-virtio-fix-byteorder-handling-in-virtio_gpu_cmd_.patch b/queue-5.5/drm-virtio-fix-byteorder-handling-in-virtio_gpu_cmd_.patch
new file mode 100644
index 00000000000..8314dd0003e
--- /dev/null
+++ b/queue-5.5/drm-virtio-fix-byteorder-handling-in-virtio_gpu_cmd_.patch
@@ -0,0 +1,194 @@
+From 5dbab7c5970d14fd55c66a7a9fee0bf73d47ab6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 08:25:37 +0200
+Subject: drm/virtio: fix byteorder handling in virtio_gpu_cmd_transfer_{from,
+ to}_host_3d functions
+
+From: Gerd Hoffmann <kraxel@redhat.com>
+
+[ Upstream commit 1dc3485247170d3b88a21cadee7f7da1f0433495 ]
+
+Be consistent with the rest of the code base.
+No functional change.
+
+v2:
+ - fix sparse warnings for virtio_gpu_cmd_transfer_to_host_2d call.
+ - move convert_to_hw_box helper function.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Gurchetan Singh <gurchetansingh@chromium.org>
+Link: http://patchwork.freedesktop.org/patch/msgid/20191023062539.11728-2-kraxel@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_drv.h   |  5 +++--
+ drivers/gpu/drm/virtio/virtgpu_ioctl.c | 22 +++-------------------
+ drivers/gpu/drm/virtio/virtgpu_vq.c    | 19 +++++++++++++++----
+ 3 files changed, 21 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
+index 0b56ba005e253..eedae2a7b532d 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
++++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
+@@ -38,6 +38,7 @@
+ #include <drm/drm_gem_shmem_helper.h>
+ #include <drm/drm_ioctl.h>
+ #include <drm/drm_probe_helper.h>
++#include <drm/virtgpu_drm.h>
+ 
+ #define DRIVER_NAME "virtio_gpu"
+ #define DRIVER_DESC "virtio GPU"
+@@ -312,13 +313,13 @@ void virtio_gpu_cmd_submit(struct virtio_gpu_device *vgdev,
+ void virtio_gpu_cmd_transfer_from_host_3d(struct virtio_gpu_device *vgdev,
+ 					  uint32_t ctx_id,
+ 					  uint64_t offset, uint32_t level,
+-					  struct virtio_gpu_box *box,
++					  struct drm_virtgpu_3d_box *box,
+ 					  struct virtio_gpu_object_array *objs,
+ 					  struct virtio_gpu_fence *fence);
+ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev,
+ 					uint32_t ctx_id,
+ 					uint64_t offset, uint32_t level,
+-					struct virtio_gpu_box *box,
++					struct drm_virtgpu_3d_box *box,
+ 					struct virtio_gpu_object_array *objs,
+ 					struct virtio_gpu_fence *fence);
+ void
+diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+index 9af1ec62434f2..205ec4abae2b9 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+@@ -33,17 +33,6 @@
+ 
+ #include "virtgpu_drv.h"
+ 
+-static void convert_to_hw_box(struct virtio_gpu_box *dst,
+-			      const struct drm_virtgpu_3d_box *src)
+-{
+-	dst->x = cpu_to_le32(src->x);
+-	dst->y = cpu_to_le32(src->y);
+-	dst->z = cpu_to_le32(src->z);
+-	dst->w = cpu_to_le32(src->w);
+-	dst->h = cpu_to_le32(src->h);
+-	dst->d = cpu_to_le32(src->d);
+-}
+-
+ static int virtio_gpu_map_ioctl(struct drm_device *dev, void *data,
+ 				struct drm_file *file_priv)
+ {
+@@ -304,7 +293,6 @@ static int virtio_gpu_transfer_from_host_ioctl(struct drm_device *dev,
+ 	struct virtio_gpu_fence *fence;
+ 	int ret;
+ 	u32 offset = args->offset;
+-	struct virtio_gpu_box box;
+ 
+ 	if (vgdev->has_virgl_3d == false)
+ 		return -ENOSYS;
+@@ -317,8 +305,6 @@ static int virtio_gpu_transfer_from_host_ioctl(struct drm_device *dev,
+ 	if (ret != 0)
+ 		goto err_put_free;
+ 
+-	convert_to_hw_box(&box, &args->box);
+-
+ 	fence = virtio_gpu_fence_alloc(vgdev);
+ 	if (!fence) {
+ 		ret = -ENOMEM;
+@@ -326,7 +312,7 @@ static int virtio_gpu_transfer_from_host_ioctl(struct drm_device *dev,
+ 	}
+ 	virtio_gpu_cmd_transfer_from_host_3d
+ 		(vgdev, vfpriv->ctx_id, offset, args->level,
+-		 &box, objs, fence);
++		 &args->box, objs, fence);
+ 	dma_fence_put(&fence->f);
+ 	return 0;
+ 
+@@ -345,7 +331,6 @@ static int virtio_gpu_transfer_to_host_ioctl(struct drm_device *dev, void *data,
+ 	struct drm_virtgpu_3d_transfer_to_host *args = data;
+ 	struct virtio_gpu_object_array *objs;
+ 	struct virtio_gpu_fence *fence;
+-	struct virtio_gpu_box box;
+ 	int ret;
+ 	u32 offset = args->offset;
+ 
+@@ -353,11 +338,10 @@ static int virtio_gpu_transfer_to_host_ioctl(struct drm_device *dev, void *data,
+ 	if (objs == NULL)
+ 		return -ENOENT;
+ 
+-	convert_to_hw_box(&box, &args->box);
+ 	if (!vgdev->has_virgl_3d) {
+ 		virtio_gpu_cmd_transfer_to_host_2d
+ 			(vgdev, offset,
+-			 box.w, box.h, box.x, box.y,
++			 args->box.w, args->box.h, args->box.x, args->box.y,
+ 			 objs, NULL);
+ 	} else {
+ 		ret = virtio_gpu_array_lock_resv(objs);
+@@ -372,7 +356,7 @@ static int virtio_gpu_transfer_to_host_ioctl(struct drm_device *dev, void *data,
+ 		virtio_gpu_cmd_transfer_to_host_3d
+ 			(vgdev,
+ 			 vfpriv ? vfpriv->ctx_id : 0, offset,
+-			 args->level, &box, objs, fence);
++			 args->level, &args->box, objs, fence);
+ 		dma_fence_put(&fence->f);
+ 	}
+ 	return 0;
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index 74ad3bc3ebe83..9274c4063c701 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -40,6 +40,17 @@
+ 			       + MAX_INLINE_CMD_SIZE		 \
+ 			       + MAX_INLINE_RESP_SIZE)
+ 
++static void convert_to_hw_box(struct virtio_gpu_box *dst,
++			      const struct drm_virtgpu_3d_box *src)
++{
++	dst->x = cpu_to_le32(src->x);
++	dst->y = cpu_to_le32(src->y);
++	dst->z = cpu_to_le32(src->z);
++	dst->w = cpu_to_le32(src->w);
++	dst->h = cpu_to_le32(src->h);
++	dst->d = cpu_to_le32(src->d);
++}
++
+ void virtio_gpu_ctrl_ack(struct virtqueue *vq)
+ {
+ 	struct drm_device *dev = vq->vdev->priv;
+@@ -965,7 +976,7 @@ virtio_gpu_cmd_resource_create_3d(struct virtio_gpu_device *vgdev,
+ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev,
+ 					uint32_t ctx_id,
+ 					uint64_t offset, uint32_t level,
+-					struct virtio_gpu_box *box,
++					struct drm_virtgpu_3d_box *box,
+ 					struct virtio_gpu_object_array *objs,
+ 					struct virtio_gpu_fence *fence)
+ {
+@@ -987,7 +998,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev,
+ 	cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_TRANSFER_TO_HOST_3D);
+ 	cmd_p->hdr.ctx_id = cpu_to_le32(ctx_id);
+ 	cmd_p->resource_id = cpu_to_le32(bo->hw_res_handle);
+-	cmd_p->box = *box;
++	convert_to_hw_box(&cmd_p->box, box);
+ 	cmd_p->offset = cpu_to_le64(offset);
+ 	cmd_p->level = cpu_to_le32(level);
+ 
+@@ -997,7 +1008,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev,
+ void virtio_gpu_cmd_transfer_from_host_3d(struct virtio_gpu_device *vgdev,
+ 					  uint32_t ctx_id,
+ 					  uint64_t offset, uint32_t level,
+-					  struct virtio_gpu_box *box,
++					  struct drm_virtgpu_3d_box *box,
+ 					  struct virtio_gpu_object_array *objs,
+ 					  struct virtio_gpu_fence *fence)
+ {
+@@ -1013,7 +1024,7 @@ void virtio_gpu_cmd_transfer_from_host_3d(struct virtio_gpu_device *vgdev,
+ 	cmd_p->hdr.type = cpu_to_le32(VIRTIO_GPU_CMD_TRANSFER_FROM_HOST_3D);
+ 	cmd_p->hdr.ctx_id = cpu_to_le32(ctx_id);
+ 	cmd_p->resource_id = cpu_to_le32(bo->hw_res_handle);
+-	cmd_p->box = *box;
++	convert_to_hw_box(&cmd_p->box, box);
+ 	cmd_p->offset = cpu_to_le64(offset);
+ 	cmd_p->level = cpu_to_le32(level);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/drm-vmwgfx-prevent-memory-leak-in-vmw_cmdbuf_res_add.patch b/queue-5.5/drm-vmwgfx-prevent-memory-leak-in-vmw_cmdbuf_res_add.patch
new file mode 100644
index 00000000000..d76f8f382ec
--- /dev/null
+++ b/queue-5.5/drm-vmwgfx-prevent-memory-leak-in-vmw_cmdbuf_res_add.patch
@@ -0,0 +1,40 @@
+From ec30ecc54b9737671aac3acefef94849b9b17bf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 23:37:58 -0500
+Subject: drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 40efb09a7f53125719e49864da008495e39aaa1e ]
+
+In vmw_cmdbuf_res_add if drm_ht_insert_item fails the allocated memory
+for cres should be released.
+
+Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+index 4ac55fc2bf970..44d858ce4ce7f 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+@@ -209,8 +209,10 @@ int vmw_cmdbuf_res_add(struct vmw_cmdbuf_res_manager *man,
+ 
+ 	cres->hash.key = user_key | (res_type << 24);
+ 	ret = drm_ht_insert_item(&man->resources, &cres->hash);
+-	if (unlikely(ret != 0))
++	if (unlikely(ret != 0)) {
++		kfree(cres);
+ 		goto out_invalid_key;
++	}
+ 
+ 	cres->state = VMW_CMDBUF_RES_ADD;
+ 	cres->res = vmw_resource_reference(res);
+-- 
+2.20.1
+
diff --git a/queue-5.5/edac-sifive-fix-return-value-check-in-ecc_register.patch b/queue-5.5/edac-sifive-fix-return-value-check-in-ecc_register.patch
new file mode 100644
index 00000000000..ac4e24bc081
--- /dev/null
+++ b/queue-5.5/edac-sifive-fix-return-value-check-in-ecc_register.patch
@@ -0,0 +1,40 @@
+From 2f1b0bfe785cb3df629302ed46c388c98f300230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 15:03:03 +0000
+Subject: EDAC/sifive: Fix return value check in ecc_register()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 6cd18453b68942913fd3b1913b707646e544c2ac ]
+
+In case of error, the function edac_device_alloc_ctl_info() returns a
+NULL pointer, not ERR_PTR(). Replace the IS_ERR() test in the return
+value check with a NULL test.
+
+Fixes: 91abaeaaff35 ("EDAC/sifive: Add EDAC platform driver for SiFive SoCs")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20200115150303.112627-1-weiyongjun1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/sifive_edac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/sifive_edac.c b/drivers/edac/sifive_edac.c
+index c0cc72a3b2be9..3a3dcb14ed99d 100644
+--- a/drivers/edac/sifive_edac.c
++++ b/drivers/edac/sifive_edac.c
+@@ -54,8 +54,8 @@ static int ecc_register(struct platform_device *pdev)
+ 	p->dci = edac_device_alloc_ctl_info(0, "sifive_ecc", 1, "sifive_ecc",
+ 					    1, 1, NULL, 0,
+ 					    edac_device_alloc_index());
+-	if (IS_ERR(p->dci))
+-		return PTR_ERR(p->dci);
++	if (!p->dci)
++		return -ENOMEM;
+ 
+ 	p->dci->dev = &pdev->dev;
+ 	p->dci->mod_name = "Sifive ECC Manager";
+-- 
+2.20.1
+
diff --git a/queue-5.5/efi-arm-defer-probe-of-pcie-backed-efifb-on-dt-syste.patch b/queue-5.5/efi-arm-defer-probe-of-pcie-backed-efifb-on-dt-syste.patch
new file mode 100644
index 00000000000..d149bd304d2
--- /dev/null
+++ b/queue-5.5/efi-arm-defer-probe-of-pcie-backed-efifb-on-dt-syste.patch
@@ -0,0 +1,168 @@
+From 1ad36ac6ec04fdfcb23bf4125a599f77d41f30a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 18:22:40 +0100
+Subject: efi/arm: Defer probe of PCIe backed efifb on DT systems
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 64c8a0cd0a535891d5905c3a1651150f0f141439 ]
+
+The new of_devlink support breaks PCIe probing on ARM platforms booting
+via UEFI if the firmware exposes a EFI framebuffer that is backed by a
+PCI device. The reason is that the probing order gets reversed,
+resulting in a resource conflict on the framebuffer memory window when
+the PCIe probes last, causing it to give up entirely.
+
+Given that we rely on PCI quirks to deal with EFI framebuffers that get
+moved around in memory, we cannot simply drop the memory reservation, so
+instead, let's use the device link infrastructure to register this
+dependency, and force the probing to occur in the expected order.
+
+Co-developed-by: Saravana Kannan <saravanak@google.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20200113172245.27925-9-ardb@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/arm-init.c | 107 ++++++++++++++++++++++++++++++--
+ 1 file changed, 103 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
+index 904fa09e6a6b0..d99f5b0c8a090 100644
+--- a/drivers/firmware/efi/arm-init.c
++++ b/drivers/firmware/efi/arm-init.c
+@@ -10,10 +10,12 @@
+ #define pr_fmt(fmt)	"efi: " fmt
+ 
+ #include <linux/efi.h>
++#include <linux/fwnode.h>
+ #include <linux/init.h>
+ #include <linux/memblock.h>
+ #include <linux/mm_types.h>
+ #include <linux/of.h>
++#include <linux/of_address.h>
+ #include <linux/of_fdt.h>
+ #include <linux/platform_device.h>
+ #include <linux/screen_info.h>
+@@ -276,15 +278,112 @@ void __init efi_init(void)
+ 		efi_memmap_unmap();
+ }
+ 
++static bool efifb_overlaps_pci_range(const struct of_pci_range *range)
++{
++	u64 fb_base = screen_info.lfb_base;
++
++	if (screen_info.capabilities & VIDEO_CAPABILITY_64BIT_BASE)
++		fb_base |= (u64)(unsigned long)screen_info.ext_lfb_base << 32;
++
++	return fb_base >= range->cpu_addr &&
++	       fb_base < (range->cpu_addr + range->size);
++}
++
++static struct device_node *find_pci_overlap_node(void)
++{
++	struct device_node *np;
++
++	for_each_node_by_type(np, "pci") {
++		struct of_pci_range_parser parser;
++		struct of_pci_range range;
++		int err;
++
++		err = of_pci_range_parser_init(&parser, np);
++		if (err) {
++			pr_warn("of_pci_range_parser_init() failed: %d\n", err);
++			continue;
++		}
++
++		for_each_of_pci_range(&parser, &range)
++			if (efifb_overlaps_pci_range(&range))
++				return np;
++	}
++	return NULL;
++}
++
++/*
++ * If the efifb framebuffer is backed by a PCI graphics controller, we have
++ * to ensure that this relation is expressed using a device link when
++ * running in DT mode, or the probe order may be reversed, resulting in a
++ * resource reservation conflict on the memory window that the efifb
++ * framebuffer steals from the PCIe host bridge.
++ */
++static int efifb_add_links(const struct fwnode_handle *fwnode,
++			   struct device *dev)
++{
++	struct device_node *sup_np;
++	struct device *sup_dev;
++
++	sup_np = find_pci_overlap_node();
++
++	/*
++	 * If there's no PCI graphics controller backing the efifb, we are
++	 * done here.
++	 */
++	if (!sup_np)
++		return 0;
++
++	sup_dev = get_dev_from_fwnode(&sup_np->fwnode);
++	of_node_put(sup_np);
++
++	/*
++	 * Return -ENODEV if the PCI graphics controller device hasn't been
++	 * registered yet.  This ensures that efifb isn't allowed to probe
++	 * and this function is retried again when new devices are
++	 * registered.
++	 */
++	if (!sup_dev)
++		return -ENODEV;
++
++	/*
++	 * If this fails, retrying this function at a later point won't
++	 * change anything. So, don't return an error after this.
++	 */
++	if (!device_link_add(dev, sup_dev, 0))
++		dev_warn(dev, "device_link_add() failed\n");
++
++	put_device(sup_dev);
++
++	return 0;
++}
++
++static const struct fwnode_operations efifb_fwnode_ops = {
++	.add_links = efifb_add_links,
++};
++
++static struct fwnode_handle efifb_fwnode = {
++	.ops = &efifb_fwnode_ops,
++};
++
+ static int __init register_gop_device(void)
+ {
+-	void *pd;
++	struct platform_device *pd;
++	int err;
+ 
+ 	if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI)
+ 		return 0;
+ 
+-	pd = platform_device_register_data(NULL, "efi-framebuffer", 0,
+-					   &screen_info, sizeof(screen_info));
+-	return PTR_ERR_OR_ZERO(pd);
++	pd = platform_device_alloc("efi-framebuffer", 0);
++	if (!pd)
++		return -ENOMEM;
++
++	if (IS_ENABLED(CONFIG_PCI))
++		pd->dev.fwnode = &efifb_fwnode;
++
++	err = platform_device_add_data(pd, &screen_info, sizeof(screen_info));
++	if (err)
++		return err;
++
++	return platform_device_add(pd);
+ }
+ subsys_initcall(register_gop_device);
+-- 
+2.20.1
+
diff --git a/queue-5.5/efi-x86-don-t-panic-or-bug-on-non-critical-error-con.patch b/queue-5.5/efi-x86-don-t-panic-or-bug-on-non-critical-error-con.patch
new file mode 100644
index 00000000000..b0462d3225c
--- /dev/null
+++ b/queue-5.5/efi-x86-don-t-panic-or-bug-on-non-critical-error-con.patch
@@ -0,0 +1,131 @@
+From 5913adada52d2fccfedf07d1a882ea3564e403ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 12:39:46 +0100
+Subject: efi/x86: Don't panic or BUG() on non-critical error conditions
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit e2d68a955e49d61fd0384f23e92058dc9b79be5e ]
+
+The logic in __efi_enter_virtual_mode() does a number of steps in
+sequence, all of which may fail in one way or the other. In most
+cases, we simply print an error and disable EFI runtime services
+support, but in some cases, we BUG() or panic() and bring down the
+system when encountering conditions that we could easily handle in
+the same way.
+
+While at it, replace a pointless page-to-virt-phys conversion with
+one that goes straight from struct page to physical.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Arvind Sankar <nivedita@alum.mit.edu>
+Cc: Matthew Garrett <mjg59@google.com>
+Cc: linux-efi@vger.kernel.org
+Link: https://lkml.kernel.org/r/20200103113953.9571-14-ardb@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/efi/efi.c    | 28 ++++++++++++++--------------
+ arch/x86/platform/efi/efi_64.c |  9 +++++----
+ 2 files changed, 19 insertions(+), 18 deletions(-)
+
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 06f69bcd233fe..ad4dd3a977533 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -1000,16 +1000,14 @@ static void __init __efi_enter_virtual_mode(void)
+ 
+ 	if (efi_alloc_page_tables()) {
+ 		pr_err("Failed to allocate EFI page tables\n");
+-		clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+-		return;
++		goto err;
+ 	}
+ 
+ 	efi_merge_regions();
+ 	new_memmap = efi_map_regions(&count, &pg_shift);
+ 	if (!new_memmap) {
+ 		pr_err("Error reallocating memory, EFI runtime non-functional!\n");
+-		clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+-		return;
++		goto err;
+ 	}
+ 
+ 	pa = __pa(new_memmap);
+@@ -1023,8 +1021,7 @@ static void __init __efi_enter_virtual_mode(void)
+ 
+ 	if (efi_memmap_init_late(pa, efi.memmap.desc_size * count)) {
+ 		pr_err("Failed to remap late EFI memory map\n");
+-		clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+-		return;
++		goto err;
+ 	}
+ 
+ 	if (efi_enabled(EFI_DBG)) {
+@@ -1032,12 +1029,11 @@ static void __init __efi_enter_virtual_mode(void)
+ 		efi_print_memmap();
+ 	}
+ 
+-	BUG_ON(!efi.systab);
++	if (WARN_ON(!efi.systab))
++		goto err;
+ 
+-	if (efi_setup_page_tables(pa, 1 << pg_shift)) {
+-		clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+-		return;
+-	}
++	if (efi_setup_page_tables(pa, 1 << pg_shift))
++		goto err;
+ 
+ 	efi_sync_low_kernel_mappings();
+ 
+@@ -1057,9 +1053,9 @@ static void __init __efi_enter_virtual_mode(void)
+ 	}
+ 
+ 	if (status != EFI_SUCCESS) {
+-		pr_alert("Unable to switch EFI into virtual mode (status=%lx)!\n",
+-			 status);
+-		panic("EFI call to SetVirtualAddressMap() failed!");
++		pr_err("Unable to switch EFI into virtual mode (status=%lx)!\n",
++		       status);
++		goto err;
+ 	}
+ 
+ 	efi_free_boot_services();
+@@ -1088,6 +1084,10 @@ static void __init __efi_enter_virtual_mode(void)
+ 
+ 	/* clean DUMMY object */
+ 	efi_delete_dummy_variable();
++	return;
++
++err:
++	clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+ }
+ 
+ void __init efi_enter_virtual_mode(void)
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index 08ce8177c3af1..52a1e5192fa80 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -392,11 +392,12 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
+ 		return 0;
+ 
+ 	page = alloc_page(GFP_KERNEL|__GFP_DMA32);
+-	if (!page)
+-		panic("Unable to allocate EFI runtime stack < 4GB\n");
++	if (!page) {
++		pr_err("Unable to allocate EFI runtime stack < 4GB\n");
++		return 1;
++	}
+ 
+-	efi_scratch.phys_stack = virt_to_phys(page_address(page));
+-	efi_scratch.phys_stack += PAGE_SIZE; /* stack grows down */
++	efi_scratch.phys_stack = page_to_phys(page + 1); /* stack grows down */
+ 
+ 	npages = (_etext - _text) >> PAGE_SHIFT;
+ 	text = __pa(_text);
+-- 
+2.20.1
+
diff --git a/queue-5.5/efi-x86-map-the-entire-efi-vendor-string-before-copy.patch b/queue-5.5/efi-x86-map-the-entire-efi-vendor-string-before-copy.patch
new file mode 100644
index 00000000000..3f7e8d1b831
--- /dev/null
+++ b/queue-5.5/efi-x86-map-the-entire-efi-vendor-string-before-copy.patch
@@ -0,0 +1,69 @@
+From a656a67453c9e15cc2127ce4137fca1b786a07a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 12:39:37 +0100
+Subject: efi/x86: Map the entire EFI vendor string before copying it
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit ffc2760bcf2dba0dbef74013ed73eea8310cc52c ]
+
+Fix a couple of issues with the way we map and copy the vendor string:
+- we map only 2 bytes, which usually works since you get at least a
+  page, but if the vendor string happens to cross a page boundary,
+  a crash will result
+- only call early_memunmap() if early_memremap() succeeded, or we will
+  call it with a NULL address which it doesn't like,
+- while at it, switch to early_memremap_ro(), and array indexing rather
+  than pointer dereferencing to read the CHAR16 characters.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Arvind Sankar <nivedita@alum.mit.edu>
+Cc: Matthew Garrett <mjg59@google.com>
+Cc: linux-efi@vger.kernel.org
+Fixes: 5b83683f32b1 ("x86: EFI runtime service support")
+Link: https://lkml.kernel.org/r/20200103113953.9571-5-ardb@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/efi/efi.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 38d44f36d5ede..06f69bcd233fe 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -541,7 +541,6 @@ void __init efi_init(void)
+ 	efi_char16_t *c16;
+ 	char vendor[100] = "unknown";
+ 	int i = 0;
+-	void *tmp;
+ 
+ #ifdef CONFIG_X86_32
+ 	if (boot_params.efi_info.efi_systab_hi ||
+@@ -566,14 +565,16 @@ void __init efi_init(void)
+ 	/*
+ 	 * Show what we know for posterity
+ 	 */
+-	c16 = tmp = early_memremap(efi.systab->fw_vendor, 2);
++	c16 = early_memremap_ro(efi.systab->fw_vendor,
++				sizeof(vendor) * sizeof(efi_char16_t));
+ 	if (c16) {
+-		for (i = 0; i < sizeof(vendor) - 1 && *c16; ++i)
+-			vendor[i] = *c16++;
++		for (i = 0; i < sizeof(vendor) - 1 && c16[i]; ++i)
++			vendor[i] = c16[i];
+ 		vendor[i] = '\0';
+-	} else
++		early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
++	} else {
+ 		pr_err("Could not map the firmware vendor!\n");
+-	early_memunmap(tmp, 2);
++	}
+ 
+ 	pr_info("EFI v%u.%.02u by %s\n",
+ 		efi.systab->hdr.revision >> 16,
+-- 
+2.20.1
+
diff --git a/queue-5.5/enetc-don-t-print-from-enetc_sched_speed_set-when-li.patch b/queue-5.5/enetc-don-t-print-from-enetc_sched_speed_set-when-li.patch
new file mode 100644
index 00000000000..aa3d14bba60
--- /dev/null
+++ b/queue-5.5/enetc-don-t-print-from-enetc_sched_speed_set-when-li.patch
@@ -0,0 +1,40 @@
+From 2a3356035ecc24ecafea9488c8897bc36bdcc9b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 19:18:28 +0200
+Subject: enetc: Don't print from enetc_sched_speed_set when link goes down
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 90f29f0eada4d60e1f6ae537502ddb2202b9540d ]
+
+It is not an error to unplug a cable from the ENETC port even with TSN
+offloads, so don't spam the log with link-related messages from the
+tc-taprio offload subsystem, a single notification is sufficient:
+
+[10972.351859] fsl_enetc 0000:00:00.0 eno0: Qbv PSPEED set speed link down.
+[10972.360241] fsl_enetc 0000:00:00.0 eno0: Link is Down
+
+Fixes: 2e47cb415f0a ("enetc: update TSN Qbv PSPEED set according to adjust link speed")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_qos.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+index 9190ffc9f6b21..de52686b1d467 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+@@ -36,7 +36,6 @@ void enetc_sched_speed_set(struct net_device *ndev)
+ 	case SPEED_10:
+ 	default:
+ 		pspeed = ENETC_PMR_PSPEED_10M;
+-		netdev_err(ndev, "Qbv PSPEED set speed link down.\n");
+ 	}
+ 
+ 	priv->speed = speed;
+-- 
+2.20.1
+
diff --git a/queue-5.5/enetc-remove-variable-tc_max_sized_frame-set-but-not.patch b/queue-5.5/enetc-remove-variable-tc_max_sized_frame-set-but-not.patch
new file mode 100644
index 00000000000..aad180787ee
--- /dev/null
+++ b/queue-5.5/enetc-remove-variable-tc_max_sized_frame-set-but-not.patch
@@ -0,0 +1,46 @@
+From 55d7e4ae696c4a9f679e798e1dba8b47803a1e6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 18:24:50 +0800
+Subject: enetc: remove variable 'tc_max_sized_frame' set but not used
+
+From: Chen Wandun <chenwandun@huawei.com>
+
+[ Upstream commit 6525b5ef65fdaf8a782449fb5d585195b573c2c1 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/net/ethernet/freescale/enetc/enetc_qos.c: In function enetc_setup_tc_cbs:
+drivers/net/ethernet/freescale/enetc/enetc_qos.c:195:6: warning: variable tc_max_sized_frame set but not used [-Wunused-but-set-variable]
+
+Fixes: c431047c4efe ("enetc: add support Credit Based Shaper(CBS) for hardware offload")
+Signed-off-by: Chen Wandun <chenwandun@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_qos.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+index 2e99438cb1bf3..9190ffc9f6b21 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+@@ -192,7 +192,6 @@ int enetc_setup_tc_cbs(struct net_device *ndev, void *type_data)
+ 	u32 hi_credit_bit, hi_credit_reg;
+ 	u32 max_interference_size;
+ 	u32 port_frame_max_size;
+-	u32 tc_max_sized_frame;
+ 	u8 tc = cbs->queue;
+ 	u8 prio_top, prio_next;
+ 	int bw_sum = 0;
+@@ -250,7 +249,7 @@ int enetc_setup_tc_cbs(struct net_device *ndev, void *type_data)
+ 		return -EINVAL;
+ 	}
+ 
+-	tc_max_sized_frame = enetc_port_rd(&si->hw, ENETC_PTCMSDUR(tc));
++	enetc_port_rd(&si->hw, ENETC_PTCMSDUR(tc));
+ 
+ 	/* For top prio TC, the max_interfrence_size is maxSizedFrame.
+ 	 *
+-- 
+2.20.1
+
diff --git a/queue-5.5/ext4-fix-deadlock-allocating-bio_post_read_ctx-from-.patch b/queue-5.5/ext4-fix-deadlock-allocating-bio_post_read_ctx-from-.patch
new file mode 100644
index 00000000000..37878d9ecf0
--- /dev/null
+++ b/queue-5.5/ext4-fix-deadlock-allocating-bio_post_read_ctx-from-.patch
@@ -0,0 +1,81 @@
+From 1b60c2e35bd1034e8787fc9b4c9dfd3f2e3d1d6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Dec 2019 12:12:22 -0600
+Subject: ext4: fix deadlock allocating bio_post_read_ctx from mempool
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 68e45330e341dad2d3a0a3f8ef2ec46a2a0a3bbc ]
+
+Without any form of coordination, any case where multiple allocations
+from the same mempool are needed at a time to make forward progress can
+deadlock under memory pressure.
+
+This is the case for struct bio_post_read_ctx, as one can be allocated
+to decrypt a Merkle tree page during fsverity_verify_bio(), which itself
+is running from a post-read callback for a data bio which has its own
+struct bio_post_read_ctx.
+
+Fix this by freeing the first bio_post_read_ctx before calling
+fsverity_verify_bio().  This works because verity (if enabled) is always
+the last post-read step.
+
+This deadlock can be reproduced by trying to read from an encrypted
+verity file after reducing NUM_PREALLOC_POST_READ_CTXS to 1 and patching
+mempool_alloc() to pretend that pool->alloc() always fails.
+
+Note that since NUM_PREALLOC_POST_READ_CTXS is actually 128, to actually
+hit this bug in practice would require reading from lots of encrypted
+verity files at the same time.  But it's theoretically possible, as N
+available objects isn't enough to guarantee forward progress when > N/2
+threads each need 2 objects at a time.
+
+Fixes: 22cfe4b48ccb ("ext4: add fs-verity read support")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Link: https://lore.kernel.org/r/20191231181222.47684-1-ebiggers@kernel.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/readpage.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ext4/readpage.c b/fs/ext4/readpage.c
+index fef7755300c35..410c904cf59b9 100644
+--- a/fs/ext4/readpage.c
++++ b/fs/ext4/readpage.c
+@@ -57,6 +57,7 @@ enum bio_post_read_step {
+ 	STEP_INITIAL = 0,
+ 	STEP_DECRYPT,
+ 	STEP_VERITY,
++	STEP_MAX,
+ };
+ 
+ struct bio_post_read_ctx {
+@@ -106,10 +107,22 @@ static void verity_work(struct work_struct *work)
+ {
+ 	struct bio_post_read_ctx *ctx =
+ 		container_of(work, struct bio_post_read_ctx, work);
++	struct bio *bio = ctx->bio;
+ 
+-	fsverity_verify_bio(ctx->bio);
++	/*
++	 * fsverity_verify_bio() may call readpages() again, and although verity
++	 * will be disabled for that, decryption may still be needed, causing
++	 * another bio_post_read_ctx to be allocated.  So to guarantee that
++	 * mempool_alloc() never deadlocks we must free the current ctx first.
++	 * This is safe because verity is the last post-read step.
++	 */
++	BUILD_BUG_ON(STEP_VERITY + 1 != STEP_MAX);
++	mempool_free(ctx, bio_post_read_ctx_pool);
++	bio->bi_private = NULL;
+ 
+-	bio_post_read_processing(ctx);
++	fsverity_verify_bio(bio);
++
++	__read_end_io(bio);
+ }
+ 
+ static void bio_post_read_processing(struct bio_post_read_ctx *ctx)
+-- 
+2.20.1
+
diff --git a/queue-5.5/ext4-fix-ext4_dax_read-write-inode-locking-sequence-.patch b/queue-5.5/ext4-fix-ext4_dax_read-write-inode-locking-sequence-.patch
new file mode 100644
index 00000000000..aec174069cf
--- /dev/null
+++ b/queue-5.5/ext4-fix-ext4_dax_read-write-inode-locking-sequence-.patch
@@ -0,0 +1,59 @@
+From 20e3c99927ff54a4a416ebd6be8d81a5a8ad4399 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:25:55 +0530
+Subject: ext4: fix ext4_dax_read/write inode locking sequence for IOCB_NOWAIT
+
+From: Ritesh Harjani <riteshh@linux.ibm.com>
+
+[ Upstream commit f629afe3369e9885fd6e9cc7a4f514b6a65cf9e9 ]
+
+Apparently our current rwsem code doesn't like doing the trylock, then
+lock for real scheme.  So change our dax read/write methods to just do the
+trylock for the RWF_NOWAIT case.
+This seems to fix AIM7 regression in some scalable filesystems upto ~25%
+in some cases. Claimed in commit 942491c9e6d6 ("xfs: fix AIM7 regression")
+
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Matthew Bobrowski <mbobrowski@mbobrowski.org>
+Tested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Link: https://lore.kernel.org/r/20191212055557.11151-2-riteshh@linux.ibm.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/file.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 6a7293a5cda2d..977ac58dc718d 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -88,9 +88,10 @@ static ssize_t ext4_dax_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ 	struct inode *inode = file_inode(iocb->ki_filp);
+ 	ssize_t ret;
+ 
+-	if (!inode_trylock_shared(inode)) {
+-		if (iocb->ki_flags & IOCB_NOWAIT)
++	if (iocb->ki_flags & IOCB_NOWAIT) {
++		if (!inode_trylock_shared(inode))
+ 			return -EAGAIN;
++	} else {
+ 		inode_lock_shared(inode);
+ 	}
+ 	/*
+@@ -487,9 +488,10 @@ ext4_dax_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ 	bool extend = false;
+ 	struct inode *inode = file_inode(iocb->ki_filp);
+ 
+-	if (!inode_trylock(inode)) {
+-		if (iocb->ki_flags & IOCB_NOWAIT)
++	if (iocb->ki_flags & IOCB_NOWAIT) {
++		if (!inode_trylock(inode))
+ 			return -EAGAIN;
++	} else {
+ 		inode_lock(inode);
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/ext4-jbd2-ensure-panic-when-aborting-with-zero-errno.patch b/queue-5.5/ext4-jbd2-ensure-panic-when-aborting-with-zero-errno.patch
new file mode 100644
index 00000000000..f3a4fc1d7e8
--- /dev/null
+++ b/queue-5.5/ext4-jbd2-ensure-panic-when-aborting-with-zero-errno.patch
@@ -0,0 +1,76 @@
+From 511259b7e621ef9bc8d4099093671842bce7a1ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 20:46:12 +0800
+Subject: ext4, jbd2: ensure panic when aborting with zero errno
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+[ Upstream commit 51f57b01e4a3c7d7bdceffd84de35144e8c538e7 ]
+
+JBD2_REC_ERR flag used to indicate the errno has been updated when jbd2
+aborted, and then __ext4_abort() and ext4_handle_error() can invoke
+panic if ERRORS_PANIC is specified. But if the journal has been aborted
+with zero errno, jbd2_journal_abort() didn't set this flag so we can
+no longer panic. Fix this by always record the proper errno in the
+journal superblock.
+
+Fixes: 4327ba52afd03 ("ext4, jbd2: ensure entering into panic after recording an error in superblock")
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20191204124614.45424-3-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/checkpoint.c |  2 +-
+ fs/jbd2/journal.c    | 15 ++++-----------
+ 2 files changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
+index 8fff6677a5da4..96bf33986d030 100644
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -164,7 +164,7 @@ void __jbd2_log_wait_for_space(journal_t *journal)
+ 				       "journal space in %s\n", __func__,
+ 				       journal->j_devname);
+ 				WARN_ON(1);
+-				jbd2_journal_abort(journal, 0);
++				jbd2_journal_abort(journal, -EIO);
+ 			}
+ 			write_lock(&journal->j_state_lock);
+ 		} else {
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 6847b18455068..8479e84159675 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -2156,12 +2156,10 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+ 
+ 	__jbd2_journal_abort_hard(journal);
+ 
+-	if (errno) {
+-		jbd2_journal_update_sb_errno(journal);
+-		write_lock(&journal->j_state_lock);
+-		journal->j_flags |= JBD2_REC_ERR;
+-		write_unlock(&journal->j_state_lock);
+-	}
++	jbd2_journal_update_sb_errno(journal);
++	write_lock(&journal->j_state_lock);
++	journal->j_flags |= JBD2_REC_ERR;
++	write_unlock(&journal->j_state_lock);
+ }
+ 
+ /**
+@@ -2203,11 +2201,6 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+  * failure to disk.  ext3_error, for example, now uses this
+  * functionality.
+  *
+- * Errors which originate from within the journaling layer will NOT
+- * supply an errno; a null errno implies that absolutely no further
+- * writes are done to the journal (unless there are any already in
+- * progress).
+- *
+  */
+ 
+ void jbd2_journal_abort(journal_t *journal, int errno)
+-- 
+2.20.1
+
diff --git a/queue-5.5/f2fs-call-f2fs_balance_fs-outside-of-locked-page.patch b/queue-5.5/f2fs-call-f2fs_balance_fs-outside-of-locked-page.patch
new file mode 100644
index 00000000000..6d705a1930f
--- /dev/null
+++ b/queue-5.5/f2fs-call-f2fs_balance_fs-outside-of-locked-page.patch
@@ -0,0 +1,68 @@
+From 43a82c42c9c0ed698b6a42bfd8ddcd5c49a2223e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 15:53:16 -0800
+Subject: f2fs: call f2fs_balance_fs outside of locked page
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit bdf03299248916640a835a05d32841bb3d31912d ]
+
+Otherwise, we can hit deadlock by waiting for the locked page in
+move_data_block in GC.
+
+ Thread A                     Thread B
+ - do_page_mkwrite
+  - f2fs_vm_page_mkwrite
+   - lock_page
+                              - f2fs_balance_fs
+                                  - mutex_lock(gc_mutex)
+                               - f2fs_gc
+                                - do_garbage_collect
+                                 - ra_data_block
+                                  - grab_cache_page
+   - f2fs_balance_fs
+    - mutex_lock(gc_mutex)
+
+Fixes: 39a8695824510 ("f2fs: refactor ->page_mkwrite() flow")
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 33c412d178f0f..6c4436a5ce797 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -50,7 +50,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
+ 	struct page *page = vmf->page;
+ 	struct inode *inode = file_inode(vmf->vma->vm_file);
+ 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+-	struct dnode_of_data dn = { .node_changed = false };
++	struct dnode_of_data dn;
+ 	int err;
+ 
+ 	if (unlikely(f2fs_cp_error(sbi))) {
+@@ -63,6 +63,9 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
+ 		goto err;
+ 	}
+ 
++	/* should do out of any locked page */
++	f2fs_balance_fs(sbi, true);
++
+ 	sb_start_pagefault(inode->i_sb);
+ 
+ 	f2fs_bug_on(sbi, f2fs_has_inline_data(inode));
+@@ -120,8 +123,6 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
+ out_sem:
+ 	up_read(&F2FS_I(inode)->i_mmap_sem);
+ 
+-	f2fs_balance_fs(sbi, dn.node_changed);
+-
+ 	sb_end_pagefault(inode->i_sb);
+ err:
+ 	return block_page_mkwrite_return(err);
+-- 
+2.20.1
+
diff --git a/queue-5.5/f2fs-fix-memleak-of-kobject.patch b/queue-5.5/f2fs-fix-memleak-of-kobject.patch
new file mode 100644
index 00000000000..39d9903c0e8
--- /dev/null
+++ b/queue-5.5/f2fs-fix-memleak-of-kobject.patch
@@ -0,0 +1,54 @@
+From 9035e1ebd653f26854f66d0b68a6dc06dfed8848 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2019 17:41:41 +0800
+Subject: f2fs: fix memleak of kobject
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit fe396ad8e7526f059f7b8c7290d33a1b84adacab ]
+
+If kobject_init_and_add() failed, caller needs to invoke kobject_put()
+to release kobject explicitly.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/sysfs.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index 5963316f391a5..e79c86b8553a5 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -733,10 +733,12 @@ int __init f2fs_init_sysfs(void)
+ 
+ 	ret = kobject_init_and_add(&f2fs_feat, &f2fs_feat_ktype,
+ 				   NULL, "features");
+-	if (ret)
++	if (ret) {
++		kobject_put(&f2fs_feat);
+ 		kset_unregister(&f2fs_kset);
+-	else
++	} else {
+ 		f2fs_proc_root = proc_mkdir("fs/f2fs", NULL);
++	}
+ 	return ret;
+ }
+ 
+@@ -757,8 +759,11 @@ int f2fs_register_sysfs(struct f2fs_sb_info *sbi)
+ 	init_completion(&sbi->s_kobj_unregister);
+ 	err = kobject_init_and_add(&sbi->s_kobj, &f2fs_sb_ktype, NULL,
+ 				"%s", sb->s_id);
+-	if (err)
++	if (err) {
++		kobject_put(&sbi->s_kobj);
++		wait_for_completion(&sbi->s_kobj_unregister);
+ 		return err;
++	}
+ 
+ 	if (f2fs_proc_root)
+ 		sbi->s_proc = proc_mkdir(sb->s_id, f2fs_proc_root);
+-- 
+2.20.1
+
diff --git a/queue-5.5/f2fs-free-sysfs-kobject.patch b/queue-5.5/f2fs-free-sysfs-kobject.patch
new file mode 100644
index 00000000000..3b539c44e24
--- /dev/null
+++ b/queue-5.5/f2fs-free-sysfs-kobject.patch
@@ -0,0 +1,31 @@
+From 8cd43fd4cbea512730a806f945c9bd5fa5ff028a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 18:32:16 -0800
+Subject: f2fs: free sysfs kobject
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 820d366736c949ffe698d3b3fe1266a91da1766d ]
+
+Detected kmemleak.
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/sysfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index 70945ceb9c0ca..5963316f391a5 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -786,4 +786,5 @@ void f2fs_unregister_sysfs(struct f2fs_sb_info *sbi)
+ 		remove_proc_entry(sbi->sb->s_id, f2fs_proc_root);
+ 	}
+ 	kobject_del(&sbi->s_kobj);
++	kobject_put(&sbi->s_kobj);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/f2fs-preallocate-dio-blocks-when-forcing-buffered_io.patch b/queue-5.5/f2fs-preallocate-dio-blocks-when-forcing-buffered_io.patch
new file mode 100644
index 00000000000..56d39ef09c0
--- /dev/null
+++ b/queue-5.5/f2fs-preallocate-dio-blocks-when-forcing-buffered_io.patch
@@ -0,0 +1,124 @@
+From ed22c44b1bd390aad3f3ed98f7d1d3e76508feaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 15:01:42 -0800
+Subject: f2fs: preallocate DIO blocks when forcing buffered_io
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 47501f87c61ad2aa234add63e1ae231521dbc3f5 ]
+
+The previous preallocation and DIO decision like below.
+
+                         allow_outplace_dio              !allow_outplace_dio
+f2fs_force_buffered_io   (*) No_Prealloc / Buffered_IO   Prealloc / Buffered_IO
+!f2fs_force_buffered_io  No_Prealloc / DIO               Prealloc / DIO
+
+But, Javier reported Case (*) where zoned device bypassed preallocation but
+fell back to buffered writes in f2fs_direct_IO(), resulting in stale data
+being read.
+
+In order to fix the issue, actually we need to preallocate blocks whenever
+we fall back to buffered IO like this. No change is made in the other cases.
+
+                         allow_outplace_dio              !allow_outplace_dio
+f2fs_force_buffered_io   (*) Prealloc / Buffered_IO      Prealloc / Buffered_IO
+!f2fs_force_buffered_io  No_Prealloc / DIO               Prealloc / DIO
+
+Reported-and-tested-by: Javier Gonzalez <javier@javigon.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Reviewed-by: Javier González <javier@javigon.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 13 -------------
+ fs/f2fs/file.c | 43 +++++++++++++++++++++++++++++++++----------
+ 2 files changed, 33 insertions(+), 23 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index a034cd0ce0217..fc40a72f7827f 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1180,19 +1180,6 @@ int f2fs_preallocate_blocks(struct kiocb *iocb, struct iov_iter *from)
+ 	int err = 0;
+ 	bool direct_io = iocb->ki_flags & IOCB_DIRECT;
+ 
+-	/* convert inline data for Direct I/O*/
+-	if (direct_io) {
+-		err = f2fs_convert_inline_inode(inode);
+-		if (err)
+-			return err;
+-	}
+-
+-	if (direct_io && allow_outplace_dio(inode, iocb, from))
+-		return 0;
+-
+-	if (is_inode_flag_set(inode, FI_NO_PREALLOC))
+-		return 0;
+-
+ 	map.m_lblk = F2FS_BLK_ALIGN(iocb->ki_pos);
+ 	map.m_len = F2FS_BYTES_TO_BLK(iocb->ki_pos + iov_iter_count(from));
+ 	if (map.m_len > map.m_lblk)
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 13aef5f28fa8f..33c412d178f0f 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3383,18 +3383,41 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ 				ret = -EAGAIN;
+ 				goto out;
+ 			}
+-		} else {
+-			preallocated = true;
+-			target_size = iocb->ki_pos + iov_iter_count(from);
++			goto write;
++		}
+ 
+-			err = f2fs_preallocate_blocks(iocb, from);
+-			if (err) {
+-				clear_inode_flag(inode, FI_NO_PREALLOC);
+-				inode_unlock(inode);
+-				ret = err;
+-				goto out;
+-			}
++		if (is_inode_flag_set(inode, FI_NO_PREALLOC))
++			goto write;
++
++		if (iocb->ki_flags & IOCB_DIRECT) {
++			/*
++			 * Convert inline data for Direct I/O before entering
++			 * f2fs_direct_IO().
++			 */
++			err = f2fs_convert_inline_inode(inode);
++			if (err)
++				goto out_err;
++			/*
++			 * If force_buffere_io() is true, we have to allocate
++			 * blocks all the time, since f2fs_direct_IO will fall
++			 * back to buffered IO.
++			 */
++			if (!f2fs_force_buffered_io(inode, iocb, from) &&
++					allow_outplace_dio(inode, iocb, from))
++				goto write;
++		}
++		preallocated = true;
++		target_size = iocb->ki_pos + iov_iter_count(from);
++
++		err = f2fs_preallocate_blocks(iocb, from);
++		if (err) {
++out_err:
++			clear_inode_flag(inode, FI_NO_PREALLOC);
++			inode_unlock(inode);
++			ret = err;
++			goto out;
+ 		}
++write:
+ 		ret = __generic_file_write_iter(iocb, from);
+ 		clear_inode_flag(inode, FI_NO_PREALLOC);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/f2fs-set-i_linkable-early-to-avoid-wrong-access-by-v.patch b/queue-5.5/f2fs-set-i_linkable-early-to-avoid-wrong-access-by-v.patch
new file mode 100644
index 00000000000..4543e429d45
--- /dev/null
+++ b/queue-5.5/f2fs-set-i_linkable-early-to-avoid-wrong-access-by-v.patch
@@ -0,0 +1,134 @@
+From 21242a04d71db59cfe21d2e97a7216b1c994481c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 16:59:58 -0800
+Subject: f2fs: set I_LINKABLE early to avoid wrong access by vfs
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 5b1dbb082f196278f82b6a15a13848efacb9ff11 ]
+
+This patch moves setting I_LINKABLE early in rename2(whiteout) to avoid the
+below warning.
+
+[ 3189.163385] WARNING: CPU: 3 PID: 59523 at fs/inode.c:358 inc_nlink+0x32/0x40
+[ 3189.246979] Call Trace:
+[ 3189.248707]  f2fs_init_inode_metadata+0x2d6/0x440 [f2fs]
+[ 3189.251399]  f2fs_add_inline_entry+0x162/0x8c0 [f2fs]
+[ 3189.254010]  f2fs_add_dentry+0x69/0xe0 [f2fs]
+[ 3189.256353]  f2fs_do_add_link+0xc5/0x100 [f2fs]
+[ 3189.258774]  f2fs_rename2+0xabf/0x1010 [f2fs]
+[ 3189.261079]  vfs_rename+0x3f8/0xaa0
+[ 3189.263056]  ? tomoyo_path_rename+0x44/0x60
+[ 3189.265283]  ? do_renameat2+0x49b/0x550
+[ 3189.267324]  do_renameat2+0x49b/0x550
+[ 3189.269316]  __x64_sys_renameat2+0x20/0x30
+[ 3189.271441]  do_syscall_64+0x5a/0x230
+[ 3189.273410]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 3189.275848] RIP: 0033:0x7f270b4d9a49
+
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/namei.c | 27 +++++++++++++--------------
+ 1 file changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index a1c507b0b4ac4..5d9584281935f 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -797,6 +797,7 @@ static int __f2fs_tmpfile(struct inode *dir, struct dentry *dentry,
+ 
+ 	if (whiteout) {
+ 		f2fs_i_links_write(inode, false);
++		inode->i_state |= I_LINKABLE;
+ 		*whiteout = inode;
+ 	} else {
+ 		d_tmpfile(dentry, inode);
+@@ -867,6 +868,12 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ 			F2FS_I(old_dentry->d_inode)->i_projid)))
+ 		return -EXDEV;
+ 
++	if (flags & RENAME_WHITEOUT) {
++		err = f2fs_create_whiteout(old_dir, &whiteout);
++		if (err)
++			return err;
++	}
++
+ 	err = dquot_initialize(old_dir);
+ 	if (err)
+ 		goto out;
+@@ -898,17 +905,11 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ 		}
+ 	}
+ 
+-	if (flags & RENAME_WHITEOUT) {
+-		err = f2fs_create_whiteout(old_dir, &whiteout);
+-		if (err)
+-			goto out_dir;
+-	}
+-
+ 	if (new_inode) {
+ 
+ 		err = -ENOTEMPTY;
+ 		if (old_dir_entry && !f2fs_empty_dir(new_inode))
+-			goto out_whiteout;
++			goto out_dir;
+ 
+ 		err = -ENOENT;
+ 		new_entry = f2fs_find_entry(new_dir, &new_dentry->d_name,
+@@ -916,7 +917,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ 		if (!new_entry) {
+ 			if (IS_ERR(new_page))
+ 				err = PTR_ERR(new_page);
+-			goto out_whiteout;
++			goto out_dir;
+ 		}
+ 
+ 		f2fs_balance_fs(sbi, true);
+@@ -948,7 +949,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ 		err = f2fs_add_link(new_dentry, old_inode);
+ 		if (err) {
+ 			f2fs_unlock_op(sbi);
+-			goto out_whiteout;
++			goto out_dir;
+ 		}
+ 
+ 		if (old_dir_entry)
+@@ -972,7 +973,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ 				if (IS_ERR(old_page))
+ 					err = PTR_ERR(old_page);
+ 				f2fs_unlock_op(sbi);
+-				goto out_whiteout;
++				goto out_dir;
+ 			}
+ 		}
+ 	}
+@@ -991,7 +992,6 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ 	f2fs_delete_entry(old_entry, old_page, old_dir, NULL);
+ 
+ 	if (whiteout) {
+-		whiteout->i_state |= I_LINKABLE;
+ 		set_inode_flag(whiteout, FI_INC_LINK);
+ 		err = f2fs_add_link(old_dentry, whiteout);
+ 		if (err)
+@@ -1027,15 +1027,14 @@ put_out_dir:
+ 	f2fs_unlock_op(sbi);
+ 	if (new_page)
+ 		f2fs_put_page(new_page, 0);
+-out_whiteout:
+-	if (whiteout)
+-		iput(whiteout);
+ out_dir:
+ 	if (old_dir_entry)
+ 		f2fs_put_page(old_dir_page, 0);
+ out_old:
+ 	f2fs_put_page(old_page, 0);
+ out:
++	if (whiteout)
++		iput(whiteout);
+ 	return err;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/fbdev-fix-numbering-of-fbcon-options.patch b/queue-5.5/fbdev-fix-numbering-of-fbcon-options.patch
new file mode 100644
index 00000000000..7c55f7898a9
--- /dev/null
+++ b/queue-5.5/fbdev-fix-numbering-of-fbcon-options.patch
@@ -0,0 +1,67 @@
+From 763468166d239c80ce9dcc7084b08e7ea1efd0f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2019 11:09:16 +0000
+Subject: fbdev: fix numbering of fbcon options
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit fd933c00ebe220060e66fb136a7050a242456566 ]
+
+Three shall be the number thou shalt count, and the number of the
+counting shall be three. Four shalt thou not count...
+
+One! Two! Five!
+
+Fixes: efb985f6b265 ("[PATCH] fbcon: Console Rotation - Add framebuffer console documentation")
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Matthew Wilcox <willy@infradead.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190827110854.12574-2-peda@axentia.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/fb/fbcon.rst | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Documentation/fb/fbcon.rst b/Documentation/fb/fbcon.rst
+index ebca41785abea..65ba402551374 100644
+--- a/Documentation/fb/fbcon.rst
++++ b/Documentation/fb/fbcon.rst
+@@ -127,7 +127,7 @@ C. Boot options
+ 	is typically located on the same video card.  Thus, the consoles that
+ 	are controlled by the VGA console will be garbled.
+ 
+-4. fbcon=rotate:<n>
++5. fbcon=rotate:<n>
+ 
+ 	This option changes the orientation angle of the console display. The
+ 	value 'n' accepts the following:
+@@ -152,21 +152,21 @@ C. Boot options
+ 	Actually, the underlying fb driver is totally ignorant of console
+ 	rotation.
+ 
+-5. fbcon=margin:<color>
++6. fbcon=margin:<color>
+ 
+ 	This option specifies the color of the margins. The margins are the
+ 	leftover area at the right and the bottom of the screen that are not
+ 	used by text. By default, this area will be black. The 'color' value
+ 	is an integer number that depends on the framebuffer driver being used.
+ 
+-6. fbcon=nodefer
++7. fbcon=nodefer
+ 
+ 	If the kernel is compiled with deferred fbcon takeover support, normally
+ 	the framebuffer contents, left in place by the firmware/bootloader, will
+ 	be preserved until there actually is some text is output to the console.
+ 	This option causes fbcon to bind immediately to the fbdev device.
+ 
+-7. fbcon=logo-pos:<location>
++8. fbcon=logo-pos:<location>
+ 
+ 	The only possible 'location' is 'center' (without quotes), and when
+ 	given, the bootup logo is moved from the default top-left corner
+-- 
+2.20.1
+
diff --git a/queue-5.5/fore200e-fix-incorrect-checks-of-null-pointer-derefe.patch b/queue-5.5/fore200e-fix-incorrect-checks-of-null-pointer-derefe.patch
new file mode 100644
index 00000000000..f239dca2671
--- /dev/null
+++ b/queue-5.5/fore200e-fix-incorrect-checks-of-null-pointer-derefe.patch
@@ -0,0 +1,80 @@
+From b5e49593b609609b9e1f031686dce7e252bf0828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 10:14:51 -0600
+Subject: fore200e: Fix incorrect checks of NULL pointer dereference
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit bbd20c939c8aa3f27fa30e86691af250bf92973a ]
+
+In fore200e_send and fore200e_close, the pointers from the arguments
+are dereferenced in the variable declaration block and then checked
+for NULL. The patch fixes these issues by avoiding NULL pointer
+dereferences.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/fore200e.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
+index f1a5002053132..8fbd36eb89410 100644
+--- a/drivers/atm/fore200e.c
++++ b/drivers/atm/fore200e.c
+@@ -1414,12 +1414,14 @@ fore200e_open(struct atm_vcc *vcc)
+ static void
+ fore200e_close(struct atm_vcc* vcc)
+ {
+-    struct fore200e*        fore200e = FORE200E_DEV(vcc->dev);
+     struct fore200e_vcc*    fore200e_vcc;
++    struct fore200e*        fore200e;
+     struct fore200e_vc_map* vc_map;
+     unsigned long           flags;
+ 
+     ASSERT(vcc);
++    fore200e = FORE200E_DEV(vcc->dev);
++
+     ASSERT((vcc->vpi >= 0) && (vcc->vpi < 1<<FORE200E_VPI_BITS));
+     ASSERT((vcc->vci >= 0) && (vcc->vci < 1<<FORE200E_VCI_BITS));
+ 
+@@ -1464,10 +1466,10 @@ fore200e_close(struct atm_vcc* vcc)
+ static int
+ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
+ {
+-    struct fore200e*        fore200e     = FORE200E_DEV(vcc->dev);
+-    struct fore200e_vcc*    fore200e_vcc = FORE200E_VCC(vcc);
++    struct fore200e*        fore200e;
++    struct fore200e_vcc*    fore200e_vcc;
+     struct fore200e_vc_map* vc_map;
+-    struct host_txq*        txq          = &fore200e->host_txq;
++    struct host_txq*        txq;
+     struct host_txq_entry*  entry;
+     struct tpd*             tpd;
+     struct tpd_haddr        tpd_haddr;
+@@ -1480,9 +1482,18 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
+     unsigned char*          data;
+     unsigned long           flags;
+ 
+-    ASSERT(vcc);
+-    ASSERT(fore200e);
+-    ASSERT(fore200e_vcc);
++    if (!vcc)
++        return -EINVAL;
++
++    fore200e = FORE200E_DEV(vcc->dev);
++    fore200e_vcc = FORE200E_VCC(vcc);
++
++    if (!fore200e)
++        return -EINVAL;
++
++    txq = &fore200e->host_txq;
++    if (!fore200e_vcc)
++        return -EINVAL;
+ 
+     if (!test_bit(ATM_VF_READY, &vcc->flags)) {
+ 	DPRINTK(1, "VC %d.%d.%d not ready for tx\n", vcc->itf, vcc->vpi, vcc->vpi);
+-- 
+2.20.1
+
diff --git a/queue-5.5/ftrace-fpid_next-should-increase-position-index.patch b/queue-5.5/ftrace-fpid_next-should-increase-position-index.patch
new file mode 100644
index 00000000000..6c380ebfde0
--- /dev/null
+++ b/queue-5.5/ftrace-fpid_next-should-increase-position-index.patch
@@ -0,0 +1,63 @@
+From a030596c7a0f673d89f3947d56bded3aeabe1ec7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 10:02:56 +0300
+Subject: ftrace: fpid_next() should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit e4075e8bdffd93a9b6d6e1d52fabedceeca5a91b ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+Without patch:
+ # dd bs=4 skip=1 if=/sys/kernel/tracing/set_ftrace_pid
+ dd: /sys/kernel/tracing/set_ftrace_pid: cannot skip to specified offset
+ id
+ no pid
+ 2+1 records in
+ 2+1 records out
+ 10 bytes copied, 0.000213285 s, 46.9 kB/s
+
+Notice the "id" followed by "no pid".
+
+With the patch:
+ # dd bs=4 skip=1 if=/sys/kernel/tracing/set_ftrace_pid
+ dd: /sys/kernel/tracing/set_ftrace_pid: cannot skip to specified offset
+ id
+ 0+1 records in
+ 0+1 records out
+ 3 bytes copied, 0.000202112 s, 14.8 kB/s
+
+Notice that it only prints "id" and not the "no pid" afterward.
+
+Link: http://lkml.kernel.org/r/4f87c6ad-f114-30bb-8506-c32274ce2992@virtuozzo.com
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 3581bd96d6eb3..ddb47a0af854b 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -7038,9 +7038,10 @@ static void *fpid_next(struct seq_file *m, void *v, loff_t *pos)
+ 	struct trace_array *tr = m->private;
+ 	struct trace_pid_list *pid_list = rcu_dereference_sched(tr->function_pids);
+ 
+-	if (v == FTRACE_NO_PIDS)
++	if (v == FTRACE_NO_PIDS) {
++		(*pos)++;
+ 		return NULL;
+-
++	}
+ 	return trace_pid_next(pid_list, v, pos);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/fuse-don-t-overflow-llong_max-with-end-offset.patch b/queue-5.5/fuse-don-t-overflow-llong_max-with-end-offset.patch
new file mode 100644
index 00000000000..36b8556f635
--- /dev/null
+++ b/queue-5.5/fuse-don-t-overflow-llong_max-with-end-offset.patch
@@ -0,0 +1,55 @@
+From 9566068cb1358861531c37ae0bb8bf3ad2c7a801 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2020 16:39:28 +0100
+Subject: fuse: don't overflow LLONG_MAX with end offset
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit 2f1398291bf35fe027914ae7a9610d8e601fbfde ]
+
+Handle the special case of fuse_readpages() wanting to read the last page
+of a hugest file possible and overflowing the end offset in the process.
+
+This is basically to unbreak xfstests:generic/525 and prevent filesystems
+from doing bad things with an overflowing offset.
+
+Reported-by: Xiao Yang <ice_yangxiao@163.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/file.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 695369f46f92d..3dd37a998ea93 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -803,6 +803,10 @@ static int fuse_do_readpage(struct file *file, struct page *page)
+ 
+ 	attr_ver = fuse_get_attr_version(fc);
+ 
++	/* Don't overflow end offset */
++	if (pos + (desc.length - 1) == LLONG_MAX)
++		desc.length--;
++
+ 	fuse_read_args_fill(&ia, file, pos, desc.length, FUSE_READ);
+ 	res = fuse_simple_request(fc, &ia.ap.args);
+ 	if (res < 0)
+@@ -888,6 +892,14 @@ static void fuse_send_readpages(struct fuse_io_args *ia, struct file *file)
+ 	ap->args.out_pages = true;
+ 	ap->args.page_zeroing = true;
+ 	ap->args.page_replace = true;
++
++	/* Don't overflow end offset */
++	if (pos + (count - 1) == LLONG_MAX) {
++		count--;
++		ap->descs[ap->num_pages - 1].length--;
++	}
++	WARN_ON((loff_t) (pos + count) < 0);
++
+ 	fuse_read_args_fill(ia, file, pos, count, FUSE_READ);
+ 	ia->read.attr_ver = fuse_get_attr_version(fc);
+ 	if (fc->async_read) {
+-- 
+2.20.1
+
diff --git a/queue-5.5/gianfar-fix-tx-timestamping-with-a-stacked-dsa-drive.patch b/queue-5.5/gianfar-fix-tx-timestamping-with-a-stacked-dsa-drive.patch
new file mode 100644
index 00000000000..1ce649dc4a0
--- /dev/null
+++ b/queue-5.5/gianfar-fix-tx-timestamping-with-a-stacked-dsa-drive.patch
@@ -0,0 +1,89 @@
+From eb168037e4a55fafcef422a2f78696eb982f3c8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Dec 2019 15:30:45 +0200
+Subject: gianfar: Fix TX timestamping with a stacked DSA driver
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit c26a2c2ddc0115eb088873f5c309cf46b982f522 ]
+
+The driver wrongly assumes that it is the only entity that can set the
+SKBTX_IN_PROGRESS bit of the current skb. Therefore, in the
+gfar_clean_tx_ring function, where the TX timestamp is collected if
+necessary, the aforementioned bit is used to discriminate whether or not
+the TX timestamp should be delivered to the socket's error queue.
+
+But a stacked driver such as a DSA switch can also set the
+SKBTX_IN_PROGRESS bit, which is actually exactly what it should do in
+order to denote that the hardware timestamping process is undergoing.
+
+Therefore, gianfar would misinterpret the "in progress" bit as being its
+own, and deliver a second skb clone in the socket's error queue,
+completely throwing off a PTP process which is not expecting to receive
+it, _even though_ TX timestamping is not enabled for gianfar.
+
+There have been discussions [0] as to whether non-MAC drivers need or
+not to set SKBTX_IN_PROGRESS at all (whose purpose is to avoid sending 2
+timestamps, a sw and a hw one, to applications which only expect one).
+But as of this patch, there are at least 2 PTP drivers that would break
+in conjunction with gianfar: the sja1105 DSA switch and the felix
+switch, by way of its ocelot core driver.
+
+So regardless of that conclusion, fix the gianfar driver to not do stuff
+based on flags set by others and not intended for it.
+
+[0]: https://www.spinics.net/lists/netdev/msg619699.html
+
+Fixes: f0ee7acfcdd4 ("gianfar: Add hardware TX timestamping support")
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index 72868a28b621d..7d08bf6370ae1 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -2205,13 +2205,17 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ 	skb_dirtytx = tx_queue->skb_dirtytx;
+ 
+ 	while ((skb = tx_queue->tx_skbuff[skb_dirtytx])) {
++		bool do_tstamp;
++
++		do_tstamp = (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
++			    priv->hwts_tx_en;
+ 
+ 		frags = skb_shinfo(skb)->nr_frags;
+ 
+ 		/* When time stamping, one additional TxBD must be freed.
+ 		 * Also, we need to dma_unmap_single() the TxPAL.
+ 		 */
+-		if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS))
++		if (unlikely(do_tstamp))
+ 			nr_txbds = frags + 2;
+ 		else
+ 			nr_txbds = frags + 1;
+@@ -2225,7 +2229,7 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ 		    (lstatus & BD_LENGTH_MASK))
+ 			break;
+ 
+-		if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) {
++		if (unlikely(do_tstamp)) {
+ 			next = next_txbd(bdp, base, tx_ring_size);
+ 			buflen = be16_to_cpu(next->length) +
+ 				 GMAC_FCB_LEN + GMAC_TXPAL_LEN;
+@@ -2235,7 +2239,7 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ 		dma_unmap_single(priv->dev, be32_to_cpu(bdp->bufPtr),
+ 				 buflen, DMA_TO_DEVICE);
+ 
+-		if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) {
++		if (unlikely(do_tstamp)) {
+ 			struct skb_shared_hwtstamps shhwtstamps;
+ 			u64 *ns = (u64 *)(((uintptr_t)skb->data + 0x10) &
+ 					  ~0x7UL);
+-- 
+2.20.1
+
diff --git a/queue-5.5/gpio-gpio-grgpio-fix-possible-sleep-in-atomic-contex.patch b/queue-5.5/gpio-gpio-grgpio-fix-possible-sleep-in-atomic-contex.patch
new file mode 100644
index 00000000000..0f4eeae7c83
--- /dev/null
+++ b/queue-5.5/gpio-gpio-grgpio-fix-possible-sleep-in-atomic-contex.patch
@@ -0,0 +1,78 @@
+From cd68ac3b91a1a2dd8e68b91ad4085f75b336ea99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 21:26:05 +0800
+Subject: gpio: gpio-grgpio: fix possible sleep-in-atomic-context bugs in
+ grgpio_irq_map/unmap()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit e36eaf94be8f7bc4e686246eed3cf92d845e2ef8 ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+drivers/gpio/gpio-grgpio.c, 261:
+	request_irq in grgpio_irq_map
+drivers/gpio/gpio-grgpio.c, 255:
+	_raw_spin_lock_irqsave in grgpio_irq_map
+
+drivers/gpio/gpio-grgpio.c, 318:
+	free_irq in grgpio_irq_unmap
+drivers/gpio/gpio-grgpio.c, 299:
+	_raw_spin_lock_irqsave in grgpio_irq_unmap
+
+request_irq() and free_irq() can sleep at runtime.
+
+To fix these bugs, request_irq() and free_irq() are called without
+holding the spinlock.
+
+These bugs are found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20191218132605.10594-1-baijiaju1990@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-grgpio.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-grgpio.c b/drivers/gpio/gpio-grgpio.c
+index 08234e64993a9..3224933f4c8f4 100644
+--- a/drivers/gpio/gpio-grgpio.c
++++ b/drivers/gpio/gpio-grgpio.c
+@@ -253,17 +253,16 @@ static int grgpio_irq_map(struct irq_domain *d, unsigned int irq,
+ 	lirq->irq = irq;
+ 	uirq = &priv->uirqs[lirq->index];
+ 	if (uirq->refcnt == 0) {
++		spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+ 		ret = request_irq(uirq->uirq, grgpio_irq_handler, 0,
+ 				  dev_name(priv->dev), priv);
+ 		if (ret) {
+ 			dev_err(priv->dev,
+ 				"Could not request underlying irq %d\n",
+ 				uirq->uirq);
+-
+-			spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+-
+ 			return ret;
+ 		}
++		spin_lock_irqsave(&priv->gc.bgpio_lock, flags);
+ 	}
+ 	uirq->refcnt++;
+ 
+@@ -309,8 +308,11 @@ static void grgpio_irq_unmap(struct irq_domain *d, unsigned int irq)
+ 	if (index >= 0) {
+ 		uirq = &priv->uirqs[lirq->index];
+ 		uirq->refcnt--;
+-		if (uirq->refcnt == 0)
++		if (uirq->refcnt == 0) {
++			spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+ 			free_irq(uirq->uirq, priv);
++			return;
++		}
+ 	}
+ 
+ 	spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+-- 
+2.20.1
+
diff --git a/queue-5.5/gpiolib-set-lockdep-class-for-hierarchical-irq-domai.patch b/queue-5.5/gpiolib-set-lockdep-class-for-hierarchical-irq-domai.patch
new file mode 100644
index 00000000000..19d6a1c39e6
--- /dev/null
+++ b/queue-5.5/gpiolib-set-lockdep-class-for-hierarchical-irq-domai.patch
@@ -0,0 +1,120 @@
+From 7202c9c717132b05502f2cfd6f424334463e139e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2020 15:11:03 -0800
+Subject: gpiolib: Set lockdep class for hierarchical irq domains
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit c34f6dc8c9e6bbe9fba1d53acd6d9a3889599da3 ]
+
+I see the following lockdep splat in the qcom pinctrl driver when
+attempting to suspend the device.
+
+ ============================================
+ WARNING: possible recursive locking detected
+ 5.4.2 #2 Tainted: G S
+ --------------------------------------------
+ cat/6536 is trying to acquire lock:
+ ffffff814787ccc0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x64/0x94
+
+ but task is already holding lock:
+ ffffff81436740c0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x64/0x94
+
+ other info that might help us debug this:
+  Possible unsafe locking scenario:
+
+        CPU0
+        ----
+   lock(&irq_desc_lock_class);
+   lock(&irq_desc_lock_class);
+
+  *** DEADLOCK ***
+
+  May be due to missing lock nesting notation
+
+ 7 locks held by cat/6536:
+  #0: ffffff8140e0c420 (sb_writers#7){.+.+}, at: vfs_write+0xc8/0x19c
+  #1: ffffff8121eec480 (&of->mutex){+.+.}, at: kernfs_fop_write+0x128/0x1f4
+  #2: ffffff8147cad668 (kn->count#263){.+.+}, at: kernfs_fop_write+0x130/0x1f4
+  #3: ffffffd011446000 (system_transition_mutex){+.+.}, at: pm_suspend+0x108/0x354
+  #4: ffffff814302b970 (&dev->mutex){....}, at: __device_suspend+0x16c/0x420
+  #5: ffffff81436740c0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x64/0x94
+  #6: ffffff81479b8c10 (&pctrl->lock){....}, at: msm_gpio_irq_set_wake+0x48/0x7c
+
+ stack backtrace:
+ CPU: 4 PID: 6536 Comm: cat Tainted: G S                5.4.2 #2
+ Call trace:
+  dump_backtrace+0x0/0x174
+  show_stack+0x20/0x2c
+  dump_stack+0xdc/0x144
+  __lock_acquire+0x52c/0x2268
+  lock_acquire+0x1dc/0x220
+  _raw_spin_lock_irqsave+0x64/0x80
+  __irq_get_desc_lock+0x64/0x94
+  irq_set_irq_wake+0x40/0x144
+  msm_gpio_irq_set_wake+0x5c/0x7c
+  set_irq_wake_real+0x40/0x5c
+  irq_set_irq_wake+0x70/0x144
+  cros_ec_rtc_suspend+0x38/0x4c
+  platform_pm_suspend+0x34/0x60
+  dpm_run_callback+0x64/0xcc
+  __device_suspend+0x314/0x420
+  dpm_suspend+0xf8/0x298
+  dpm_suspend_start+0x84/0xb4
+  suspend_devices_and_enter+0xbc/0x628
+  pm_suspend+0x214/0x354
+  state_store+0xb0/0x108
+  kobj_attr_store+0x14/0x24
+  sysfs_kf_write+0x4c/0x64
+  kernfs_fop_write+0x158/0x1f4
+  __vfs_write+0x54/0x18c
+  vfs_write+0xdc/0x19c
+  ksys_write+0x7c/0xe4
+  __arm64_sys_write+0x20/0x2c
+  el0_svc_common+0xa8/0x160
+  el0_svc_compat_handler+0x2c/0x38
+  el0_svc_compat+0x8/0x10
+
+This is because the msm_gpio_irq_set_wake() function calls
+irq_set_irq_wake() as a backup in case the irq comes in during the path
+to idle. Given that we're calling irqchip functions from within an
+irqchip we need to set the lockdep class to be different for this child
+controller vs. the default one that the parent irqchip gets.
+
+This used to be done before this driver was converted to hierarchical
+irq domains in commit e35a6ae0eb3a ("pinctrl/msm: Setup GPIO chip in
+hierarchy") via the gpiochip_irq_map() function. With hierarchical irq
+domains this function has been replaced by
+gpiochip_hierarchy_irq_domain_alloc(). Therefore, set the lockdep class
+like was done previously in the irq domain path so we can avoid this
+lockdep warning.
+
+Fixes: fdd61a013a24 ("gpio: Add support for hierarchical IRQ domains")
+Cc: Thierry Reding <treding@nvidia.com>
+Cc: Brian Masney <masneyb@onstation.org>
+Cc: Lina Iyer <ilina@codeaurora.org>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: Maulik Shah <mkshah@codeaurora.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20200114231103.85641-1-swboyd@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index bcfbfded9ba3f..175c6363cf611 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2053,6 +2053,7 @@ static int gpiochip_hierarchy_irq_domain_alloc(struct irq_domain *d,
+ 				     parent_type);
+ 	chip_info(gc, "alloc_irqs_parent for %d parent hwirq %d\n",
+ 		  irq, parent_hwirq);
++	irq_set_lockdep_class(irq, gc->irq.lock_key, gc->irq.request_key);
+ 	ret = irq_domain_alloc_irqs_parent(d, irq, 1, &parent_fwspec);
+ 	if (ret)
+ 		chip_err(gc,
+-- 
+2.20.1
+
diff --git a/queue-5.5/gpu-drm-ingenic-avoid-null-pointer-deference-in-plan.patch b/queue-5.5/gpu-drm-ingenic-avoid-null-pointer-deference-in-plan.patch
new file mode 100644
index 00000000000..e356bf8433f
--- /dev/null
+++ b/queue-5.5/gpu-drm-ingenic-avoid-null-pointer-deference-in-plan.patch
@@ -0,0 +1,55 @@
+From d654142645076355f5d43ef4e5f9f23d9f65e170 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 15:41:38 +0100
+Subject: gpu/drm: ingenic: Avoid null pointer deference in plane atomic update
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 354b051c5dcbeb35bbfd5d54161364fc7a75a58a ]
+
+It is possible that there is no drm_framebuffer associated with a given
+plane state.
+
+v2: Handle drm_plane->state which can be NULL too
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191210144142.33143-2-paul@crapouillou.net
+# *** extracted tags ***
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ingenic/ingenic-drm.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/ingenic/ingenic-drm.c b/drivers/gpu/drm/ingenic/ingenic-drm.c
+index ec32e1c673350..43a015f33e975 100644
+--- a/drivers/gpu/drm/ingenic/ingenic-drm.c
++++ b/drivers/gpu/drm/ingenic/ingenic-drm.c
+@@ -372,14 +372,18 @@ static void ingenic_drm_plane_atomic_update(struct drm_plane *plane,
+ 	struct ingenic_drm *priv = drm_plane_get_priv(plane);
+ 	struct drm_plane_state *state = plane->state;
+ 	unsigned int width, height, cpp;
++	dma_addr_t addr;
+ 
+-	width = state->crtc->state->adjusted_mode.hdisplay;
+-	height = state->crtc->state->adjusted_mode.vdisplay;
+-	cpp = state->fb->format->cpp[plane->index];
++	if (state && state->fb) {
++		addr = drm_fb_cma_get_gem_addr(state->fb, state, 0);
++		width = state->crtc->state->adjusted_mode.hdisplay;
++		height = state->crtc->state->adjusted_mode.vdisplay;
++		cpp = state->fb->format->cpp[plane->index];
+ 
+-	priv->dma_hwdesc->addr = drm_fb_cma_get_gem_addr(state->fb, state, 0);
+-	priv->dma_hwdesc->cmd = width * height * cpp / 4;
+-	priv->dma_hwdesc->cmd |= JZ_LCD_CMD_EOF_IRQ;
++		priv->dma_hwdesc->addr = addr;
++		priv->dma_hwdesc->cmd = width * height * cpp / 4;
++		priv->dma_hwdesc->cmd |= JZ_LCD_CMD_EOF_IRQ;
++	}
+ }
+ 
+ static void ingenic_drm_encoder_atomic_mode_set(struct drm_encoder *encoder,
+-- 
+2.20.1
+
diff --git a/queue-5.5/help_next-should-increase-position-index.patch b/queue-5.5/help_next-should-increase-position-index.patch
new file mode 100644
index 00000000000..1f89d241137
--- /dev/null
+++ b/queue-5.5/help_next-should-increase-position-index.patch
@@ -0,0 +1,35 @@
+From 401b64c6ee93ae3d8999b5c20a2621e2814feec9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 09:10:47 +0300
+Subject: help_next should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 9f198a2ac543eaaf47be275531ad5cbd50db3edf ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/orangefs-debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c
+index 25543a966c486..29eaa45443727 100644
+--- a/fs/orangefs/orangefs-debugfs.c
++++ b/fs/orangefs/orangefs-debugfs.c
+@@ -273,6 +273,7 @@ static void *help_start(struct seq_file *m, loff_t *pos)
+ 
+ static void *help_next(struct seq_file *m, void *v, loff_t *pos)
+ {
++	(*pos)++;
+ 	gossip_debug(GOSSIP_DEBUGFS_DEBUG, "help_next: start\n");
+ 
+ 	return NULL;
+-- 
+2.20.1
+
diff --git a/queue-5.5/hostap-adjust-indentation-in-prism2_hostapd_add_sta.patch b/queue-5.5/hostap-adjust-indentation-in-prism2_hostapd_add_sta.patch
new file mode 100644
index 00000000000..5e46e22a9d4
--- /dev/null
+++ b/queue-5.5/hostap-adjust-indentation-in-prism2_hostapd_add_sta.patch
@@ -0,0 +1,52 @@
+From 36585e8be40a6dba30e66b92dae401333655e9d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 18:15:46 -0700
+Subject: hostap: Adjust indentation in prism2_hostapd_add_sta
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit b61156fba74f659d0bc2de8f2dbf5bad9f4b8faf ]
+
+Clang warns:
+
+../drivers/net/wireless/intersil/hostap/hostap_ap.c:2511:3: warning:
+misleading indentation; statement is not part of the previous 'if'
+[-Wmisleading-indentation]
+        if (sta->tx_supp_rates & WLAN_RATE_5M5)
+        ^
+../drivers/net/wireless/intersil/hostap/hostap_ap.c:2509:2: note:
+previous statement is here
+        if (sta->tx_supp_rates & WLAN_RATE_2M)
+        ^
+1 warning generated.
+
+This warning occurs because there is a space before the tab on this
+line. Remove it so that the indentation is consistent with the Linux
+kernel coding style and clang no longer warns.
+
+Fixes: ff1d2767d5a4 ("Add HostAP wireless driver.")
+Link: https://github.com/ClangBuiltLinux/linux/issues/813
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intersil/hostap/hostap_ap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intersil/hostap/hostap_ap.c b/drivers/net/wireless/intersil/hostap/hostap_ap.c
+index 0094b1d2b5770..3ec46f48cfde1 100644
+--- a/drivers/net/wireless/intersil/hostap/hostap_ap.c
++++ b/drivers/net/wireless/intersil/hostap/hostap_ap.c
+@@ -2508,7 +2508,7 @@ static int prism2_hostapd_add_sta(struct ap_data *ap,
+ 		sta->supported_rates[0] = 2;
+ 	if (sta->tx_supp_rates & WLAN_RATE_2M)
+ 		sta->supported_rates[1] = 4;
+- 	if (sta->tx_supp_rates & WLAN_RATE_5M5)
++	if (sta->tx_supp_rates & WLAN_RATE_5M5)
+ 		sta->supported_rates[2] = 11;
+ 	if (sta->tx_supp_rates & WLAN_RATE_11M)
+ 		sta->supported_rates[3] = 22;
+-- 
+2.20.1
+
diff --git a/queue-5.5/i40e-relax-i40e_xsk_wakeup-s-return-value-when-pf-is.patch b/queue-5.5/i40e-relax-i40e_xsk_wakeup-s-return-value-when-pf-is.patch
new file mode 100644
index 00000000000..68b243aaac3
--- /dev/null
+++ b/queue-5.5/i40e-relax-i40e_xsk_wakeup-s-return-value-when-pf-is.patch
@@ -0,0 +1,42 @@
+From b78ac2c5714b5f68234e863843945b9a1e1aed82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2020 05:58:32 +0100
+Subject: i40e: Relax i40e_xsk_wakeup's return value when PF is busy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+
+[ Upstream commit c77e9f09143822623dd71a0fdc84331129e97c3a ]
+
+Return -EAGAIN instead of -ENETDOWN to provide a slightly milder
+information to user space so that an application will know to retry the
+syscall when __I40E_CONFIG_BUSY bit is set on pf->state.
+
+Fixes: b3873a5be757 ("net/i40e: Fix concurrency issues between config flow and XSK")
+Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Björn Töpel <bjorn.topel@intel.com>
+Link: https://lore.kernel.org/bpf/20200205045834.56795-2-maciej.fijalkowski@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_xsk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+index f73cd917c44f7..3156de786d955 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+@@ -791,7 +791,7 @@ int i40e_xsk_wakeup(struct net_device *dev, u32 queue_id, u32 flags)
+ 	struct i40e_ring *ring;
+ 
+ 	if (test_bit(__I40E_CONFIG_BUSY, pf->state))
+-		return -ENETDOWN;
++		return -EAGAIN;
+ 
+ 	if (test_bit(__I40E_VSI_DOWN, vsi->state))
+ 		return -ENETDOWN;
+-- 
+2.20.1
+
diff --git a/queue-5.5/ib-core-let-ib-core-distribute-cache-update-events.patch b/queue-5.5/ib-core-let-ib-core-distribute-cache-update-events.patch
new file mode 100644
index 00000000000..70beef5255a
--- /dev/null
+++ b/queue-5.5/ib-core-let-ib-core-distribute-cache-update-events.patch
@@ -0,0 +1,384 @@
+From b7f087b3d1d61c2ea001112e6b4225298c78c672 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 13:30:22 +0200
+Subject: IB/core: Let IB core distribute cache update events
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit 6b57cea9221b0247ad5111b348522625e489a8e4 ]
+
+Currently when the low level driver notifies Pkey, GID, and port change
+events they are notified to the registered handlers in the order they are
+registered.
+
+IB core and other ULPs such as IPoIB are interested in GID, LID, Pkey
+change events.
+
+Since all GID queries done by ULPs are serviced by IB core, and the IB
+core deferes cache updates to a work queue, it is possible for other
+clients to see stale cache data when they handle their own events.
+
+For example, the below call tree shows how ipoib will call
+rdma_query_gid() concurrently with the update to the cache sitting in the
+WQ.
+
+mlx5_ib_handle_event()
+  ib_dispatch_event()
+    ib_cache_event()
+       queue_work() -> slow cache update
+
+    [..]
+    ipoib_event()
+     queue_work()
+       [..]
+       work handler
+         ipoib_ib_dev_flush_light()
+           __ipoib_ib_dev_flush()
+              ipoib_dev_addr_changed_valid()
+                rdma_query_gid() <- Returns old GID, cache not updated.
+
+Move all the event dispatch to a work queue so that the cache update is
+always done before any clients are notified.
+
+Fixes: f35faa4ba956 ("IB/core: Simplify ib_query_gid to always refer to cache")
+Link: https://lore.kernel.org/r/20191212113024.336702-3-leon@kernel.org
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cache.c     | 121 +++++++++++++++++-----------
+ drivers/infiniband/core/core_priv.h |   1 +
+ drivers/infiniband/core/device.c    |  33 +++-----
+ include/rdma/ib_verbs.h             |   9 ++-
+ 4 files changed, 92 insertions(+), 72 deletions(-)
+
+diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
+index d535995711c30..e55f345799e41 100644
+--- a/drivers/infiniband/core/cache.c
++++ b/drivers/infiniband/core/cache.c
+@@ -51,9 +51,8 @@ struct ib_pkey_cache {
+ 
+ struct ib_update_work {
+ 	struct work_struct work;
+-	struct ib_device  *device;
+-	u8                 port_num;
+-	bool		   enforce_security;
++	struct ib_event event;
++	bool enforce_security;
+ };
+ 
+ union ib_gid zgid;
+@@ -130,7 +129,7 @@ static void dispatch_gid_change_event(struct ib_device *ib_dev, u8 port)
+ 	event.element.port_num	= port;
+ 	event.event		= IB_EVENT_GID_CHANGE;
+ 
+-	ib_dispatch_event(&event);
++	ib_dispatch_event_clients(&event);
+ }
+ 
+ static const char * const gid_type_str[] = {
+@@ -1381,9 +1380,8 @@ err:
+ 	return ret;
+ }
+ 
+-static void ib_cache_update(struct ib_device *device,
+-			    u8                port,
+-			    bool	      enforce_security)
++static int
++ib_cache_update(struct ib_device *device, u8 port, bool enforce_security)
+ {
+ 	struct ib_port_attr       *tprops = NULL;
+ 	struct ib_pkey_cache      *pkey_cache = NULL, *old_pkey_cache;
+@@ -1391,11 +1389,11 @@ static void ib_cache_update(struct ib_device *device,
+ 	int                        ret;
+ 
+ 	if (!rdma_is_port_valid(device, port))
+-		return;
++		return -EINVAL;
+ 
+ 	tprops = kmalloc(sizeof *tprops, GFP_KERNEL);
+ 	if (!tprops)
+-		return;
++		return -ENOMEM;
+ 
+ 	ret = ib_query_port(device, port, tprops);
+ 	if (ret) {
+@@ -1413,8 +1411,10 @@ static void ib_cache_update(struct ib_device *device,
+ 	pkey_cache = kmalloc(struct_size(pkey_cache, table,
+ 					 tprops->pkey_tbl_len),
+ 			     GFP_KERNEL);
+-	if (!pkey_cache)
++	if (!pkey_cache) {
++		ret = -ENOMEM;
+ 		goto err;
++	}
+ 
+ 	pkey_cache->table_len = tprops->pkey_tbl_len;
+ 
+@@ -1446,50 +1446,84 @@ static void ib_cache_update(struct ib_device *device,
+ 
+ 	kfree(old_pkey_cache);
+ 	kfree(tprops);
+-	return;
++	return 0;
+ 
+ err:
+ 	kfree(pkey_cache);
+ 	kfree(tprops);
++	return ret;
++}
++
++static void ib_cache_event_task(struct work_struct *_work)
++{
++	struct ib_update_work *work =
++		container_of(_work, struct ib_update_work, work);
++	int ret;
++
++	/* Before distributing the cache update event, first sync
++	 * the cache.
++	 */
++	ret = ib_cache_update(work->event.device, work->event.element.port_num,
++			      work->enforce_security);
++
++	/* GID event is notified already for individual GID entries by
++	 * dispatch_gid_change_event(). Hence, notifiy for rest of the
++	 * events.
++	 */
++	if (!ret && work->event.event != IB_EVENT_GID_CHANGE)
++		ib_dispatch_event_clients(&work->event);
++
++	kfree(work);
+ }
+ 
+-static void ib_cache_task(struct work_struct *_work)
++static void ib_generic_event_task(struct work_struct *_work)
+ {
+ 	struct ib_update_work *work =
+ 		container_of(_work, struct ib_update_work, work);
+ 
+-	ib_cache_update(work->device,
+-			work->port_num,
+-			work->enforce_security);
++	ib_dispatch_event_clients(&work->event);
+ 	kfree(work);
+ }
+ 
+-static void ib_cache_event(struct ib_event_handler *handler,
+-			   struct ib_event *event)
++static bool is_cache_update_event(const struct ib_event *event)
++{
++	return (event->event == IB_EVENT_PORT_ERR    ||
++		event->event == IB_EVENT_PORT_ACTIVE ||
++		event->event == IB_EVENT_LID_CHANGE  ||
++		event->event == IB_EVENT_PKEY_CHANGE ||
++		event->event == IB_EVENT_CLIENT_REREGISTER ||
++		event->event == IB_EVENT_GID_CHANGE);
++}
++
++/**
++ * ib_dispatch_event - Dispatch an asynchronous event
++ * @event:Event to dispatch
++ *
++ * Low-level drivers must call ib_dispatch_event() to dispatch the
++ * event to all registered event handlers when an asynchronous event
++ * occurs.
++ */
++void ib_dispatch_event(const struct ib_event *event)
+ {
+ 	struct ib_update_work *work;
+ 
+-	if (event->event == IB_EVENT_PORT_ERR    ||
+-	    event->event == IB_EVENT_PORT_ACTIVE ||
+-	    event->event == IB_EVENT_LID_CHANGE  ||
+-	    event->event == IB_EVENT_PKEY_CHANGE ||
+-	    event->event == IB_EVENT_CLIENT_REREGISTER ||
+-	    event->event == IB_EVENT_GID_CHANGE) {
+-		work = kmalloc(sizeof *work, GFP_ATOMIC);
+-		if (work) {
+-			INIT_WORK(&work->work, ib_cache_task);
+-			work->device   = event->device;
+-			work->port_num = event->element.port_num;
+-			if (event->event == IB_EVENT_PKEY_CHANGE ||
+-			    event->event == IB_EVENT_GID_CHANGE)
+-				work->enforce_security = true;
+-			else
+-				work->enforce_security = false;
+-
+-			queue_work(ib_wq, &work->work);
+-		}
+-	}
++	work = kzalloc(sizeof(*work), GFP_ATOMIC);
++	if (!work)
++		return;
++
++	if (is_cache_update_event(event))
++		INIT_WORK(&work->work, ib_cache_event_task);
++	else
++		INIT_WORK(&work->work, ib_generic_event_task);
++
++	work->event = *event;
++	if (event->event == IB_EVENT_PKEY_CHANGE ||
++	    event->event == IB_EVENT_GID_CHANGE)
++		work->enforce_security = true;
++
++	queue_work(ib_wq, &work->work);
+ }
++EXPORT_SYMBOL(ib_dispatch_event);
+ 
+ int ib_cache_setup_one(struct ib_device *device)
+ {
+@@ -1505,9 +1539,6 @@ int ib_cache_setup_one(struct ib_device *device)
+ 	rdma_for_each_port (device, p)
+ 		ib_cache_update(device, p, true);
+ 
+-	INIT_IB_EVENT_HANDLER(&device->cache.event_handler,
+-			      device, ib_cache_event);
+-	ib_register_event_handler(&device->cache.event_handler);
+ 	return 0;
+ }
+ 
+@@ -1529,14 +1560,12 @@ void ib_cache_release_one(struct ib_device *device)
+ 
+ void ib_cache_cleanup_one(struct ib_device *device)
+ {
+-	/* The cleanup function unregisters the event handler,
+-	 * waits for all in-progress workqueue elements and cleans
+-	 * up the GID cache. This function should be called after
+-	 * the device was removed from the devices list and all
+-	 * clients were removed, so the cache exists but is
++	/* The cleanup function waits for all in-progress workqueue
++	 * elements and cleans up the GID cache. This function should be
++	 * called after the device was removed from the devices list and
++	 * all clients were removed, so the cache exists but is
+ 	 * non-functional and shouldn't be updated anymore.
+ 	 */
+-	ib_unregister_event_handler(&device->cache.event_handler);
+ 	flush_workqueue(ib_wq);
+ 	gid_table_cleanup_one(device);
+ 
+diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
+index 3645e092e1c79..d657d90e618be 100644
+--- a/drivers/infiniband/core/core_priv.h
++++ b/drivers/infiniband/core/core_priv.h
+@@ -149,6 +149,7 @@ unsigned long roce_gid_type_mask_support(struct ib_device *ib_dev, u8 port);
+ int ib_cache_setup_one(struct ib_device *device);
+ void ib_cache_cleanup_one(struct ib_device *device);
+ void ib_cache_release_one(struct ib_device *device);
++void ib_dispatch_event_clients(struct ib_event *event);
+ 
+ #ifdef CONFIG_CGROUP_RDMA
+ void ib_device_register_rdmacg(struct ib_device *device);
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 84dd74fe13b81..c38b2b0b078ad 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -588,6 +588,7 @@ struct ib_device *_ib_alloc_device(size_t size)
+ 
+ 	INIT_LIST_HEAD(&device->event_handler_list);
+ 	spin_lock_init(&device->event_handler_lock);
++	init_rwsem(&device->event_handler_rwsem);
+ 	mutex_init(&device->unregistration_lock);
+ 	/*
+ 	 * client_data needs to be alloc because we don't want our mark to be
+@@ -1931,17 +1932,15 @@ EXPORT_SYMBOL(ib_set_client_data);
+  *
+  * ib_register_event_handler() registers an event handler that will be
+  * called back when asynchronous IB events occur (as defined in
+- * chapter 11 of the InfiniBand Architecture Specification).  This
+- * callback may occur in interrupt context.
++ * chapter 11 of the InfiniBand Architecture Specification). This
++ * callback occurs in workqueue context.
+  */
+ void ib_register_event_handler(struct ib_event_handler *event_handler)
+ {
+-	unsigned long flags;
+-
+-	spin_lock_irqsave(&event_handler->device->event_handler_lock, flags);
++	down_write(&event_handler->device->event_handler_rwsem);
+ 	list_add_tail(&event_handler->list,
+ 		      &event_handler->device->event_handler_list);
+-	spin_unlock_irqrestore(&event_handler->device->event_handler_lock, flags);
++	up_write(&event_handler->device->event_handler_rwsem);
+ }
+ EXPORT_SYMBOL(ib_register_event_handler);
+ 
+@@ -1954,35 +1953,23 @@ EXPORT_SYMBOL(ib_register_event_handler);
+  */
+ void ib_unregister_event_handler(struct ib_event_handler *event_handler)
+ {
+-	unsigned long flags;
+-
+-	spin_lock_irqsave(&event_handler->device->event_handler_lock, flags);
++	down_write(&event_handler->device->event_handler_rwsem);
+ 	list_del(&event_handler->list);
+-	spin_unlock_irqrestore(&event_handler->device->event_handler_lock, flags);
++	up_write(&event_handler->device->event_handler_rwsem);
+ }
+ EXPORT_SYMBOL(ib_unregister_event_handler);
+ 
+-/**
+- * ib_dispatch_event - Dispatch an asynchronous event
+- * @event:Event to dispatch
+- *
+- * Low-level drivers must call ib_dispatch_event() to dispatch the
+- * event to all registered event handlers when an asynchronous event
+- * occurs.
+- */
+-void ib_dispatch_event(struct ib_event *event)
++void ib_dispatch_event_clients(struct ib_event *event)
+ {
+-	unsigned long flags;
+ 	struct ib_event_handler *handler;
+ 
+-	spin_lock_irqsave(&event->device->event_handler_lock, flags);
++	down_read(&event->device->event_handler_rwsem);
+ 
+ 	list_for_each_entry(handler, &event->device->event_handler_list, list)
+ 		handler->handler(handler, event);
+ 
+-	spin_unlock_irqrestore(&event->device->event_handler_lock, flags);
++	up_read(&event->device->event_handler_rwsem);
+ }
+-EXPORT_SYMBOL(ib_dispatch_event);
+ 
+ static int iw_query_port(struct ib_device *device,
+ 			   u8 port_num,
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index 8d0f447e1faa1..a14f837fb1c84 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -2149,7 +2149,6 @@ struct ib_port_cache {
+ 
+ struct ib_cache {
+ 	rwlock_t                lock;
+-	struct ib_event_handler event_handler;
+ };
+ 
+ struct ib_port_immutable {
+@@ -2627,7 +2626,11 @@ struct ib_device {
+ 	struct rcu_head rcu_head;
+ 
+ 	struct list_head              event_handler_list;
+-	spinlock_t                    event_handler_lock;
++	/* Protects event_handler_list */
++	struct rw_semaphore event_handler_rwsem;
++
++	/* Protects QP's event_handler calls and open_qp list */
++	spinlock_t event_handler_lock;
+ 
+ 	struct rw_semaphore	      client_data_rwsem;
+ 	struct xarray                 client_data;
+@@ -2942,7 +2945,7 @@ bool ib_modify_qp_is_ok(enum ib_qp_state cur_state, enum ib_qp_state next_state,
+ 
+ void ib_register_event_handler(struct ib_event_handler *event_handler);
+ void ib_unregister_event_handler(struct ib_event_handler *event_handler);
+-void ib_dispatch_event(struct ib_event *event);
++void ib_dispatch_event(const struct ib_event *event);
+ 
+ int ib_query_port(struct ib_device *device,
+ 		  u8 port_num, struct ib_port_attr *port_attr);
+-- 
+2.20.1
+
diff --git a/queue-5.5/ib-hfi1-add-rcvshortlengtherrcnt-to-hfi1stats.patch b/queue-5.5/ib-hfi1-add-rcvshortlengtherrcnt-to-hfi1stats.patch
new file mode 100644
index 00000000000..744c3e377c5
--- /dev/null
+++ b/queue-5.5/ib-hfi1-add-rcvshortlengtherrcnt-to-hfi1stats.patch
@@ -0,0 +1,63 @@
+From 1bd198f8e8c4b70f8d532f718d8901a803f87981 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 08:42:35 -0500
+Subject: IB/hfi1: Add RcvShortLengthErrCnt to hfi1stats
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+[ Upstream commit 2c9d4e26d1ab27ceae2ded2ffe930f8e5f5b2a89 ]
+
+This counter, RxShrErr, is required for error analysis and debug.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Link: https://lore.kernel.org/r/20200106134235.119356.29123.stgit@awfm-01.aw.intel.com
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c           | 1 +
+ drivers/infiniband/hw/hfi1/chip.h           | 1 +
+ drivers/infiniband/hw/hfi1/chip_registers.h | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index d5961918fe157..10924f1220720 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -4114,6 +4114,7 @@ def_access_ibp_counter(rc_crwaits);
+ static struct cntr_entry dev_cntrs[DEV_CNTR_LAST] = {
+ [C_RCV_OVF] = RXE32_DEV_CNTR_ELEM(RcvOverflow, RCV_BUF_OVFL_CNT, CNTR_SYNTH),
+ [C_RX_LEN_ERR] = RXE32_DEV_CNTR_ELEM(RxLenErr, RCV_LENGTH_ERR_CNT, CNTR_SYNTH),
++[C_RX_SHORT_ERR] = RXE32_DEV_CNTR_ELEM(RxShrErr, RCV_SHORT_ERR_CNT, CNTR_SYNTH),
+ [C_RX_ICRC_ERR] = RXE32_DEV_CNTR_ELEM(RxICrcErr, RCV_ICRC_ERR_CNT, CNTR_SYNTH),
+ [C_RX_EBP] = RXE32_DEV_CNTR_ELEM(RxEbpCnt, RCV_EBP_CNT, CNTR_SYNTH),
+ [C_RX_TID_FULL] = RXE32_DEV_CNTR_ELEM(RxTIDFullEr, RCV_TID_FULL_ERR_CNT,
+diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
+index bfccd4ae07a72..af0061936c666 100644
+--- a/drivers/infiniband/hw/hfi1/chip.h
++++ b/drivers/infiniband/hw/hfi1/chip.h
+@@ -859,6 +859,7 @@ static inline int idx_from_vl(int vl)
+ enum {
+ 	C_RCV_OVF = 0,
+ 	C_RX_LEN_ERR,
++	C_RX_SHORT_ERR,
+ 	C_RX_ICRC_ERR,
+ 	C_RX_EBP,
+ 	C_RX_TID_FULL,
+diff --git a/drivers/infiniband/hw/hfi1/chip_registers.h b/drivers/infiniband/hw/hfi1/chip_registers.h
+index ab3589d17aee6..fb3ec9bff7a22 100644
+--- a/drivers/infiniband/hw/hfi1/chip_registers.h
++++ b/drivers/infiniband/hw/hfi1/chip_registers.h
+@@ -381,6 +381,7 @@
+ #define DC_LCB_STS_LINK_TRANSFER_ACTIVE (DC_LCB_CSRS + 0x000000000468)
+ #define DC_LCB_STS_ROUND_TRIP_LTP_CNT (DC_LCB_CSRS + 0x0000000004B0)
+ #define RCV_LENGTH_ERR_CNT 0
++#define RCV_SHORT_ERR_CNT 2
+ #define RCV_ICRC_ERR_CNT 6
+ #define RCV_EBP_CNT 9
+ #define RCV_BUF_OVFL_CNT 10
+-- 
+2.20.1
+
diff --git a/queue-5.5/ib-hfi1-add-software-counter-for-ctxt0-seq-drop.patch b/queue-5.5/ib-hfi1-add-software-counter-for-ctxt0-seq-drop.patch
new file mode 100644
index 00000000000..4d26c128a68
--- /dev/null
+++ b/queue-5.5/ib-hfi1-add-software-counter-for-ctxt0-seq-drop.patch
@@ -0,0 +1,95 @@
+From 6467b65548f6c35c792fef97024f0589202d175b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 08:42:28 -0500
+Subject: IB/hfi1: Add software counter for ctxt0 seq drop
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+[ Upstream commit 5ffd048698ea5139743acd45e8ab388a683642b8 ]
+
+All other code paths increment some form of drop counter.
+
+This was missed in the original implementation.
+
+Fixes: 82c2611daaf0 ("staging/rdma/hfi1: Handle packets with invalid RHF on context 0")
+Link: https://lore.kernel.org/r/20200106134228.119356.96828.stgit@awfm-01.aw.intel.com
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c   | 10 ++++++++++
+ drivers/infiniband/hw/hfi1/chip.h   |  1 +
+ drivers/infiniband/hw/hfi1/driver.c |  1 +
+ drivers/infiniband/hw/hfi1/hfi.h    |  2 ++
+ 4 files changed, 14 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 9b1fb84a3d45b..d5961918fe157 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -1685,6 +1685,14 @@ static u64 access_sw_pio_drain(const struct cntr_entry *entry,
+ 	return dd->verbs_dev.n_piodrain;
+ }
+ 
++static u64 access_sw_ctx0_seq_drop(const struct cntr_entry *entry,
++				   void *context, int vl, int mode, u64 data)
++{
++	struct hfi1_devdata *dd = context;
++
++	return dd->ctx0_seq_drop;
++}
++
+ static u64 access_sw_vtx_wait(const struct cntr_entry *entry,
+ 			      void *context, int vl, int mode, u64 data)
+ {
+@@ -4249,6 +4257,8 @@ static struct cntr_entry dev_cntrs[DEV_CNTR_LAST] = {
+ 			    access_sw_cpu_intr),
+ [C_SW_CPU_RCV_LIM] = CNTR_ELEM("RcvLimit", 0, 0, CNTR_NORMAL,
+ 			    access_sw_cpu_rcv_limit),
++[C_SW_CTX0_SEQ_DROP] = CNTR_ELEM("SeqDrop0", 0, 0, CNTR_NORMAL,
++			    access_sw_ctx0_seq_drop),
+ [C_SW_VTX_WAIT] = CNTR_ELEM("vTxWait", 0, 0, CNTR_NORMAL,
+ 			    access_sw_vtx_wait),
+ [C_SW_PIO_WAIT] = CNTR_ELEM("PioWait", 0, 0, CNTR_NORMAL,
+diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
+index 4ca5ac8d7e9e4..bfccd4ae07a72 100644
+--- a/drivers/infiniband/hw/hfi1/chip.h
++++ b/drivers/infiniband/hw/hfi1/chip.h
+@@ -926,6 +926,7 @@ enum {
+ 	C_DC_PG_STS_TX_MBE_CNT,
+ 	C_SW_CPU_INTR,
+ 	C_SW_CPU_RCV_LIM,
++	C_SW_CTX0_SEQ_DROP,
+ 	C_SW_VTX_WAIT,
+ 	C_SW_PIO_WAIT,
+ 	C_SW_PIO_DRAIN,
+diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
+index 01aa1f132f55e..941b465244abe 100644
+--- a/drivers/infiniband/hw/hfi1/driver.c
++++ b/drivers/infiniband/hw/hfi1/driver.c
+@@ -734,6 +734,7 @@ static noinline int skip_rcv_packet(struct hfi1_packet *packet, int thread)
+ {
+ 	int ret;
+ 
++	packet->rcd->dd->ctx0_seq_drop++;
+ 	/* Set up for the next packet */
+ 	packet->rhqoff += packet->rsize;
+ 	if (packet->rhqoff >= packet->maxcnt)
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index 27dea5e1e2017..9edfd3e56f61c 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1153,6 +1153,8 @@ struct hfi1_devdata {
+ 
+ 	char *boardname; /* human readable board info */
+ 
++	u64 ctx0_seq_drop;
++
+ 	/* reset value */
+ 	u64 z_int_counter;
+ 	u64 z_rcv_limit;
+-- 
+2.20.1
+
diff --git a/queue-5.5/ice-add-extra-check-for-null-rx-descriptor.patch b/queue-5.5/ice-add-extra-check-for-null-rx-descriptor.patch
new file mode 100644
index 00000000000..ed57e530e4f
--- /dev/null
+++ b/queue-5.5/ice-add-extra-check-for-null-rx-descriptor.patch
@@ -0,0 +1,58 @@
+From 920912a5f04914f38f3de7edaab9c3b20934f875 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 03:13:05 -0800
+Subject: ice: add extra check for null Rx descriptor
+
+From: Mitch Williams <mitch.a.williams@intel.com>
+
+[ Upstream commit 1f45ebe0d8fbe6178670b663005f38ef8535db5d ]
+
+In the case where the hardware gives us a null Rx descriptor, it is
+theoretically possible that we could call one of our skb-construction
+functions with no data pointer, which would cause a panic.
+
+In real life, this will never happen - we only get null RX
+descriptors as the final descriptor in a chain of otherwise-valid
+descriptors. When this happens, the skb will be extant and we'll just
+call ice_add_rx_frag(), which can deal with empty data buffers.
+
+Unfortunately, Coverity does not have intimate knowledge of our
+hardware, so we must add a check here.
+
+Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_txrx.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
+index 2c212f64d99f2..8b2b9e254d28d 100644
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
+@@ -1071,13 +1071,16 @@ static int ice_clean_rx_irq(struct ice_ring *rx_ring, int budget)
+ 		ice_put_rx_buf(rx_ring, rx_buf);
+ 		continue;
+ construct_skb:
+-		if (skb)
++		if (skb) {
+ 			ice_add_rx_frag(rx_ring, rx_buf, skb, size);
+-		else if (ice_ring_uses_build_skb(rx_ring))
+-			skb = ice_build_skb(rx_ring, rx_buf, &xdp);
+-		else
++		} else if (likely(xdp.data)) {
++			if (ice_ring_uses_build_skb(rx_ring))
++				skb = ice_build_skb(rx_ring, rx_buf, &xdp);
++			else
++				skb = ice_construct_skb(rx_ring, rx_buf, &xdp);
++		} else {
+ 			skb = ice_construct_skb(rx_ring, rx_buf, &xdp);
+-
++		}
+ 		/* exit if we failed to retrieve a buffer */
+ 		if (!skb) {
+ 			rx_ring->rx_stats.alloc_buf_failed++;
+-- 
+2.20.1
+
diff --git a/queue-5.5/ide-serverworks-potential-overflow-in-svwks_set_pio_.patch b/queue-5.5/ide-serverworks-potential-overflow-in-svwks_set_pio_.patch
new file mode 100644
index 00000000000..02163ddb367
--- /dev/null
+++ b/queue-5.5/ide-serverworks-potential-overflow-in-svwks_set_pio_.patch
@@ -0,0 +1,45 @@
+From 18d7ec633b64a2a9afbaf5b1973e54ed5cf94b6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 16:06:07 +0300
+Subject: ide: serverworks: potential overflow in svwks_set_pio_mode()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ce1f31b4c0b9551dd51874dd5364654ed4ca13ae ]
+
+The "drive->dn" variable is a u8 controlled by root.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ide/serverworks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
+index ac6fc3fffa0de..458e72e034b09 100644
+--- a/drivers/ide/serverworks.c
++++ b/drivers/ide/serverworks.c
+@@ -115,6 +115,9 @@ static void svwks_set_pio_mode(ide_hwif_t *hwif, ide_drive_t *drive)
+ 	struct pci_dev *dev = to_pci_dev(hwif->dev);
+ 	const u8 pio = drive->pio_mode - XFER_PIO_0;
+ 
++	if (drive->dn >= ARRAY_SIZE(drive_pci))
++		return;
++
+ 	pci_write_config_byte(dev, drive_pci[drive->dn], pio_modes[pio]);
+ 
+ 	if (svwks_csb_check(dev)) {
+@@ -141,6 +144,9 @@ static void svwks_set_dma_mode(ide_hwif_t *hwif, ide_drive_t *drive)
+ 
+ 	u8 ultra_enable	 = 0, ultra_timing = 0, dma_timing = 0;
+ 
++	if (drive->dn >= ARRAY_SIZE(drive_pci2))
++		return;
++
+ 	pci_read_config_byte(dev, (0x56|hwif->channel), &ultra_timing);
+ 	pci_read_config_byte(dev, 0x54, &ultra_enable);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/iio-imu-st_lsm6dsx-check-return-value-from-st_lsm6ds.patch b/queue-5.5/iio-imu-st_lsm6dsx-check-return-value-from-st_lsm6ds.patch
new file mode 100644
index 00000000000..565052acbd1
--- /dev/null
+++ b/queue-5.5/iio-imu-st_lsm6dsx-check-return-value-from-st_lsm6ds.patch
@@ -0,0 +1,48 @@
+From 5e88cf7f43202f58906fccc24c7853c6f3526c03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 09:36:29 +0100
+Subject: iio: imu: st_lsm6dsx: check return value from
+ st_lsm6dsx_sensor_set_enable
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit a2dd9bd9334efb8dc0bdc0109abff3a7b57effb1 ]
+
+Add missing return value check in st_lsm6dsx_read_oneshot disabling the
+sensor. The issue is reported by coverity with the following error:
+
+Unchecked return value:
+If the function returns an error value, the error value may be mistaken
+for a normal value.
+
+Addresses-Coverity-ID: 1446733 ("Unchecked return value")
+Fixes: b5969abfa8b8 ("iio: imu: st_lsm6dsx: add motion events")
+Fixes: 290a6ce11d93 ("iio: imu: add support to lsm6dsx driver")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+index b921dd9e108fa..e45123d8d2812 100644
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+@@ -1506,8 +1506,11 @@ static int st_lsm6dsx_read_oneshot(struct st_lsm6dsx_sensor *sensor,
+ 	if (err < 0)
+ 		return err;
+ 
+-	if (!hw->enable_event)
+-		st_lsm6dsx_sensor_set_enable(sensor, false);
++	if (!hw->enable_event) {
++		err = st_lsm6dsx_sensor_set_enable(sensor, false);
++		if (err < 0)
++			return err;
++	}
+ 
+ 	*val = (s16)le16_to_cpu(data);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/ima-check-ima-policy-flag.patch b/queue-5.5/ima-check-ima-policy-flag.patch
new file mode 100644
index 00000000000..9b662665b7f
--- /dev/null
+++ b/queue-5.5/ima-check-ima-policy-flag.patch
@@ -0,0 +1,41 @@
+From 7ab843f82661f86eb19f8c32179da954f14fd606 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 08:47:02 -0800
+Subject: IMA: Check IMA policy flag
+
+From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+
+[ Upstream commit c5563bad88e07017e08cce1142903e501598c80c ]
+
+process_buffer_measurement() may be called prior to IMA being
+initialized (for instance, when the IMA hook is called when
+a key is added to the .builtin_trusted_keys keyring), which
+would result in a kernel panic.
+
+This patch adds the check in process_buffer_measurement()
+to return immediately if IMA is not initialized yet.
+
+Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
+index d7e987baf1274..9b35db2fc777a 100644
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -655,6 +655,9 @@ void process_buffer_measurement(const void *buf, int size,
+ 	int action = 0;
+ 	u32 secid;
+ 
++	if (!ima_policy_flag)
++		return;
++
+ 	/*
+ 	 * Both LSM hooks and auxilary based buffer measurements are
+ 	 * based on policy.  To avoid code duplication, differentiate
+-- 
+2.20.1
+
diff --git a/queue-5.5/input-edt-ft5x06-work-around-first-register-access-e.patch b/queue-5.5/input-edt-ft5x06-work-around-first-register-access-e.patch
new file mode 100644
index 00000000000..e1a6fab932a
--- /dev/null
+++ b/queue-5.5/input-edt-ft5x06-work-around-first-register-access-e.patch
@@ -0,0 +1,55 @@
+From 9dd1c4e1d8e118456dabddd6889d3caaf6a22270 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2020 17:03:21 -0800
+Subject: Input: edt-ft5x06 - work around first register access error
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit e112324cc0422c046f1cf54c56f333d34fa20885 ]
+
+The EP0700MLP1 returns bogus data on the first register read access
+(reading the threshold parameter from register 0x00):
+
+    edt_ft5x06 2-0038: crc error: 0xfc expected, got 0x40
+
+It ignores writes until then. This patch adds a dummy read after which
+the number of sensors and parameter read/writes work correctly.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Tested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/edt-ft5x06.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
+index d61731c0037d1..b87b1e074f624 100644
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -1050,6 +1050,7 @@ static int edt_ft5x06_ts_probe(struct i2c_client *client,
+ {
+ 	const struct edt_i2c_chip_data *chip_data;
+ 	struct edt_ft5x06_ts_data *tsdata;
++	u8 buf[2] = { 0xfc, 0x00 };
+ 	struct input_dev *input;
+ 	unsigned long irq_flags;
+ 	int error;
+@@ -1140,6 +1141,12 @@ static int edt_ft5x06_ts_probe(struct i2c_client *client,
+ 		return error;
+ 	}
+ 
++	/*
++	 * Dummy read access. EP0700MLP1 returns bogus data on the first
++	 * register read access and ignores writes.
++	 */
++	edt_ft5x06_ts_readwrite(tsdata->client, 2, buf, 2, buf);
++
+ 	edt_ft5x06_ts_set_regs(tsdata);
+ 	edt_ft5x06_ts_get_defaults(&client->dev, tsdata);
+ 	edt_ft5x06_ts_get_parameters(tsdata);
+-- 
+2.20.1
+
diff --git a/queue-5.5/iommu-amd-check-feature-support-bit-before-accessing.patch b/queue-5.5/iommu-amd-check-feature-support-bit-before-accessing.patch
new file mode 100644
index 00000000000..a6ecda3a5b5
--- /dev/null
+++ b/queue-5.5/iommu-amd-check-feature-support-bit-before-accessing.patch
@@ -0,0 +1,83 @@
+From 30f158136626c64f2d7576e51492d974259f6097 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 07:55:48 -0600
+Subject: iommu/amd: Check feature support bit before accessing MSI capability
+ registers
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+[ Upstream commit 813071438e83d338ba5cfe98b3b26c890dc0a6c0 ]
+
+The IOMMU MMIO access to MSI capability registers is available only if
+the EFR[MsiCapMmioSup] is set. Current implementation assumes this bit
+is set if the EFR[XtSup] is set, which might not be the case.
+
+Fix by checking the EFR[MsiCapMmioSup] before accessing the MSI address
+low/high and MSI data registers via the MMIO.
+
+Fixes: 66929812955b ('iommu/amd: Add support for X2APIC IOMMU interrupts')
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_init.c  | 17 ++++++++++++-----
+ drivers/iommu/amd_iommu_types.h |  1 +
+ 2 files changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 483f7bc379fa8..61628c906ce11 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -147,7 +147,7 @@ bool amd_iommu_dump;
+ bool amd_iommu_irq_remap __read_mostly;
+ 
+ int amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_VAPIC;
+-static int amd_iommu_xt_mode = IRQ_REMAP_X2APIC_MODE;
++static int amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE;
+ 
+ static bool amd_iommu_detected;
+ static bool __initdata amd_iommu_disabled;
+@@ -1534,8 +1534,15 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
+ 			iommu->mmio_phys_end = MMIO_CNTR_CONF_OFFSET;
+ 		if (((h->efr_reg & (0x1 << IOMMU_EFR_GASUP_SHIFT)) == 0))
+ 			amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY;
+-		if (((h->efr_reg & (0x1 << IOMMU_EFR_XTSUP_SHIFT)) == 0))
+-			amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE;
++		/*
++		 * Note: Since iommu_update_intcapxt() leverages
++		 * the IOMMU MMIO access to MSI capability block registers
++		 * for MSI address lo/hi/data, we need to check both
++		 * EFR[XtSup] and EFR[MsiCapMmioSup] for x2APIC support.
++		 */
++		if ((h->efr_reg & BIT(IOMMU_EFR_XTSUP_SHIFT)) &&
++		    (h->efr_reg & BIT(IOMMU_EFR_MSICAPMMIOSUP_SHIFT)))
++			amd_iommu_xt_mode = IRQ_REMAP_X2APIC_MODE;
+ 		break;
+ 	default:
+ 		return -EINVAL;
+@@ -1996,8 +2003,8 @@ static int iommu_init_intcapxt(struct amd_iommu *iommu)
+ 	struct irq_affinity_notify *notify = &iommu->intcapxt_notify;
+ 
+ 	/**
+-	 * IntCapXT requires XTSup=1, which can be inferred
+-	 * amd_iommu_xt_mode.
++	 * IntCapXT requires XTSup=1 and MsiCapMmioSup=1,
++	 * which can be inferred from amd_iommu_xt_mode.
+ 	 */
+ 	if (amd_iommu_xt_mode != IRQ_REMAP_X2APIC_MODE)
+ 		return 0;
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index f52f59d5c6bd4..f8a7945f3df90 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -383,6 +383,7 @@
+ /* IOMMU Extended Feature Register (EFR) */
+ #define IOMMU_EFR_XTSUP_SHIFT	2
+ #define IOMMU_EFR_GASUP_SHIFT	7
++#define IOMMU_EFR_MSICAPMMIOSUP_SHIFT	46
+ 
+ #define MAX_DOMAIN_ID 65536
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/iommu-amd-only-support-x2apic-with-ivhd-type-11h-40h.patch b/queue-5.5/iommu-amd-only-support-x2apic-with-ivhd-type-11h-40h.patch
new file mode 100644
index 00000000000..6c342c2820c
--- /dev/null
+++ b/queue-5.5/iommu-amd-only-support-x2apic-with-ivhd-type-11h-40h.patch
@@ -0,0 +1,54 @@
+From 101207e6f9005522168cca4029801cc6b0ab46fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 07:55:49 -0600
+Subject: iommu/amd: Only support x2APIC with IVHD type 11h/40h
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+[ Upstream commit 966b753cf3969553ca50bacd2b8c4ddade5ecc9e ]
+
+Current implementation for IOMMU x2APIC support makes use of
+the MMIO access to MSI capability block registers, which requires
+checking EFR[MsiCapMmioSup]. However, only IVHD type 11h/40h contain
+the information, and not in the IVHD type 10h IOMMU feature reporting
+field. Since the BIOS in newer systems, which supports x2APIC, would
+normally contain IVHD type 11h/40h, remove the IOMMU_FEAT_XTSUP_SHIFT
+check for IVHD type 10h, and only support x2APIC with IVHD type 11h/40h.
+
+Fixes: 66929812955b ('iommu/amd: Add support for X2APIC IOMMU interrupts')
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_init.c  | 2 --
+ drivers/iommu/amd_iommu_types.h | 1 -
+ 2 files changed, 3 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 61628c906ce11..d7cbca8bf2cd4 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -1523,8 +1523,6 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
+ 			iommu->mmio_phys_end = MMIO_CNTR_CONF_OFFSET;
+ 		if (((h->efr_attr & (0x1 << IOMMU_FEAT_GASUP_SHIFT)) == 0))
+ 			amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY;
+-		if (((h->efr_attr & (0x1 << IOMMU_FEAT_XTSUP_SHIFT)) == 0))
+-			amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE;
+ 		break;
+ 	case 0x11:
+ 	case 0x40:
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index f8a7945f3df90..798e1533a1471 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -377,7 +377,6 @@
+ #define IOMMU_CAP_EFR     27
+ 
+ /* IOMMU Feature Reporting Field (for IVHD type 10h */
+-#define IOMMU_FEAT_XTSUP_SHIFT	0
+ #define IOMMU_FEAT_GASUP_SHIFT	6
+ 
+ /* IOMMU Extended Feature Register (EFR) */
+-- 
+2.20.1
+
diff --git a/queue-5.5/iommu-arm-smmu-v3-use-write_once-when-changing-valid.patch b/queue-5.5/iommu-arm-smmu-v3-use-write_once-when-changing-valid.patch
new file mode 100644
index 00000000000..d75eb91f63b
--- /dev/null
+++ b/queue-5.5/iommu-arm-smmu-v3-use-write_once-when-changing-valid.patch
@@ -0,0 +1,40 @@
+From d45d1541247160d5e7ee32a5b6464fe6dcedca00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 15:21:47 +0000
+Subject: iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit d71e01716b3606a6648df7e5646ae12c75babde4 ]
+
+If, for some bizarre reason, the compiler decided to split up the write
+of STE DWORD 0, we could end up making a partial structure valid.
+
+Although this probably won't happen, follow the example of the
+context-descriptor code and use WRITE_ONCE() to ensure atomicity of the
+write.
+
+Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm-smmu-v3.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index 2f7680faba49e..6bd6a3f3f4710 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -1643,7 +1643,8 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_master *master, u32 sid,
+ 						 STRTAB_STE_1_EATS_TRANS));
+ 
+ 	arm_smmu_sync_ste_for_sid(smmu, sid);
+-	dst[0] = cpu_to_le64(val);
++	/* See comment in arm_smmu_write_ctx_desc() */
++	WRITE_ONCE(dst[0], cpu_to_le64(val));
+ 	arm_smmu_sync_ste_for_sid(smmu, sid);
+ 
+ 	/* It's likely that we'll want to use the new STE soon */
+-- 
+2.20.1
+
diff --git a/queue-5.5/iommu-iova-silence-warnings-under-memory-pressure.patch b/queue-5.5/iommu-iova-silence-warnings-under-memory-pressure.patch
new file mode 100644
index 00000000000..7fafc279141
--- /dev/null
+++ b/queue-5.5/iommu-iova-silence-warnings-under-memory-pressure.patch
@@ -0,0 +1,161 @@
+From ab032b2ce3a3d5ac98ebfca10c504d228eaf3135 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2019 14:16:54 -0500
+Subject: iommu/iova: Silence warnings under memory pressure
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit 944c9175397476199d4dd1028d87ddc582c35ee8 ]
+
+When running heavy memory pressure workloads, this 5+ old system is
+throwing endless warnings below because disk IO is too slow to recover
+from swapping. Since the volume from alloc_iova_fast() could be large,
+once it calls printk(), it will trigger disk IO (writing to the log
+files) and pending softirqs which could cause an infinite loop and make
+no progress for days by the ongoimng memory reclaim. This is the counter
+part for Intel where the AMD part has already been merged. See the
+commit 3d708895325b ("iommu/amd: Silence warnings under memory
+pressure"). Since the allocation failure will be reported in
+intel_alloc_iova(), so just call dev_err_once() there because even the
+"ratelimited" is too much, and silence the one in alloc_iova_mem() to
+avoid the expensive warn_alloc().
+
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ slab_out_of_memory: 66 callbacks suppressed
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+   cache: iommu_iova, object size: 40, buffer size: 448, default order:
+0, min order: 0
+   node 0: slabs: 1822, objs: 16398, free: 0
+   node 1: slabs: 2051, objs: 18459, free: 31
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+   cache: iommu_iova, object size: 40, buffer size: 448, default order:
+0, min order: 0
+   node 0: slabs: 1822, objs: 16398, free: 0
+   node 1: slabs: 2051, objs: 18459, free: 31
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+   cache: iommu_iova, object size: 40, buffer size: 448, default order:
+0, min order: 0
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+   cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+   cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+   cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+   cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+   node 0: slabs: 697, objs: 4182, free: 0
+   node 0: slabs: 697, objs: 4182, free: 0
+   node 0: slabs: 697, objs: 4182, free: 0
+   node 0: slabs: 697, objs: 4182, free: 0
+   node 1: slabs: 381, objs: 2286, free: 27
+   node 1: slabs: 381, objs: 2286, free: 27
+   node 1: slabs: 381, objs: 2286, free: 27
+   node 1: slabs: 381, objs: 2286, free: 27
+   node 0: slabs: 1822, objs: 16398, free: 0
+   cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+   node 1: slabs: 2051, objs: 18459, free: 31
+   node 0: slabs: 697, objs: 4182, free: 0
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+   node 1: slabs: 381, objs: 2286, free: 27
+   cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+   node 0: slabs: 697, objs: 4182, free: 0
+   node 1: slabs: 381, objs: 2286, free: 27
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ warn_alloc: 96 callbacks suppressed
+ kworker/11:1H: page allocation failure: order:0,
+mode:0xa20(GFP_ATOMIC), nodemask=(null),cpuset=/,mems_allowed=0-1
+ CPU: 11 PID: 1642 Comm: kworker/11:1H Tainted: G    B
+ Hardware name: HP ProLiant XL420 Gen9/ProLiant XL420 Gen9, BIOS U19
+12/27/2015
+ Workqueue: kblockd blk_mq_run_work_fn
+ Call Trace:
+  dump_stack+0xa0/0xea
+  warn_alloc.cold.94+0x8a/0x12d
+  __alloc_pages_slowpath+0x1750/0x1870
+  __alloc_pages_nodemask+0x58a/0x710
+  alloc_pages_current+0x9c/0x110
+  alloc_slab_page+0xc9/0x760
+  allocate_slab+0x48f/0x5d0
+  new_slab+0x46/0x70
+  ___slab_alloc+0x4ab/0x7b0
+  __slab_alloc+0x43/0x70
+  kmem_cache_alloc+0x2dd/0x450
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+  alloc_iova+0x33/0x210
+   cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+   node 0: slabs: 697, objs: 4182, free: 0
+  alloc_iova_fast+0x62/0x3d1
+   node 1: slabs: 381, objs: 2286, free: 27
+  intel_alloc_iova+0xce/0xe0
+  intel_map_sg+0xed/0x410
+  scsi_dma_map+0xd7/0x160
+  scsi_queue_rq+0xbf7/0x1310
+  blk_mq_dispatch_rq_list+0x4d9/0xbc0
+  blk_mq_sched_dispatch_requests+0x24a/0x300
+  __blk_mq_run_hw_queue+0x156/0x230
+  blk_mq_run_work_fn+0x3b/0x40
+  process_one_work+0x579/0xb90
+  worker_thread+0x63/0x5b0
+  kthread+0x1e6/0x210
+  ret_from_fork+0x3a/0x50
+ Mem-Info:
+ active_anon:2422723 inactive_anon:361971 isolated_anon:34403
+  active_file:2285 inactive_file:1838 isolated_file:0
+  unevictable:0 dirty:1 writeback:5 unstable:0
+  slab_reclaimable:13972 slab_unreclaimable:453879
+  mapped:2380 shmem:154 pagetables:6948 bounce:0
+  free:19133 free_pcp:7363 free_cma:0
+
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 3 ++-
+ drivers/iommu/iova.c        | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 932267f49f9a8..541896ab3d086 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3406,7 +3406,8 @@ static unsigned long intel_alloc_iova(struct device *dev,
+ 	iova_pfn = alloc_iova_fast(&domain->iovad, nrpages,
+ 				   IOVA_PFN(dma_mask), true);
+ 	if (unlikely(!iova_pfn)) {
+-		dev_err(dev, "Allocating %ld-page iova failed", nrpages);
++		dev_err_once(dev, "Allocating %ld-page iova failed\n",
++			     nrpages);
+ 		return 0;
+ 	}
+ 
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index c7a914b9bbbc4..0e6a9536eca62 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -233,7 +233,7 @@ static DEFINE_MUTEX(iova_cache_mutex);
+ 
+ struct iova *alloc_iova_mem(void)
+ {
+-	return kmem_cache_zalloc(iova_cache, GFP_ATOMIC);
++	return kmem_cache_zalloc(iova_cache, GFP_ATOMIC | __GFP_NOWARN);
+ }
+ EXPORT_SYMBOL(alloc_iova_mem);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/iommu-vt-d-avoid-sending-invalid-page-response.patch b/queue-5.5/iommu-vt-d-avoid-sending-invalid-page-response.patch
new file mode 100644
index 00000000000..5ab3c61905e
--- /dev/null
+++ b/queue-5.5/iommu-vt-d-avoid-sending-invalid-page-response.patch
@@ -0,0 +1,45 @@
+From e486f6e87c200931c72d3c22756d4cb31f24b012 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 08:18:09 +0800
+Subject: iommu/vt-d: Avoid sending invalid page response
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 5f75585e19cc7018bf2016aa771632081ee2f313 ]
+
+Page responses should only be sent when last page in group (LPIG) or
+private data is present in the page request. This patch avoids sending
+invalid descriptors.
+
+Fixes: 5d308fc1ecf53 ("iommu/vt-d: Add 256-bit invalidation descriptor support")
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-svm.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index ff7a3f9add325..518d0b2d12afd 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -654,11 +654,10 @@ static irqreturn_t prq_event_thread(int irq, void *d)
+ 			if (req->priv_data_present)
+ 				memcpy(&resp.qw2, req->priv_data,
+ 				       sizeof(req->priv_data));
++			resp.qw2 = 0;
++			resp.qw3 = 0;
++			qi_submit_sync(&resp, iommu);
+ 		}
+-		resp.qw2 = 0;
+-		resp.qw3 = 0;
+-		qi_submit_sync(&resp, iommu);
+-
+ 		head = (head + sizeof(*req)) & PRQ_RING_MASK;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/iommu-vt-d-fix-off-by-one-in-pasid-allocation.patch b/queue-5.5/iommu-vt-d-fix-off-by-one-in-pasid-allocation.patch
new file mode 100644
index 00000000000..856e4fd8050
--- /dev/null
+++ b/queue-5.5/iommu-vt-d-fix-off-by-one-in-pasid-allocation.patch
@@ -0,0 +1,39 @@
+From 179ad791ede76fa7b819c07f983bfdff3ed10118 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 08:18:07 +0800
+Subject: iommu/vt-d: Fix off-by-one in PASID allocation
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 39d630e332144028f56abba83d94291978e72df1 ]
+
+PASID allocator uses IDR which is exclusive for the end of the
+allocation range. There is no need to decrement pasid_max.
+
+Fixes: af39507305fb ("iommu/vt-d: Apply global PASID in SVA")
+Reported-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index dca88f9fdf29a..ff7a3f9add325 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -317,7 +317,7 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_
+ 		/* Do not use PASID 0 in caching mode (virtualised IOMMU) */
+ 		ret = intel_pasid_alloc_id(svm,
+ 					   !!cap_caching_mode(iommu->cap),
+-					   pasid_max - 1, GFP_KERNEL);
++					   pasid_max, GFP_KERNEL);
+ 		if (ret < 0) {
+ 			kfree(svm);
+ 			kfree(sdev);
+-- 
+2.20.1
+
diff --git a/queue-5.5/iommu-vt-d-mark-firmware-tainted-if-rmrr-fails-sanit.patch b/queue-5.5/iommu-vt-d-mark-firmware-tainted-if-rmrr-fails-sanit.patch
new file mode 100644
index 00000000000..86089441cc6
--- /dev/null
+++ b/queue-5.5/iommu-vt-d-mark-firmware-tainted-if-rmrr-fails-sanit.patch
@@ -0,0 +1,57 @@
+From 4b0999f09d7e0428cf0f0214be46fbb23166e05a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 11:03:56 +0800
+Subject: iommu/vt-d: Mark firmware tainted if RMRR fails sanity check
+
+From: Barret Rhoden <brho@google.com>
+
+[ Upstream commit f5a68bb0752e0cf77c06f53f72258e7beb41381b ]
+
+RMRR entries describe memory regions that are DMA targets for devices
+outside the kernel's control.
+
+RMRR entries that fail the sanity check are pointing to regions of
+memory that the firmware did not tell the kernel are reserved or
+otherwise should not be used.
+
+Instead of aborting DMAR processing, this commit marks the firmware
+as tainted. These RMRRs will still be identity mapped, otherwise,
+some devices, e.x. graphic devices, will not work during boot.
+
+Signed-off-by: Barret Rhoden <brho@google.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Fixes: f036c7fa0ab60 ("iommu/vt-d: Check VT-d RMRR region in BIOS is reported as reserved")
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 541896ab3d086..dfedbb04f647d 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -4320,12 +4320,16 @@ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
+ {
+ 	struct acpi_dmar_reserved_memory *rmrr;
+ 	struct dmar_rmrr_unit *rmrru;
+-	int ret;
+ 
+ 	rmrr = (struct acpi_dmar_reserved_memory *)header;
+-	ret = arch_rmrr_sanity_check(rmrr);
+-	if (ret)
+-		return ret;
++	if (arch_rmrr_sanity_check(rmrr))
++		WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND,
++			   "Your BIOS is broken; bad RMRR [%#018Lx-%#018Lx]\n"
++			   "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
++			   rmrr->base_address, rmrr->end_address,
++			   dmi_get_system_info(DMI_BIOS_VENDOR),
++			   dmi_get_system_info(DMI_BIOS_VERSION),
++			   dmi_get_system_info(DMI_PRODUCT_VERSION));
+ 
+ 	rmrru = kzalloc(sizeof(*rmrru), GFP_KERNEL);
+ 	if (!rmrru)
+-- 
+2.20.1
+
diff --git a/queue-5.5/iommu-vt-d-match-cpu-and-iommu-paging-mode.patch b/queue-5.5/iommu-vt-d-match-cpu-and-iommu-paging-mode.patch
new file mode 100644
index 00000000000..80d0cc6626f
--- /dev/null
+++ b/queue-5.5/iommu-vt-d-match-cpu-and-iommu-paging-mode.patch
@@ -0,0 +1,57 @@
+From 37e212930d35ff5ce449d2f2ad7bc38f2ab25021 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 08:18:04 +0800
+Subject: iommu/vt-d: Match CPU and IOMMU paging mode
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 79db7e1b4cf2a006f556099c13de3b12970fc6e3 ]
+
+When setting up first level page tables for sharing with CPU, we need
+to ensure IOMMU can support no less than the levels supported by the
+CPU.
+
+It is not adequate, as in the current code, to set up 5-level paging
+in PASID entry First Level Paging Mode(FLPM) solely based on CPU.
+
+Currently, intel_pasid_setup_first_level() is only used by native SVM
+code which already checks paging mode matches. However, future use of
+this helper function may not be limited to native SVM.
+https://lkml.org/lkml/2019/11/18/1037
+
+Fixes: 437f35e1cd4c8 ("iommu/vt-d: Add first level page table interface")
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-pasid.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel-pasid.c b/drivers/iommu/intel-pasid.c
+index 040a445be3009..e7cb0b8a73327 100644
+--- a/drivers/iommu/intel-pasid.c
++++ b/drivers/iommu/intel-pasid.c
+@@ -499,8 +499,16 @@ int intel_pasid_setup_first_level(struct intel_iommu *iommu,
+ 	}
+ 
+ #ifdef CONFIG_X86
+-	if (cpu_feature_enabled(X86_FEATURE_LA57))
+-		pasid_set_flpm(pte, 1);
++	/* Both CPU and IOMMU paging mode need to match */
++	if (cpu_feature_enabled(X86_FEATURE_LA57)) {
++		if (cap_5lp_support(iommu->cap)) {
++			pasid_set_flpm(pte, 1);
++		} else {
++			pr_err("VT-d has no 5-level paging support for CPU\n");
++			pasid_clear_entry(pte);
++			return -EINVAL;
++		}
++	}
+ #endif /* CONFIG_X86 */
+ 
+ 	pasid_set_domain_id(pte, did);
+-- 
+2.20.1
+
diff --git a/queue-5.5/iommu-vt-d-remove-unnecessary-warn_on_once.patch b/queue-5.5/iommu-vt-d-remove-unnecessary-warn_on_once.patch
new file mode 100644
index 00000000000..e8c89b63610
--- /dev/null
+++ b/queue-5.5/iommu-vt-d-remove-unnecessary-warn_on_once.patch
@@ -0,0 +1,49 @@
+From 8cb6da41f79cef378a780aa167b29d927175d848 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 09:52:36 +0800
+Subject: iommu/vt-d: Remove unnecessary WARN_ON_ONCE()
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 857f081426e5aa38313426c13373730f1345fe95 ]
+
+Address field in device TLB invalidation descriptor is qualified
+by the S field. If S field is zero, a single page at page address
+specified by address [63:12] is requested to be invalidated. If S
+field is set, the least significant bit in the address field with
+value 0b (say bit N) indicates the invalidation address range. The
+spec doesn't require the address [N - 1, 0] to be cleared, hence
+remove the unnecessary WARN_ON_ONCE().
+
+Otherwise, the caller might set "mask = MAX_AGAW_PFN_WIDTH" in order
+to invalidating all the cached mappings on an endpoint, and below
+overflow error will be triggered.
+
+[...]
+UBSAN: Undefined behaviour in drivers/iommu/dmar.c:1354:3
+shift exponent 64 is too large for 64-bit type 'long long unsigned int'
+[...]
+
+Reported-and-tested-by: Frank <fgndev@posteo.de>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/dmar.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 3acfa6a25fa29..fb66f717127d2 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1354,7 +1354,6 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid,
+ 	struct qi_desc desc;
+ 
+ 	if (mask) {
+-		WARN_ON_ONCE(addr & ((1ULL << (VTD_PAGE_SHIFT + mask)) - 1));
+ 		addr |= (1ULL << (VTD_PAGE_SHIFT + mask - 1)) - 1;
+ 		desc.qw1 = QI_DEV_IOTLB_ADDR(addr) | QI_DEV_IOTLB_SIZE;
+ 	} else
+-- 
+2.20.1
+
diff --git a/queue-5.5/ipw2x00-fix-wcast-function-type.patch b/queue-5.5/ipw2x00-fix-wcast-function-type.patch
new file mode 100644
index 00000000000..c41acd80da7
--- /dev/null
+++ b/queue-5.5/ipw2x00-fix-wcast-function-type.patch
@@ -0,0 +1,81 @@
+From b09eb67dce1f45dbc58019410028fc9209b7be2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:27 +0700
+Subject: ipw2x00: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit ebd77feb27e91bb5fe35a7818b7c13ea7435fb98 ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/ipw2x00/ipw2100.c | 7 ++++---
+ drivers/net/wireless/intel/ipw2x00/ipw2200.c | 5 +++--
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+index c4c83ab60cbc4..0579554ed4b38 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+@@ -3206,8 +3206,9 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv)
+ 	}
+ }
+ 
+-static void ipw2100_irq_tasklet(struct ipw2100_priv *priv)
++static void ipw2100_irq_tasklet(unsigned long data)
+ {
++	struct ipw2100_priv *priv = (struct ipw2100_priv *)data;
+ 	struct net_device *dev = priv->net_dev;
+ 	unsigned long flags;
+ 	u32 inta, tmp;
+@@ -6006,7 +6007,7 @@ static void ipw2100_rf_kill(struct work_struct *work)
+ 	spin_unlock_irqrestore(&priv->low_lock, flags);
+ }
+ 
+-static void ipw2100_irq_tasklet(struct ipw2100_priv *priv);
++static void ipw2100_irq_tasklet(unsigned long data);
+ 
+ static const struct net_device_ops ipw2100_netdev_ops = {
+ 	.ndo_open		= ipw2100_open,
+@@ -6136,7 +6137,7 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
+ 	INIT_DELAYED_WORK(&priv->rf_kill, ipw2100_rf_kill);
+ 	INIT_DELAYED_WORK(&priv->scan_event, ipw2100_scan_event);
+ 
+-	tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
++	tasklet_init(&priv->irq_tasklet,
+ 		     ipw2100_irq_tasklet, (unsigned long)priv);
+ 
+ 	/* NOTE:  We do not start the deferred work for status checks yet */
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+index 31e43fc1d12b3..5ef6f87a48ac7 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+@@ -1945,8 +1945,9 @@ static void notify_wx_assoc_event(struct ipw_priv *priv)
+ 	wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
+ }
+ 
+-static void ipw_irq_tasklet(struct ipw_priv *priv)
++static void ipw_irq_tasklet(unsigned long data)
+ {
++	struct ipw_priv *priv = (struct ipw_priv *)data;
+ 	u32 inta, inta_mask, handled = 0;
+ 	unsigned long flags;
+ 	int rc = 0;
+@@ -10677,7 +10678,7 @@ static int ipw_setup_deferred_work(struct ipw_priv *priv)
+ 	INIT_WORK(&priv->qos_activate, ipw_bg_qos_activate);
+ #endif				/* CONFIG_IPW2200_QOS */
+ 
+-	tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
++	tasklet_init(&priv->irq_tasklet,
+ 		     ipw_irq_tasklet, (unsigned long)priv);
+ 
+ 	return ret;
+-- 
+2.20.1
+
diff --git a/queue-5.5/irqchip-gic-v3-its-fix-get_vlpi_map-breakage-with-do.patch b/queue-5.5/irqchip-gic-v3-its-fix-get_vlpi_map-breakage-with-do.patch
new file mode 100644
index 00000000000..046992e82dd
--- /dev/null
+++ b/queue-5.5/irqchip-gic-v3-its-fix-get_vlpi_map-breakage-with-do.patch
@@ -0,0 +1,55 @@
+From 914c34d9faa07bba3fd8843445d8fdfa7e476f99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 13:53:44 +0000
+Subject: irqchip/gic-v3-its: Fix get_vlpi_map() breakage with doorbells
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 093bf439fee0d40ade7e309c1288b409cdc3b38f ]
+
+When updating an LPI configuration, get_vlpi_map() may be passed a
+irq_data structure relative to an ITS domain (the normal case) or one
+that is relative to the core GICv3 domain in the case of a GICv4
+doorbell.
+
+In the latter case, special care must be take not to dereference
+the irq_chip data as an its_dev structure, as that isn't what is
+stored there. Instead, check *first* whether the IRQ is forwarded
+to a vcpu, and only then try to obtain the vlpi mapping.
+
+Fixes: c1d4d5cd203c ("irqchip/gic-v3-its: Add its_vlpi_map helpers")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reported-by: Zenghui Yu <yuzenghui@huawei.com>
+Link: https://lore.kernel.org/r/20200122085609.658-1-yuzenghui@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index e05673bcd52bd..b704214390c0f 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -1170,13 +1170,14 @@ static void its_send_vclear(struct its_device *dev, u32 event_id)
+  */
+ static struct its_vlpi_map *get_vlpi_map(struct irq_data *d)
+ {
+-	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+-	u32 event = its_get_event_id(d);
++	if (irqd_is_forwarded_to_vcpu(d)) {
++		struct its_device *its_dev = irq_data_get_irq_chip_data(d);
++		u32 event = its_get_event_id(d);
+ 
+-	if (!irqd_is_forwarded_to_vcpu(d))
+-		return NULL;
++		return dev_event_to_vlpi_map(its_dev, event);
++	}
+ 
+-	return dev_event_to_vlpi_map(its_dev, event);
++	return NULL;
+ }
+ 
+ static void lpi_write_config(struct irq_data *d, u8 clr, u8 set)
+-- 
+2.20.1
+
diff --git a/queue-5.5/irqchip-gic-v3-its-reference-to-its_invall_cmd-descr.patch b/queue-5.5/irqchip-gic-v3-its-reference-to-its_invall_cmd-descr.patch
new file mode 100644
index 00000000000..38f8672aba1
--- /dev/null
+++ b/queue-5.5/irqchip-gic-v3-its-reference-to-its_invall_cmd-descr.patch
@@ -0,0 +1,40 @@
+From ee58e922994adfd63ae4ec848e6fe32ef479f9b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2019 15:10:21 +0800
+Subject: irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when
+ building INVALL
+
+From: Zenghui Yu <yuzenghui@huawei.com>
+
+[ Upstream commit 107945227ac5d4c37911c7841b27c64b489ce9a9 ]
+
+It looks like an obvious mistake to use its_mapc_cmd descriptor when
+building the INVALL command block. It so far worked by luck because
+both its_mapc_cmd.col and its_invall_cmd.col sit at the same offset of
+the ITS command descriptor, but we should not rely on it.
+
+Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue")
+Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20191202071021.1251-1-yuzenghui@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index b704214390c0f..50f89056c16bb 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -598,7 +598,7 @@ static struct its_collection *its_build_invall_cmd(struct its_node *its,
+ 						   struct its_cmd_desc *desc)
+ {
+ 	its_encode_cmd(cmd, GITS_CMD_INVALL);
+-	its_encode_collection(cmd, desc->its_mapc_cmd.col->col_id);
++	its_encode_collection(cmd, desc->its_invall_cmd.col->col_id);
+ 
+ 	its_fixup_cmd(cmd);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/irqchip-gic-v3-only-provision-redistributors-that-ar.patch b/queue-5.5/irqchip-gic-v3-only-provision-redistributors-that-ar.patch
new file mode 100644
index 00000000000..ed8aa1b7d3b
--- /dev/null
+++ b/queue-5.5/irqchip-gic-v3-only-provision-redistributors-that-ar.patch
@@ -0,0 +1,71 @@
+From 58e6bf23176f978ba748b80cd702d525f7e0e29a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 11:24:57 +0000
+Subject: irqchip/gic-v3: Only provision redistributors that are enabled in
+ ACPI
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 926b5dfa6b8dc666ff398044af6906b156e1d949 ]
+
+We currently allocate redistributor region structures for
+individual redistributors when ACPI doesn't present us with
+compact MMIO regions covering multiple redistributors.
+
+It turns out that we allocate these structures even when
+the redistributor is flagged as disabled by ACPI. It works
+fine until someone actually tries to tarse one of these
+structures, and access the corresponding MMIO region.
+
+Instead, track the number of enabled redistributors, and
+only allocate what is required. This makes sure that there
+is no invalid data to misuse.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reported-by: Heyi Guo <guoheyi@huawei.com>
+Tested-by: Heyi Guo <guoheyi@huawei.com>
+Link: https://lore.kernel.org/r/20191216062745.63397-1-guoheyi@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index d6218012097b4..3f5baa5043db4 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1821,6 +1821,7 @@ static struct
+ 	struct redist_region *redist_regs;
+ 	u32 nr_redist_regions;
+ 	bool single_redist;
++	int enabled_rdists;
+ 	u32 maint_irq;
+ 	int maint_irq_mode;
+ 	phys_addr_t vcpu_base;
+@@ -1915,8 +1916,10 @@ static int __init gic_acpi_match_gicc(union acpi_subtable_headers *header,
+ 	 * If GICC is enabled and has valid gicr base address, then it means
+ 	 * GICR base is presented via GICC
+ 	 */
+-	if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address)
++	if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address) {
++		acpi_data.enabled_rdists++;
+ 		return 0;
++	}
+ 
+ 	/*
+ 	 * It's perfectly valid firmware can pass disabled GICC entry, driver
+@@ -1946,8 +1949,10 @@ static int __init gic_acpi_count_gicr_regions(void)
+ 
+ 	count = acpi_table_parse_madt(ACPI_MADT_TYPE_GENERIC_INTERRUPT,
+ 				      gic_acpi_match_gicc, 0);
+-	if (count > 0)
++	if (count > 0) {
+ 		acpi_data.single_redist = true;
++		count = acpi_data.enabled_rdists;
++	}
+ 
+ 	return count;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/irqchip-mbigen-set-driver-.suppress_bind_attrs-to-av.patch b/queue-5.5/irqchip-mbigen-set-driver-.suppress_bind_attrs-to-av.patch
new file mode 100644
index 00000000000..a1faad73af9
--- /dev/null
+++ b/queue-5.5/irqchip-mbigen-set-driver-.suppress_bind_attrs-to-av.patch
@@ -0,0 +1,127 @@
+From be40174856b526239a92a0810f57f027da7461d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2020 01:38:43 +0800
+Subject: irqchip/mbigen: Set driver .suppress_bind_attrs to avoid remove
+ problems
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit d6152e6ec9e2171280436f7b31a571509b9287e1 ]
+
+The following crash can be seen for setting
+CONFIG_DEBUG_TEST_DRIVER_REMOVE=y for DT FW (which some people still use):
+
+Hisilicon MBIGEN-V2 60080000.interrupt-controller: Failed to create mbi-gen irqdomain
+Hisilicon MBIGEN-V2: probe of 60080000.interrupt-controller failed with error -12
+
+[...]
+
+Unable to handle kernel paging request at virtual address 0000000000005008
+ Mem abort info:
+   ESR = 0x96000004
+   EC = 0x25: DABT (current EL), IL = 32 bits
+   SET = 0, FnV = 0
+   EA = 0, S1PTW = 0
+ Data abort info:
+   ISV = 0, ISS = 0x00000004
+   CM = 0, WnR = 0
+ user pgtable: 4k pages, 48-bit VAs, pgdp=0000041fb9990000
+ [0000000000005008] pgd=0000000000000000
+ Internal error: Oops: 96000004 [#1] PREEMPT SMP
+ Modules linked in:
+ CPU: 7 PID: 1 Comm: swapper/0 Not tainted 5.5.0-rc6-00002-g3fc42638a506-dirty #1622
+ Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT21 Nemo 2.0 RC0 04/18/2018
+ pstate: 40000085 (nZcv daIf -PAN -UAO)
+ pc : mbigen_set_type+0x38/0x60
+ lr : __irq_set_trigger+0x6c/0x188
+ sp : ffff800014b4b400
+ x29: ffff800014b4b400 x28: 0000000000000007
+ x27: 0000000000000000 x26: 0000000000000000
+ x25: ffff041fd83bd0d4 x24: ffff041fd83bd188
+ x23: 0000000000000000 x22: ffff80001193ce00
+ x21: 0000000000000004 x20: 0000000000000000
+ x19: ffff041fd83bd000 x18: ffffffffffffffff
+ x17: 0000000000000000 x16: 0000000000000000
+ x15: ffff8000119098c8 x14: ffff041fb94ec91c
+ x13: ffff041fb94ec1a1 x12: 0000000000000030
+ x11: 0101010101010101 x10: 0000000000000040
+ x9 : 0000000000000000 x8 : ffff041fb98c6680
+ x7 : ffff800014b4b380 x6 : ffff041fd81636c8
+ x5 : 0000000000000000 x4 : 000000000000025f
+ x3 : 0000000000005000 x2 : 0000000000005008
+ x1 : 0000000000000004 x0 : 0000000080000000
+ Call trace:
+  mbigen_set_type+0x38/0x60
+  __setup_irq+0x744/0x900
+  request_threaded_irq+0xe0/0x198
+  pcie_pme_probe+0x98/0x118
+  pcie_port_probe_service+0x38/0x78
+  really_probe+0xa0/0x3e0
+  driver_probe_device+0x58/0x100
+  __device_attach_driver+0x90/0xb0
+  bus_for_each_drv+0x64/0xc8
+  __device_attach+0xd8/0x138
+  device_initial_probe+0x10/0x18
+  bus_probe_device+0x90/0x98
+  device_add+0x4c4/0x770
+  device_register+0x1c/0x28
+  pcie_port_device_register+0x1e4/0x4f0
+  pcie_portdrv_probe+0x34/0xd8
+  local_pci_probe+0x3c/0xa0
+  pci_device_probe+0x128/0x1c0
+  really_probe+0xa0/0x3e0
+  driver_probe_device+0x58/0x100
+  __device_attach_driver+0x90/0xb0
+  bus_for_each_drv+0x64/0xc8
+  __device_attach+0xd8/0x138
+  device_attach+0x10/0x18
+  pci_bus_add_device+0x4c/0xb8
+  pci_bus_add_devices+0x38/0x88
+  pci_host_probe+0x3c/0xc0
+  pci_host_common_probe+0xf0/0x208
+  hisi_pcie_almost_ecam_probe+0x24/0x30
+  platform_drv_probe+0x50/0xa0
+  really_probe+0xa0/0x3e0
+  driver_probe_device+0x58/0x100
+  device_driver_attach+0x6c/0x90
+  __driver_attach+0x84/0xc8
+  bus_for_each_dev+0x74/0xc8
+  driver_attach+0x20/0x28
+  bus_add_driver+0x148/0x1f0
+  driver_register+0x60/0x110
+  __platform_driver_register+0x40/0x48
+  hisi_pcie_almost_ecam_driver_init+0x1c/0x24
+
+The specific problem here is that the mbigen driver real probe has failed
+as the mbigen_of_create_domain()->of_platform_device_create() call fails,
+the reason for that being that we never destroyed the platform device
+created during the remove test dry run and there is some conflict.
+
+Since we generally would never want to unbind this driver, and to save
+adding a driver tear down path for that, just set the driver
+.suppress_bind_attrs member to avoid this possibility.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+Link: https://lore.kernel.org/r/1579196323-180137-1-git-send-email-john.garry@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-mbigen.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
+index 3f09f658e8e29..6b566bba263bd 100644
+--- a/drivers/irqchip/irq-mbigen.c
++++ b/drivers/irqchip/irq-mbigen.c
+@@ -374,6 +374,7 @@ static struct platform_driver mbigen_platform_driver = {
+ 		.name		= "Hisilicon MBIGEN-V2",
+ 		.of_match_table	= mbigen_of_match,
+ 		.acpi_match_table = ACPI_PTR(mbigen_acpi_match),
++		.suppress_bind_attrs = true,
+ 	},
+ 	.probe			= mbigen_device_probe,
+ };
+-- 
+2.20.1
+
diff --git a/queue-5.5/isdn-don-t-mark-kcapi_proc_exit-as-__exit.patch b/queue-5.5/isdn-don-t-mark-kcapi_proc_exit-as-__exit.patch
new file mode 100644
index 00000000000..1ffea790f14
--- /dev/null
+++ b/queue-5.5/isdn-don-t-mark-kcapi_proc_exit-as-__exit.patch
@@ -0,0 +1,49 @@
+From ad116418b2992100adcdad26a97319f28ca6c8cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 20:48:56 +0100
+Subject: isdn: don't mark kcapi_proc_exit as __exit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit b33bdf8020c94438269becc6dace9ed49257c4ba ]
+
+As everybody pointed out by now, my patch to clean up CAPI introduced
+a link time warning, as the two parts of the capi driver are now in
+one module and the exit function may need to be called in the error
+path of the init function:
+
+>> WARNING: drivers/isdn/capi/kernelcapi.o(.text+0xea4): Section mismatch in reference from the function kcapi_exit() to the function .exit.text:kcapi_proc_exit()
+   The function kcapi_exit() references a function in an exit section.
+   Often the function kcapi_proc_exit() has valid usage outside the exit section
+   and the fix is to remove the __exit annotation of kcapi_proc_exit.
+
+Remove the incorrect __exit annotation.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Reported-by: kernelci.org bot <bot@kernelci.org>
+Reported-by: Olof's autobuilder <build@lixom.net>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20191216194909.1983639-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/capi/kcapi_proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/capi/kcapi_proc.c b/drivers/isdn/capi/kcapi_proc.c
+index c94bd12c0f7c6..28cd051f1dfd9 100644
+--- a/drivers/isdn/capi/kcapi_proc.c
++++ b/drivers/isdn/capi/kcapi_proc.c
+@@ -239,7 +239,7 @@ kcapi_proc_init(void)
+ 	proc_create_seq("capi/driver",       0, NULL, &seq_capi_driver_ops);
+ }
+ 
+-void __exit
++void
+ kcapi_proc_exit(void)
+ {
+ 	remove_proc_entry("capi/driver",       NULL);
+-- 
+2.20.1
+
diff --git a/queue-5.5/iwlegacy-ensure-loop-counter-addr-does-not-wrap-and-.patch b/queue-5.5/iwlegacy-ensure-loop-counter-addr-does-not-wrap-and-.patch
new file mode 100644
index 00000000000..63785ae07e0
--- /dev/null
+++ b/queue-5.5/iwlegacy-ensure-loop-counter-addr-does-not-wrap-and-.patch
@@ -0,0 +1,42 @@
+From 1efd95961eb788b56fa7d940a510c6fa26aa187c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jan 2020 00:09:54 +0000
+Subject: iwlegacy: ensure loop counter addr does not wrap and cause an
+ infinite loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit c2f9a4e4a5abfc84c01b738496b3fd2d471e0b18 ]
+
+The loop counter addr is a u16 where as the upper limit of the loop
+is an int. In the unlikely event that the il->cfg->eeprom_size is
+greater than 64K then we end up with an infinite loop since addr will
+wrap around an never reach upper loop limit. Fix this by making addr
+an int.
+
+Addresses-Coverity: ("Infinite loop")
+Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
+index d966b29b45ee7..348c17ce72f5c 100644
+--- a/drivers/net/wireless/intel/iwlegacy/common.c
++++ b/drivers/net/wireless/intel/iwlegacy/common.c
+@@ -699,7 +699,7 @@ il_eeprom_init(struct il_priv *il)
+ 	u32 gp = _il_rd(il, CSR_EEPROM_GP);
+ 	int sz;
+ 	int ret;
+-	u16 addr;
++	int addr;
+ 
+ 	/* allocate eeprom */
+ 	sz = il->cfg->eeprom_size;
+-- 
+2.20.1
+
diff --git a/queue-5.5/iwlegacy-fix-wcast-function-type.patch b/queue-5.5/iwlegacy-fix-wcast-function-type.patch
new file mode 100644
index 00000000000..29a4e29e70f
--- /dev/null
+++ b/queue-5.5/iwlegacy-fix-wcast-function-type.patch
@@ -0,0 +1,72 @@
+From 9dfedaf992b5227b72c4e4c3afc41c1cd474d5c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:28 +0700
+Subject: iwlegacy: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit da5e57e8a6a3e69dac2937ba63fa86355628fbb2 ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c | 5 +++--
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 5 +++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index 1168055da1828..206b43b9dff86 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -1376,8 +1376,9 @@ il3945_dump_nic_error_log(struct il_priv *il)
+ }
+ 
+ static void
+-il3945_irq_tasklet(struct il_priv *il)
++il3945_irq_tasklet(unsigned long data)
+ {
++	struct il_priv *il = (struct il_priv *)data;
+ 	u32 inta, handled = 0;
+ 	u32 inta_fh;
+ 	unsigned long flags;
+@@ -3401,7 +3402,7 @@ il3945_setup_deferred_work(struct il_priv *il)
+ 	timer_setup(&il->watchdog, il_bg_watchdog, 0);
+ 
+ 	tasklet_init(&il->irq_tasklet,
+-		     (void (*)(unsigned long))il3945_irq_tasklet,
++		     il3945_irq_tasklet,
+ 		     (unsigned long)il);
+ }
+ 
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index 3664f56f8cbd0..d1e17589dbeb7 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -4343,8 +4343,9 @@ il4965_synchronize_irq(struct il_priv *il)
+ }
+ 
+ static void
+-il4965_irq_tasklet(struct il_priv *il)
++il4965_irq_tasklet(unsigned long data)
+ {
++	struct il_priv *il = (struct il_priv *)data;
+ 	u32 inta, handled = 0;
+ 	u32 inta_fh;
+ 	unsigned long flags;
+@@ -6237,7 +6238,7 @@ il4965_setup_deferred_work(struct il_priv *il)
+ 	timer_setup(&il->watchdog, il_bg_watchdog, 0);
+ 
+ 	tasklet_init(&il->irq_tasklet,
+-		     (void (*)(unsigned long))il4965_irq_tasklet,
++		     il4965_irq_tasklet,
+ 		     (unsigned long)il);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/iwlwifi-mvm-check-the-sta-is-not-null-in-iwl_mvm_cfg.patch b/queue-5.5/iwlwifi-mvm-check-the-sta-is-not-null-in-iwl_mvm_cfg.patch
new file mode 100644
index 00000000000..dd193261f66
--- /dev/null
+++ b/queue-5.5/iwlwifi-mvm-check-the-sta-is-not-null-in-iwl_mvm_cfg.patch
@@ -0,0 +1,77 @@
+From 2d73cf3e8bef1f4e6bae63b2a78e6ee71618e35c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jan 2020 15:45:28 +0200
+Subject: iwlwifi: mvm: Check the sta is not NULL in iwl_mvm_cfg_he_sta()
+
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+
+[ Upstream commit 12d47f0ea5e0aa63f19ba618da55a7c67850ca10 ]
+
+Fix a kernel panic by checking that the sta is not NULL.
+This could happen during a reconfig flow, as mac80211 moves the sta
+between all the states without really checking if the previous state was
+successfully set. So, if for some reason we failed to add back the
+station, subsequent calls to sta_state() callback will be done when the
+station is NULL. This would result in a following panic:
+
+BUG: unable to handle kernel NULL pointer dereference at
+0000000000000040
+IP: iwl_mvm_cfg_he_sta+0xfc/0x690 [iwlmvm]
+[..]
+Call Trace:
+ iwl_mvm_mac_sta_state+0x629/0x6f0 [iwlmvm]
+ drv_sta_state+0xf4/0x950 [mac80211]
+ ieee80211_reconfig+0xa12/0x2180 [mac80211]
+ ieee80211_restart_work+0xbb/0xe0 [mac80211]
+ process_one_work+0x1e2/0x610
+ worker_thread+0x4d/0x3e0
+[..]
+
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index efdf15f57f163..02df603b64000 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -5,10 +5,9 @@
+  *
+  * GPL LICENSE SUMMARY
+  *
+- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 - 2019 Intel Corporation
++ * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of version 2 of the GNU General Public License as
+@@ -28,10 +27,9 @@
+  *
+  * BSD LICENSE
+  *
+- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 - 2019 Intel Corporation
++ * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation
+  * All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+@@ -2037,7 +2035,7 @@ static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
+ 	rcu_read_lock();
+ 
+ 	sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_ctxt_cmd.sta_id]);
+-	if (IS_ERR(sta)) {
++	if (IS_ERR_OR_NULL(sta)) {
+ 		rcu_read_unlock();
+ 		WARN(1, "Can't find STA to configure HE\n");
+ 		return;
+-- 
+2.20.1
+
diff --git a/queue-5.5/iwlwifi-mvm-fix-thermal-zone-registration.patch b/queue-5.5/iwlwifi-mvm-fix-thermal-zone-registration.patch
new file mode 100644
index 00000000000..1d8b8a5faa3
--- /dev/null
+++ b/queue-5.5/iwlwifi-mvm-fix-thermal-zone-registration.patch
@@ -0,0 +1,64 @@
+From a8c6d556a0850b723ccdf7ba2dbd8f6da7a77a6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jan 2020 15:45:24 +0200
+Subject: iwlwifi: mvm: Fix thermal zone registration
+
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+
+[ Upstream commit baa6cf8450b72dcab11f37c47efce7c5b9b8ad0f ]
+
+Use a unique name when registering a thermal zone. Otherwise, with
+multiple NICS, we hit the following warning during the unregistration.
+
+WARNING: CPU: 2 PID: 3525 at fs/sysfs/group.c:255
+ RIP: 0010:sysfs_remove_group+0x80/0x90
+ Call Trace:
+  dpm_sysfs_remove+0x57/0x60
+  device_del+0x5a/0x350
+  ? sscanf+0x4e/0x70
+  device_unregister+0x1a/0x60
+  hwmon_device_unregister+0x4a/0xa0
+  thermal_remove_hwmon_sysfs+0x175/0x1d0
+  thermal_zone_device_unregister+0x188/0x1e0
+  iwl_mvm_thermal_exit+0xe7/0x100 [iwlmvm]
+  iwl_op_mode_mvm_stop+0x27/0x180 [iwlmvm]
+  _iwl_op_mode_stop.isra.3+0x2b/0x50 [iwlwifi]
+  iwl_opmode_deregister+0x90/0xa0 [iwlwifi]
+  __exit_compat+0x10/0x2c7 [iwlmvm]
+  __x64_sys_delete_module+0x13f/0x270
+  do_syscall_64+0x5a/0x110
+  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+index b5a16f00bada9..fcad25ffd811f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+@@ -734,7 +734,8 @@ static  struct thermal_zone_device_ops tzone_ops = {
+ static void iwl_mvm_thermal_zone_register(struct iwl_mvm *mvm)
+ {
+ 	int i;
+-	char name[] = "iwlwifi";
++	char name[16];
++	static atomic_t counter = ATOMIC_INIT(0);
+ 
+ 	if (!iwl_mvm_is_tt_in_fw(mvm)) {
+ 		mvm->tz_device.tzone = NULL;
+@@ -744,6 +745,7 @@ static void iwl_mvm_thermal_zone_register(struct iwl_mvm *mvm)
+ 
+ 	BUILD_BUG_ON(ARRAY_SIZE(name) >= THERMAL_NAME_LENGTH);
+ 
++	sprintf(name, "iwlwifi_%u", atomic_inc_return(&counter) & 0xFF);
+ 	mvm->tz_device.tzone = thermal_zone_device_register(name,
+ 							IWL_MAX_DTS_TRIPS,
+ 							IWL_WRITABLE_TRIPS_MSK,
+-- 
+2.20.1
+
diff --git a/queue-5.5/jbd2-clear-jbd2_abort-flag-before-journal_reset-to-u.patch b/queue-5.5/jbd2-clear-jbd2_abort-flag-before-journal_reset-to-u.patch
new file mode 100644
index 00000000000..666c5b986fe
--- /dev/null
+++ b/queue-5.5/jbd2-clear-jbd2_abort-flag-before-journal_reset-to-u.patch
@@ -0,0 +1,56 @@
+From 62053f2b4344196c34edbe44067b289c1da2b31a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 10:25:42 +0800
+Subject: jbd2: clear JBD2_ABORT flag before journal_reset to update log tail
+ info when load journal
+
+From: Kai Li <li.kai4@h3c.com>
+
+[ Upstream commit a09decff5c32060639a685581c380f51b14e1fc2 ]
+
+If the journal is dirty when the filesystem is mounted, jbd2 will replay
+the journal but the journal superblock will not be updated by
+journal_reset() because JBD2_ABORT flag is still set (it was set in
+journal_init_common()). This is problematic because when a new transaction
+is then committed, it will be recorded in block 1 (journal->j_tail was set
+to 1 in journal_reset()). If unclean shutdown happens again before the
+journal superblock is updated, the new recorded transaction will not be
+replayed during the next mount (because of stale sb->s_start and
+sb->s_sequence values) which can lead to filesystem corruption.
+
+Fixes: 85e0c4e89c1b ("jbd2: if the journal is aborted then don't allow update of the log tail")
+Signed-off-by: Kai Li <li.kai4@h3c.com>
+Link: https://lore.kernel.org/r/20200111022542.5008-1-li.kai4@h3c.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/journal.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index b3e2433f94fe2..6847b18455068 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1711,6 +1711,11 @@ int jbd2_journal_load(journal_t *journal)
+ 		       journal->j_devname);
+ 		return -EFSCORRUPTED;
+ 	}
++	/*
++	 * clear JBD2_ABORT flag initialized in journal_init_common
++	 * here to update log tail information with the newest seq.
++	 */
++	journal->j_flags &= ~JBD2_ABORT;
+ 
+ 	/* OK, we've finished with the dynamic journal bits:
+ 	 * reinitialise the dynamic contents of the superblock in memory
+@@ -1718,7 +1723,6 @@ int jbd2_journal_load(journal_t *journal)
+ 	if (journal_reset(journal))
+ 		goto recovery_error;
+ 
+-	journal->j_flags &= ~JBD2_ABORT;
+ 	journal->j_flags |= JBD2_LOADED;
+ 	return 0;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/jbd2-make-sure-eshutdown-to-be-recorded-in-the-journ.patch b/queue-5.5/jbd2-make-sure-eshutdown-to-be-recorded-in-the-journ.patch
new file mode 100644
index 00000000000..caf87cc195e
--- /dev/null
+++ b/queue-5.5/jbd2-make-sure-eshutdown-to-be-recorded-in-the-journ.patch
@@ -0,0 +1,43 @@
+From a6b82331dfb025249d65514c4f25b0f383bd3789 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 20:46:13 +0800
+Subject: jbd2: make sure ESHUTDOWN to be recorded in the journal superblock
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+[ Upstream commit 0e98c084a21177ef136149c6a293b3d1eb33ff92 ]
+
+Commit fb7c02445c49 ("ext4: pass -ESHUTDOWN code to jbd2 layer") want
+to allow jbd2 layer to distinguish shutdown journal abort from other
+error cases. So the ESHUTDOWN should be taken precedence over any other
+errno which has already been recoded after EXT4_FLAGS_SHUTDOWN is set,
+but it only update errno in the journal suoerblock now if the old errno
+is 0.
+
+Fixes: fb7c02445c49 ("ext4: pass -ESHUTDOWN code to jbd2 layer")
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20191204124614.45424-4-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/journal.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 8479e84159675..0b4280fcad91d 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -2147,8 +2147,7 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+ 
+ 	if (journal->j_flags & JBD2_ABORT) {
+ 		write_unlock(&journal->j_state_lock);
+-		if (!old_errno && old_errno != -ESHUTDOWN &&
+-		    errno == -ESHUTDOWN)
++		if (old_errno != -ESHUTDOWN && errno == -ESHUTDOWN)
+ 			jbd2_journal_update_sb_errno(journal);
+ 		return;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.5/jbd2-switch-to-use-jbd2_journal_abort-when-failed-to.patch b/queue-5.5/jbd2-switch-to-use-jbd2_journal_abort-when-failed-to.patch
new file mode 100644
index 00000000000..20d7d14ec06
--- /dev/null
+++ b/queue-5.5/jbd2-switch-to-use-jbd2_journal_abort-when-failed-to.patch
@@ -0,0 +1,51 @@
+From 410202769435caab4f79379175fd524b555ca02d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 20:46:11 +0800
+Subject: jbd2: switch to use jbd2_journal_abort() when failed to submit the
+ commit record
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+[ Upstream commit d0a186e0d3e7ac05cc77da7c157dae5aa59f95d9 ]
+
+We invoke jbd2_journal_abort() to abort the journal and record errno
+in the jbd2 superblock when committing journal transaction besides the
+failure on submitting the commit record. But there is no need for the
+case and we can also invoke jbd2_journal_abort() instead of
+__jbd2_journal_abort_hard().
+
+Fixes: 818d276ceb83a ("ext4: Add the journal checksum feature")
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20191204124614.45424-2-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/commit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 3845750f70ec8..27373f5792a4f 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -782,7 +782,7 @@ start_journal_io:
+ 		err = journal_submit_commit_record(journal, commit_transaction,
+ 						 &cbh, crc32_sum);
+ 		if (err)
+-			__jbd2_journal_abort_hard(journal);
++			jbd2_journal_abort(journal, err);
+ 	}
+ 
+ 	blk_finish_plug(&plug);
+@@ -875,7 +875,7 @@ start_journal_io:
+ 		err = journal_submit_commit_record(journal, commit_transaction,
+ 						&cbh, crc32_sum);
+ 		if (err)
+-			__jbd2_journal_abort_hard(journal);
++			jbd2_journal_abort(journal, err);
+ 	}
+ 	if (cbh)
+ 		err = journal_wait_on_commit_record(journal, cbh);
+-- 
+2.20.1
+
diff --git a/queue-5.5/kbuild-make-multiple-directory-targets-work.patch b/queue-5.5/kbuild-make-multiple-directory-targets-work.patch
new file mode 100644
index 00000000000..c826f47e2bd
--- /dev/null
+++ b/queue-5.5/kbuild-make-multiple-directory-targets-work.patch
@@ -0,0 +1,45 @@
+From 00f9eee064389561c30965cb3fdd32f26c5e6d0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2020 15:51:52 +0900
+Subject: kbuild: make multiple directory targets work
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit f566e1fbadb686e28f1c307e356114b2865ef588 ]
+
+Currently, the single-target build does not work when two
+or more sub-directories are given:
+
+  $ make fs/ kernel/ lib/
+    CALL    scripts/checksyscalls.sh
+    CALL    scripts/atomic/check-atomics.sh
+    DESCEND  objtool
+  make[2]: Nothing to be done for 'kernel/'.
+  make[2]: Nothing to be done for 'fs/'.
+  make[2]: Nothing to be done for 'lib/'.
+
+Make it work properly.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 1f7dc3a2e1dd1..142042ac62e21 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1691,7 +1691,7 @@ PHONY += descend $(build-dirs)
+ descend: $(build-dirs)
+ $(build-dirs): prepare
+ 	$(Q)$(MAKE) $(build)=$@ \
+-	single-build=$(if $(filter-out $@/, $(single-no-ko)),1) \
++	single-build=$(if $(filter-out $@/, $(filter $@/%, $(single-no-ko))),1) \
+ 	need-builtin=1 need-modorder=1
+ 
+ clean-dirs := $(addprefix _clean_, $(clean-dirs))
+-- 
+2.20.1
+
diff --git a/queue-5.5/kbuild-remove-.tmp-file-when-filechk-fails.patch b/queue-5.5/kbuild-remove-.tmp-file-when-filechk-fails.patch
new file mode 100644
index 00000000000..60b31c34f14
--- /dev/null
+++ b/queue-5.5/kbuild-remove-.tmp-file-when-filechk-fails.patch
@@ -0,0 +1,83 @@
+From f8a93ad5a466fd90ba79df0c5276948214aa1cc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 14:02:24 +0900
+Subject: kbuild: remove *.tmp file when filechk fails
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 88fe89a47153facd8cb2d06d5c8727f7224c43c2 ]
+
+Bartosz Golaszewski reports that when "make {menu,n,g,x}config" fails
+due to missing packages, a temporary file is left over, which is not
+ignored by git.
+
+For example, if GTK+ is not installed:
+
+  $ make gconfig
+  *
+  * Unable to find the GTK+ installation. Please make sure that
+  * the GTK+ 2.0 development package is correctly installed.
+  * You need gtk+-2.0 gmodule-2.0 libglade-2.0
+  *
+  scripts/kconfig/Makefile:208: recipe for target 'scripts/kconfig/gconf-cfg' failed
+  make[1]: *** [scripts/kconfig/gconf-cfg] Error 1
+  Makefile:567: recipe for target 'gconfig' failed
+  make: *** [gconfig] Error 2
+  $ git status
+  HEAD detached at v5.4
+  Untracked files:
+    (use "git add <file>..." to include in what will be committed)
+
+          scripts/kconfig/gconf-cfg.tmp
+
+  nothing added to commit but untracked files present (use "git add" to track)
+
+This is because the check scripts are run with filechk, which misses
+to clean up the temporary file on failure.
+
+When the line
+
+  { $(filechk_$(1)); } > $@.tmp;
+
+... fails, it exits immediately due to the 'set -e'. Use trap to make
+sure to delete the temporary file on exit.
+
+For extra safety, I replaced $@.tmp with $(dot-target).tmp to make it
+a hidden file.
+
+Reported-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Kbuild.include | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
+index bc5f25763c1b9..f3155af04d859 100644
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -55,14 +55,13 @@ kecho := $($(quiet)kecho)
+ # - stdin is piped in from the first prerequisite ($<) so one has
+ #   to specify a valid file as first prerequisite (often the kbuild file)
+ define filechk
+-	$(Q)set -e;				\
+-	mkdir -p $(dir $@);			\
+-	{ $(filechk_$(1)); } > $@.tmp;		\
+-	if [ -r $@ ] && cmp -s $@ $@.tmp; then	\
+-		rm -f $@.tmp;			\
+-	else					\
+-		$(kecho) '  UPD     $@';	\
+-		mv -f $@.tmp $@;		\
++	$(Q)set -e;						\
++	mkdir -p $(dir $@);					\
++	trap "rm -f $(dot-target).tmp" EXIT;			\
++	{ $(filechk_$(1)); } > $(dot-target).tmp;		\
++	if [ ! -r $@ ] || ! cmp -s $@ $(dot-target).tmp; then	\
++		$(kecho) '  UPD     $@';			\
++		mv -f $(dot-target).tmp $@;			\
+ 	fi
+ endef
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/kbuild-use-s-instead-of-e-for-precise-cc-option-test.patch b/queue-5.5/kbuild-use-s-instead-of-e-for-precise-cc-option-test.patch
new file mode 100644
index 00000000000..ab79d50729a
--- /dev/null
+++ b/queue-5.5/kbuild-use-s-instead-of-e-for-precise-cc-option-test.patch
@@ -0,0 +1,52 @@
+From 9607fd5bf3304f006f4f7de6eafebe9e5f4d49ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jan 2020 02:14:35 +0900
+Subject: kbuild: use -S instead of -E for precise cc-option test in Kconfig
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 3bed1b7b9d79ca40e41e3af130931a3225e951a3 ]
+
+Currently, -E (stop after the preprocessing stage) is used to check
+whether the given compiler flag is supported.
+
+While it is faster than -S (or -c), it can be false-positive. You need
+to run the compilation proper to check the flag more precisely.
+
+For example, -E and -S disagree about the support of
+"--param asan-instrument-allocas=1".
+
+$ gcc -Werror --param asan-instrument-allocas=1 -E -x c /dev/null -o /dev/null
+$ echo $?
+0
+
+$ gcc -Werror --param asan-instrument-allocas=1 -S -x c /dev/null -o /dev/null
+cc1: error: invalid --param name ‘asan-instrument-allocas’; did you mean ‘asan-instrument-writes’?
+$ echo $?
+1
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Kconfig.include | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/Kconfig.include b/scripts/Kconfig.include
+index d4adfbe426903..bfb44b265a948 100644
+--- a/scripts/Kconfig.include
++++ b/scripts/Kconfig.include
+@@ -25,7 +25,7 @@ failure = $(if-success,$(1),n,y)
+ 
+ # $(cc-option,<flag>)
+ # Return y if the compiler supports <flag>, n otherwise
+-cc-option = $(success,$(CC) -Werror $(CLANG_FLAGS) $(1) -E -x c /dev/null -o /dev/null)
++cc-option = $(success,$(CC) -Werror $(CLANG_FLAGS) $(1) -S -x c /dev/null -o /dev/null)
+ 
+ # $(ld-option,<flag>)
+ # Return y if the linker supports <flag>, n otherwise
+-- 
+2.20.1
+
diff --git a/queue-5.5/kconfig-fix-broken-dependency-in-randconfig-generate.patch b/queue-5.5/kconfig-fix-broken-dependency-in-randconfig-generate.patch
new file mode 100644
index 00000000000..1be7e753dbe
--- /dev/null
+++ b/queue-5.5/kconfig-fix-broken-dependency-in-randconfig-generate.patch
@@ -0,0 +1,46 @@
+From 7233bbd6f15d09cac81ff9cf56b1935b4ce9fd1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2020 14:03:11 +0900
+Subject: kconfig: fix broken dependency in randconfig-generated .config
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit c8fb7d7e48d11520ad24808cfce7afb7b9c9f798 ]
+
+Running randconfig on arm64 using KCONFIG_SEED=0x40C5E904 (e.g. on v5.5)
+produces the .config with CONFIG_EFI=y and CONFIG_CPU_BIG_ENDIAN=y,
+which does not meet the !CONFIG_CPU_BIG_ENDIAN dependency.
+
+This is because the user choice for CONFIG_CPU_LITTLE_ENDIAN vs
+CONFIG_CPU_BIG_ENDIAN is set by randomize_choice_values() after the
+value of CONFIG_EFI is calculated.
+
+When this happens, the has_changed flag should be set.
+
+Currently, it takes the result from the last iteration. It should
+accumulate all the results of the loop.
+
+Fixes: 3b9a19e08960 ("kconfig: loop as long as we changed some symbols in randconfig")
+Reported-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/confdata.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
+index 3569d2dec37ce..17298239e3633 100644
+--- a/scripts/kconfig/confdata.c
++++ b/scripts/kconfig/confdata.c
+@@ -1353,7 +1353,7 @@ bool conf_set_all_new_symbols(enum conf_def_mode mode)
+ 
+ 		sym_calc_value(csym);
+ 		if (mode == def_random)
+-			has_changed = randomize_choice_values(csym);
++			has_changed |= randomize_choice_values(csym);
+ 		else {
+ 			set_all_choice_values(csym);
+ 			has_changed = true;
+-- 
+2.20.1
+
diff --git a/queue-5.5/kernel-module-fix-memleak-in-module_add_modinfo_attr.patch b/queue-5.5/kernel-module-fix-memleak-in-module_add_modinfo_attr.patch
new file mode 100644
index 00000000000..354d98d915c
--- /dev/null
+++ b/queue-5.5/kernel-module-fix-memleak-in-module_add_modinfo_attr.patch
@@ -0,0 +1,38 @@
+From 68d4f74c8728e6480b819f950424685b749c4c00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Dec 2019 19:54:55 +0800
+Subject: kernel/module: Fix memleak in module_add_modinfo_attrs()
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit f6d061d617124abbd55396a3bc37b9bf7d33233c ]
+
+In module_add_modinfo_attrs() if sysfs_create_file() fails
+on the first iteration of the loop (so i = 0), we forget to
+free the modinfo_attrs.
+
+Fixes: bc6f2a757d52 ("kernel/module: Fix mem leak in module_add_modinfo_attrs")
+Reviewed-by: Miroslav Benes <mbenes@suse.cz>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index b56f3224b161b..8785e31c2dd0f 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1781,6 +1781,8 @@ static int module_add_modinfo_attrs(struct module *mod)
+ error_out:
+ 	if (i > 0)
+ 		module_remove_modinfo_attrs(mod, --i);
++	else
++		kfree(mod->modinfo_attrs);
+ 	return error;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/kprobes-fix-optimize_kprobe-unoptimize_kprobe-cancel.patch b/queue-5.5/kprobes-fix-optimize_kprobe-unoptimize_kprobe-cancel.patch
new file mode 100644
index 00000000000..d777c310a14
--- /dev/null
+++ b/queue-5.5/kprobes-fix-optimize_kprobe-unoptimize_kprobe-cancel.patch
@@ -0,0 +1,167 @@
+From 32bcbfd1cc494c720d7972255dff6cb29e54dd09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 23:42:24 +0900
+Subject: kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit e4add247789e4ba5e08ad8256183ce2e211877d4 ]
+
+optimize_kprobe() and unoptimize_kprobe() cancels if a given kprobe
+is on the optimizing_list or unoptimizing_list already. However, since
+the following commit:
+
+  f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code")
+
+modified the update timing of the KPROBE_FLAG_OPTIMIZED, it doesn't
+work as expected anymore.
+
+The optimized_kprobe could be in the following states:
+
+- [optimizing]: Before inserting jump instruction
+  op.kp->flags has KPROBE_FLAG_OPTIMIZED and
+  op->list is not empty.
+
+- [optimized]: jump inserted
+  op.kp->flags has KPROBE_FLAG_OPTIMIZED and
+  op->list is empty.
+
+- [unoptimizing]: Before removing jump instruction (including unused
+  optprobe)
+  op.kp->flags has KPROBE_FLAG_OPTIMIZED and
+  op->list is not empty.
+
+- [unoptimized]: jump removed
+  op.kp->flags doesn't have KPROBE_FLAG_OPTIMIZED and
+  op->list is empty.
+
+Current code mis-expects [unoptimizing] state doesn't have
+KPROBE_FLAG_OPTIMIZED, and that can cause incorrect results.
+
+To fix this, introduce optprobe_queued_unopt() to distinguish [optimizing]
+and [unoptimizing] states and fixes the logic in optimize_kprobe() and
+unoptimize_kprobe().
+
+[ mingo: Cleaned up the changelog and the code a bit. ]
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: bristot@redhat.com
+Fixes: f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code")
+Link: https://lkml.kernel.org/r/157840814418.7181.13478003006386303481.stgit@devnote2
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kprobes.c | 67 +++++++++++++++++++++++++++++++-----------------
+ 1 file changed, 43 insertions(+), 24 deletions(-)
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 53534aa258a60..fd81882f05210 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -610,6 +610,18 @@ void wait_for_kprobe_optimizer(void)
+ 	mutex_unlock(&kprobe_mutex);
+ }
+ 
++static bool optprobe_queued_unopt(struct optimized_kprobe *op)
++{
++	struct optimized_kprobe *_op;
++
++	list_for_each_entry(_op, &unoptimizing_list, list) {
++		if (op == _op)
++			return true;
++	}
++
++	return false;
++}
++
+ /* Optimize kprobe if p is ready to be optimized */
+ static void optimize_kprobe(struct kprobe *p)
+ {
+@@ -631,17 +643,21 @@ static void optimize_kprobe(struct kprobe *p)
+ 		return;
+ 
+ 	/* Check if it is already optimized. */
+-	if (op->kp.flags & KPROBE_FLAG_OPTIMIZED)
++	if (op->kp.flags & KPROBE_FLAG_OPTIMIZED) {
++		if (optprobe_queued_unopt(op)) {
++			/* This is under unoptimizing. Just dequeue the probe */
++			list_del_init(&op->list);
++		}
+ 		return;
++	}
+ 	op->kp.flags |= KPROBE_FLAG_OPTIMIZED;
+ 
+-	if (!list_empty(&op->list))
+-		/* This is under unoptimizing. Just dequeue the probe */
+-		list_del_init(&op->list);
+-	else {
+-		list_add(&op->list, &optimizing_list);
+-		kick_kprobe_optimizer();
+-	}
++	/* On unoptimizing/optimizing_list, op must have OPTIMIZED flag */
++	if (WARN_ON_ONCE(!list_empty(&op->list)))
++		return;
++
++	list_add(&op->list, &optimizing_list);
++	kick_kprobe_optimizer();
+ }
+ 
+ /* Short cut to direct unoptimizing */
+@@ -662,31 +678,34 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)
+ 		return; /* This is not an optprobe nor optimized */
+ 
+ 	op = container_of(p, struct optimized_kprobe, kp);
+-	if (!kprobe_optimized(p)) {
+-		/* Unoptimized or unoptimizing case */
+-		if (force && !list_empty(&op->list)) {
+-			/*
+-			 * Only if this is unoptimizing kprobe and forced,
+-			 * forcibly unoptimize it. (No need to unoptimize
+-			 * unoptimized kprobe again :)
+-			 */
+-			list_del_init(&op->list);
+-			force_unoptimize_kprobe(op);
+-		}
++	if (!kprobe_optimized(p))
+ 		return;
+-	}
+ 
+ 	op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
+ 	if (!list_empty(&op->list)) {
+-		/* Dequeue from the optimization queue */
+-		list_del_init(&op->list);
++		if (optprobe_queued_unopt(op)) {
++			/* Queued in unoptimizing queue */
++			if (force) {
++				/*
++				 * Forcibly unoptimize the kprobe here, and queue it
++				 * in the freeing list for release afterwards.
++				 */
++				force_unoptimize_kprobe(op);
++				list_move(&op->list, &freeing_list);
++			}
++		} else {
++			/* Dequeue from the optimizing queue */
++			list_del_init(&op->list);
++			op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
++		}
+ 		return;
+ 	}
++
+ 	/* Optimized kprobe case */
+-	if (force)
++	if (force) {
+ 		/* Forcibly update the code: this is a special case */
+ 		force_unoptimize_kprobe(op);
+-	else {
++	} else {
+ 		list_add(&op->list, &unoptimizing_list);
+ 		kick_kprobe_optimizer();
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.5/kselftest-minimise-dependency-of-get_size-on-c-libra.patch b/queue-5.5/kselftest-minimise-dependency-of-get_size-on-c-libra.patch
new file mode 100644
index 00000000000..c012d2dccc6
--- /dev/null
+++ b/queue-5.5/kselftest-minimise-dependency-of-get_size-on-c-libra.patch
@@ -0,0 +1,113 @@
+From 7957d87fe1f2975179ac2ce01e1fe699c0e96e59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 22:11:58 +0530
+Subject: kselftest: Minimise dependency of get_size on C library interfaces
+
+From: Siddhesh Poyarekar <siddhesh@gotplt.org>
+
+[ Upstream commit 6b64a650f0b2ae3940698f401732988699eecf7a ]
+
+It was observed[1] on arm64 that __builtin_strlen led to an infinite
+loop in the get_size selftest.  This is because __builtin_strlen (and
+other builtins) may sometimes result in a call to the C library
+function.  The C library implementation of strlen uses an IFUNC
+resolver to load the most efficient strlen implementation for the
+underlying machine and hence has a PLT indirection even for static
+binaries.  Because this binary avoids the C library startup routines,
+the PLT initialization never happens and hence the program gets stuck
+in an infinite loop.
+
+On x86_64 the __builtin_strlen just happens to expand inline and avoid
+the call but that is not always guaranteed.
+
+Further, while testing on x86_64 (Fedora 31), it was observed that the
+test also failed with a segfault inside write() because the generated
+code for the write function in glibc seems to access TLS before the
+syscall (probably due to the cancellation point check) and fails
+because TLS is not initialised.
+
+To mitigate these problems, this patch reduces the interface with the
+C library to just the syscall function.  The syscall function still
+sets errno on failure, which is undesirable but for now it only
+affects cases where syscalls fail.
+
+[1] https://bugs.linaro.org/show_bug.cgi?id=5479
+
+Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
+Reported-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
+Tested-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
+Reviewed-by: Tim Bird <tim.bird@sony.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/size/get_size.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/tools/testing/selftests/size/get_size.c b/tools/testing/selftests/size/get_size.c
+index 2ad45b9443550..2980b1a63366b 100644
+--- a/tools/testing/selftests/size/get_size.c
++++ b/tools/testing/selftests/size/get_size.c
+@@ -11,23 +11,35 @@
+  * own execution.  It also attempts to have as few dependencies
+  * on kernel features as possible.
+  *
+- * It should be statically linked, with startup libs avoided.
+- * It uses no library calls, and only the following 3 syscalls:
++ * It should be statically linked, with startup libs avoided.  It uses
++ * no library calls except the syscall() function for the following 3
++ * syscalls:
+  *   sysinfo(), write(), and _exit()
+  *
+  * For output, it avoids printf (which in some C libraries
+  * has large external dependencies) by  implementing it's own
+  * number output and print routines, and using __builtin_strlen()
++ *
++ * The test may crash if any of the above syscalls fails because in some
++ * libc implementations (e.g. the GNU C Library) errno is saved in
++ * thread-local storage, which does not get initialized due to avoiding
++ * startup libs.
+  */
+ 
+ #include <sys/sysinfo.h>
+ #include <unistd.h>
++#include <sys/syscall.h>
+ 
+ #define STDOUT_FILENO 1
+ 
+ static int print(const char *s)
+ {
+-	return write(STDOUT_FILENO, s, __builtin_strlen(s));
++	size_t len = 0;
++
++	while (s[len] != '\0')
++		len++;
++
++	return syscall(SYS_write, STDOUT_FILENO, s, len);
+ }
+ 
+ static inline char *num_to_str(unsigned long num, char *buf, int len)
+@@ -79,12 +91,12 @@ void _start(void)
+ 	print("TAP version 13\n");
+ 	print("# Testing system size.\n");
+ 
+-	ccode = sysinfo(&info);
++	ccode = syscall(SYS_sysinfo, &info);
+ 	if (ccode < 0) {
+ 		print("not ok 1");
+ 		print(test_name);
+ 		print(" ---\n reason: \"could not get sysinfo\"\n ...\n");
+-		_exit(ccode);
++		syscall(SYS_exit, ccode);
+ 	}
+ 	print("ok 1");
+ 	print(test_name);
+@@ -100,5 +112,5 @@ void _start(void)
+ 	print(" ...\n");
+ 	print("1..1\n");
+ 
+-	_exit(0);
++	syscall(SYS_exit, 0);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/kunit-remove-timeout-dependence-on-sysctl_hung_task_.patch b/queue-5.5/kunit-remove-timeout-dependence-on-sysctl_hung_task_.patch
new file mode 100644
index 00000000000..d1fa351032b
--- /dev/null
+++ b/queue-5.5/kunit-remove-timeout-dependence-on-sysctl_hung_task_.patch
@@ -0,0 +1,80 @@
+From 36da478ddc910917bb4ff3a65a0423ef82d2b7d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 22:28:21 +0000
+Subject: kunit: remove timeout dependence on sysctl_hung_task_timeout_seconds
+
+From: Alan Maguire <alan.maguire@oracle.com>
+
+[ Upstream commit 1c024d45151b51c8f8d4749e65958b0bcf3e7c52 ]
+
+In discussion of how to handle timeouts, it was noted that if
+sysctl_hung_task_timeout_seconds is exceeded for a kunit test,
+the test task will be killed and an oops generated.  This should
+suffice as a means of debugging such timeout issues for now.
+
+Hence remove use of sysctl_hung_task_timeout_secs, which has the
+added benefit of avoiding the need to export that symbol from
+the core kernel.
+
+Co-developed-by: Knut Omang <knut.omang@oracle.com>
+Signed-off-by: Knut Omang <knut.omang@oracle.com>
+Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kunit/try-catch.c | 22 ++++------------------
+ 1 file changed, 4 insertions(+), 18 deletions(-)
+
+diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c
+index 55686839eb619..6b9c5242017f6 100644
+--- a/lib/kunit/try-catch.c
++++ b/lib/kunit/try-catch.c
+@@ -12,7 +12,6 @@
+ #include <linux/completion.h>
+ #include <linux/kernel.h>
+ #include <linux/kthread.h>
+-#include <linux/sched/sysctl.h>
+ 
+ void __noreturn kunit_try_catch_throw(struct kunit_try_catch *try_catch)
+ {
+@@ -31,8 +30,6 @@ static int kunit_generic_run_threadfn_adapter(void *data)
+ 
+ static unsigned long kunit_test_timeout(void)
+ {
+-	unsigned long timeout_msecs;
+-
+ 	/*
+ 	 * TODO(brendanhiggins@google.com): We should probably have some type of
+ 	 * variable timeout here. The only question is what that timeout value
+@@ -49,22 +46,11 @@ static unsigned long kunit_test_timeout(void)
+ 	 *
+ 	 * For more background on this topic, see:
+ 	 * https://mike-bland.com/2011/11/01/small-medium-large.html
++	 *
++	 * If tests timeout due to exceeding sysctl_hung_task_timeout_secs,
++	 * the task will be killed and an oops generated.
+ 	 */
+-	if (sysctl_hung_task_timeout_secs) {
+-		/*
+-		 * If sysctl_hung_task is active, just set the timeout to some
+-		 * value less than that.
+-		 *
+-		 * In regards to the above TODO, if we decide on variable
+-		 * timeouts, this logic will likely need to change.
+-		 */
+-		timeout_msecs = (sysctl_hung_task_timeout_secs - 1) *
+-				MSEC_PER_SEC;
+-	} else {
+-		timeout_msecs = 300 * MSEC_PER_SEC; /* 5 min */
+-	}
+-
+-	return timeout_msecs;
++	return 300 * MSEC_PER_SEC; /* 5 min */
+ }
+ 
+ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
+-- 
+2.20.1
+
diff --git a/queue-5.5/kvm-ppc-book3s-hv-release-lock-on-page-out-failure-p.patch b/queue-5.5/kvm-ppc-book3s-hv-release-lock-on-page-out-failure-p.patch
new file mode 100644
index 00000000000..44afb064579
--- /dev/null
+++ b/queue-5.5/kvm-ppc-book3s-hv-release-lock-on-page-out-failure-p.patch
@@ -0,0 +1,37 @@
+From d00dea2491650b26a9a147b0ccf2d77801b1b4a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 10:25:42 +0530
+Subject: KVM: PPC: Book3S HV: Release lock on page-out failure path
+
+From: Bharata B Rao <bharata@linux.ibm.com>
+
+[ Upstream commit e032e3b55b6f487e48c163c5dca74086f147a169 ]
+
+When migrate_vma_setup() fails in kvmppc_svm_page_out(),
+release kvm->arch.uvmem_lock before returning.
+
+Fixes: ca9f4942670 ("KVM: PPC: Book3S HV: Support for running secure guests")
+Signed-off-by: Bharata B Rao <bharata@linux.ibm.com>
+Reviewed-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv_uvmem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv_uvmem.c b/arch/powerpc/kvm/book3s_hv_uvmem.c
+index 2de264fc31563..5914fbfa5e0a7 100644
+--- a/arch/powerpc/kvm/book3s_hv_uvmem.c
++++ b/arch/powerpc/kvm/book3s_hv_uvmem.c
+@@ -543,7 +543,7 @@ kvmppc_svm_page_out(struct vm_area_struct *vma, unsigned long start,
+ 
+ 	ret = migrate_vma_setup(&mig);
+ 	if (ret)
+-		return ret;
++		goto out;
+ 
+ 	spage = migrate_pfn_to_page(*mig.src);
+ 	if (!spage || !(*mig.src & MIGRATE_PFN_MIGRATE))
+-- 
+2.20.1
+
diff --git a/queue-5.5/kvm-ppc-remove-set-but-not-used-variable-ra-rs-rt.patch b/queue-5.5/kvm-ppc-remove-set-but-not-used-variable-ra-rs-rt.patch
new file mode 100644
index 00000000000..db262e7f64c
--- /dev/null
+++ b/queue-5.5/kvm-ppc-remove-set-but-not-used-variable-ra-rs-rt.patch
@@ -0,0 +1,55 @@
+From 2ceb933d6ed528bddc35f9aa5c2420f31f32cf89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 14:27:40 +0800
+Subject: KVM: PPC: Remove set but not used variable 'ra', 'rs', 'rt'
+
+From: zhengbin <zhengbin13@huawei.com>
+
+[ Upstream commit 4de0a8355463e068e443b48eb5ae32370155368b ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+arch/powerpc/kvm/emulate_loadstore.c: In function kvmppc_emulate_loadstore:
+arch/powerpc/kvm/emulate_loadstore.c:87:6: warning: variable ra set but not used [-Wunused-but-set-variable]
+arch/powerpc/kvm/emulate_loadstore.c: In function kvmppc_emulate_loadstore:
+arch/powerpc/kvm/emulate_loadstore.c:87:10: warning: variable rs set but not used [-Wunused-but-set-variable]
+arch/powerpc/kvm/emulate_loadstore.c: In function kvmppc_emulate_loadstore:
+arch/powerpc/kvm/emulate_loadstore.c:87:14: warning: variable rt set but not used [-Wunused-but-set-variable]
+
+They are not used since commit 2b33cb585f94 ("KVM: PPC: Reimplement
+LOAD_FP/STORE_FP instruction mmio emulation with analyse_instr() input")
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/emulate_loadstore.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/powerpc/kvm/emulate_loadstore.c b/arch/powerpc/kvm/emulate_loadstore.c
+index 2e496eb86e94a..1139bc56e0045 100644
+--- a/arch/powerpc/kvm/emulate_loadstore.c
++++ b/arch/powerpc/kvm/emulate_loadstore.c
+@@ -73,7 +73,6 @@ int kvmppc_emulate_loadstore(struct kvm_vcpu *vcpu)
+ {
+ 	struct kvm_run *run = vcpu->run;
+ 	u32 inst;
+-	int ra, rs, rt;
+ 	enum emulation_result emulated = EMULATE_FAIL;
+ 	int advance = 1;
+ 	struct instruction_op op;
+@@ -85,10 +84,6 @@ int kvmppc_emulate_loadstore(struct kvm_vcpu *vcpu)
+ 	if (emulated != EMULATE_DONE)
+ 		return emulated;
+ 
+-	ra = get_ra(inst);
+-	rs = get_rs(inst);
+-	rt = get_rt(inst);
+-
+ 	vcpu->arch.mmio_vsx_copy_nums = 0;
+ 	vcpu->arch.mmio_vsx_offset = 0;
+ 	vcpu->arch.mmio_copy_type = KVMPPC_VSX_COPY_NONE;
+-- 
+2.20.1
+
diff --git a/queue-5.5/kvm-s390-enotsupp-eopnotsupp-fixups.patch b/queue-5.5/kvm-s390-enotsupp-eopnotsupp-fixups.patch
new file mode 100644
index 00000000000..ea606b84e4d
--- /dev/null
+++ b/queue-5.5/kvm-s390-enotsupp-eopnotsupp-fixups.patch
@@ -0,0 +1,56 @@
+From 639c756669c95b08925120132f1f10804171a1ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 07:40:43 -0500
+Subject: KVM: s390: ENOTSUPP -> EOPNOTSUPP fixups
+
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+
+[ Upstream commit c611990844c28c61ca4b35ff69d3a2ae95ccd486 ]
+
+There is no ENOTSUPP for userspace.
+
+Reported-by: Julian Wiedmann <jwi@linux.ibm.com>
+Fixes: 519783935451 ("KVM: s390: introduce ais mode modify function")
+Fixes: 2c1a48f2e5ed ("KVM: S390: add new group for flic")
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/interrupt.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index 165dea4c7f193..c06c89d370a73 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -2190,7 +2190,7 @@ static int flic_ais_mode_get_all(struct kvm *kvm, struct kvm_device_attr *attr)
+ 		return -EINVAL;
+ 
+ 	if (!test_kvm_facility(kvm, 72))
+-		return -ENOTSUPP;
++		return -EOPNOTSUPP;
+ 
+ 	mutex_lock(&fi->ais_lock);
+ 	ais.simm = fi->simm;
+@@ -2499,7 +2499,7 @@ static int modify_ais_mode(struct kvm *kvm, struct kvm_device_attr *attr)
+ 	int ret = 0;
+ 
+ 	if (!test_kvm_facility(kvm, 72))
+-		return -ENOTSUPP;
++		return -EOPNOTSUPP;
+ 
+ 	if (copy_from_user(&req, (void __user *)attr->addr, sizeof(req)))
+ 		return -EFAULT;
+@@ -2579,7 +2579,7 @@ static int flic_ais_mode_set_all(struct kvm *kvm, struct kvm_device_attr *attr)
+ 	struct kvm_s390_ais_all ais;
+ 
+ 	if (!test_kvm_facility(kvm, 72))
+-		return -ENOTSUPP;
++		return -EOPNOTSUPP;
+ 
+ 	if (copy_from_user(&ais, (void __user *)attr->addr, sizeof(ais)))
+ 		return -EFAULT;
+-- 
+2.20.1
+
diff --git a/queue-5.5/leds-pca963x-fix-open-drain-initialization.patch b/queue-5.5/leds-pca963x-fix-open-drain-initialization.patch
new file mode 100644
index 00000000000..3daa88ed344
--- /dev/null
+++ b/queue-5.5/leds-pca963x-fix-open-drain-initialization.patch
@@ -0,0 +1,69 @@
+From 16d0e9c0c45c6a4d1a4123599f49faa9031741f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 23:02:55 +0200
+Subject: leds: pca963x: Fix open-drain initialization
+
+From: Zahari Petkov <zahari@balena.io>
+
+[ Upstream commit 697529091ac7a0a90ca349b914bb30641c13c753 ]
+
+Before commit bb29b9cccd95 ("leds: pca963x: Add bindings to invert
+polarity") Mode register 2 was initialized directly with either 0x01
+or 0x05 for open-drain or totem pole (push-pull) configuration.
+
+Afterwards, MODE2 initialization started using bitwise operations on
+top of the default MODE2 register value (0x05). Using bitwise OR for
+setting OUTDRV with 0x01 and 0x05 does not produce correct results.
+When open-drain is used, instead of setting OUTDRV to 0, the driver
+keeps it as 1:
+
+Open-drain: 0x05 | 0x01 -> 0x05 (0b101 - incorrect)
+Totem pole: 0x05 | 0x05 -> 0x05 (0b101 - correct but still wrong)
+
+Now OUTDRV setting uses correct bitwise operations for initialization:
+
+Open-drain: 0x05 & ~0x04 -> 0x01 (0b001 - correct)
+Totem pole: 0x05 | 0x04 -> 0x05 (0b101 - correct)
+
+Additional MODE2 register definitions are introduced now as well.
+
+Fixes: bb29b9cccd95 ("leds: pca963x: Add bindings to invert polarity")
+Signed-off-by: Zahari Petkov <zahari@balena.io>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-pca963x.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/leds/leds-pca963x.c b/drivers/leds/leds-pca963x.c
+index 4afc317901a89..66cdc003b8f42 100644
+--- a/drivers/leds/leds-pca963x.c
++++ b/drivers/leds/leds-pca963x.c
+@@ -40,6 +40,8 @@
+ #define PCA963X_LED_PWM		0x2	/* Controlled through PWM */
+ #define PCA963X_LED_GRP_PWM	0x3	/* Controlled through PWM/GRPPWM */
+ 
++#define PCA963X_MODE2_OUTDRV	0x04	/* Open-drain or totem pole */
++#define PCA963X_MODE2_INVRT	0x10	/* Normal or inverted direction */
+ #define PCA963X_MODE2_DMBLNK	0x20	/* Enable blinking */
+ 
+ #define PCA963X_MODE1		0x00
+@@ -438,12 +440,12 @@ static int pca963x_probe(struct i2c_client *client,
+ 						    PCA963X_MODE2);
+ 		/* Configure output: open-drain or totem pole (push-pull) */
+ 		if (pdata->outdrv == PCA963X_OPEN_DRAIN)
+-			mode2 |= 0x01;
++			mode2 &= ~PCA963X_MODE2_OUTDRV;
+ 		else
+-			mode2 |= 0x05;
++			mode2 |= PCA963X_MODE2_OUTDRV;
+ 		/* Configure direction: normal or inverted */
+ 		if (pdata->dir == PCA963X_INVERTED)
+-			mode2 |= 0x10;
++			mode2 |= PCA963X_MODE2_INVRT;
+ 		i2c_smbus_write_byte_data(pca963x->chip->client, PCA963X_MODE2,
+ 					  mode2);
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.5/lib-scatterlist.c-adjust-indentation-in-__sg_alloc_t.patch b/queue-5.5/lib-scatterlist.c-adjust-indentation-in-__sg_alloc_t.patch
new file mode 100644
index 00000000000..9ce473ca39f
--- /dev/null
+++ b/queue-5.5/lib-scatterlist.c-adjust-indentation-in-__sg_alloc_t.patch
@@ -0,0 +1,51 @@
+From 389baf6ecbab01d72e6d25a815009efaac13c975 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:16:37 -0800
+Subject: lib/scatterlist.c: adjust indentation in __sg_alloc_table
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 4e456fee215677584cafa7f67298a76917e89c64 ]
+
+Clang warns:
+
+  ../lib/scatterlist.c:314:5: warning: misleading indentation; statement
+  is not part of the previous 'if' [-Wmisleading-indentation]
+                          return -ENOMEM;
+                          ^
+  ../lib/scatterlist.c:311:4: note: previous statement is here
+                          if (prv)
+                          ^
+  1 warning generated.
+
+This warning occurs because there is a space before the tab on this
+line.  Remove it so that the indentation is consistent with the Linux
+kernel coding style and clang no longer warns.
+
+Link: http://lkml.kernel.org/r/20191218033606.11942-1-natechancellor@gmail.com
+Link: https://github.com/ClangBuiltLinux/linux/issues/830
+Fixes: edce6820a9fd ("scatterlist: prevent invalid free when alloc fails")
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/scatterlist.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/scatterlist.c b/lib/scatterlist.c
+index c2cf2c311b7db..5813072bc5895 100644
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -311,7 +311,7 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents,
+ 			if (prv)
+ 				table->nents = ++table->orig_nents;
+ 
+- 			return -ENOMEM;
++			return -ENOMEM;
+ 		}
+ 
+ 		sg_init_table(sg, alloc_size);
+-- 
+2.20.1
+
diff --git a/queue-5.5/media-cx23885-add-support-for-avermedia-ce310b.patch b/queue-5.5/media-cx23885-add-support-for-avermedia-ce310b.patch
new file mode 100644
index 00000000000..d637816c063
--- /dev/null
+++ b/queue-5.5/media-cx23885-add-support-for-avermedia-ce310b.patch
@@ -0,0 +1,113 @@
+From 822993af5b135dd4a93607541ab8e95a3a7bcbbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2019 23:38:40 +0100
+Subject: media: cx23885: Add support for AVerMedia CE310B
+
+From: Forest Crossman <cyrozap@gmail.com>
+
+[ Upstream commit dc4cac67e13515835ed8081d510aa507aacb013b ]
+
+The AVerMedia CE310B is a simple composite + S-Video + stereo audio
+capture card, and uses only the CX23888 to perform all of these
+functions.
+
+I've tested both video inputs and the audio interface and confirmed that
+they're all working. However, there are some issues:
+
+* Sometimes when I switch inputs the video signal turns black and can't
+  be recovered until the system is rebooted. I haven't been able to
+  determine the cause of this behavior, nor have I found a solution to
+  fix it or any workarounds other than rebooting.
+* The card sometimes seems to have trouble syncing to the video signal,
+  and some of the VBI data appears as noise at the top of the frame, but
+  I assume that to be a result of my very noisy RF environment and the
+  card's unshielded input traces rather than a configuration issue.
+
+Signed-off-by: Forest Crossman <cyrozap@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx23885/cx23885-cards.c | 24 +++++++++++++++++++++++
+ drivers/media/pci/cx23885/cx23885-video.c |  3 ++-
+ drivers/media/pci/cx23885/cx23885.h       |  1 +
+ 3 files changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx23885/cx23885-cards.c b/drivers/media/pci/cx23885/cx23885-cards.c
+index 8644205d3cd33..8e5a2c580821e 100644
+--- a/drivers/media/pci/cx23885/cx23885-cards.c
++++ b/drivers/media/pci/cx23885/cx23885-cards.c
+@@ -801,6 +801,25 @@ struct cx23885_board cx23885_boards[] = {
+ 		.name		= "Hauppauge WinTV-Starburst2",
+ 		.portb		= CX23885_MPEG_DVB,
+ 	},
++	[CX23885_BOARD_AVERMEDIA_CE310B] = {
++		.name		= "AVerMedia CE310B",
++		.porta		= CX23885_ANALOG_VIDEO,
++		.force_bff	= 1,
++		.input          = {{
++			.type   = CX23885_VMUX_COMPOSITE1,
++			.vmux   = CX25840_VIN1_CH1 |
++				  CX25840_NONE_CH2 |
++				  CX25840_NONE0_CH3,
++			.amux   = CX25840_AUDIO7,
++		}, {
++			.type   = CX23885_VMUX_SVIDEO,
++			.vmux   = CX25840_VIN8_CH1 |
++				  CX25840_NONE_CH2 |
++				  CX25840_VIN7_CH3 |
++				  CX25840_SVIDEO_ON,
++			.amux   = CX25840_AUDIO7,
++		} },
++	},
+ };
+ const unsigned int cx23885_bcount = ARRAY_SIZE(cx23885_boards);
+ 
+@@ -1124,6 +1143,10 @@ struct cx23885_subid cx23885_subids[] = {
+ 		.subvendor = 0x0070,
+ 		.subdevice = 0xf02a,
+ 		.card      = CX23885_BOARD_HAUPPAUGE_STARBURST2,
++	}, {
++		.subvendor = 0x1461,
++		.subdevice = 0x3100,
++		.card      = CX23885_BOARD_AVERMEDIA_CE310B,
+ 	},
+ };
+ const unsigned int cx23885_idcount = ARRAY_SIZE(cx23885_subids);
+@@ -2348,6 +2371,7 @@ void cx23885_card_setup(struct cx23885_dev *dev)
+ 	case CX23885_BOARD_DVBSKY_T982:
+ 	case CX23885_BOARD_VIEWCAST_260E:
+ 	case CX23885_BOARD_VIEWCAST_460E:
++	case CX23885_BOARD_AVERMEDIA_CE310B:
+ 		dev->sd_cx25840 = v4l2_i2c_new_subdev(&dev->v4l2_dev,
+ 				&dev->i2c_bus[2].i2c_adap,
+ 				"cx25840", 0x88 >> 1, NULL);
+diff --git a/drivers/media/pci/cx23885/cx23885-video.c b/drivers/media/pci/cx23885/cx23885-video.c
+index 8098b15493de9..7fc408ee4934f 100644
+--- a/drivers/media/pci/cx23885/cx23885-video.c
++++ b/drivers/media/pci/cx23885/cx23885-video.c
+@@ -257,7 +257,8 @@ static int cx23885_video_mux(struct cx23885_dev *dev, unsigned int input)
+ 		(dev->board == CX23885_BOARD_MYGICA_X8507) ||
+ 		(dev->board == CX23885_BOARD_AVERMEDIA_HC81R) ||
+ 		(dev->board == CX23885_BOARD_VIEWCAST_260E) ||
+-		(dev->board == CX23885_BOARD_VIEWCAST_460E)) {
++		(dev->board == CX23885_BOARD_VIEWCAST_460E) ||
++		(dev->board == CX23885_BOARD_AVERMEDIA_CE310B)) {
+ 		/* Configure audio routing */
+ 		v4l2_subdev_call(dev->sd_cx25840, audio, s_routing,
+ 			INPUT(input)->amux, 0, 0);
+diff --git a/drivers/media/pci/cx23885/cx23885.h b/drivers/media/pci/cx23885/cx23885.h
+index a95a2e4c6a0d3..c472498e57c4e 100644
+--- a/drivers/media/pci/cx23885/cx23885.h
++++ b/drivers/media/pci/cx23885/cx23885.h
+@@ -101,6 +101,7 @@
+ #define CX23885_BOARD_HAUPPAUGE_STARBURST2     59
+ #define CX23885_BOARD_HAUPPAUGE_QUADHD_DVB_885 60
+ #define CX23885_BOARD_HAUPPAUGE_QUADHD_ATSC_885 61
++#define CX23885_BOARD_AVERMEDIA_CE310B         62
+ 
+ #define GPIO_0 0x00000001
+ #define GPIO_1 0x00000002
+-- 
+2.20.1
+
diff --git a/queue-5.5/media-i2c-mt9v032-fix-enum-mbus-codes-and-frame-size.patch b/queue-5.5/media-i2c-mt9v032-fix-enum-mbus-codes-and-frame-size.patch
new file mode 100644
index 00000000000..0df077c42e2
--- /dev/null
+++ b/queue-5.5/media-i2c-mt9v032-fix-enum-mbus-codes-and-frame-size.patch
@@ -0,0 +1,63 @@
+From 8f64440a6b1c93b418cc240492768c8ae8c44999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 08:55:24 +0100
+Subject: media: i2c: mt9v032: fix enum mbus codes and frame sizes
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit 1451d5ae351d938a0ab1677498c893f17b9ee21d ]
+
+This driver supports both the mt9v032 (color) and the mt9v022 (mono)
+sensors. Depending on which sensor is used, the format from the sensor is
+different. The format.code inside the dev struct holds this information.
+The enum mbus and enum frame sizes need to take into account both type of
+sensors, not just the color one. To solve this, use the format.code in
+these functions instead of the hardcoded bayer color format (which is only
+used for mt9v032).
+
+[Sakari Ailus: rewrapped commit message]
+
+Suggested-by: Wenyou Yang <wenyou.yang@microchip.com>
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/mt9v032.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/mt9v032.c b/drivers/media/i2c/mt9v032.c
+index 4b9b98cf6674c..5bd3ae82992f3 100644
+--- a/drivers/media/i2c/mt9v032.c
++++ b/drivers/media/i2c/mt9v032.c
+@@ -428,10 +428,12 @@ static int mt9v032_enum_mbus_code(struct v4l2_subdev *subdev,
+ 				  struct v4l2_subdev_pad_config *cfg,
+ 				  struct v4l2_subdev_mbus_code_enum *code)
+ {
++	struct mt9v032 *mt9v032 = to_mt9v032(subdev);
++
+ 	if (code->index > 0)
+ 		return -EINVAL;
+ 
+-	code->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	code->code = mt9v032->format.code;
+ 	return 0;
+ }
+ 
+@@ -439,7 +441,11 @@ static int mt9v032_enum_frame_size(struct v4l2_subdev *subdev,
+ 				   struct v4l2_subdev_pad_config *cfg,
+ 				   struct v4l2_subdev_frame_size_enum *fse)
+ {
+-	if (fse->index >= 3 || fse->code != MEDIA_BUS_FMT_SGRBG10_1X10)
++	struct mt9v032 *mt9v032 = to_mt9v032(subdev);
++
++	if (fse->index >= 3)
++		return -EINVAL;
++	if (mt9v032->format.code != fse->code)
+ 		return -EINVAL;
+ 
+ 	fse->min_width = MT9V032_WINDOW_WIDTH_DEF / (1 << fse->index);
+-- 
+2.20.1
+
diff --git a/queue-5.5/media-meson-add-missing-allocation-failure-check-on-.patch b/queue-5.5/media-meson-add-missing-allocation-failure-check-on-.patch
new file mode 100644
index 00000000000..c920c8c3303
--- /dev/null
+++ b/queue-5.5/media-meson-add-missing-allocation-failure-check-on-.patch
@@ -0,0 +1,42 @@
+From 6d04ff9a934f6091d39d772fe937a97723be25ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 15:11:59 +0100
+Subject: media: meson: add missing allocation failure check on new_buf
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 11e0e167d071a28288a7a0a211d48c571d19b56f ]
+
+Currently if the allocation of new_buf fails then a null pointer
+dereference occurs when assiging new_buf->vb. Avoid this by returning
+early on a memory allocation failure as there is not much more can
+be done at this point.
+
+Addresses-Coverity: ("Dereference null return")
+
+Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/meson/vdec/vdec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
+index 0a1a04fd5d13d..8dd1396909d7e 100644
+--- a/drivers/staging/media/meson/vdec/vdec.c
++++ b/drivers/staging/media/meson/vdec/vdec.c
+@@ -133,6 +133,8 @@ vdec_queue_recycle(struct amvdec_session *sess, struct vb2_buffer *vb)
+ 	struct amvdec_buffer *new_buf;
+ 
+ 	new_buf = kmalloc(sizeof(*new_buf), GFP_KERNEL);
++	if (!new_buf)
++		return;
+ 	new_buf->vb = vb;
+ 
+ 	mutex_lock(&sess->bufs_recycle_lock);
+-- 
+2.20.1
+
diff --git a/queue-5.5/media-ov5640-fix-check-for-pll1-exceeding-max-allowe.patch b/queue-5.5/media-ov5640-fix-check-for-pll1-exceeding-max-allowe.patch
new file mode 100644
index 00000000000..2dceb351dfb
--- /dev/null
+++ b/queue-5.5/media-ov5640-fix-check-for-pll1-exceeding-max-allowe.patch
@@ -0,0 +1,42 @@
+From 3882284c6b75c6b66fb56ba424ee613c903e955c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 13:42:11 +0100
+Subject: media: ov5640: Fix check for PLL1 exceeding max allowed rate
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 2e3df204f9af42a47823ee955c08950373417420 ]
+
+The variable _rate is by ov5640_compute_sys_clk() which returns
+zero if the PLL exceeds 1GHz.  Unfortunately, the check to see
+if the max PLL1 output is checking 'rate' and not '_rate' and
+'rate' does not ever appear to be 0.
+
+This patch changes the check against the returned value of
+'_rate' to determine if the PLL1 output exceeds 1GHz.
+
+Fixes: aa2882481cad ("media: ov5640: Adjust the clock based on the expected rate")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5640.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 5e495c833d329..bb968e764f318 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -874,7 +874,7 @@ static unsigned long ov5640_calc_sys_clk(struct ov5640_dev *sensor,
+ 			 * We have reached the maximum allowed PLL1 output,
+ 			 * increase sysdiv.
+ 			 */
+-			if (!rate)
++			if (!_rate)
+ 				break;
+ 
+ 			/*
+-- 
+2.20.1
+
diff --git a/queue-5.5/media-sti-bdisp-fix-a-possible-sleep-in-atomic-conte.patch b/queue-5.5/media-sti-bdisp-fix-a-possible-sleep-in-atomic-conte.patch
new file mode 100644
index 00000000000..a220dbdb69d
--- /dev/null
+++ b/queue-5.5/media-sti-bdisp-fix-a-possible-sleep-in-atomic-conte.patch
@@ -0,0 +1,60 @@
+From 14c9432272dcf6d1565280330a35928499078351 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 11:34:01 +0100
+Subject: media: sti: bdisp: fix a possible sleep-in-atomic-context bug in
+ bdisp_device_run()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit bb6d42061a05d71dd73f620582d9e09c8fbf7f5b ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+drivers/media/platform/sti/bdisp/bdisp-hw.c, 385:
+    msleep in bdisp_hw_reset
+drivers/media/platform/sti/bdisp/bdisp-v4l2.c, 341:
+    bdisp_hw_reset in bdisp_device_run
+drivers/media/platform/sti/bdisp/bdisp-v4l2.c, 317:
+    _raw_spin_lock_irqsave in bdisp_device_run
+
+To fix this bug, msleep() is replaced with udelay().
+
+This bug is found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Reviewed-by: Fabien Dessenne <fabien.dessenne@st.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sti/bdisp/bdisp-hw.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/sti/bdisp/bdisp-hw.c b/drivers/media/platform/sti/bdisp/bdisp-hw.c
+index 4372abbb5950f..a74e9fd652389 100644
+--- a/drivers/media/platform/sti/bdisp/bdisp-hw.c
++++ b/drivers/media/platform/sti/bdisp/bdisp-hw.c
+@@ -14,8 +14,8 @@
+ #define MAX_SRC_WIDTH           2048
+ 
+ /* Reset & boot poll config */
+-#define POLL_RST_MAX            50
+-#define POLL_RST_DELAY_MS       20
++#define POLL_RST_MAX            500
++#define POLL_RST_DELAY_MS       2
+ 
+ enum bdisp_target_plan {
+ 	BDISP_RGB,
+@@ -382,7 +382,7 @@ int bdisp_hw_reset(struct bdisp_dev *bdisp)
+ 	for (i = 0; i < POLL_RST_MAX; i++) {
+ 		if (readl(bdisp->regs + BLT_STA1) & BLT_STA1_IDLE)
+ 			break;
+-		msleep(POLL_RST_DELAY_MS);
++		udelay(POLL_RST_DELAY_MS * 1000);
+ 	}
+ 	if (i == POLL_RST_MAX)
+ 		dev_err(bdisp->dev, "Reset timeout\n");
+-- 
+2.20.1
+
diff --git a/queue-5.5/media-sun4i-csi-deal-with-dram-offset.patch b/queue-5.5/media-sun4i-csi-deal-with-dram-offset.patch
new file mode 100644
index 00000000000..325005e9b30
--- /dev/null
+++ b/queue-5.5/media-sun4i-csi-deal-with-dram-offset.patch
@@ -0,0 +1,71 @@
+From 48ecc094b037c1a652edaf81d82de52735e31ce3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 17:59:15 +0100
+Subject: media: sun4i-csi: Deal with DRAM offset
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 249b286171fa9c358e8d5c825b48c4ebea97c498 ]
+
+On Allwinner SoCs, some high memory bandwidth devices do DMA directly
+over the memory bus (called MBUS), instead of the system bus. These
+devices include the CSI camera sensor interface, video (codec) engine,
+display subsystem, etc.. The memory bus has a different addressing
+scheme without the DRAM starting offset.
+
+Deal with this using the "interconnects" property from the device tree,
+or if that is not available, set dev->dma_pfn_offset to PHYS_PFN_OFFSET.
+
+Fixes: 577bbf23b758 ("media: sunxi: Add A10 CSI driver")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/sunxi/sun4i-csi/sun4i_csi.c      | 22 +++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c
+index f36dc6258900e..b8b07c1de2a8e 100644
+--- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c
++++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c
+@@ -11,6 +11,7 @@
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/of.h>
++#include <linux/of_device.h>
+ #include <linux/of_graph.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+@@ -155,6 +156,27 @@ static int sun4i_csi_probe(struct platform_device *pdev)
+ 	subdev = &csi->subdev;
+ 	vdev = &csi->vdev;
+ 
++	/*
++	 * On Allwinner SoCs, some high memory bandwidth devices do DMA
++	 * directly over the memory bus (called MBUS), instead of the
++	 * system bus. The memory bus has a different addressing scheme
++	 * without the DRAM starting offset.
++	 *
++	 * In some cases this can be described by an interconnect in
++	 * the device tree. In other cases where the hardware is not
++	 * fully understood and the interconnect is left out of the
++	 * device tree, fall back to a default offset.
++	 */
++	if (of_find_property(csi->dev->of_node, "interconnects", NULL)) {
++		ret = of_dma_configure(csi->dev, csi->dev->of_node, true);
++		if (ret)
++			return ret;
++	} else {
++#ifdef PHYS_PFN_OFFSET
++		csi->dev->dma_pfn_offset = PHYS_PFN_OFFSET;
++#endif
++	}
++
+ 	csi->mdev.dev = csi->dev;
+ 	strscpy(csi->mdev.model, "Allwinner Video Capture Device",
+ 		sizeof(csi->mdev.model));
+-- 
+2.20.1
+
diff --git a/queue-5.5/media-sun4i-csi-fix-data-sampling-polarity-handling.patch b/queue-5.5/media-sun4i-csi-fix-data-sampling-polarity-handling.patch
new file mode 100644
index 00000000000..24e4a65c0f3
--- /dev/null
+++ b/queue-5.5/media-sun4i-csi-fix-data-sampling-polarity-handling.patch
@@ -0,0 +1,45 @@
+From 804bbc011691493cc52d65546e4b9201dcb0790d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 17:59:13 +0100
+Subject: media: sun4i-csi: Fix data sampling polarity handling
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit cf9e6d5dbdd56ef2aa72f28c806711c4293c8848 ]
+
+The CLK_POL field specifies whether data is sampled on the falling or
+rising edge of PCLK, not whether the data lines are active high or low.
+Evidence of this can be found in the timing diagram labeled "horizontal
+size setting and pixel clock timing".
+
+Fix the setting by checking the correct flag, V4L2_MBUS_PCLK_SAMPLE_RISING.
+While at it, reorder the three polarity flag checks so HSYNC and VSYNC
+are grouped together.
+
+Fixes: 577bbf23b758 ("media: sunxi: Add A10 CSI driver")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
+index d6979e11a67b2..8b567d0f019bf 100644
+--- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
++++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
+@@ -279,8 +279,8 @@ static int sun4i_csi_start_streaming(struct vb2_queue *vq, unsigned int count)
+ 	       csi->regs + CSI_WIN_CTRL_H_REG);
+ 
+ 	hsync_pol = !!(bus->flags & V4L2_MBUS_HSYNC_ACTIVE_HIGH);
+-	pclk_pol = !!(bus->flags & V4L2_MBUS_DATA_ACTIVE_HIGH);
+ 	vsync_pol = !!(bus->flags & V4L2_MBUS_VSYNC_ACTIVE_HIGH);
++	pclk_pol = !!(bus->flags & V4L2_MBUS_PCLK_SAMPLE_RISING);
+ 	writel(CSI_CFG_INPUT_FMT(csi_fmt->input) |
+ 	       CSI_CFG_OUTPUT_FMT(csi_fmt->output) |
+ 	       CSI_CFG_VSYNC_POL(vsync_pol) |
+-- 
+2.20.1
+
diff --git a/queue-5.5/media-sun4i-csi-fix-hv-sync-polarity-handling.patch b/queue-5.5/media-sun4i-csi-fix-hv-sync-polarity-handling.patch
new file mode 100644
index 00000000000..ca0bd8d2ad8
--- /dev/null
+++ b/queue-5.5/media-sun4i-csi-fix-hv-sync-polarity-handling.patch
@@ -0,0 +1,89 @@
+From cd225cf05fd0a5ecac3eee61705f79eef63e13e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 17:59:14 +0100
+Subject: media: sun4i-csi: Fix [HV]sync polarity handling
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 1948dcf0f928b8bcdca57ca3fba8545ba380fc29 ]
+
+The Allwinner camera sensor interface has a different definition of
+[HV]sync. While the timing diagram uses the names HSYNC and VSYNC,
+the note following the diagram and register names use HREF and VREF.
+Combined they imply the hardware uses either [HV]REF or inverted
+[HV]SYNC. There are also registers to set horizontal skip lengths
+in pixels and vertical skip lengths in lines, also known as back
+porches.
+
+Fix the polarity handling by using the opposite polarity flag for
+the checks. Also rename `[hv]sync_pol` to `[hv]ref_pol` to better
+match the hardware register description.
+
+Fixes: 577bbf23b758 ("media: sunxi: Add A10 CSI driver")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/sunxi/sun4i-csi/sun4i_csi.h |  4 ++--
+ .../media/platform/sunxi/sun4i-csi/sun4i_dma.c | 18 +++++++++++++-----
+ 2 files changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h
+index 001c8bde006ce..88d39b3554c4b 100644
+--- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h
++++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h
+@@ -22,8 +22,8 @@
+ #define CSI_CFG_INPUT_FMT(fmt)			((fmt) << 20)
+ #define CSI_CFG_OUTPUT_FMT(fmt)			((fmt) << 16)
+ #define CSI_CFG_YUV_DATA_SEQ(seq)		((seq) << 8)
+-#define CSI_CFG_VSYNC_POL(pol)			((pol) << 2)
+-#define CSI_CFG_HSYNC_POL(pol)			((pol) << 1)
++#define CSI_CFG_VREF_POL(pol)			((pol) << 2)
++#define CSI_CFG_HREF_POL(pol)			((pol) << 1)
+ #define CSI_CFG_PCLK_POL(pol)			((pol) << 0)
+ 
+ #define CSI_CPT_CTRL_REG		0x08
+diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
+index 8b567d0f019bf..78fa1c535ac64 100644
+--- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
++++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
+@@ -228,7 +228,7 @@ static int sun4i_csi_start_streaming(struct vb2_queue *vq, unsigned int count)
+ 	struct sun4i_csi *csi = vb2_get_drv_priv(vq);
+ 	struct v4l2_fwnode_bus_parallel *bus = &csi->bus;
+ 	const struct sun4i_csi_format *csi_fmt;
+-	unsigned long hsync_pol, pclk_pol, vsync_pol;
++	unsigned long href_pol, pclk_pol, vref_pol;
+ 	unsigned long flags;
+ 	unsigned int i;
+ 	int ret;
+@@ -278,13 +278,21 @@ static int sun4i_csi_start_streaming(struct vb2_queue *vq, unsigned int count)
+ 	writel(CSI_WIN_CTRL_H_ACTIVE(csi->fmt.height),
+ 	       csi->regs + CSI_WIN_CTRL_H_REG);
+ 
+-	hsync_pol = !!(bus->flags & V4L2_MBUS_HSYNC_ACTIVE_HIGH);
+-	vsync_pol = !!(bus->flags & V4L2_MBUS_VSYNC_ACTIVE_HIGH);
++	/*
++	 * This hardware uses [HV]REF instead of [HV]SYNC. Based on the
++	 * provided timing diagrams in the manual, positive polarity
++	 * equals active high [HV]REF.
++	 *
++	 * When the back porch is 0, [HV]REF is more or less equivalent
++	 * to [HV]SYNC inverted.
++	 */
++	href_pol = !!(bus->flags & V4L2_MBUS_HSYNC_ACTIVE_LOW);
++	vref_pol = !!(bus->flags & V4L2_MBUS_VSYNC_ACTIVE_LOW);
+ 	pclk_pol = !!(bus->flags & V4L2_MBUS_PCLK_SAMPLE_RISING);
+ 	writel(CSI_CFG_INPUT_FMT(csi_fmt->input) |
+ 	       CSI_CFG_OUTPUT_FMT(csi_fmt->output) |
+-	       CSI_CFG_VSYNC_POL(vsync_pol) |
+-	       CSI_CFG_HSYNC_POL(hsync_pol) |
++	       CSI_CFG_VREF_POL(vref_pol) |
++	       CSI_CFG_HREF_POL(href_pol) |
+ 	       CSI_CFG_PCLK_POL(pclk_pol),
+ 	       csi->regs + CSI_CFG_REG);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/media-uvcvideo-add-a-quirk-to-force-geo-gc6500-camer.patch b/queue-5.5/media-uvcvideo-add-a-quirk-to-force-geo-gc6500-camer.patch
new file mode 100644
index 00000000000..ee56b4e1963
--- /dev/null
+++ b/queue-5.5/media-uvcvideo-add-a-quirk-to-force-geo-gc6500-camer.patch
@@ -0,0 +1,85 @@
+From 97d10fc2c995217b6c2817581d845af17bf28d2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 11:31:23 +0200
+Subject: media: uvcvideo: Add a quirk to force GEO GC6500 Camera
+ bits-per-pixel value
+
+From: Sergey Zakharchenko <szakharchenko@digital-loggers.com>
+
+[ Upstream commit 1dd2e8f942574e2be18374ebb81751082d8d467c ]
+
+This device does not function correctly in raw mode in kernel
+versions validating buffer sizes in bulk mode. It erroneously
+announces 16 bits per pixel instead of 12 for NV12 format, so it
+needs this quirk to fix computed frame size and avoid legitimate
+frames getting discarded.
+
+[Move info and div variables to local scope]
+
+Signed-off-by: Sergey Zakharchenko <szakharchenko@digital-loggers.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_driver.c | 25 +++++++++++++++++++++++++
+ drivers/media/usb/uvc/uvcvideo.h   |  1 +
+ 2 files changed, 26 insertions(+)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 2b688cc39bb81..99883550375e9 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -497,6 +497,22 @@ static int uvc_parse_format(struct uvc_device *dev,
+ 			}
+ 		}
+ 
++		/* Some devices report bpp that doesn't match the format. */
++		if (dev->quirks & UVC_QUIRK_FORCE_BPP) {
++			const struct v4l2_format_info *info =
++				v4l2_format_info(format->fcc);
++
++			if (info) {
++				unsigned int div = info->hdiv * info->vdiv;
++
++				n = info->bpp[0] * div;
++				for (i = 1; i < info->comp_planes; i++)
++					n += info->bpp[i];
++
++				format->bpp = DIV_ROUND_UP(8 * n, div);
++			}
++		}
++
+ 		if (buffer[2] == UVC_VS_FORMAT_UNCOMPRESSED) {
+ 			ftype = UVC_VS_FRAME_UNCOMPRESSED;
+ 		} else {
+@@ -2874,6 +2890,15 @@ static const struct usb_device_id uvc_ids[] = {
+ 	  .bInterfaceSubClass	= 1,
+ 	  .bInterfaceProtocol	= 0,
+ 	  .driver_info		= (kernel_ulong_t)&uvc_quirk_force_y8 },
++	/* GEO Semiconductor GC6500 */
++	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
++				| USB_DEVICE_ID_MATCH_INT_INFO,
++	  .idVendor		= 0x29fe,
++	  .idProduct		= 0x4d53,
++	  .bInterfaceClass	= USB_CLASS_VIDEO,
++	  .bInterfaceSubClass	= 1,
++	  .bInterfaceProtocol	= 0,
++	  .driver_info		= UVC_INFO_QUIRK(UVC_QUIRK_FORCE_BPP) },
+ 	/* Intel RealSense D4M */
+ 	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+ 				| USB_DEVICE_ID_MATCH_INT_INFO,
+diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
+index f773dc5d802cd..6ab972c643e37 100644
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -198,6 +198,7 @@
+ #define UVC_QUIRK_RESTRICT_FRAME_RATE	0x00000200
+ #define UVC_QUIRK_RESTORE_CTRLS_ON_INIT	0x00000400
+ #define UVC_QUIRK_FORCE_Y8		0x00000800
++#define UVC_QUIRK_FORCE_BPP		0x00001000
+ 
+ /* Format flags */
+ #define UVC_FMT_FLAG_COMPRESSED		0x00000001
+-- 
+2.20.1
+
diff --git a/queue-5.5/media-v4l2-device.h-explicitly-compare-grp-id-mask-t.patch b/queue-5.5/media-v4l2-device.h-explicitly-compare-grp-id-mask-t.patch
new file mode 100644
index 00000000000..e6847e69a5b
--- /dev/null
+++ b/queue-5.5/media-v4l2-device.h-explicitly-compare-grp-id-mask-t.patch
@@ -0,0 +1,94 @@
+From a00c0fbc407df1c75a57e35413557ecb9c835ec4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Dec 2019 22:11:40 +0100
+Subject: media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in
+ v4l2_device macros
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit afb34781620274236bd9fc9246e22f6963ef5262 ]
+
+When building with Clang + -Wtautological-constant-compare, several of
+the ivtv and cx18 drivers warn along the lines of:
+
+ drivers/media/pci/cx18/cx18-driver.c:1005:21: warning: converting the
+ result of '<<' to a boolean always evaluates to true
+ [-Wtautological-constant-compare]
+                         cx18_call_hw(cx, CX18_HW_GPIO_RESET_CTRL,
+                                         ^
+ drivers/media/pci/cx18/cx18-cards.h:18:37: note: expanded from macro
+ 'CX18_HW_GPIO_RESET_CTRL'
+ #define CX18_HW_GPIO_RESET_CTRL         (1 << 6)
+                                           ^
+ 1 warning generated.
+
+This warning happens because the shift operation is implicitly converted
+to a boolean in v4l2_device_mask_call_all before being negated. This can
+be solved by just comparing the mask result to 0 explicitly so that
+there is no boolean conversion. The ultimate goal is to enable
+-Wtautological-compare globally because there are several subwarnings
+that would be helpful to have.
+
+For visual consistency and avoidance of these warnings in the future,
+all of the implicitly boolean conversions in the v4l2_device macros
+are converted to explicit ones as well.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/752
+
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/media/v4l2-device.h | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
+index 5f36e0d2ede67..95353ae476a18 100644
+--- a/include/media/v4l2-device.h
++++ b/include/media/v4l2-device.h
+@@ -371,7 +371,7 @@ static inline bool v4l2_device_supports_requests(struct v4l2_device *v4l2_dev)
+ 		struct v4l2_subdev *__sd;				\
+ 									\
+ 		__v4l2_device_call_subdevs_p(v4l2_dev, __sd,		\
+-			!(grpid) || __sd->grp_id == (grpid), o, f ,	\
++			(grpid) == 0 || __sd->grp_id == (grpid), o, f ,	\
+ 			##args);					\
+ 	} while (0)
+ 
+@@ -403,7 +403,7 @@ static inline bool v4l2_device_supports_requests(struct v4l2_device *v4l2_dev)
+ ({									\
+ 	struct v4l2_subdev *__sd;					\
+ 	__v4l2_device_call_subdevs_until_err_p(v4l2_dev, __sd,		\
+-			!(grpid) || __sd->grp_id == (grpid), o, f ,	\
++			(grpid) == 0 || __sd->grp_id == (grpid), o, f ,	\
+ 			##args);					\
+ })
+ 
+@@ -431,8 +431,8 @@ static inline bool v4l2_device_supports_requests(struct v4l2_device *v4l2_dev)
+ 		struct v4l2_subdev *__sd;				\
+ 									\
+ 		__v4l2_device_call_subdevs_p(v4l2_dev, __sd,		\
+-			!(grpmsk) || (__sd->grp_id & (grpmsk)), o, f ,	\
+-			##args);					\
++			(grpmsk) == 0 || (__sd->grp_id & (grpmsk)), o,	\
++			f , ##args);					\
+ 	} while (0)
+ 
+ /**
+@@ -462,8 +462,8 @@ static inline bool v4l2_device_supports_requests(struct v4l2_device *v4l2_dev)
+ ({									\
+ 	struct v4l2_subdev *__sd;					\
+ 	__v4l2_device_call_subdevs_until_err_p(v4l2_dev, __sd,		\
+-			!(grpmsk) || (__sd->grp_id & (grpmsk)), o, f ,	\
+-			##args);					\
++			(grpmsk) == 0 || (__sd->grp_id & (grpmsk)), o,	\
++			f , ##args);					\
+ })
+ 
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/microblaze-prevent-the-overflow-of-the-start.patch b/queue-5.5/microblaze-prevent-the-overflow-of-the-start.patch
new file mode 100644
index 00000000000..c1c8ce9126b
--- /dev/null
+++ b/queue-5.5/microblaze-prevent-the-overflow-of-the-start.patch
@@ -0,0 +1,37 @@
+From 02afbe2528b3d180a64d0209664af21a23f2fddb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 18:44:34 +0530
+Subject: microblaze: Prevent the overflow of the start
+
+From: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
+
+[ Upstream commit 061d2c1d593076424c910cb1b64ecdb5c9a6923f ]
+
+In case the start + cache size is more than the max int the
+start overflows.
+Prevent the same.
+
+Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/kernel/cpu/cache.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/microblaze/kernel/cpu/cache.c b/arch/microblaze/kernel/cpu/cache.c
+index 0bde47e4fa694..dcba53803fa5f 100644
+--- a/arch/microblaze/kernel/cpu/cache.c
++++ b/arch/microblaze/kernel/cpu/cache.c
+@@ -92,7 +92,8 @@ static inline void __disable_dcache_nomsr(void)
+ #define CACHE_LOOP_LIMITS(start, end, cache_line_length, cache_size)	\
+ do {									\
+ 	int align = ~(cache_line_length - 1);				\
+-	end = min(start + cache_size, end);				\
++	if (start <  UINT_MAX - cache_size)				\
++		end = min(start + cache_size, end);			\
+ 	start &= align;							\
+ } while (0)
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/mips-ralink-dts-gardena_smart_gateway_mt7688-limit-u.patch b/queue-5.5/mips-ralink-dts-gardena_smart_gateway_mt7688-limit-u.patch
new file mode 100644
index 00000000000..fa4bf620ae3
--- /dev/null
+++ b/queue-5.5/mips-ralink-dts-gardena_smart_gateway_mt7688-limit-u.patch
@@ -0,0 +1,40 @@
+From d9c0413b278577e19c1eda1bc98ac05a261db1df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2020 09:48:06 +0100
+Subject: MIPS: ralink: dts: gardena_smart_gateway_mt7688: Limit UART1
+
+From: Reto Schneider <reto.schneider@husqvarnagroup.com>
+
+[ Upstream commit e8c192011c920517e5578d51c7aff0ecadd25de3 ]
+
+The radio module asserts CTS when its RX buffer has 10 bytes left.
+Putting just 8 instead of 16 bytes into the UART1 TX buffer on the Linux
+side ensures to not overflow the RX buffer on the radio module side.
+
+Signed-off-by: Reto Schneider <reto.schneider@husqvarnagroup.com>
+Signed-off-by: Stefan Roese <sr@denx.de>
+Cc: Paul Burton <paul.burton@mips.com>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts b/arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts
+index aa5caaa311047..aad9a8a8669b4 100644
+--- a/arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts
++++ b/arch/mips/boot/dts/ralink/gardena_smart_gateway_mt7688.dts
+@@ -177,6 +177,9 @@
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&pinmux_i2s_gpio>;		/* GPIO0..3 */
+ 
++	fifo-size = <8>;
++	tx-threshold = <8>;
++
+ 	rts-gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+ 	cts-gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+ };
+-- 
+2.20.1
+
diff --git a/queue-5.5/misc-xilinx_sdfec-fix-xsdfec_poll-s-return-type.patch b/queue-5.5/misc-xilinx_sdfec-fix-xsdfec_poll-s-return-type.patch
new file mode 100644
index 00000000000..8ed1efab2f2
--- /dev/null
+++ b/queue-5.5/misc-xilinx_sdfec-fix-xsdfec_poll-s-return-type.patch
@@ -0,0 +1,64 @@
+From 7a88ca4d4da31a8b321c226a5c6ee6ee10d96b7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 22:36:55 +0100
+Subject: misc: xilinx_sdfec: fix xsdfec_poll()'s return type
+
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+
+[ Upstream commit fa4e7fc1386078edcfddd8848cb0374f4af74fe7 ]
+
+xsdfec_poll() is defined as returning 'unsigned int' but the
+.poll method is declared as returning '__poll_t', a bitwise type.
+
+Fix this by using the proper return type and using the EPOLL
+constants instead of the POLL ones, as required for __poll_t.
+
+CC: Derek Kiernan <derek.kiernan@xilinx.com>
+CC: Dragan Cvetic <dragan.cvetic@xilinx.com>
+Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Acked-by: Dragan Cvetic <dragan.cvetic@xilinx.com>
+Link: https://lore.kernel.org/r/20191209213655.57985-1-luc.vanoostenryck@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/xilinx_sdfec.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/misc/xilinx_sdfec.c b/drivers/misc/xilinx_sdfec.c
+index 11835969e9828..48ba7e02bed72 100644
+--- a/drivers/misc/xilinx_sdfec.c
++++ b/drivers/misc/xilinx_sdfec.c
+@@ -1025,25 +1025,25 @@ static long xsdfec_dev_compat_ioctl(struct file *file, unsigned int cmd,
+ }
+ #endif
+ 
+-static unsigned int xsdfec_poll(struct file *file, poll_table *wait)
++static __poll_t xsdfec_poll(struct file *file, poll_table *wait)
+ {
+-	unsigned int mask = 0;
++	__poll_t mask = 0;
+ 	struct xsdfec_dev *xsdfec;
+ 
+ 	xsdfec = container_of(file->private_data, struct xsdfec_dev, miscdev);
+ 
+ 	if (!xsdfec)
+-		return POLLNVAL | POLLHUP;
++		return EPOLLNVAL | EPOLLHUP;
+ 
+ 	poll_wait(file, &xsdfec->waitq, wait);
+ 
+ 	/* XSDFEC ISR detected an error */
+ 	spin_lock_irqsave(&xsdfec->error_data_lock, xsdfec->flags);
+ 	if (xsdfec->state_updated)
+-		mask |= POLLIN | POLLPRI;
++		mask |= EPOLLIN | EPOLLPRI;
+ 
+ 	if (xsdfec->stats_updated)
+-		mask |= POLLIN | POLLRDNORM;
++		mask |= EPOLLIN | EPOLLRDNORM;
+ 	spin_unlock_irqrestore(&xsdfec->error_data_lock, xsdfec->flags);
+ 
+ 	return mask;
+-- 
+2.20.1
+
diff --git a/queue-5.5/mlx5-work-around-high-stack-usage-with-gcc.patch b/queue-5.5/mlx5-work-around-high-stack-usage-with-gcc.patch
new file mode 100644
index 00000000000..85ba25794c1
--- /dev/null
+++ b/queue-5.5/mlx5-work-around-high-stack-usage-with-gcc.patch
@@ -0,0 +1,46 @@
+From 4b18a18a2aa79928f83a6cb20fa5788b69a53c78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2020 22:51:44 +0100
+Subject: mlx5: work around high stack usage with gcc
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 42ae1a5c76691928ed217c7e40269db27f5225e9 ]
+
+In some configurations, gcc tries too hard to optimize this code:
+
+drivers/net/ethernet/mellanox/mlx5/core/en_stats.c: In function 'mlx5e_grp_sw_update_stats':
+drivers/net/ethernet/mellanox/mlx5/core/en_stats.c:302:1: error: the frame size of 1336 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+
+As was stated in the bug report, the reason is that gcc runs into a corner
+case in the register allocator that is rather hard to fix in a good way.
+
+As there is an easy way to work around it, just add a comment and the
+barrier that stops gcc from trying to overoptimize the function.
+
+Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92657
+Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index 9f09253f9f466..a05158472ed11 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -297,6 +297,9 @@ static void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
+ 			s->tx_tls_drop_bypass_req   += sq_stats->tls_drop_bypass_req;
+ #endif
+ 			s->tx_cqes		+= sq_stats->cqes;
++
++			/* https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92657 */
++			barrier();
+ 		}
+ 	}
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/mlxsw-core-add-validation-of-hardware-device-types-f.patch b/queue-5.5/mlxsw-core-add-validation-of-hardware-device-types-f.patch
new file mode 100644
index 00000000000..1e12c328586
--- /dev/null
+++ b/queue-5.5/mlxsw-core-add-validation-of-hardware-device-types-f.patch
@@ -0,0 +1,98 @@
+From a60eea41d0c9e4e6fe3508009e3493d769ab6ecd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Feb 2020 19:26:27 +0200
+Subject: mlxsw: core: Add validation of hardware device types for MGPIR
+ register
+
+From: Vadim Pasternak <vadimp@mellanox.com>
+
+[ Upstream commit 36844c855b896f90bab51ccecf72940eb7e3cfe1 ]
+
+When reading the number of gearboxes from the hardware, the driver does
+not validate the returned 'device type' field. The driver can therefore
+wrongly assume that the queried devices are gearboxes.
+
+On Spectrum-3 systems that support different types of devices, this can
+prevent the driver from loading, as it will try to query the
+temperature sensors from devices which it assumes are gearboxes and in
+fact are not.
+
+For example:
+[  218.129230] mlxsw_minimal 2-0048: Reg cmd access status failed (status=7(bad parameter))
+[  218.138282] mlxsw_minimal 2-0048: Reg cmd access failed (reg_id=900a(mtmp),type=write)
+[  218.147131] mlxsw_minimal 2-0048: Failed to setup temp sensor number 256
+[  218.534480] mlxsw_minimal 2-0048: Fail to register core bus
+[  218.540714] mlxsw_minimal: probe of 2-0048 failed with error -5
+
+Fix this by validating the 'device type' field.
+
+Fixes: 2e265a8b6c094 ("mlxsw: core: Extend hwmon interface with inter-connect temperature attributes")
+Fixes: f14f4e621b1b4 ("mlxsw: core: Extend thermal core with per inter-connect device thermal zones")
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c   | 6 ++++--
+ drivers/net/ethernet/mellanox/mlxsw/core_thermal.c | 8 ++++++--
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
+index 9bf8da5f6dafc..3fe878d7c94cb 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
+@@ -573,6 +573,7 @@ static int mlxsw_hwmon_module_init(struct mlxsw_hwmon *mlxsw_hwmon)
+ 
+ static int mlxsw_hwmon_gearbox_init(struct mlxsw_hwmon *mlxsw_hwmon)
+ {
++	enum mlxsw_reg_mgpir_device_type device_type;
+ 	int index, max_index, sensor_index;
+ 	char mgpir_pl[MLXSW_REG_MGPIR_LEN];
+ 	char mtmp_pl[MLXSW_REG_MTMP_LEN];
+@@ -584,8 +585,9 @@ static int mlxsw_hwmon_gearbox_init(struct mlxsw_hwmon *mlxsw_hwmon)
+ 	if (err)
+ 		return err;
+ 
+-	mlxsw_reg_mgpir_unpack(mgpir_pl, &gbox_num, NULL, NULL, NULL);
+-	if (!gbox_num)
++	mlxsw_reg_mgpir_unpack(mgpir_pl, &gbox_num, &device_type, NULL, NULL);
++	if (device_type != MLXSW_REG_MGPIR_DEVICE_TYPE_GEARBOX_DIE ||
++	    !gbox_num)
+ 		return 0;
+ 
+ 	index = mlxsw_hwmon->module_sensor_max;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
+index c721b171bd8de..ce0a6837daa32 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
+@@ -895,8 +895,10 @@ static int
+ mlxsw_thermal_gearboxes_init(struct device *dev, struct mlxsw_core *core,
+ 			     struct mlxsw_thermal *thermal)
+ {
++	enum mlxsw_reg_mgpir_device_type device_type;
+ 	struct mlxsw_thermal_module *gearbox_tz;
+ 	char mgpir_pl[MLXSW_REG_MGPIR_LEN];
++	u8 gbox_num;
+ 	int i;
+ 	int err;
+ 
+@@ -908,11 +910,13 @@ mlxsw_thermal_gearboxes_init(struct device *dev, struct mlxsw_core *core,
+ 	if (err)
+ 		return err;
+ 
+-	mlxsw_reg_mgpir_unpack(mgpir_pl, &thermal->tz_gearbox_num, NULL, NULL,
++	mlxsw_reg_mgpir_unpack(mgpir_pl, &gbox_num, &device_type, NULL,
+ 			       NULL);
+-	if (!thermal->tz_gearbox_num)
++	if (device_type != MLXSW_REG_MGPIR_DEVICE_TYPE_GEARBOX_DIE ||
++	    !gbox_num)
+ 		return 0;
+ 
++	thermal->tz_gearbox_num = gbox_num;
+ 	thermal->tz_gearbox_arr = kcalloc(thermal->tz_gearbox_num,
+ 					  sizeof(*thermal->tz_gearbox_arr),
+ 					  GFP_KERNEL);
+-- 
+2.20.1
+
diff --git a/queue-5.5/mlxsw-spectrum_dpipe-add-missing-error-path.patch b/queue-5.5/mlxsw-spectrum_dpipe-add-missing-error-path.patch
new file mode 100644
index 00000000000..2bae55456be
--- /dev/null
+++ b/queue-5.5/mlxsw-spectrum_dpipe-add-missing-error-path.patch
@@ -0,0 +1,45 @@
+From 6ddf3f0ef767328bfec9da7fa0fc3914bd689fbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Feb 2020 19:26:28 +0200
+Subject: mlxsw: spectrum_dpipe: Add missing error path
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit 3a99cbb6fa7bca1995586ec2dc21b0368aad4937 ]
+
+In case devlink_dpipe_entry_ctx_prepare() failed, release RTNL that was
+previously taken and free the memory allocated by
+mlxsw_sp_erif_entry_prepare().
+
+Fixes: 2ba5999f009d ("mlxsw: spectrum: Add Support for erif table entries access")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
+index 49933818c6f59..2dc0978428e64 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
+@@ -215,7 +215,7 @@ mlxsw_sp_dpipe_table_erif_entries_dump(void *priv, bool counters_enabled,
+ start_again:
+ 	err = devlink_dpipe_entry_ctx_prepare(dump_ctx);
+ 	if (err)
+-		return err;
++		goto err_ctx_prepare;
+ 	j = 0;
+ 	for (; i < rif_count; i++) {
+ 		struct mlxsw_sp_rif *rif = mlxsw_sp_rif_by_index(mlxsw_sp, i);
+@@ -247,6 +247,7 @@ start_again:
+ 	return 0;
+ err_entry_append:
+ err_entry_get:
++err_ctx_prepare:
+ 	rtnl_unlock();
+ 	devlink_dpipe_entry_clear(&entry);
+ 	return err;
+-- 
+2.20.1
+
diff --git a/queue-5.5/module-avoid-setting-info-name-early-in-case-we-can-.patch b/queue-5.5/module-avoid-setting-info-name-early-in-case-we-can-.patch
new file mode 100644
index 00000000000..5a580701e73
--- /dev/null
+++ b/queue-5.5/module-avoid-setting-info-name-early-in-case-we-can-.patch
@@ -0,0 +1,61 @@
+From 4e56a2a033ff3072f34b0190ba1db73c1a296ea7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2020 13:32:21 +0100
+Subject: module: avoid setting info->name early in case we can fall back to
+ info->mod->name
+
+From: Jessica Yu <jeyu@kernel.org>
+
+[ Upstream commit 708e0ada1916be765b7faa58854062f2bc620bbf ]
+
+In setup_load_info(), info->name (which contains the name of the module,
+mostly used for early logging purposes before the module gets set up)
+gets unconditionally assigned if .modinfo is missing despite the fact
+that there is an if (!info->name) check near the end of the function.
+Avoid assigning a placeholder string to info->name if .modinfo doesn't
+exist, so that we can fall back to info->mod->name later on.
+
+Fixes: 5fdc7db6448a ("module: setup load info before module_sig_check()")
+Reviewed-by: Miroslav Benes <mbenes@suse.cz>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index d83edc3a41a33..4810ce0fbbca3 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -3059,9 +3059,7 @@ static int setup_load_info(struct load_info *info, int flags)
+ 
+ 	/* Try to find a name early so we can log errors with a module name */
+ 	info->index.info = find_sec(info, ".modinfo");
+-	if (!info->index.info)
+-		info->name = "(missing .modinfo section)";
+-	else
++	if (info->index.info)
+ 		info->name = get_modinfo(info, "name");
+ 
+ 	/* Find internal symbols and strings. */
+@@ -3076,14 +3074,15 @@ static int setup_load_info(struct load_info *info, int flags)
+ 	}
+ 
+ 	if (info->index.sym == 0) {
+-		pr_warn("%s: module has no symbols (stripped?)\n", info->name);
++		pr_warn("%s: module has no symbols (stripped?)\n",
++			info->name ?: "(missing .modinfo section or name field)");
+ 		return -ENOEXEC;
+ 	}
+ 
+ 	info->index.mod = find_sec(info, ".gnu.linkonce.this_module");
+ 	if (!info->index.mod) {
+ 		pr_warn("%s: No module found in object\n",
+-			info->name ?: "(missing .modinfo name field)");
++			info->name ?: "(missing .modinfo section or name field)");
+ 		return -ENOEXEC;
+ 	}
+ 	/* This is temporary: point mod into copy of data. */
+-- 
+2.20.1
+
diff --git a/queue-5.5/modules-lockdep-suppress-suspicious-rcu-usage-warnin.patch b/queue-5.5/modules-lockdep-suppress-suspicious-rcu-usage-warnin.patch
new file mode 100644
index 00000000000..771c1db91d2
--- /dev/null
+++ b/queue-5.5/modules-lockdep-suppress-suspicious-rcu-usage-warnin.patch
@@ -0,0 +1,90 @@
+From f7c59dd65414e538b995ffcd5a11b77e936265c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 15:14:04 +0900
+Subject: modules: lockdep: Suppress suspicious RCU usage warning
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit bf08949cc8b98b7d1e20cfbba169a5938d42dae8 ]
+
+While running kprobe module test, find_module_all() caused
+a suspicious RCU usage warning.
+
+-----
+ =============================
+ WARNING: suspicious RCU usage
+ 5.4.0-next-20191202+ #63 Not tainted
+ -----------------------------
+ kernel/module.c:619 RCU-list traversed in non-reader section!!
+
+ other info that might help us debug this:
+
+ rcu_scheduler_active = 2, debug_locks = 1
+ 1 lock held by rmmod/642:
+  #0: ffffffff8227da80 (module_mutex){+.+.}, at: __x64_sys_delete_module+0x9a/0x230
+
+ stack backtrace:
+ CPU: 0 PID: 642 Comm: rmmod Not tainted 5.4.0-next-20191202+ #63
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+ Call Trace:
+  dump_stack+0x71/0xa0
+  find_module_all+0xc1/0xd0
+  __x64_sys_delete_module+0xac/0x230
+  ? do_syscall_64+0x12/0x1f0
+  do_syscall_64+0x50/0x1f0
+  entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ RIP: 0033:0x4b6d49
+-----
+
+This is because list_for_each_entry_rcu(modules) is called
+without rcu_read_lock(). This is safe because the module_mutex
+is locked.
+
+Pass lockdep_is_held(&module_mutex) to the list_for_each_entry_rcu()
+to suppress this warning, This also fixes similar issue in
+mod_find() and each_symbol_section().
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 8785e31c2dd0f..d83edc3a41a33 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -214,7 +214,8 @@ static struct module *mod_find(unsigned long addr)
+ {
+ 	struct module *mod;
+ 
+-	list_for_each_entry_rcu(mod, &modules, list) {
++	list_for_each_entry_rcu(mod, &modules, list,
++				lockdep_is_held(&module_mutex)) {
+ 		if (within_module(addr, mod))
+ 			return mod;
+ 	}
+@@ -448,7 +449,8 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
+ 	if (each_symbol_in_section(arr, ARRAY_SIZE(arr), NULL, fn, data))
+ 		return true;
+ 
+-	list_for_each_entry_rcu(mod, &modules, list) {
++	list_for_each_entry_rcu(mod, &modules, list,
++				lockdep_is_held(&module_mutex)) {
+ 		struct symsearch arr[] = {
+ 			{ mod->syms, mod->syms + mod->num_syms, mod->crcs,
+ 			  NOT_GPL_ONLY, false },
+@@ -616,7 +618,8 @@ static struct module *find_module_all(const char *name, size_t len,
+ 
+ 	module_assert_mutex_or_preempt();
+ 
+-	list_for_each_entry_rcu(mod, &modules, list) {
++	list_for_each_entry_rcu(mod, &modules, list,
++				lockdep_is_held(&module_mutex)) {
+ 		if (!even_unformed && mod->state == MODULE_STATE_UNFORMED)
+ 			continue;
+ 		if (strlen(mod->name) == len && !memcmp(mod->name, name, len))
+-- 
+2.20.1
+
diff --git a/queue-5.5/nbd-add-a-flush_workqueue-in-nbd_start_device.patch b/queue-5.5/nbd-add-a-flush_workqueue-in-nbd_start_device.patch
new file mode 100644
index 00000000000..5545d1337f3
--- /dev/null
+++ b/queue-5.5/nbd-add-a-flush_workqueue-in-nbd_start_device.patch
@@ -0,0 +1,56 @@
+From 214dbbcffa297624eb1784cfd2c073c3f2baea4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 11:18:57 +0800
+Subject: nbd: add a flush_workqueue in nbd_start_device
+
+From: Sun Ke <sunke32@huawei.com>
+
+[ Upstream commit 5c0dd228b5fc30a3b732c7ae2657e0161ec7ed80 ]
+
+When kzalloc fail, may cause trying to destroy the
+workqueue from inside the workqueue.
+
+If num_connections is m (2 < m), and NO.1 ~ NO.n
+(1 < n < m) kzalloc are successful. The NO.(n + 1)
+failed. Then, nbd_start_device will return ENOMEM
+to nbd_start_device_ioctl, and nbd_start_device_ioctl
+will return immediately without running flush_workqueue.
+However, we still have n recv threads. If nbd_release
+run first, recv threads may have to drop the last
+config_refs and try to destroy the workqueue from
+inside the workqueue.
+
+To fix it, add a flush_workqueue in nbd_start_device.
+
+Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs")
+Signed-off-by: Sun Ke <sunke32@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index b4607dd961852..78181908f0df6 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1265,6 +1265,16 @@ static int nbd_start_device(struct nbd_device *nbd)
+ 		args = kzalloc(sizeof(*args), GFP_KERNEL);
+ 		if (!args) {
+ 			sock_shutdown(nbd);
++			/*
++			 * If num_connections is m (2 < m),
++			 * and NO.1 ~ NO.n(1 < n < m) kzallocs are successful.
++			 * But NO.(n + 1) failed. We still have n recv threads.
++			 * So, add flush_workqueue here to prevent recv threads
++			 * dropping the last config_refs and trying to destroy
++			 * the workqueue from inside the workqueue.
++			 */
++			if (i)
++				flush_workqueue(nbd->recv_workq);
+ 			return -ENOMEM;
+ 		}
+ 		sk_set_memalloc(config->socks[i]->sock->sk);
+-- 
+2.20.1
+
diff --git a/queue-5.5/net-ethernet-ixp4xx-standard-module-init.patch b/queue-5.5/net-ethernet-ixp4xx-standard-module-init.patch
new file mode 100644
index 00000000000..474fa19c363
--- /dev/null
+++ b/queue-5.5/net-ethernet-ixp4xx-standard-module-init.patch
@@ -0,0 +1,228 @@
+From 782055b8d4e20ffa9b1eb2fd80f0cf51c86cb6a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 13:04:46 +0100
+Subject: net: ethernet: ixp4xx: Standard module init
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit c83db9ef5640548631707e8b4a7bcddc115fdbae ]
+
+The IXP4xx driver was initializing the MDIO bus before even
+probing, in the callbacks supposed to be used for setting up
+the module itself, and with the side effect of trying to
+register the MDIO bus as soon as this module was loaded or
+compiled into the kernel whether the device was discovered
+or not.
+
+This does not work with multiplatform environments.
+
+To get rid of this: set up the MDIO bus from the probe()
+callback and remove it in the remove() callback. Rename
+the probe() and remove() calls to reflect the most common
+conventions.
+
+Since there is a bit of checking for the ethernet feature
+to be present in the MDIO registering function, making the
+whole module not even be registered if we can't find an
+MDIO bus, we need something similar: register the MDIO
+bus when the corresponding ethernet is probed, and
+return -EPROBE_DEFER on the other interfaces until this
+happens. If no MDIO bus is present on any of the
+registered interfaces we will eventually bail out.
+
+None of the platforms I've seen has e.g. MDIO on EthB
+and only uses EthC, there is always a Ethernet hardware
+on the NPE (B, C) that has the MDIO bus, we just might
+have to wait for it.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xscale/ixp4xx_eth.c | 96 +++++++++++-------------
+ 1 file changed, 44 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
+index 6fc04ffb22c2a..d4e095d0e8f14 100644
+--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
++++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
+@@ -517,25 +517,14 @@ static int ixp4xx_mdio_write(struct mii_bus *bus, int phy_id, int location,
+ 	return ret;
+ }
+ 
+-static int ixp4xx_mdio_register(void)
++static int ixp4xx_mdio_register(struct eth_regs __iomem *regs)
+ {
+ 	int err;
+ 
+ 	if (!(mdio_bus = mdiobus_alloc()))
+ 		return -ENOMEM;
+ 
+-	if (cpu_is_ixp43x()) {
+-		/* IXP43x lacks NPE-B and uses NPE-C for MII PHY access */
+-		if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEC_ETH))
+-			return -ENODEV;
+-		mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthC_BASE_VIRT;
+-	} else {
+-		/* All MII PHY accesses use NPE-B Ethernet registers */
+-		if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEB_ETH0))
+-			return -ENODEV;
+-		mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthB_BASE_VIRT;
+-	}
+-
++	mdio_regs = regs;
+ 	__raw_writel(DEFAULT_CORE_CNTRL, &mdio_regs->core_control);
+ 	spin_lock_init(&mdio_lock);
+ 	mdio_bus->name = "IXP4xx MII Bus";
+@@ -1374,7 +1363,7 @@ static const struct net_device_ops ixp4xx_netdev_ops = {
+ 	.ndo_validate_addr = eth_validate_addr,
+ };
+ 
+-static int eth_init_one(struct platform_device *pdev)
++static int ixp4xx_eth_probe(struct platform_device *pdev)
+ {
+ 	struct port *port;
+ 	struct net_device *dev;
+@@ -1384,7 +1373,7 @@ static int eth_init_one(struct platform_device *pdev)
+ 	char phy_id[MII_BUS_ID_SIZE + 3];
+ 	int err;
+ 
+-	if (!(dev = alloc_etherdev(sizeof(struct port))))
++	if (!(dev = devm_alloc_etherdev(&pdev->dev, sizeof(struct port))))
+ 		return -ENOMEM;
+ 
+ 	SET_NETDEV_DEV(dev, &pdev->dev);
+@@ -1394,20 +1383,51 @@ static int eth_init_one(struct platform_device *pdev)
+ 
+ 	switch (port->id) {
+ 	case IXP4XX_ETH_NPEA:
++		/* If the MDIO bus is not up yet, defer probe */
++		if (!mdio_bus)
++			return -EPROBE_DEFER;
+ 		port->regs = (struct eth_regs __iomem *)IXP4XX_EthA_BASE_VIRT;
+ 		regs_phys  = IXP4XX_EthA_BASE_PHYS;
+ 		break;
+ 	case IXP4XX_ETH_NPEB:
++		/*
++		 * On all except IXP43x, NPE-B is used for the MDIO bus.
++		 * If there is no NPE-B in the feature set, bail out, else
++		 * register the MDIO bus.
++		 */
++		if (!cpu_is_ixp43x()) {
++			if (!(ixp4xx_read_feature_bits() &
++			      IXP4XX_FEATURE_NPEB_ETH0))
++				return -ENODEV;
++			/* Else register the MDIO bus on NPE-B */
++			if ((err = ixp4xx_mdio_register(IXP4XX_EthC_BASE_VIRT)))
++				return err;
++		}
++		if (!mdio_bus)
++			return -EPROBE_DEFER;
+ 		port->regs = (struct eth_regs __iomem *)IXP4XX_EthB_BASE_VIRT;
+ 		regs_phys  = IXP4XX_EthB_BASE_PHYS;
+ 		break;
+ 	case IXP4XX_ETH_NPEC:
++		/*
++		 * IXP43x lacks NPE-B and uses NPE-C for the MDIO bus access,
++		 * of there is no NPE-C, no bus, nothing works, so bail out.
++		 */
++		if (cpu_is_ixp43x()) {
++			if (!(ixp4xx_read_feature_bits() &
++			      IXP4XX_FEATURE_NPEC_ETH))
++				return -ENODEV;
++			/* Else register the MDIO bus on NPE-C */
++			if ((err = ixp4xx_mdio_register(IXP4XX_EthC_BASE_VIRT)))
++				return err;
++		}
++		if (!mdio_bus)
++			return -EPROBE_DEFER;
+ 		port->regs = (struct eth_regs __iomem *)IXP4XX_EthC_BASE_VIRT;
+ 		regs_phys  = IXP4XX_EthC_BASE_PHYS;
+ 		break;
+ 	default:
+-		err = -ENODEV;
+-		goto err_free;
++		return -ENODEV;
+ 	}
+ 
+ 	dev->netdev_ops = &ixp4xx_netdev_ops;
+@@ -1416,10 +1436,8 @@ static int eth_init_one(struct platform_device *pdev)
+ 
+ 	netif_napi_add(dev, &port->napi, eth_poll, NAPI_WEIGHT);
+ 
+-	if (!(port->npe = npe_request(NPE_ID(port->id)))) {
+-		err = -EIO;
+-		goto err_free;
+-	}
++	if (!(port->npe = npe_request(NPE_ID(port->id))))
++		return -EIO;
+ 
+ 	port->mem_res = request_mem_region(regs_phys, REGS_SIZE, dev->name);
+ 	if (!port->mem_res) {
+@@ -1465,12 +1483,10 @@ err_free_mem:
+ 	release_resource(port->mem_res);
+ err_npe_rel:
+ 	npe_release(port->npe);
+-err_free:
+-	free_netdev(dev);
+ 	return err;
+ }
+ 
+-static int eth_remove_one(struct platform_device *pdev)
++static int ixp4xx_eth_remove(struct platform_device *pdev)
+ {
+ 	struct net_device *dev = platform_get_drvdata(pdev);
+ 	struct phy_device *phydev = dev->phydev;
+@@ -1478,45 +1494,21 @@ static int eth_remove_one(struct platform_device *pdev)
+ 
+ 	unregister_netdev(dev);
+ 	phy_disconnect(phydev);
++	ixp4xx_mdio_remove();
+ 	npe_port_tab[NPE_ID(port->id)] = NULL;
+ 	npe_release(port->npe);
+ 	release_resource(port->mem_res);
+-	free_netdev(dev);
+ 	return 0;
+ }
+ 
+ static struct platform_driver ixp4xx_eth_driver = {
+ 	.driver.name	= DRV_NAME,
+-	.probe		= eth_init_one,
+-	.remove		= eth_remove_one,
++	.probe		= ixp4xx_eth_probe,
++	.remove		= ixp4xx_eth_remove,
+ };
+-
+-static int __init eth_init_module(void)
+-{
+-	int err;
+-
+-	/*
+-	 * FIXME: we bail out on device tree boot but this really needs
+-	 * to be fixed in a nicer way: this registers the MDIO bus before
+-	 * even matching the driver infrastructure, we should only probe
+-	 * detected hardware.
+-	 */
+-	if (of_have_populated_dt())
+-		return -ENODEV;
+-	if ((err = ixp4xx_mdio_register()))
+-		return err;
+-	return platform_driver_register(&ixp4xx_eth_driver);
+-}
+-
+-static void __exit eth_cleanup_module(void)
+-{
+-	platform_driver_unregister(&ixp4xx_eth_driver);
+-	ixp4xx_mdio_remove();
+-}
++module_platform_driver(ixp4xx_eth_driver);
+ 
+ MODULE_AUTHOR("Krzysztof Halasa");
+ MODULE_DESCRIPTION("Intel IXP4xx Ethernet driver");
+ MODULE_LICENSE("GPL v2");
+ MODULE_ALIAS("platform:ixp4xx_eth");
+-module_init(eth_init_module);
+-module_exit(eth_cleanup_module);
+-- 
+2.20.1
+
diff --git a/queue-5.5/net-mlx5e-fix-printk-format-warning.patch b/queue-5.5/net-mlx5e-fix-printk-format-warning.patch
new file mode 100644
index 00000000000..84c6585db04
--- /dev/null
+++ b/queue-5.5/net-mlx5e-fix-printk-format-warning.patch
@@ -0,0 +1,38 @@
+From e6081ede95ccff13350faafed7d5064eb99f2960 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 16:15:17 -0800
+Subject: net/mlx5e: Fix printk format warning
+
+From: Olof Johansson <olof@lixom.net>
+
+[ Upstream commit ca9c74ae9be5e78541c2058db9a754947a7d4a9b ]
+
+Use "%zu" for size_t. Seen on ARM allmodconfig:
+
+drivers/net/ethernet/mellanox/mlx5/core/wq.c: In function 'mlx5_wq_cyc_wqe_dump':
+include/linux/kern_levels.h:5:18: warning: format '%ld' expects argument of type 'long int', but argument 5 has type 'size_t' {aka 'unsigned int'} [-Wformat=]
+
+Fixes: 130c7b46c93d ("net/mlx5e: TX, Dump WQs wqe descriptors on CQE with error events")
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/wq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+index f2a0e72285bac..02f7e4a39578a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+@@ -89,7 +89,7 @@ void mlx5_wq_cyc_wqe_dump(struct mlx5_wq_cyc *wq, u16 ix, u8 nstrides)
+ 	len = nstrides << wq->fbc.log_stride;
+ 	wqe = mlx5_wq_cyc_get_wqe(wq, ix);
+ 
+-	pr_info("WQE DUMP: WQ size %d WQ cur size %d, WQE index 0x%x, len: %ld\n",
++	pr_info("WQE DUMP: WQ size %d WQ cur size %d, WQE index 0x%x, len: %zu\n",
+ 		mlx5_wq_cyc_get_size(wq), wq->cur_sz, ix, len);
+ 	print_hex_dump(KERN_WARNING, "", DUMP_PREFIX_OFFSET, 16, 1, wqe, len, false);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/net-phy-fixed_phy-fix-use-after-free-when-checking-l.patch b/queue-5.5/net-phy-fixed_phy-fix-use-after-free-when-checking-l.patch
new file mode 100644
index 00000000000..6ad62a42e20
--- /dev/null
+++ b/queue-5.5/net-phy-fixed_phy-fix-use-after-free-when-checking-l.patch
@@ -0,0 +1,47 @@
+From cee9647efd48bb1b7a2e42f5a78ce591c2872c01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 17:03:19 -0800
+Subject: net: phy: fixed_phy: fix use-after-free when checking link GPIO
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit d266f19f3ae7fbcaf92229639b78d2110ae44f33 ]
+
+If we fail to locate GPIO for any reason other than deferral or
+not-found-GPIO, we try to print device tree node info, however if might
+be freed already as we called of_node_put() on it.
+
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/fixed_phy.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
+index 7c5265fd2b94d..4190f9ed5313d 100644
+--- a/drivers/net/phy/fixed_phy.c
++++ b/drivers/net/phy/fixed_phy.c
+@@ -212,16 +212,13 @@ static struct gpio_desc *fixed_phy_get_gpiod(struct device_node *np)
+ 	 */
+ 	gpiod = gpiod_get_from_of_node(fixed_link_node, "link-gpios", 0,
+ 				       GPIOD_IN, "mdio");
+-	of_node_put(fixed_link_node);
+-	if (IS_ERR(gpiod)) {
+-		if (PTR_ERR(gpiod) == -EPROBE_DEFER)
+-			return gpiod;
+-
++	if (IS_ERR(gpiod) && PTR_ERR(gpiod) != -EPROBE_DEFER) {
+ 		if (PTR_ERR(gpiod) != -ENOENT)
+ 			pr_err("error getting GPIO for fixed link %pOF, proceed without\n",
+ 			       fixed_link_node);
+ 		gpiod = NULL;
+ 	}
++	of_node_put(fixed_link_node);
+ 
+ 	return gpiod;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/net-phy-realtek-add-logging-for-the-rgmii-tx-delay-c.patch b/queue-5.5/net-phy-realtek-add-logging-for-the-rgmii-tx-delay-c.patch
new file mode 100644
index 00000000000..1d52acbb647
--- /dev/null
+++ b/queue-5.5/net-phy-realtek-add-logging-for-the-rgmii-tx-delay-c.patch
@@ -0,0 +1,74 @@
+From 7be31b7551da2845abe61ec2023e5c3168c0c83f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Dec 2019 19:51:47 +0100
+Subject: net: phy: realtek: add logging for the RGMII TX delay configuration
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 3aec743d69822d22d4a5b60deb9518ed8be6fa67 ]
+
+RGMII requires a delay of 2ns between the data and the clock signal.
+There are at least three ways this can happen. One possibility is by
+having the PHY generate this delay.
+This is a common source for problems (for example with slow TX speeds or
+packet loss when sending data). The TX delay configuration of the
+RTL8211F PHY can be set either by pin-strappping the RXD1 pin (HIGH
+means enabled, LOW means disabled) or through configuring a paged
+register. The setting from the RXD1 pin is also reflected in the
+register.
+
+Add debug logging to the TX delay configuration on RTL8211F so it's
+easier to spot these issues (for example if the TX delay is enabled for
+both, the RTL8211F PHY and the MAC).
+This is especially helpful because there is no public datasheet for the
+RTL8211F PHY available with all the RX/TX delay specifics.
+
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/realtek.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
+index 476db5345e1af..879ca37c85081 100644
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -171,7 +171,9 @@ static int rtl8211c_config_init(struct phy_device *phydev)
+ 
+ static int rtl8211f_config_init(struct phy_device *phydev)
+ {
++	struct device *dev = &phydev->mdio.dev;
+ 	u16 val;
++	int ret;
+ 
+ 	/* enable TX-delay for rgmii-{id,txid}, and disable it for rgmii and
+ 	 * rgmii-rxid. The RX-delay can be enabled by the external RXDLY pin.
+@@ -189,7 +191,22 @@ static int rtl8211f_config_init(struct phy_device *phydev)
+ 		return 0;
+ 	}
+ 
+-	return phy_modify_paged(phydev, 0xd08, 0x11, RTL8211F_TX_DELAY, val);
++	ret = phy_modify_paged_changed(phydev, 0xd08, 0x11, RTL8211F_TX_DELAY,
++				       val);
++	if (ret < 0) {
++		dev_err(dev, "Failed to update the TX delay register\n");
++		return ret;
++	} else if (ret) {
++		dev_dbg(dev,
++			"%s 2ns TX delay (and changing the value from pin-strapping RXD1 or the bootloader)\n",
++			val ? "Enabling" : "Disabling");
++	} else {
++		dev_dbg(dev,
++			"2ns TX delay was already %s (by pin-strapping RXD1 or bootloader configuration)\n",
++			val ? "enabled" : "disabled");
++	}
++
++	return 0;
+ }
+ 
+ static int rtl8211e_config_init(struct phy_device *phydev)
+-- 
+2.20.1
+
diff --git a/queue-5.5/net-wan-fsl_ucc_hdlc-reject-muram-offsets-above-64k.patch b/queue-5.5/net-wan-fsl_ucc_hdlc-reject-muram-offsets-above-64k.patch
new file mode 100644
index 00000000000..c9bb2d0868c
--- /dev/null
+++ b/queue-5.5/net-wan-fsl_ucc_hdlc-reject-muram-offsets-above-64k.patch
@@ -0,0 +1,44 @@
+From 3e8b100f2cb85c98b5f2ccac80e539fcd846a9f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2019 15:55:51 +0100
+Subject: net/wan/fsl_ucc_hdlc: reject muram offsets above 64K
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit 148587a59f6b85831695e0497d9dd1af5f0495af ]
+
+Qiang Zhao points out that these offsets get written to 16-bit
+registers, and there are some QE platforms with more than 64K
+muram. So it is possible that qe_muram_alloc() gives us an allocation
+that can't actually be used by the hardware, so detect and reject
+that.
+
+Reported-by: Qiang Zhao <qiang.zhao@nxp.com>
+Reviewed-by: Timur Tabi <timur@kernel.org>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/fsl_ucc_hdlc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index aef7de225783f..4ad0a0c33d853 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -245,6 +245,11 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ 		ret = -ENOMEM;
+ 		goto free_riptr;
+ 	}
++	if (riptr != (u16)riptr || tiptr != (u16)tiptr) {
++		dev_err(priv->dev, "MURAM allocation out of addressable range\n");
++		ret = -ENOMEM;
++		goto free_tiptr;
++	}
+ 
+ 	/* Set RIPTR, TIPTR */
+ 	iowrite16be(riptr, &priv->ucc_pram->riptr);
+-- 
+2.20.1
+
diff --git a/queue-5.5/netfilter-nft_tunnel-add-the-missing-erspan_version-.patch b/queue-5.5/netfilter-nft_tunnel-add-the-missing-erspan_version-.patch
new file mode 100644
index 00000000000..114fa044805
--- /dev/null
+++ b/queue-5.5/netfilter-nft_tunnel-add-the-missing-erspan_version-.patch
@@ -0,0 +1,39 @@
+From 91cb9b9151266479b2150f7aebd14d4d2c05a359 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 16:53:06 +0800
+Subject: netfilter: nft_tunnel: add the missing ERSPAN_VERSION nla_policy
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 0705f95c332081036d85f26691e9d3cd7d901c31 ]
+
+ERSPAN_VERSION is an attribute parsed in kernel side, nla_policy
+type should be added for it, like other attributes.
+
+Fixes: af308b94a2a4 ("netfilter: nf_tables: add tunnel support")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_tunnel.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index 5284fcf16be73..f8d2919cf9fdc 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -248,8 +248,9 @@ static int nft_tunnel_obj_vxlan_init(const struct nlattr *attr,
+ }
+ 
+ static const struct nla_policy nft_tunnel_opts_erspan_policy[NFTA_TUNNEL_KEY_ERSPAN_MAX + 1] = {
++	[NFTA_TUNNEL_KEY_ERSPAN_VERSION]	= { .type = NLA_U32 },
+ 	[NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX]	= { .type = NLA_U32 },
+-	[NFTA_TUNNEL_KEY_ERSPAN_V2_DIR]	= { .type = NLA_U8 },
++	[NFTA_TUNNEL_KEY_ERSPAN_V2_DIR]		= { .type = NLA_U8 },
+ 	[NFTA_TUNNEL_KEY_ERSPAN_V2_HWID]	= { .type = NLA_U8 },
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/nfc-port100-convert-cpu_to_le16-le16_to_cpu-e1-e2-to.patch b/queue-5.5/nfc-port100-convert-cpu_to_le16-le16_to_cpu-e1-e2-to.patch
new file mode 100644
index 00000000000..407c298bde1
--- /dev/null
+++ b/queue-5.5/nfc-port100-convert-cpu_to_le16-le16_to_cpu-e1-e2-to.patch
@@ -0,0 +1,37 @@
+From 2fd2dbb60f7cf2c915ee9db14731322de634b6e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 21:08:45 +0800
+Subject: NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use
+ le16_add_cpu().
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit 718eae277e62a26e5862eb72a830b5e0fe37b04a ]
+
+Convert cpu_to_le16(le16_to_cpu(frame->datalen) + len) to
+use le16_add_cpu(), which is more concise and does the same thing.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/port100.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
+index 604dba4f18afd..8e4d355dc3aec 100644
+--- a/drivers/nfc/port100.c
++++ b/drivers/nfc/port100.c
+@@ -565,7 +565,7 @@ static void port100_tx_update_payload_len(void *_frame, int len)
+ {
+ 	struct port100_frame *frame = _frame;
+ 
+-	frame->datalen = cpu_to_le16(le16_to_cpu(frame->datalen) + len);
++	le16_add_cpu(&frame->datalen, len);
+ }
+ 
+ static bool port100_rx_frame_is_valid(void *_frame)
+-- 
+2.20.1
+
diff --git a/queue-5.5/nfs-fix-memory-leaks.patch b/queue-5.5/nfs-fix-memory-leaks.patch
new file mode 100644
index 00000000000..2241efd0e27
--- /dev/null
+++ b/queue-5.5/nfs-fix-memory-leaks.patch
@@ -0,0 +1,51 @@
+From 938947f10eac6ac85779d85e2265a9ae912b8ce3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 03:47:53 +0000
+Subject: NFS: Fix memory leaks
+
+From: Wenwen Wang <wenwen@cs.uga.edu>
+
+[ Upstream commit 123c23c6a7b7ecd2a3d6060bea1d94019f71fd66 ]
+
+In _nfs42_proc_copy(), 'res->commit_res.verf' is allocated through
+kzalloc() if 'args->sync' is true. In the following code, if
+'res->synchronous' is false, handle_async_copy() will be invoked. If an
+error occurs during the invocation, the following code will not be executed
+and the error will be returned . However, the allocated
+'res->commit_res.verf' is not deallocated, leading to a memory leak. This
+is also true if the invocation of process_copy_commit() returns an error.
+
+To fix the above leaks, redirect the execution to the 'out' label if an
+error is encountered.
+
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs42proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
+index 9637aad36bdca..e2ae54b35dfe1 100644
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -343,14 +343,14 @@ static ssize_t _nfs42_proc_copy(struct file *src,
+ 		status = handle_async_copy(res, dst_server, src_server, src,
+ 				dst, &args->src_stateid, restart);
+ 		if (status)
+-			return status;
++			goto out;
+ 	}
+ 
+ 	if ((!res->synchronous || !args->sync) &&
+ 			res->write_res.verifier.committed != NFS_FILE_SYNC) {
+ 		status = process_copy_commit(dst, pos_dst, res);
+ 		if (status)
+-			return status;
++			goto out;
+ 	}
+ 
+ 	truncate_pagecache_range(dst_inode, pos_dst,
+-- 
+2.20.1
+
diff --git a/queue-5.5/nfs-fix-timstamp-debug-prints.patch b/queue-5.5/nfs-fix-timstamp-debug-prints.patch
new file mode 100644
index 00000000000..022fbf5f1e2
--- /dev/null
+++ b/queue-5.5/nfs-fix-timstamp-debug-prints.patch
@@ -0,0 +1,65 @@
+From 1ce8ae73a77cabd54946eaca64fbccb69e779d68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 10:13:16 +0100
+Subject: nfs: fix timstamp debug prints
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 057f184b1245150b88e59997fc6f1af0e138d42e ]
+
+Starting in v5.5, the timestamps are correctly passed down as
+64-bit seconds with NFSv4 on 32-bit machines, but some debug
+statements still truncate them to 'long'.
+
+Fixes: e86d5a02874c ("NFS: Convert struct nfs_fattr to use struct timespec64")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4xdr.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index d0feef17db50d..dc6b9c2f36b2a 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -4097,7 +4097,7 @@ static int decode_attr_time_access(struct xdr_stream *xdr, uint32_t *bitmap, str
+ 			status = NFS_ATTR_FATTR_ATIME;
+ 		bitmap[1] &= ~FATTR4_WORD1_TIME_ACCESS;
+ 	}
+-	dprintk("%s: atime=%ld\n", __func__, (long)time->tv_sec);
++	dprintk("%s: atime=%lld\n", __func__, time->tv_sec);
+ 	return status;
+ }
+ 
+@@ -4115,7 +4115,7 @@ static int decode_attr_time_metadata(struct xdr_stream *xdr, uint32_t *bitmap, s
+ 			status = NFS_ATTR_FATTR_CTIME;
+ 		bitmap[1] &= ~FATTR4_WORD1_TIME_METADATA;
+ 	}
+-	dprintk("%s: ctime=%ld\n", __func__, (long)time->tv_sec);
++	dprintk("%s: ctime=%lld\n", __func__, time->tv_sec);
+ 	return status;
+ }
+ 
+@@ -4132,8 +4132,8 @@ static int decode_attr_time_delta(struct xdr_stream *xdr, uint32_t *bitmap,
+ 		status = decode_attr_time(xdr, time);
+ 		bitmap[1] &= ~FATTR4_WORD1_TIME_DELTA;
+ 	}
+-	dprintk("%s: time_delta=%ld %ld\n", __func__, (long)time->tv_sec,
+-		(long)time->tv_nsec);
++	dprintk("%s: time_delta=%lld %ld\n", __func__, time->tv_sec,
++		time->tv_nsec);
+ 	return status;
+ }
+ 
+@@ -4197,7 +4197,7 @@ static int decode_attr_time_modify(struct xdr_stream *xdr, uint32_t *bitmap, str
+ 			status = NFS_ATTR_FATTR_MTIME;
+ 		bitmap[1] &= ~FATTR4_WORD1_TIME_MODIFY;
+ 	}
+-	dprintk("%s: mtime=%ld\n", __func__, (long)time->tv_sec);
++	dprintk("%s: mtime=%lld\n", __func__, time->tv_sec);
+ 	return status;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/nfsd-clone-should-commit-src-file-metadata-too.patch b/queue-5.5/nfsd-clone-should-commit-src-file-metadata-too.patch
new file mode 100644
index 00000000000..cabe6ff94f3
--- /dev/null
+++ b/queue-5.5/nfsd-clone-should-commit-src-file-metadata-too.patch
@@ -0,0 +1,69 @@
+From 769c6899e2f4b65ee41139857d5c3b1bc438054f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 14:57:23 -0500
+Subject: nfsd: Clone should commit src file metadata too
+
+From: Trond Myklebust <trondmy@gmail.com>
+
+[ Upstream commit 57f64034966fb945fc958f95f0c51e47af590344 ]
+
+vfs_clone_file_range() can modify the metadata on the source file too,
+so we need to commit that to stable storage as well.
+
+Reported-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Acked-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/vfs.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index f0bca0e87d0c4..82cf80dde5c71 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -280,19 +280,25 @@ out:
+  * Commit metadata changes to stable storage.
+  */
+ static int
+-commit_metadata(struct svc_fh *fhp)
++commit_inode_metadata(struct inode *inode)
+ {
+-	struct inode *inode = d_inode(fhp->fh_dentry);
+ 	const struct export_operations *export_ops = inode->i_sb->s_export_op;
+ 
+-	if (!EX_ISSYNC(fhp->fh_export))
+-		return 0;
+-
+ 	if (export_ops->commit_metadata)
+ 		return export_ops->commit_metadata(inode);
+ 	return sync_inode_metadata(inode, 1);
+ }
+ 
++static int
++commit_metadata(struct svc_fh *fhp)
++{
++	struct inode *inode = d_inode(fhp->fh_dentry);
++
++	if (!EX_ISSYNC(fhp->fh_export))
++		return 0;
++	return commit_inode_metadata(inode);
++}
++
+ /*
+  * Go over the attributes and take care of the small differences between
+  * NFS semantics and what Linux expects.
+@@ -537,6 +543,9 @@ __be32 nfsd4_clone_file_range(struct file *src, u64 src_pos, struct file *dst,
+ 	if (sync) {
+ 		loff_t dst_end = count ? dst_pos + count - 1 : LLONG_MAX;
+ 		int status = vfs_fsync_range(dst, dst_pos, dst_end, 0);
++
++		if (!status)
++			status = commit_inode_metadata(file_inode(src));
+ 		if (status < 0)
+ 			return nfserrno(status);
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.5/nfsd4-avoid-null-deference-on-strange-copy-compounds.patch b/queue-5.5/nfsd4-avoid-null-deference-on-strange-copy-compounds.patch
new file mode 100644
index 00000000000..07d05cb81c3
--- /dev/null
+++ b/queue-5.5/nfsd4-avoid-null-deference-on-strange-copy-compounds.patch
@@ -0,0 +1,54 @@
+From 37e01a00c2c8333af15909df4975045cc24ec2e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 16:07:32 -0500
+Subject: nfsd4: avoid NULL deference on strange COPY compounds
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit d781e3df710745fbbaee4eb07fd5b64331a1b175 ]
+
+With cross-server COPY we've introduced the possibility that the current
+or saved filehandle might not have fh_dentry/fh_export filled in, but we
+missed a place that assumed it was.  I think this could be triggered by
+a compound like:
+
+	PUTFH(foreign filehandle)
+	GETATTR
+	SAVEFH
+	COPY
+
+First, check_if_stalefh_allowed sets no_verify on the first (PUTFH) op.
+Then op_func = nfsd4_putfh runs and leaves current_fh->fh_export NULL.
+need_wrongsec_check returns true, since this PUTFH has OP_IS_PUTFH_LIKE
+set and GETATTR does not have OP_HANDLES_WRONGSEC set.
+
+We should probably also consider tightening the checks in
+check_if_stalefh_allowed and double-checking that we don't assume the
+filehandle is verified elsewhere in the compound.  But I think this
+fixes the immediate issue.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 4e48f1cccab3 "NFSD: allow inter server COPY to have... "
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4proc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 4798667af647c..4d1d0bf8e385f 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -2025,7 +2025,8 @@ nfsd4_proc_compound(struct svc_rqst *rqstp)
+ 			if (op->opdesc->op_flags & OP_CLEAR_STATEID)
+ 				clear_current_stateid(cstate);
+ 
+-			if (need_wrongsec_check(rqstp))
++			if (current_fh->fh_export &&
++					need_wrongsec_check(rqstp))
+ 				op->status = check_nfsd_access(current_fh->fh_export, rqstp);
+ 		}
+ encode_op:
+-- 
+2.20.1
+
diff --git a/queue-5.5/nvme-pci-remove-nvmeq-tags.patch b/queue-5.5/nvme-pci-remove-nvmeq-tags.patch
new file mode 100644
index 00000000000..bb3ac3ee3ac
--- /dev/null
+++ b/queue-5.5/nvme-pci-remove-nvmeq-tags.patch
@@ -0,0 +1,100 @@
+From 6c0d44304589e1e9a6d724f8d62a7d53955dec89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 19:40:24 +0100
+Subject: nvme-pci: remove nvmeq->tags
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit cfa27356f835dc7755192e7b941d4f4851acbcc7 ]
+
+There is no real need to have a pointer to the tagset in
+struct nvme_queue, as we only need it in a single place, and that place
+can derive the used tagset from the device and qid trivially.  This
+fixes a problem with stale pointer exposure when tagsets are reset,
+and also shrinks the nvme_queue structure.  It also matches what most
+other transports have done since day 1.
+
+Reported-by: Edmund Nadolski <edmund.nadolski@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 365a2ddbeaa76..da392b50f73e7 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -167,7 +167,6 @@ struct nvme_queue {
+ 	 /* only used for poll queues: */
+ 	spinlock_t cq_poll_lock ____cacheline_aligned_in_smp;
+ 	volatile struct nvme_completion *cqes;
+-	struct blk_mq_tags **tags;
+ 	dma_addr_t sq_dma_addr;
+ 	dma_addr_t cq_dma_addr;
+ 	u32 __iomem *q_db;
+@@ -376,29 +375,17 @@ static int nvme_admin_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
+ 
+ 	WARN_ON(hctx_idx != 0);
+ 	WARN_ON(dev->admin_tagset.tags[0] != hctx->tags);
+-	WARN_ON(nvmeq->tags);
+ 
+ 	hctx->driver_data = nvmeq;
+-	nvmeq->tags = &dev->admin_tagset.tags[0];
+ 	return 0;
+ }
+ 
+-static void nvme_admin_exit_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
+-{
+-	struct nvme_queue *nvmeq = hctx->driver_data;
+-
+-	nvmeq->tags = NULL;
+-}
+-
+ static int nvme_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
+ 			  unsigned int hctx_idx)
+ {
+ 	struct nvme_dev *dev = data;
+ 	struct nvme_queue *nvmeq = &dev->queues[hctx_idx + 1];
+ 
+-	if (!nvmeq->tags)
+-		nvmeq->tags = &dev->tagset.tags[hctx_idx];
+-
+ 	WARN_ON(dev->tagset.tags[hctx_idx] != hctx->tags);
+ 	hctx->driver_data = nvmeq;
+ 	return 0;
+@@ -948,6 +935,13 @@ static inline void nvme_ring_cq_doorbell(struct nvme_queue *nvmeq)
+ 		writel(head, nvmeq->q_db + nvmeq->dev->db_stride);
+ }
+ 
++static inline struct blk_mq_tags *nvme_queue_tagset(struct nvme_queue *nvmeq)
++{
++	if (!nvmeq->qid)
++		return nvmeq->dev->admin_tagset.tags[0];
++	return nvmeq->dev->tagset.tags[nvmeq->qid - 1];
++}
++
+ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx)
+ {
+ 	volatile struct nvme_completion *cqe = &nvmeq->cqes[idx];
+@@ -972,7 +966,7 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx)
+ 		return;
+ 	}
+ 
+-	req = blk_mq_tag_to_rq(*nvmeq->tags, cqe->command_id);
++	req = blk_mq_tag_to_rq(nvme_queue_tagset(nvmeq), cqe->command_id);
+ 	trace_nvme_sq(req, cqe->sq_head, nvmeq->sq_tail);
+ 	nvme_end_request(req, cqe->status, cqe->result);
+ }
+@@ -1572,7 +1566,6 @@ static const struct blk_mq_ops nvme_mq_admin_ops = {
+ 	.queue_rq	= nvme_queue_rq,
+ 	.complete	= nvme_pci_complete_rq,
+ 	.init_hctx	= nvme_admin_init_hctx,
+-	.exit_hctx      = nvme_admin_exit_hctx,
+ 	.init_request	= nvme_init_request,
+ 	.timeout	= nvme_timeout,
+ };
+-- 
+2.20.1
+
diff --git a/queue-5.5/nvmet-fix-dsm-failure-when-payload-does-not-match-sg.patch b/queue-5.5/nvmet-fix-dsm-failure-when-payload-does-not-match-sg.patch
new file mode 100644
index 00000000000..56388aae891
--- /dev/null
+++ b/queue-5.5/nvmet-fix-dsm-failure-when-payload-does-not-match-sg.patch
@@ -0,0 +1,89 @@
+From 9ad2bb01593777b8d459fd1cee5f9c049b7dfbb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jan 2020 23:23:28 -0800
+Subject: nvmet: fix dsm failure when payload does not match sgl descriptor
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit b716e6889c95f64ba32af492461f6cc9341f3f05 ]
+
+The host is allowed to pass the controller an sgl describing a buffer
+that is larger than the dsm payload itself, allow it when executing
+dsm.
+
+Reported-by: Dakshaja Uppalapati <dakshaja@chelsio.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>,
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/core.c        | 11 +++++++++++
+ drivers/nvme/target/io-cmd-bdev.c |  2 +-
+ drivers/nvme/target/io-cmd-file.c |  2 +-
+ drivers/nvme/target/nvmet.h       |  1 +
+ 4 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index 35810a0a8d212..461987f669c50 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -939,6 +939,17 @@ bool nvmet_check_data_len(struct nvmet_req *req, size_t data_len)
+ }
+ EXPORT_SYMBOL_GPL(nvmet_check_data_len);
+ 
++bool nvmet_check_data_len_lte(struct nvmet_req *req, size_t data_len)
++{
++	if (unlikely(data_len > req->transfer_len)) {
++		req->error_loc = offsetof(struct nvme_common_command, dptr);
++		nvmet_req_complete(req, NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR);
++		return false;
++	}
++
++	return true;
++}
++
+ int nvmet_req_alloc_sgl(struct nvmet_req *req)
+ {
+ 	struct pci_dev *p2p_dev = NULL;
+diff --git a/drivers/nvme/target/io-cmd-bdev.c b/drivers/nvme/target/io-cmd-bdev.c
+index b6fca0e421ef1..ea0e596be15dc 100644
+--- a/drivers/nvme/target/io-cmd-bdev.c
++++ b/drivers/nvme/target/io-cmd-bdev.c
+@@ -280,7 +280,7 @@ static void nvmet_bdev_execute_discard(struct nvmet_req *req)
+ 
+ static void nvmet_bdev_execute_dsm(struct nvmet_req *req)
+ {
+-	if (!nvmet_check_data_len(req, nvmet_dsm_len(req)))
++	if (!nvmet_check_data_len_lte(req, nvmet_dsm_len(req)))
+ 		return;
+ 
+ 	switch (le32_to_cpu(req->cmd->dsm.attributes)) {
+diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
+index caebfce066056..cd5670b83118f 100644
+--- a/drivers/nvme/target/io-cmd-file.c
++++ b/drivers/nvme/target/io-cmd-file.c
+@@ -336,7 +336,7 @@ static void nvmet_file_dsm_work(struct work_struct *w)
+ 
+ static void nvmet_file_execute_dsm(struct nvmet_req *req)
+ {
+-	if (!nvmet_check_data_len(req, nvmet_dsm_len(req)))
++	if (!nvmet_check_data_len_lte(req, nvmet_dsm_len(req)))
+ 		return;
+ 	INIT_WORK(&req->f.work, nvmet_file_dsm_work);
+ 	schedule_work(&req->f.work);
+diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
+index 46df45e837c95..eda28b22a2c87 100644
+--- a/drivers/nvme/target/nvmet.h
++++ b/drivers/nvme/target/nvmet.h
+@@ -374,6 +374,7 @@ bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq,
+ 		struct nvmet_sq *sq, const struct nvmet_fabrics_ops *ops);
+ void nvmet_req_uninit(struct nvmet_req *req);
+ bool nvmet_check_data_len(struct nvmet_req *req, size_t data_len);
++bool nvmet_check_data_len_lte(struct nvmet_req *req, size_t data_len);
+ void nvmet_req_complete(struct nvmet_req *req, u16 status);
+ int nvmet_req_alloc_sgl(struct nvmet_req *req);
+ void nvmet_req_free_sgl(struct nvmet_req *req);
+-- 
+2.20.1
+
diff --git a/queue-5.5/nvmet-pass-lockdep-expression-to-rcu-lists.patch b/queue-5.5/nvmet-pass-lockdep-expression-to-rcu-lists.patch
new file mode 100644
index 00000000000..19f70b9c58a
--- /dev/null
+++ b/queue-5.5/nvmet-pass-lockdep-expression-to-rcu-lists.patch
@@ -0,0 +1,53 @@
+From 8be346021693dac09114b423ee3efc40a25b49d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 13:08:16 +0530
+Subject: nvmet: Pass lockdep expression to RCU lists
+
+From: Amol Grover <frextrite@gmail.com>
+
+[ Upstream commit 4ac76436a6d07dec1c3c766f234aa787a16e8f65 ]
+
+ctrl->subsys->namespaces and subsys->namespaces are traversed with
+list_for_each_entry_rcu outside an RCU read-side critical section but
+under the protection of ctrl->subsys->lock and subsys->lock respectively.
+
+Hence, add the corresponding lockdep expression to the list traversal
+primitive to silence false-positive lockdep warnings, and harden RCU
+lists.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Amol Grover <frextrite@gmail.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index 28438b833c1b0..35810a0a8d212 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -555,7 +555,8 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
+ 	} else {
+ 		struct nvmet_ns *old;
+ 
+-		list_for_each_entry_rcu(old, &subsys->namespaces, dev_link) {
++		list_for_each_entry_rcu(old, &subsys->namespaces, dev_link,
++					lockdep_is_held(&subsys->lock)) {
+ 			BUG_ON(ns->nsid == old->nsid);
+ 			if (ns->nsid < old->nsid)
+ 				break;
+@@ -1172,7 +1173,8 @@ static void nvmet_setup_p2p_ns_map(struct nvmet_ctrl *ctrl,
+ 
+ 	ctrl->p2p_client = get_device(req->p2p_client);
+ 
+-	list_for_each_entry_rcu(ns, &ctrl->subsys->namespaces, dev_link)
++	list_for_each_entry_rcu(ns, &ctrl->subsys->namespaces, dev_link,
++				lockdep_is_held(&ctrl->subsys->lock))
+ 		nvmet_p2pmem_ns_add_p2p(ctrl, ns);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/objtool-fix-arch-x86_64-build-error.patch b/queue-5.5/objtool-fix-arch-x86_64-build-error.patch
new file mode 100644
index 00000000000..c74a22c8936
--- /dev/null
+++ b/queue-5.5/objtool-fix-arch-x86_64-build-error.patch
@@ -0,0 +1,66 @@
+From ed722841a80ab18aada3158a106fd7d54bf98112 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 12:14:08 -0600
+Subject: objtool: Fix ARCH=x86_64 build error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shile Zhang <shile.zhang@linux.alibaba.com>
+
+[ Upstream commit 8580bed7e751e6d4f17881e059daf3cb37ba4717 ]
+
+Building objtool with ARCH=x86_64 fails with:
+
+   $make ARCH=x86_64 -C tools/objtool
+   ...
+     CC       arch/x86/decode.o
+   arch/x86/decode.c:10:22: fatal error: asm/insn.h: No such file or directory
+    #include <asm/insn.h>
+                         ^
+   compilation terminated.
+   mv: cannot stat ‘arch/x86/.decode.o.tmp’: No such file or directory
+   make[2]: *** [arch/x86/decode.o] Error 1
+   ...
+
+The root cause is that the command-line variable 'ARCH' cannot be
+overridden.  It can be replaced by 'SRCARCH', which is defined in
+'tools/scripts/Makefile.arch'.
+
+Signed-off-by: Shile Zhang <shile.zhang@linux.alibaba.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
+Link: https://lore.kernel.org/r/d5d11370ae116df6c653493acd300ec3d7f5e925.1579543924.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/Makefile | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
+index d2a19b0bc05aa..ee08aeff30a19 100644
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -2,10 +2,6 @@
+ include ../scripts/Makefile.include
+ include ../scripts/Makefile.arch
+ 
+-ifeq ($(ARCH),x86_64)
+-ARCH := x86
+-endif
+-
+ # always use the host compiler
+ HOSTAR	?= ar
+ HOSTCC	?= gcc
+@@ -33,7 +29,7 @@ all: $(OBJTOOL)
+ 
+ INCLUDES := -I$(srctree)/tools/include \
+ 	    -I$(srctree)/tools/arch/$(HOSTARCH)/include/uapi \
+-	    -I$(srctree)/tools/arch/$(ARCH)/include
++	    -I$(srctree)/tools/arch/$(SRCARCH)/include
+ WARNINGS := $(EXTRA_WARNINGS) -Wno-switch-default -Wno-switch-enum -Wno-packed
+ CFLAGS   := -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -g $(INCLUDES) $(LIBELF_FLAGS)
+ LDFLAGS  += $(LIBELF_LIBS) $(LIBSUBCMD) $(KBUILD_HOSTLDFLAGS)
+-- 
+2.20.1
+
diff --git a/queue-5.5/ocfs2-fix-a-null-pointer-dereference-when-call-ocfs2.patch b/queue-5.5/ocfs2-fix-a-null-pointer-dereference-when-call-ocfs2.patch
new file mode 100644
index 00000000000..13b89e3b795
--- /dev/null
+++ b/queue-5.5/ocfs2-fix-a-null-pointer-dereference-when-call-ocfs2.patch
@@ -0,0 +1,140 @@
+From 3d3dc9f2bb7f2ba6b46d9961330b289708c20fc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:11:50 -0800
+Subject: ocfs2: fix a NULL pointer dereference when call
+ ocfs2_update_inode_fsync_trans()
+
+From: wangyan <wangyan122@huawei.com>
+
+[ Upstream commit 9f16ca48fc818a17de8be1f75d08e7f4addc4497 ]
+
+I found a NULL pointer dereference in ocfs2_update_inode_fsync_trans(),
+handle->h_transaction may be NULL in this situation:
+
+ocfs2_file_write_iter
+  ->__generic_file_write_iter
+      ->generic_perform_write
+        ->ocfs2_write_begin
+          ->ocfs2_write_begin_nolock
+            ->ocfs2_write_cluster_by_desc
+              ->ocfs2_write_cluster
+                ->ocfs2_mark_extent_written
+                  ->ocfs2_change_extent_flag
+                    ->ocfs2_split_extent
+                      ->ocfs2_try_to_merge_extent
+                        ->ocfs2_extend_rotate_transaction
+                          ->ocfs2_extend_trans
+                            ->jbd2_journal_restart
+                              ->jbd2__journal_restart
+                                // handle->h_transaction is NULL here
+                                ->handle->h_transaction = NULL;
+                                ->start_this_handle
+                                  /* journal aborted due to storage
+                                     network disconnection, return error */
+                                  ->return -EROFS;
+                         /* line 3806 in ocfs2_try_to_merge_extent (),
+                            it will ignore ret error. */
+                        ->ret = 0;
+        ->...
+        ->ocfs2_write_end
+          ->ocfs2_write_end_nolock
+            ->ocfs2_update_inode_fsync_trans
+              // NULL pointer dereference
+              ->oi->i_sync_tid = handle->h_transaction->t_tid;
+
+The information of NULL pointer dereference as follows:
+    JBD2: Detected IO errors while flushing file data on dm-11-45
+    Aborting journal on device dm-11-45.
+    JBD2: Error -5 detected when updating journal superblock for dm-11-45.
+    (dd,22081,3):ocfs2_extend_trans:474 ERROR: status = -30
+    (dd,22081,3):ocfs2_try_to_merge_extent:3877 ERROR: status = -30
+    Unable to handle kernel NULL pointer dereference at
+    virtual address 0000000000000008
+    Mem abort info:
+      ESR = 0x96000004
+      Exception class = DABT (current EL), IL = 32 bits
+      SET = 0, FnV = 0
+      EA = 0, S1PTW = 0
+    Data abort info:
+      ISV = 0, ISS = 0x00000004
+      CM = 0, WnR = 0
+    user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000e74e1338
+    [0000000000000008] pgd=0000000000000000
+    Internal error: Oops: 96000004 [#1] SMP
+    Process dd (pid: 22081, stack limit = 0x00000000584f35a9)
+    CPU: 3 PID: 22081 Comm: dd Kdump: loaded
+    Hardware name: Huawei TaiShan 2280 V2/BC82AMDD, BIOS 0.98 08/25/2019
+    pstate: 60400009 (nZCv daif +PAN -UAO)
+    pc : ocfs2_write_end_nolock+0x2b8/0x550 [ocfs2]
+    lr : ocfs2_write_end_nolock+0x2a0/0x550 [ocfs2]
+    sp : ffff0000459fba70
+    x29: ffff0000459fba70 x28: 0000000000000000
+    x27: ffff807ccf7f1000 x26: 0000000000000001
+    x25: ffff807bdff57970 x24: ffff807caf1d4000
+    x23: ffff807cc79e9000 x22: 0000000000001000
+    x21: 000000006c6cd000 x20: ffff0000091d9000
+    x19: ffff807ccb239db0 x18: ffffffffffffffff
+    x17: 000000000000000e x16: 0000000000000007
+    x15: ffff807c5e15bd78 x14: 0000000000000000
+    x13: 0000000000000000 x12: 0000000000000000
+    x11: 0000000000000000 x10: 0000000000000001
+    x9 : 0000000000000228 x8 : 000000000000000c
+    x7 : 0000000000000fff x6 : ffff807a308ed6b0
+    x5 : ffff7e01f10967c0 x4 : 0000000000000018
+    x3 : d0bc661572445600 x2 : 0000000000000000
+    x1 : 000000001b2e0200 x0 : 0000000000000000
+    Call trace:
+     ocfs2_write_end_nolock+0x2b8/0x550 [ocfs2]
+     ocfs2_write_end+0x4c/0x80 [ocfs2]
+     generic_perform_write+0x108/0x1a8
+     __generic_file_write_iter+0x158/0x1c8
+     ocfs2_file_write_iter+0x668/0x950 [ocfs2]
+     __vfs_write+0x11c/0x190
+     vfs_write+0xac/0x1c0
+     ksys_write+0x6c/0xd8
+     __arm64_sys_write+0x24/0x30
+     el0_svc_common+0x78/0x130
+     el0_svc_handler+0x38/0x78
+     el0_svc+0x8/0xc
+
+To prevent NULL pointer dereference in this situation, we use
+is_handle_aborted() before using handle->h_transaction->t_tid.
+
+Link: http://lkml.kernel.org/r/03e750ab-9ade-83aa-b000-b9e81e34e539@huawei.com
+Signed-off-by: Yan Wang <wangyan122@huawei.com>
+Reviewed-by: Jun Piao <piaojun@huawei.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/journal.h | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
+index 3103ba7f97a28..bfe611ed1b1d7 100644
+--- a/fs/ocfs2/journal.h
++++ b/fs/ocfs2/journal.h
+@@ -597,9 +597,11 @@ static inline void ocfs2_update_inode_fsync_trans(handle_t *handle,
+ {
+ 	struct ocfs2_inode_info *oi = OCFS2_I(inode);
+ 
+-	oi->i_sync_tid = handle->h_transaction->t_tid;
+-	if (datasync)
+-		oi->i_datasync_tid = handle->h_transaction->t_tid;
++	if (!is_handle_aborted(handle)) {
++		oi->i_sync_tid = handle->h_transaction->t_tid;
++		if (datasync)
++			oi->i_datasync_tid = handle->h_transaction->t_tid;
++	}
+ }
+ 
+ #endif /* OCFS2_JOURNAL_H */
+-- 
+2.20.1
+
diff --git a/queue-5.5/ocfs2-make-local-header-paths-relative-to-c-files.patch b/queue-5.5/ocfs2-make-local-header-paths-relative-to-c-files.patch
new file mode 100644
index 00000000000..f92081f3ebe
--- /dev/null
+++ b/queue-5.5/ocfs2-make-local-header-paths-relative-to-c-files.patch
@@ -0,0 +1,340 @@
+From 0c688799e21ec719cc5a75725b7421a9426f62e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:11:40 -0800
+Subject: ocfs2: make local header paths relative to C files
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit ca322fb6030956c2337fbf1c1beeb08c5dd5c943 ]
+
+Gang He reports the failure of building fs/ocfs2/ as an external module
+of the kernel installed on the system:
+
+ $ cd fs/ocfs2
+ $ make -C /lib/modules/`uname -r`/build M=`pwd` modules
+
+If you want to make it work reliably, I'd recommend to remove ccflags-y
+from the Makefiles, and to make header paths relative to the C files.  I
+think this is the correct usage of the #include "..." directive.
+
+Link: http://lkml.kernel.org/r/20191227022950.14804-1-ghe@suse.com
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Gang He <ghe@suse.com>
+Reported-by: Gang He <ghe@suse.com>
+Reviewed-by: Gang He <ghe@suse.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/dlm/Makefile      | 2 --
+ fs/ocfs2/dlm/dlmast.c      | 8 ++++----
+ fs/ocfs2/dlm/dlmconvert.c  | 8 ++++----
+ fs/ocfs2/dlm/dlmdebug.c    | 8 ++++----
+ fs/ocfs2/dlm/dlmdomain.c   | 8 ++++----
+ fs/ocfs2/dlm/dlmlock.c     | 8 ++++----
+ fs/ocfs2/dlm/dlmmaster.c   | 8 ++++----
+ fs/ocfs2/dlm/dlmrecovery.c | 8 ++++----
+ fs/ocfs2/dlm/dlmthread.c   | 8 ++++----
+ fs/ocfs2/dlm/dlmunlock.c   | 8 ++++----
+ fs/ocfs2/dlmfs/Makefile    | 2 --
+ fs/ocfs2/dlmfs/dlmfs.c     | 4 ++--
+ fs/ocfs2/dlmfs/userdlm.c   | 6 +++---
+ 13 files changed, 41 insertions(+), 45 deletions(-)
+
+diff --git a/fs/ocfs2/dlm/Makefile b/fs/ocfs2/dlm/Makefile
+index 38b2243727763..5e700b45d32d2 100644
+--- a/fs/ocfs2/dlm/Makefile
++++ b/fs/ocfs2/dlm/Makefile
+@@ -1,6 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-ccflags-y := -I $(srctree)/$(src)/..
+-
+ obj-$(CONFIG_OCFS2_FS_O2CB) += ocfs2_dlm.o
+ 
+ ocfs2_dlm-objs := dlmdomain.o dlmdebug.o dlmthread.o dlmrecovery.o \
+diff --git a/fs/ocfs2/dlm/dlmast.c b/fs/ocfs2/dlm/dlmast.c
+index 4de89af96abf0..6abaded3ff6bd 100644
+--- a/fs/ocfs2/dlm/dlmast.c
++++ b/fs/ocfs2/dlm/dlmast.c
+@@ -23,15 +23,15 @@
+ #include <linux/spinlock.h>
+ 
+ 
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+ 
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+ 
+ #define MLOG_MASK_PREFIX ML_DLM
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+ 
+ static void dlm_update_lvb(struct dlm_ctxt *dlm, struct dlm_lock_resource *res,
+ 			   struct dlm_lock *lock);
+diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
+index 965f45dbe17bf..6051edc33aefa 100644
+--- a/fs/ocfs2/dlm/dlmconvert.c
++++ b/fs/ocfs2/dlm/dlmconvert.c
+@@ -23,9 +23,9 @@
+ #include <linux/spinlock.h>
+ 
+ 
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+ 
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+@@ -33,7 +33,7 @@
+ #include "dlmconvert.h"
+ 
+ #define MLOG_MASK_PREFIX ML_DLM
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+ 
+ /* NOTE: __dlmconvert_master is the only function in here that
+  * needs a spinlock held on entry (res->spinlock) and it is the
+diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
+index 4d0b452012b25..c5c6efba7b5e2 100644
+--- a/fs/ocfs2/dlm/dlmdebug.c
++++ b/fs/ocfs2/dlm/dlmdebug.c
+@@ -17,9 +17,9 @@
+ #include <linux/debugfs.h>
+ #include <linux/export.h>
+ 
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+ 
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+@@ -27,7 +27,7 @@
+ #include "dlmdebug.h"
+ 
+ #define MLOG_MASK_PREFIX ML_DLM
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+ 
+ static int stringify_lockname(const char *lockname, int locklen, char *buf,
+ 			      int len);
+diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
+index ee6f459f97706..357cfc702ce36 100644
+--- a/fs/ocfs2/dlm/dlmdomain.c
++++ b/fs/ocfs2/dlm/dlmdomain.c
+@@ -20,9 +20,9 @@
+ #include <linux/debugfs.h>
+ #include <linux/sched/signal.h>
+ 
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+ 
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+@@ -30,7 +30,7 @@
+ #include "dlmdebug.h"
+ 
+ #define MLOG_MASK_PREFIX (ML_DLM|ML_DLM_DOMAIN)
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+ 
+ /*
+  * ocfs2 node maps are array of long int, which limits to send them freely
+diff --git a/fs/ocfs2/dlm/dlmlock.c b/fs/ocfs2/dlm/dlmlock.c
+index baff087f38632..83f0760e4fbaa 100644
+--- a/fs/ocfs2/dlm/dlmlock.c
++++ b/fs/ocfs2/dlm/dlmlock.c
+@@ -25,9 +25,9 @@
+ #include <linux/delay.h>
+ 
+ 
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+ 
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+@@ -35,7 +35,7 @@
+ #include "dlmconvert.h"
+ 
+ #define MLOG_MASK_PREFIX ML_DLM
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+ 
+ static struct kmem_cache *dlm_lock_cache;
+ 
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index 74b768ca1cd88..c9d7037b6793c 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -25,9 +25,9 @@
+ #include <linux/delay.h>
+ 
+ 
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+ 
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+@@ -35,7 +35,7 @@
+ #include "dlmdebug.h"
+ 
+ #define MLOG_MASK_PREFIX (ML_DLM|ML_DLM_MASTER)
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+ 
+ static void dlm_mle_node_down(struct dlm_ctxt *dlm,
+ 			      struct dlm_master_list_entry *mle,
+diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
+index 064ce5bbc3f6c..bcaaca5112d6e 100644
+--- a/fs/ocfs2/dlm/dlmrecovery.c
++++ b/fs/ocfs2/dlm/dlmrecovery.c
+@@ -26,16 +26,16 @@
+ #include <linux/delay.h>
+ 
+ 
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+ 
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+ #include "dlmdomain.h"
+ 
+ #define MLOG_MASK_PREFIX (ML_DLM|ML_DLM_RECOVERY)
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+ 
+ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node);
+ 
+diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
+index 61c51c268460a..fd40c17cd0225 100644
+--- a/fs/ocfs2/dlm/dlmthread.c
++++ b/fs/ocfs2/dlm/dlmthread.c
+@@ -25,16 +25,16 @@
+ #include <linux/delay.h>
+ 
+ 
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+ 
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+ #include "dlmdomain.h"
+ 
+ #define MLOG_MASK_PREFIX (ML_DLM|ML_DLM_THREAD)
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+ 
+ static int dlm_thread(void *data);
+ static void dlm_flush_asts(struct dlm_ctxt *dlm);
+diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
+index 3883633e82eb9..dcb17ca8ae74d 100644
+--- a/fs/ocfs2/dlm/dlmunlock.c
++++ b/fs/ocfs2/dlm/dlmunlock.c
+@@ -23,15 +23,15 @@
+ #include <linux/spinlock.h>
+ #include <linux/delay.h>
+ 
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+ 
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+ 
+ #define MLOG_MASK_PREFIX ML_DLM
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+ 
+ #define DLM_UNLOCK_FREE_LOCK           0x00000001
+ #define DLM_UNLOCK_CALL_AST            0x00000002
+diff --git a/fs/ocfs2/dlmfs/Makefile b/fs/ocfs2/dlmfs/Makefile
+index a9874e441bd4a..c7895f65be0ea 100644
+--- a/fs/ocfs2/dlmfs/Makefile
++++ b/fs/ocfs2/dlmfs/Makefile
+@@ -1,6 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-ccflags-y := -I $(srctree)/$(src)/..
+-
+ obj-$(CONFIG_OCFS2_FS) += ocfs2_dlmfs.o
+ 
+ ocfs2_dlmfs-objs := userdlm.o dlmfs.o
+diff --git a/fs/ocfs2/dlmfs/dlmfs.c b/fs/ocfs2/dlmfs/dlmfs.c
+index 4f1668c81e1f1..8e4f1ace467c1 100644
+--- a/fs/ocfs2/dlmfs/dlmfs.c
++++ b/fs/ocfs2/dlmfs/dlmfs.c
+@@ -33,11 +33,11 @@
+ 
+ #include <linux/uaccess.h>
+ 
+-#include "stackglue.h"
++#include "../stackglue.h"
+ #include "userdlm.h"
+ 
+ #define MLOG_MASK_PREFIX ML_DLMFS
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+ 
+ 
+ static const struct super_operations dlmfs_ops;
+diff --git a/fs/ocfs2/dlmfs/userdlm.c b/fs/ocfs2/dlmfs/userdlm.c
+index 525b14ddfba50..3df5be25bfb1f 100644
+--- a/fs/ocfs2/dlmfs/userdlm.c
++++ b/fs/ocfs2/dlmfs/userdlm.c
+@@ -21,12 +21,12 @@
+ #include <linux/types.h>
+ #include <linux/crc32.h>
+ 
+-#include "ocfs2_lockingver.h"
+-#include "stackglue.h"
++#include "../ocfs2_lockingver.h"
++#include "../stackglue.h"
+ #include "userdlm.h"
+ 
+ #define MLOG_MASK_PREFIX ML_DLMFS
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+ 
+ 
+ static inline struct user_lock_res *user_lksb_to_lock_res(struct ocfs2_dlm_lksb *lksb)
+-- 
+2.20.1
+
diff --git a/queue-5.5/opp-free-static-opps-on-errors-while-adding-them.patch b/queue-5.5/opp-free-static-opps-on-errors-while-adding-them.patch
new file mode 100644
index 00000000000..c88f383f54e
--- /dev/null
+++ b/queue-5.5/opp-free-static-opps-on-errors-while-adding-them.patch
@@ -0,0 +1,78 @@
+From 2c1fe040196661e0aecb942acf9a883f35878748 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 14:41:07 +0530
+Subject: opp: Free static OPPs on errors while adding them
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit ba0033192145cbd4e70ef64552958b13d597eb9e ]
+
+The static OPPs aren't getting freed properly, if errors occur while
+adding them. Fix that by calling _put_opp_list_kref() and putting their
+reference on failures.
+
+Fixes: 11e1a1648298 ("opp: Don't decrement uninitialized list_kref")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/of.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index 1cbb58240b801..1e5fcdee043c4 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -678,15 +678,17 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)
+ 			dev_err(dev, "%s: Failed to add OPP, %d\n", __func__,
+ 				ret);
+ 			of_node_put(np);
+-			return ret;
++			goto put_list_kref;
+ 		} else if (opp) {
+ 			count++;
+ 		}
+ 	}
+ 
+ 	/* There should be one of more OPP defined */
+-	if (WARN_ON(!count))
+-		return -ENOENT;
++	if (WARN_ON(!count)) {
++		ret = -ENOENT;
++		goto put_list_kref;
++	}
+ 
+ 	list_for_each_entry(opp, &opp_table->opp_list, node)
+ 		pstate_count += !!opp->pstate;
+@@ -695,7 +697,8 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)
+ 	if (pstate_count && pstate_count != count) {
+ 		dev_err(dev, "Not all nodes have performance state set (%d: %d)\n",
+ 			count, pstate_count);
+-		return -ENOENT;
++		ret = -ENOENT;
++		goto put_list_kref;
+ 	}
+ 
+ 	if (pstate_count)
+@@ -704,6 +707,11 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)
+ 	opp_table->parsed_static_opps = true;
+ 
+ 	return 0;
++
++put_list_kref:
++	_put_opp_list_kref(opp_table);
++
++	return ret;
+ }
+ 
+ /* Initializes OPP tables based on old-deprecated bindings */
+@@ -738,6 +746,7 @@ static int _of_add_opp_table_v1(struct device *dev, struct opp_table *opp_table)
+ 		if (ret) {
+ 			dev_err(dev, "%s: Failed to add OPP %ld (%d)\n",
+ 				__func__, freq, ret);
++			_put_opp_list_kref(opp_table);
+ 			return ret;
+ 		}
+ 		nr -= 2;
+-- 
+2.20.1
+
diff --git a/queue-5.5/orinoco-avoid-assertion-in-case-of-null-pointer.patch b/queue-5.5/orinoco-avoid-assertion-in-case-of-null-pointer.patch
new file mode 100644
index 00000000000..1b8191e326b
--- /dev/null
+++ b/queue-5.5/orinoco-avoid-assertion-in-case-of-null-pointer.patch
@@ -0,0 +1,37 @@
+From f7a9886ca988ef7f3365845d46beaceac16dd93c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 13:58:58 -0600
+Subject: orinoco: avoid assertion in case of NULL pointer
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit c705f9fc6a1736dcf6ec01f8206707c108dca824 ]
+
+In ezusb_init, if upriv is NULL, the code crashes. However, the caller
+in ezusb_probe can handle the error and print the failure message.
+The patch replaces the BUG_ON call to error return.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intersil/orinoco/orinoco_usb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+index 8c79b963bcffb..e753f43e0162f 100644
+--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
++++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+@@ -1361,7 +1361,8 @@ static int ezusb_init(struct hermes *hw)
+ 	int retval;
+ 
+ 	BUG_ON(in_interrupt());
+-	BUG_ON(!upriv);
++	if (!upriv)
++		return -EINVAL;
+ 
+ 	upriv->reply_count = 0;
+ 	/* Write the MAGIC number on the simulated registers to keep
+-- 
+2.20.1
+
diff --git a/queue-5.5/padata-always-acquire-cpu_hotplug_lock-before-pinst-.patch b/queue-5.5/padata-always-acquire-cpu_hotplug_lock-before-pinst-.patch
new file mode 100644
index 00000000000..8e634215bdc
--- /dev/null
+++ b/queue-5.5/padata-always-acquire-cpu_hotplug_lock-before-pinst-.patch
@@ -0,0 +1,71 @@
+From 81f5f508827b52d7260718942a2fb7b0da5570c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 14:31:11 -0500
+Subject: padata: always acquire cpu_hotplug_lock before pinst->lock
+
+From: Daniel Jordan <daniel.m.jordan@oracle.com>
+
+[ Upstream commit 38228e8848cd7dd86ccb90406af32de0cad24be3 ]
+
+lockdep complains when padata's paths to update cpumasks via CPU hotplug
+and sysfs are both taken:
+
+  # echo 0 > /sys/devices/system/cpu/cpu1/online
+  # echo ff > /sys/kernel/pcrypt/pencrypt/parallel_cpumask
+
+  ======================================================
+  WARNING: possible circular locking dependency detected
+  5.4.0-rc8-padata-cpuhp-v3+ #1 Not tainted
+  ------------------------------------------------------
+  bash/205 is trying to acquire lock:
+  ffffffff8286bcd0 (cpu_hotplug_lock.rw_sem){++++}, at: padata_set_cpumask+0x2b/0x120
+
+  but task is already holding lock:
+  ffff8880001abfa0 (&pinst->lock){+.+.}, at: padata_set_cpumask+0x26/0x120
+
+  which lock already depends on the new lock.
+
+padata doesn't take cpu_hotplug_lock and pinst->lock in a consistent
+order.  Which should be first?  CPU hotplug calls into padata with
+cpu_hotplug_lock already held, so it should have priority.
+
+Fixes: 6751fb3c0e0c ("padata: Use get_online_cpus/put_online_cpus")
+Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Cc: Eric Biggers <ebiggers@kernel.org>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: linux-crypto@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/padata.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index fda7a7039422d..fdbbe96547713 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -643,8 +643,8 @@ int padata_set_cpumask(struct padata_instance *pinst, int cpumask_type,
+ 	struct cpumask *serial_mask, *parallel_mask;
+ 	int err = -EINVAL;
+ 
+-	mutex_lock(&pinst->lock);
+ 	get_online_cpus();
++	mutex_lock(&pinst->lock);
+ 
+ 	switch (cpumask_type) {
+ 	case PADATA_CPU_PARALLEL:
+@@ -662,8 +662,8 @@ int padata_set_cpumask(struct padata_instance *pinst, int cpumask_type,
+ 	err =  __padata_set_cpumasks(pinst, parallel_mask, serial_mask);
+ 
+ out:
+-	put_online_cpus();
+ 	mutex_unlock(&pinst->lock);
++	put_online_cpus();
+ 
+ 	return err;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/padata-validate-cpumask-without-removed-cpu-during-o.patch b/queue-5.5/padata-validate-cpumask-without-removed-cpu-during-o.patch
new file mode 100644
index 00000000000..bee91f3e3e6
--- /dev/null
+++ b/queue-5.5/padata-validate-cpumask-without-removed-cpu-during-o.patch
@@ -0,0 +1,187 @@
+From ae8973499104e175db96130eafad252716a1c22c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 14:31:10 -0500
+Subject: padata: validate cpumask without removed CPU during offline
+
+From: Daniel Jordan <daniel.m.jordan@oracle.com>
+
+[ Upstream commit 894c9ef9780c5cf2f143415e867ee39a33ecb75d ]
+
+Configuring an instance's parallel mask without any online CPUs...
+
+  echo 2 > /sys/kernel/pcrypt/pencrypt/parallel_cpumask
+  echo 0 > /sys/devices/system/cpu/cpu1/online
+
+...makes tcrypt mode=215 crash like this:
+
+  divide error: 0000 [#1] SMP PTI
+  CPU: 4 PID: 283 Comm: modprobe Not tainted 5.4.0-rc8-padata-doc-v2+ #2
+  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191013_105130-anatol 04/01/2014
+  RIP: 0010:padata_do_parallel+0x114/0x300
+  Call Trace:
+   pcrypt_aead_encrypt+0xc0/0xd0 [pcrypt]
+   crypto_aead_encrypt+0x1f/0x30
+   do_mult_aead_op+0x4e/0xdf [tcrypt]
+   test_mb_aead_speed.constprop.0.cold+0x226/0x564 [tcrypt]
+   do_test+0x28c2/0x4d49 [tcrypt]
+   tcrypt_mod_init+0x55/0x1000 [tcrypt]
+   ...
+
+cpumask_weight() in padata_cpu_hash() returns 0 because the mask has no
+CPUs.  The problem is __padata_remove_cpu() checks for valid masks too
+early and so doesn't mark the instance PADATA_INVALID as expected, which
+would have made padata_do_parallel() return error before doing the
+division.
+
+Fix by introducing a second padata CPU hotplug state before
+CPUHP_BRINGUP_CPU so that __padata_remove_cpu() sees the online mask
+without @cpu.  No need for the second argument to padata_replace() since
+@cpu is now already missing from the online mask.
+
+Fixes: 33e54450683c ("padata: Handle empty padata cpumasks")
+Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Cc: Eric Biggers <ebiggers@kernel.org>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-crypto@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cpuhotplug.h |  1 +
+ kernel/padata.c            | 30 ++++++++++++++++++------------
+ 2 files changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index e51ee772b9f57..def48a5836700 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -59,6 +59,7 @@ enum cpuhp_state {
+ 	CPUHP_IOMMU_INTEL_DEAD,
+ 	CPUHP_LUSTRE_CFS_DEAD,
+ 	CPUHP_AP_ARM_CACHE_B15_RAC_DEAD,
++	CPUHP_PADATA_DEAD,
+ 	CPUHP_WORKQUEUE_PREP,
+ 	CPUHP_POWER_NUMA_PREPARE,
+ 	CPUHP_HRTIMERS_PREPARE,
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 9c82ee4a97323..fda7a7039422d 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -512,7 +512,7 @@ static int padata_replace_one(struct padata_shell *ps)
+ 	return 0;
+ }
+ 
+-static int padata_replace(struct padata_instance *pinst, int cpu)
++static int padata_replace(struct padata_instance *pinst)
+ {
+ 	int notification_mask = 0;
+ 	struct padata_shell *ps;
+@@ -523,16 +523,12 @@ static int padata_replace(struct padata_instance *pinst, int cpu)
+ 	cpumask_copy(pinst->omask, pinst->rcpumask.pcpu);
+ 	cpumask_and(pinst->rcpumask.pcpu, pinst->cpumask.pcpu,
+ 		    cpu_online_mask);
+-	if (cpu >= 0)
+-		cpumask_clear_cpu(cpu, pinst->rcpumask.pcpu);
+ 	if (!cpumask_equal(pinst->omask, pinst->rcpumask.pcpu))
+ 		notification_mask |= PADATA_CPU_PARALLEL;
+ 
+ 	cpumask_copy(pinst->omask, pinst->rcpumask.cbcpu);
+ 	cpumask_and(pinst->rcpumask.cbcpu, pinst->cpumask.cbcpu,
+ 		    cpu_online_mask);
+-	if (cpu >= 0)
+-		cpumask_clear_cpu(cpu, pinst->rcpumask.cbcpu);
+ 	if (!cpumask_equal(pinst->omask, pinst->rcpumask.cbcpu))
+ 		notification_mask |= PADATA_CPU_SERIAL;
+ 
+@@ -624,7 +620,7 @@ out_replace:
+ 	cpumask_copy(pinst->cpumask.pcpu, pcpumask);
+ 	cpumask_copy(pinst->cpumask.cbcpu, cbcpumask);
+ 
+-	err = padata_setup_cpumasks(pinst) ?: padata_replace(pinst, -1);
++	err = padata_setup_cpumasks(pinst) ?: padata_replace(pinst);
+ 
+ 	if (valid)
+ 		__padata_start(pinst);
+@@ -715,7 +711,7 @@ static int __padata_add_cpu(struct padata_instance *pinst, int cpu)
+ 	int err = 0;
+ 
+ 	if (cpumask_test_cpu(cpu, cpu_online_mask)) {
+-		err = padata_replace(pinst, -1);
++		err = padata_replace(pinst);
+ 
+ 		if (padata_validate_cpumask(pinst, pinst->cpumask.pcpu) &&
+ 		    padata_validate_cpumask(pinst, pinst->cpumask.cbcpu))
+@@ -729,12 +725,12 @@ static int __padata_remove_cpu(struct padata_instance *pinst, int cpu)
+ {
+ 	int err = 0;
+ 
+-	if (cpumask_test_cpu(cpu, cpu_online_mask)) {
++	if (!cpumask_test_cpu(cpu, cpu_online_mask)) {
+ 		if (!padata_validate_cpumask(pinst, pinst->cpumask.pcpu) ||
+ 		    !padata_validate_cpumask(pinst, pinst->cpumask.cbcpu))
+ 			__padata_stop(pinst);
+ 
+-		err = padata_replace(pinst, cpu);
++		err = padata_replace(pinst);
+ 	}
+ 
+ 	return err;
+@@ -796,7 +792,7 @@ static int padata_cpu_online(unsigned int cpu, struct hlist_node *node)
+ 	return ret;
+ }
+ 
+-static int padata_cpu_prep_down(unsigned int cpu, struct hlist_node *node)
++static int padata_cpu_dead(unsigned int cpu, struct hlist_node *node)
+ {
+ 	struct padata_instance *pinst;
+ 	int ret;
+@@ -817,6 +813,7 @@ static enum cpuhp_state hp_online;
+ static void __padata_free(struct padata_instance *pinst)
+ {
+ #ifdef CONFIG_HOTPLUG_CPU
++	cpuhp_state_remove_instance_nocalls(CPUHP_PADATA_DEAD, &pinst->node);
+ 	cpuhp_state_remove_instance_nocalls(hp_online, &pinst->node);
+ #endif
+ 
+@@ -1024,6 +1021,8 @@ static struct padata_instance *padata_alloc(const char *name,
+ 
+ #ifdef CONFIG_HOTPLUG_CPU
+ 	cpuhp_state_add_instance_nocalls_cpuslocked(hp_online, &pinst->node);
++	cpuhp_state_add_instance_nocalls_cpuslocked(CPUHP_PADATA_DEAD,
++						    &pinst->node);
+ #endif
+ 
+ 	put_online_cpus();
+@@ -1136,17 +1135,24 @@ static __init int padata_driver_init(void)
+ 	int ret;
+ 
+ 	ret = cpuhp_setup_state_multi(CPUHP_AP_ONLINE_DYN, "padata:online",
+-				      padata_cpu_online,
+-				      padata_cpu_prep_down);
++				      padata_cpu_online, NULL);
+ 	if (ret < 0)
+ 		return ret;
+ 	hp_online = ret;
++
++	ret = cpuhp_setup_state_multi(CPUHP_PADATA_DEAD, "padata:dead",
++				      NULL, padata_cpu_dead);
++	if (ret < 0) {
++		cpuhp_remove_multi_state(hp_online);
++		return ret;
++	}
+ 	return 0;
+ }
+ module_init(padata_driver_init);
+ 
+ static __exit void padata_driver_exit(void)
+ {
++	cpuhp_remove_multi_state(CPUHP_PADATA_DEAD);
+ 	cpuhp_remove_multi_state(hp_online);
+ }
+ module_exit(padata_driver_exit);
+-- 
+2.20.1
+
diff --git a/queue-5.5/pci-add-dma-alias-quirk-for-plx-pex-ntb.patch b/queue-5.5/pci-add-dma-alias-quirk-for-plx-pex-ntb.patch
new file mode 100644
index 00000000000..801b9641fee
--- /dev/null
+++ b/queue-5.5/pci-add-dma-alias-quirk-for-plx-pex-ntb.patch
@@ -0,0 +1,54 @@
+From 0eea0ef3f3cf90d5c99dda1364c253ad3326a278 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 16:25:40 -0600
+Subject: PCI: Add DMA alias quirk for PLX PEX NTB
+
+From: James Sewart <jamessewart@arista.com>
+
+[ Upstream commit 7b90dfc4873b87c468cc6046538f46a531c1d785 ]
+
+The PLX PEX NTB forwards DMA transactions using Requester IDs that don't
+exist as PCI devices.  The devfn for a transaction is used as an index into
+a lookup table storing the origin of a transaction on the other side of the
+bridge.
+
+Alias all possible devfns to the NTB device so that any transaction coming
+in is governed by the mappings for the NTB.
+
+Signed-off-by: James Sewart <jamessewart@arista.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 9aa590eb712fe..83953752337c4 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5371,6 +5371,21 @@ SWITCHTEC_QUIRK(0x8574);  /* PFXI 64XG3 */
+ SWITCHTEC_QUIRK(0x8575);  /* PFXI 80XG3 */
+ SWITCHTEC_QUIRK(0x8576);  /* PFXI 96XG3 */
+ 
++/*
++ * The PLX NTB uses devfn proxy IDs to move TLPs between NT endpoints.
++ * These IDs are used to forward responses to the originator on the other
++ * side of the NTB.  Alias all possible IDs to the NTB to permit access when
++ * the IOMMU is turned on.
++ */
++static void quirk_plx_ntb_dma_alias(struct pci_dev *pdev)
++{
++	pci_info(pdev, "Setting PLX NTB proxy ID aliases\n");
++	/* PLX NTB may use all 256 devfns */
++	pci_add_dma_alias(pdev, 0, 256);
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_PLX, 0x87b0, quirk_plx_ntb_dma_alias);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_PLX, 0x87b1, quirk_plx_ntb_dma_alias);
++
+ /*
+  * On Lenovo Thinkpad P50 SKUs with a Nvidia Quadro M1000M, the BIOS does
+  * not always reset the secondary Nvidia GPU between reboots if the system
+-- 
+2.20.1
+
diff --git a/queue-5.5/pci-add-generic-quirk-for-increasing-d3hot-delay.patch b/queue-5.5/pci-add-generic-quirk-for-increasing-d3hot-delay.patch
new file mode 100644
index 00000000000..19e692423b0
--- /dev/null
+++ b/queue-5.5/pci-add-generic-quirk-for-increasing-d3hot-delay.patch
@@ -0,0 +1,61 @@
+From 5f5fffd486b592e0e1f92495ea063bd3152ea2fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 13:38:35 +0800
+Subject: PCI: Add generic quirk for increasing D3hot delay
+
+From: Daniel Drake <drake@endlessm.com>
+
+[ Upstream commit 62fe23df067715a21c4aef44068efe7ceaa8f627 ]
+
+Separate the D3 delay increase functionality out of quirk_radeon_pm() into
+its own function so that it can be shared with other quirks, including the
+AMD Ryzen XHCI quirk that will be introduced in a followup commit.
+
+Tweak the function name and message to indicate more clearly that the delay
+relates to a D3hot-to-D0 transition.
+
+Link: https://lore.kernel.org/r/20191127053836.31624-1-drake@endlessm.com
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 5cd6a77ddefff..27008edce1a24 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1871,16 +1871,21 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	0x2609, quirk_intel_pcie_pm);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	0x260a, quirk_intel_pcie_pm);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	0x260b, quirk_intel_pcie_pm);
+ 
++static void quirk_d3hot_delay(struct pci_dev *dev, unsigned int delay)
++{
++	if (dev->d3_delay >= delay)
++		return;
++
++	dev->d3_delay = delay;
++	pci_info(dev, "extending delay after power-on from D3hot to %d msec\n",
++		 dev->d3_delay);
++}
++
+ static void quirk_radeon_pm(struct pci_dev *dev)
+ {
+ 	if (dev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+-	    dev->subsystem_device == 0x00e2) {
+-		if (dev->d3_delay < 20) {
+-			dev->d3_delay = 20;
+-			pci_info(dev, "extending delay after power-on from D3 to %d msec\n",
+-				 dev->d3_delay);
+-		}
+-	}
++	    dev->subsystem_device == 0x00e2)
++		quirk_d3hot_delay(dev, 20);
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6741, quirk_radeon_pm);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/pci-add-nr_devfns-parameter-to-pci_add_dma_alias.patch b/queue-5.5/pci-add-nr_devfns-parameter-to-pci_add_dma_alias.patch
new file mode 100644
index 00000000000..417c1353d15
--- /dev/null
+++ b/queue-5.5/pci-add-nr_devfns-parameter-to-pci_add_dma_alias.patch
@@ -0,0 +1,175 @@
+From 388e556b86b2e0d590164e952a6c384a9148d636 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 16:07:30 -0600
+Subject: PCI: Add nr_devfns parameter to pci_add_dma_alias()
+
+From: James Sewart <jamessewart@arista.com>
+
+[ Upstream commit 09298542cd891b43778db1f65aa3613aa5a562eb ]
+
+Add a "nr_devfns" parameter to pci_add_dma_alias() so it can be used to
+create DMA aliases for a range of devfns.
+
+[bhelgaas: incorporate nr_devfns fix from James, update
+quirk_pex_vca_alias() and setup_aliases()]
+Signed-off-by: James Sewart <jamessewart@arista.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c |  7 ++-----
+ drivers/pci/pci.c         | 22 +++++++++++++++++-----
+ drivers/pci/quirks.c      | 23 +++++++++--------------
+ include/linux/pci.h       |  2 +-
+ 4 files changed, 29 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index bd25674ee4dba..7a6c056b9b9cc 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -230,11 +230,8 @@ static struct pci_dev *setup_aliases(struct device *dev)
+ 	 */
+ 	ivrs_alias = amd_iommu_alias_table[pci_dev_id(pdev)];
+ 	if (ivrs_alias != pci_dev_id(pdev) &&
+-	    PCI_BUS_NUM(ivrs_alias) == pdev->bus->number) {
+-		pci_add_dma_alias(pdev, ivrs_alias & 0xff);
+-		pci_info(pdev, "Added PCI DMA alias %02x.%d\n",
+-			PCI_SLOT(ivrs_alias), PCI_FUNC(ivrs_alias));
+-	}
++	    PCI_BUS_NUM(ivrs_alias) == pdev->bus->number)
++		pci_add_dma_alias(pdev, ivrs_alias & 0xff, 1);
+ 
+ 	clone_aliases(pdev);
+ 
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 7b5fa2eabe095..951099279192d 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5998,7 +5998,8 @@ EXPORT_SYMBOL_GPL(pci_pr3_present);
+ /**
+  * pci_add_dma_alias - Add a DMA devfn alias for a device
+  * @dev: the PCI device for which alias is added
+- * @devfn: alias slot and function
++ * @devfn_from: alias slot and function
++ * @nr_devfns: number of subsequent devfns to alias
+  *
+  * This helper encodes an 8-bit devfn as a bit number in dma_alias_mask
+  * which is used to program permissible bus-devfn source addresses for DMA
+@@ -6014,8 +6015,13 @@ EXPORT_SYMBOL_GPL(pci_pr3_present);
+  * cannot be left as a userspace activity).  DMA aliases should therefore
+  * be configured via quirks, such as the PCI fixup header quirk.
+  */
+-void pci_add_dma_alias(struct pci_dev *dev, u8 devfn)
++void pci_add_dma_alias(struct pci_dev *dev, u8 devfn_from, unsigned nr_devfns)
+ {
++	int devfn_to;
++
++	nr_devfns = min(nr_devfns, (unsigned) MAX_NR_DEVFNS - devfn_from);
++	devfn_to = devfn_from + nr_devfns - 1;
++
+ 	if (!dev->dma_alias_mask)
+ 		dev->dma_alias_mask = bitmap_zalloc(MAX_NR_DEVFNS, GFP_KERNEL);
+ 	if (!dev->dma_alias_mask) {
+@@ -6023,9 +6029,15 @@ void pci_add_dma_alias(struct pci_dev *dev, u8 devfn)
+ 		return;
+ 	}
+ 
+-	set_bit(devfn, dev->dma_alias_mask);
+-	pci_info(dev, "Enabling fixed DMA alias to %02x.%d\n",
+-		 PCI_SLOT(devfn), PCI_FUNC(devfn));
++	bitmap_set(dev->dma_alias_mask, devfn_from, nr_devfns);
++
++	if (nr_devfns == 1)
++		pci_info(dev, "Enabling fixed DMA alias to %02x.%d\n",
++				PCI_SLOT(devfn_from), PCI_FUNC(devfn_from));
++	else if (nr_devfns > 1)
++		pci_info(dev, "Enabling fixed DMA alias for devfn range from %02x.%d to %02x.%d\n",
++				PCI_SLOT(devfn_from), PCI_FUNC(devfn_from),
++				PCI_SLOT(devfn_to), PCI_FUNC(devfn_to));
+ }
+ 
+ bool pci_devs_are_dma_aliases(struct pci_dev *dev1, struct pci_dev *dev2)
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index c0b7aa4dc0f51..9aa590eb712fe 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3927,7 +3927,7 @@ int pci_dev_specific_reset(struct pci_dev *dev, int probe)
+ static void quirk_dma_func0_alias(struct pci_dev *dev)
+ {
+ 	if (PCI_FUNC(dev->devfn) != 0)
+-		pci_add_dma_alias(dev, PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
++		pci_add_dma_alias(dev, PCI_DEVFN(PCI_SLOT(dev->devfn), 0), 1);
+ }
+ 
+ /*
+@@ -3941,7 +3941,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_RICOH, 0xe476, quirk_dma_func0_alias);
+ static void quirk_dma_func1_alias(struct pci_dev *dev)
+ {
+ 	if (PCI_FUNC(dev->devfn) != 1)
+-		pci_add_dma_alias(dev, PCI_DEVFN(PCI_SLOT(dev->devfn), 1));
++		pci_add_dma_alias(dev, PCI_DEVFN(PCI_SLOT(dev->devfn), 1), 1);
+ }
+ 
+ /*
+@@ -4026,7 +4026,7 @@ static void quirk_fixed_dma_alias(struct pci_dev *dev)
+ 
+ 	id = pci_match_id(fixed_dma_alias_tbl, dev);
+ 	if (id)
+-		pci_add_dma_alias(dev, id->driver_data);
++		pci_add_dma_alias(dev, id->driver_data, 1);
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ADAPTEC2, 0x0285, quirk_fixed_dma_alias);
+ 
+@@ -4067,9 +4067,9 @@ DECLARE_PCI_FIXUP_HEADER(0x8086, 0x244e, quirk_use_pcie_bridge_dma_alias);
+  */
+ static void quirk_mic_x200_dma_alias(struct pci_dev *pdev)
+ {
+-	pci_add_dma_alias(pdev, PCI_DEVFN(0x10, 0x0));
+-	pci_add_dma_alias(pdev, PCI_DEVFN(0x11, 0x0));
+-	pci_add_dma_alias(pdev, PCI_DEVFN(0x12, 0x3));
++	pci_add_dma_alias(pdev, PCI_DEVFN(0x10, 0x0), 1);
++	pci_add_dma_alias(pdev, PCI_DEVFN(0x11, 0x0), 1);
++	pci_add_dma_alias(pdev, PCI_DEVFN(0x12, 0x3), 1);
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2260, quirk_mic_x200_dma_alias);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2264, quirk_mic_x200_dma_alias);
+@@ -4093,13 +4093,8 @@ static void quirk_pex_vca_alias(struct pci_dev *pdev)
+ 	const unsigned int num_pci_slots = 0x20;
+ 	unsigned int slot;
+ 
+-	for (slot = 0; slot < num_pci_slots; slot++) {
+-		pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x0));
+-		pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x1));
+-		pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x2));
+-		pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x3));
+-		pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x4));
+-	}
++	for (slot = 0; slot < num_pci_slots; slot++)
++		pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x0), 5);
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2954, quirk_pex_vca_alias);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2955, quirk_pex_vca_alias);
+@@ -5334,7 +5329,7 @@ static void quirk_switchtec_ntb_dma_alias(struct pci_dev *pdev)
+ 			pci_dbg(pdev,
+ 				"Aliasing Partition %d Proxy ID %02x.%d\n",
+ 				pp, PCI_SLOT(devfn), PCI_FUNC(devfn));
+-			pci_add_dma_alias(pdev, devfn);
++			pci_add_dma_alias(pdev, devfn, 1);
+ 		}
+ 	}
+ 
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index c393dff2d66f6..930fab2930736 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -2310,7 +2310,7 @@ static inline struct eeh_dev *pci_dev_to_eeh_dev(struct pci_dev *pdev)
+ }
+ #endif
+ 
+-void pci_add_dma_alias(struct pci_dev *dev, u8 devfn);
++void pci_add_dma_alias(struct pci_dev *dev, u8 devfn_from, unsigned nr_devfns);
+ bool pci_devs_are_dma_aliases(struct pci_dev *dev1, struct pci_dev *dev2);
+ int pci_for_each_dma_alias(struct pci_dev *pdev,
+ 			   int (*fn)(struct pci_dev *pdev,
+-- 
+2.20.1
+
diff --git a/queue-5.5/pci-ats-restore-export_symbol_gpl-for-pci_-enable-di.patch b/queue-5.5/pci-ats-restore-export_symbol_gpl-for-pci_-enable-di.patch
new file mode 100644
index 00000000000..9fc536b1fa9
--- /dev/null
+++ b/queue-5.5/pci-ats-restore-export_symbol_gpl-for-pci_-enable-di.patch
@@ -0,0 +1,59 @@
+From f1d7b80b6efd2e4a5da621843553bb316aaac94e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 12:03:39 +0000
+Subject: PCI/ATS: Restore EXPORT_SYMBOL_GPL() for pci_{enable,disable}_ats()
+
+From: Greg Kroah-Hartman <gregkh@google.com>
+
+[ Upstream commit bb950bca5d522119f8b9ce3f6cbac4841c6d6517 ]
+
+Commit d355bb209783 ("PCI/ATS: Remove unnecessary EXPORT_SYMBOL_GPL()")
+unexported a bunch of symbols from the PCI core since the only external
+users were non-modular IOMMU drivers. Although most of those symbols
+can remain private for now, 'pci_{enable,disable_ats()' is required for
+the ARM SMMUv3 driver to build as a module, otherwise we get a build
+failure as follows:
+
+  | ERROR: "pci_enable_ats" [drivers/iommu/arm-smmu-v3.ko] undefined!
+  | ERROR: "pci_disable_ats" [drivers/iommu/arm-smmu-v3.ko] undefined!
+
+Re-export these two functions so that the ARM SMMUv3 driver can be build
+as a module.
+
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
+[will: rewrote commit message]
+Signed-off-by: Will Deacon <will@kernel.org>
+Tested-by: John Garry <john.garry@huawei.com> # smmu v3
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/ats.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pci/ats.c b/drivers/pci/ats.c
+index b6f064c885c37..3ef0bb281e7cc 100644
+--- a/drivers/pci/ats.c
++++ b/drivers/pci/ats.c
+@@ -69,6 +69,7 @@ int pci_enable_ats(struct pci_dev *dev, int ps)
+ 	dev->ats_enabled = 1;
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(pci_enable_ats);
+ 
+ /**
+  * pci_disable_ats - disable the ATS capability
+@@ -87,6 +88,7 @@ void pci_disable_ats(struct pci_dev *dev)
+ 
+ 	dev->ats_enabled = 0;
+ }
++EXPORT_SYMBOL_GPL(pci_disable_ats);
+ 
+ void pci_restore_ats_state(struct pci_dev *dev)
+ {
+-- 
+2.20.1
+
diff --git a/queue-5.5/pci-fix-pci_add_dma_alias-bitmask-size.patch b/queue-5.5/pci-fix-pci_add_dma_alias-bitmask-size.patch
new file mode 100644
index 00000000000..022cf95cadc
--- /dev/null
+++ b/queue-5.5/pci-fix-pci_add_dma_alias-bitmask-size.patch
@@ -0,0 +1,77 @@
+From c94447522b353170ab775f652e7b361608b6addf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 15:51:33 -0600
+Subject: PCI: Fix pci_add_dma_alias() bitmask size
+
+From: James Sewart <jamessewart@arista.com>
+
+[ Upstream commit f8bf2aeb651b3460a4b36fd7ba1ba1d31777d35c ]
+
+The number of possible devfns is 256, but pci_add_dma_alias() allocated a
+bitmap of size 255.  Fix this off-by-one error.
+
+This fixes commits 338c3149a221 ("PCI: Add support for multiple DMA
+aliases") and c6635792737b ("PCI: Allocate dma_alias_mask with
+bitmap_zalloc()"), but I doubt it was possible to see a problem because
+it takes 4 64-bit longs (or 8 32-bit longs) to hold 255 bits, and
+bitmap_zalloc() doesn't save the 255-bit size anywhere.
+
+[bhelgaas: commit log, move #define to drivers/pci/pci.h, include loop
+limit fix from Qian Cai:
+https://lore.kernel.org/r/20191218170004.5297-1-cai@lca.pw]
+Signed-off-by: James Sewart <jamessewart@arista.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c    | 2 +-
+ drivers/pci/pci.h    | 3 +++
+ drivers/pci/search.c | 4 ++--
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index e87196cc1a7fb..7b5fa2eabe095 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -6017,7 +6017,7 @@ EXPORT_SYMBOL_GPL(pci_pr3_present);
+ void pci_add_dma_alias(struct pci_dev *dev, u8 devfn)
+ {
+ 	if (!dev->dma_alias_mask)
+-		dev->dma_alias_mask = bitmap_zalloc(U8_MAX, GFP_KERNEL);
++		dev->dma_alias_mask = bitmap_zalloc(MAX_NR_DEVFNS, GFP_KERNEL);
+ 	if (!dev->dma_alias_mask) {
+ 		pci_warn(dev, "Unable to allocate DMA alias mask\n");
+ 		return;
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index a0a53bd05a0b8..6394e7746fb54 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -4,6 +4,9 @@
+ 
+ #include <linux/pci.h>
+ 
++/* Number of possible devfns: 0.0 to 1f.7 inclusive */
++#define MAX_NR_DEVFNS 256
++
+ #define PCI_FIND_CAP_TTL	48
+ 
+ #define PCI_VSEC_ID_INTEL_TBT	0x1234	/* Thunderbolt */
+diff --git a/drivers/pci/search.c b/drivers/pci/search.c
+index bade14002fd8a..e4dbdef5aef05 100644
+--- a/drivers/pci/search.c
++++ b/drivers/pci/search.c
+@@ -41,9 +41,9 @@ int pci_for_each_dma_alias(struct pci_dev *pdev,
+ 	 * DMA, iterate over that too.
+ 	 */
+ 	if (unlikely(pdev->dma_alias_mask)) {
+-		u8 devfn;
++		unsigned int devfn;
+ 
+-		for_each_set_bit(devfn, pdev->dma_alias_mask, U8_MAX) {
++		for_each_set_bit(devfn, pdev->dma_alias_mask, MAX_NR_DEVFNS) {
+ 			ret = fn(pdev, PCI_DEVID(pdev->bus->number, devfn),
+ 				 data);
+ 			if (ret)
+-- 
+2.20.1
+
diff --git a/queue-5.5/pci-increase-d3-delay-for-amd-ryzen5-7-xhci-controll.patch b/queue-5.5/pci-increase-d3-delay-for-amd-ryzen5-7-xhci-controll.patch
new file mode 100644
index 00000000000..06f69e4c9d7
--- /dev/null
+++ b/queue-5.5/pci-increase-d3-delay-for-amd-ryzen5-7-xhci-controll.patch
@@ -0,0 +1,69 @@
+From a5ef3cfe8e76c5865b99f9945869ce2dfeec2095 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 13:38:36 +0800
+Subject: PCI: Increase D3 delay for AMD Ryzen5/7 XHCI controllers
+
+From: Daniel Drake <drake@endlessm.com>
+
+[ Upstream commit 3030df209aa8cf831b9963829bd9f94900ee8032 ]
+
+On Asus UX434DA (AMD Ryzen7 3700U) and Asus X512DK (AMD Ryzen5 3500U), the
+XHCI controller fails to resume from runtime suspend or s2idle, and USB
+becomes unusable from that point.
+
+  xhci_hcd 0000:03:00.4: Refused to change power state, currently in D3
+  xhci_hcd 0000:03:00.4: enabling device (0000 -> 0002)
+  xhci_hcd 0000:03:00.4: WARN: xHC restore state timeout
+  xhci_hcd 0000:03:00.4: PCI post-resume error -110!
+  xhci_hcd 0000:03:00.4: HC died; cleaning up
+
+During suspend, a transition to D3cold is attempted, however the affected
+platforms do not seem to cut the power to the PCI device when in this
+state, so the device stays in D3hot.
+
+Upon resume, the D3hot-to-D0 transition is successful only if the D3 delay
+is increased to 20ms. The transition failure does not appear to be
+detectable as a CRS condition. Add a PCI quirk to increase the delay on the
+affected hardware.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=205587
+Link: http://lkml.kernel.org/r/CAD8Lp47Vh69gQjROYG69=waJgL7hs1PwnLonL9+27S_TcRhixA@mail.gmail.com
+Link: https://lore.kernel.org/r/20191127053836.31624-2-drake@endlessm.com
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 27008edce1a24..c0b7aa4dc0f51 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1889,6 +1889,22 @@ static void quirk_radeon_pm(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6741, quirk_radeon_pm);
+ 
++/*
++ * Ryzen5/7 XHCI controllers fail upon resume from runtime suspend or s2idle.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=205587
++ *
++ * The kernel attempts to transition these devices to D3cold, but that seems
++ * to be ineffective on the platforms in question; the PCI device appears to
++ * remain on in D3hot state. The D3hot-to-D0 transition then requires an
++ * extended delay in order to succeed.
++ */
++static void quirk_ryzen_xhci_d3hot(struct pci_dev *dev)
++{
++	quirk_d3hot_delay(dev, 20);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e0, quirk_ryzen_xhci_d3hot);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e1, quirk_ryzen_xhci_d3hot);
++
+ #ifdef CONFIG_X86_IO_APIC
+ static int dmi_disable_ioapicreroute(const struct dmi_system_id *d)
+ {
+-- 
+2.20.1
+
diff --git a/queue-5.5/pci-iproc-apply-quirk_paxc_bridge-for-module-as-well.patch b/queue-5.5/pci-iproc-apply-quirk_paxc_bridge-for-module-as-well.patch
new file mode 100644
index 00000000000..b79411c84ed
--- /dev/null
+++ b/queue-5.5/pci-iproc-apply-quirk_paxc_bridge-for-module-as-well.patch
@@ -0,0 +1,105 @@
+From fd0c9b411880e86c68bb1ae7f5de58d1317d32bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 17:45:11 +0000
+Subject: PCI: iproc: Apply quirk_paxc_bridge() for module as well as built-in
+
+From: Wei Liu <wei.liu@kernel.org>
+
+[ Upstream commit 574f29036fce385e28617547955dd6911d375025 ]
+
+Previously quirk_paxc_bridge() was applied when the iproc driver was
+built-in, but not when it was compiled as a module.
+
+This happened because it was under #ifdef CONFIG_PCIE_IPROC_PLATFORM:
+PCIE_IPROC_PLATFORM=y causes CONFIG_PCIE_IPROC_PLATFORM to be defined, but
+PCIE_IPROC_PLATFORM=m causes CONFIG_PCIE_IPROC_PLATFORM_MODULE to be
+defined.
+
+Move quirk_paxc_bridge() to pcie-iproc.c and drop the #ifdef so the quirk
+is always applied, whether iproc is built-in or a module.
+
+[bhelgaas: commit log, move to pcie-iproc.c, not pcie-iproc-platform.c]
+Link: https://lore.kernel.org/r/20191211174511.89713-1-wei.liu@kernel.org
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-iproc.c | 24 ++++++++++++++++++++++++
+ drivers/pci/quirks.c                | 26 --------------------------
+ 2 files changed, 24 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
+index 0a468c73bae38..8c7f875acf7fa 100644
+--- a/drivers/pci/controller/pcie-iproc.c
++++ b/drivers/pci/controller/pcie-iproc.c
+@@ -1588,6 +1588,30 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802,
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804,
+ 			quirk_paxc_disable_msi_parsing);
+ 
++static void quirk_paxc_bridge(struct pci_dev *pdev)
++{
++	/*
++	 * The PCI config space is shared with the PAXC root port and the first
++	 * Ethernet device.  So, we need to workaround this by telling the PCI
++	 * code that the bridge is not an Ethernet device.
++	 */
++	if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE)
++		pdev->class = PCI_CLASS_BRIDGE_PCI << 8;
++
++	/*
++	 * MPSS is not being set properly (as it is currently 0).  This is
++	 * because that area of the PCI config space is hard coded to zero, and
++	 * is not modifiable by firmware.  Set this to 2 (e.g., 512 byte MPS)
++	 * so that the MPS can be set to the real max value.
++	 */
++	pdev->pcie_mpss = 2;
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16cd, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16f0, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd750, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804, quirk_paxc_bridge);
++
+ MODULE_AUTHOR("Ray Jui <rjui@broadcom.com>");
+ MODULE_DESCRIPTION("Broadcom iPROC PCIe common driver");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index fbeb9f73ef280..5cd6a77ddefff 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2381,32 +2381,6 @@ DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_BROADCOM,
+ 			 PCI_DEVICE_ID_TIGON3_5719,
+ 			 quirk_brcm_5719_limit_mrrs);
+ 
+-#ifdef CONFIG_PCIE_IPROC_PLATFORM
+-static void quirk_paxc_bridge(struct pci_dev *pdev)
+-{
+-	/*
+-	 * The PCI config space is shared with the PAXC root port and the first
+-	 * Ethernet device.  So, we need to workaround this by telling the PCI
+-	 * code that the bridge is not an Ethernet device.
+-	 */
+-	if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE)
+-		pdev->class = PCI_CLASS_BRIDGE_PCI << 8;
+-
+-	/*
+-	 * MPSS is not being set properly (as it is currently 0).  This is
+-	 * because that area of the PCI config space is hard coded to zero, and
+-	 * is not modifiable by firmware.  Set this to 2 (e.g., 512 byte MPS)
+-	 * so that the MPS can be set to the real max value.
+-	 */
+-	pdev->pcie_mpss = 2;
+-}
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16cd, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16f0, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd750, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804, quirk_paxc_bridge);
+-#endif
+-
+ /*
+  * Originally in EDAC sources for i82875P: Intel tells BIOS developers to
+  * hide device 6 which configures the overflow device access containing the
+-- 
+2.20.1
+
diff --git a/queue-5.5/perf-imx_ddr-fix-cpu-hotplug-state-cleanup.patch b/queue-5.5/perf-imx_ddr-fix-cpu-hotplug-state-cleanup.patch
new file mode 100644
index 00000000000..b4a6dfc435e
--- /dev/null
+++ b/queue-5.5/perf-imx_ddr-fix-cpu-hotplug-state-cleanup.patch
@@ -0,0 +1,79 @@
+From 9080006fc78a4fcd12610c66b9bb7d141fb05e59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2020 22:25:46 +0200
+Subject: perf/imx_ddr: Fix cpu hotplug state cleanup
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+[ Upstream commit 9ee68b314e9aa63ed11b98beb8a68810b8234dcf ]
+
+This driver allocates a dynamic cpu hotplug state but never releases it.
+If reloaded in a loop it will quickly trigger a WARN message:
+
+	"No more dynamic states available for CPU hotplug"
+
+Fix by calling cpuhp_remove_multi_state on remove like several other
+perf pmu drivers.
+
+Also fix the cleanup logic on probe error paths: add the missing
+cpuhp_remove_multi_state call and properly check the return value from
+cpuhp_state_add_instant_nocalls.
+
+Fixes: 9a66d36cc7ac ("drivers/perf: imx_ddr: Add DDR performance counter support to perf")
+Acked-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/fsl_imx8_ddr_perf.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c
+index 55083c67b2bb0..95dca2cb52650 100644
+--- a/drivers/perf/fsl_imx8_ddr_perf.c
++++ b/drivers/perf/fsl_imx8_ddr_perf.c
+@@ -633,13 +633,17 @@ static int ddr_perf_probe(struct platform_device *pdev)
+ 
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "cpuhp_setup_state_multi failed\n");
+-		goto ddr_perf_err;
++		goto cpuhp_state_err;
+ 	}
+ 
+ 	pmu->cpuhp_state = ret;
+ 
+ 	/* Register the pmu instance for cpu hotplug */
+-	cpuhp_state_add_instance_nocalls(pmu->cpuhp_state, &pmu->node);
++	ret = cpuhp_state_add_instance_nocalls(pmu->cpuhp_state, &pmu->node);
++	if (ret) {
++		dev_err(&pdev->dev, "Error %d registering hotplug\n", ret);
++		goto cpuhp_instance_err;
++	}
+ 
+ 	/* Request irq */
+ 	irq = of_irq_get(np, 0);
+@@ -673,9 +677,10 @@ static int ddr_perf_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ ddr_perf_err:
+-	if (pmu->cpuhp_state)
+-		cpuhp_state_remove_instance_nocalls(pmu->cpuhp_state, &pmu->node);
+-
++	cpuhp_state_remove_instance_nocalls(pmu->cpuhp_state, &pmu->node);
++cpuhp_instance_err:
++	cpuhp_remove_multi_state(pmu->cpuhp_state);
++cpuhp_state_err:
+ 	ida_simple_remove(&ddr_ida, pmu->id);
+ 	dev_warn(&pdev->dev, "i.MX8 DDR Perf PMU failed (%d), disabled\n", ret);
+ 	return ret;
+@@ -686,6 +691,7 @@ static int ddr_perf_remove(struct platform_device *pdev)
+ 	struct ddr_pmu *pmu = platform_get_drvdata(pdev);
+ 
+ 	cpuhp_state_remove_instance_nocalls(pmu->cpuhp_state, &pmu->node);
++	cpuhp_remove_multi_state(pmu->cpuhp_state);
+ 	irq_set_affinity_hint(pmu->irq, NULL);
+ 
+ 	perf_pmu_unregister(&pmu->pmu);
+-- 
+2.20.1
+
diff --git a/queue-5.5/perf-x86-amd-constrain-large-increment-per-cycle-eve.patch b/queue-5.5/perf-x86-amd-constrain-large-increment-per-cycle-eve.patch
new file mode 100644
index 00000000000..1bab5d25628
--- /dev/null
+++ b/queue-5.5/perf-x86-amd-constrain-large-increment-per-cycle-eve.patch
@@ -0,0 +1,204 @@
+From c567a03cd12ebe7dbad574c35fc9e2efa51cf4f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 12:37:19 -0600
+Subject: perf/x86/amd: Constrain Large Increment per Cycle events
+
+From: Kim Phillips <kim.phillips@amd.com>
+
+[ Upstream commit 471af006a747f1c535c8a8c6c0973c320fe01b22 ]
+
+AMD Family 17h processors and above gain support for Large Increment
+per Cycle events.  Unfortunately there is no CPUID or equivalent bit
+that indicates whether the feature exists or not, so we continue to
+determine eligibility based on a CPU family number comparison.
+
+For Large Increment per Cycle events, we add a f17h-and-compatibles
+get_event_constraints_f17h() that returns an even counter bitmask:
+Large Increment per Cycle events can only be placed on PMCs 0, 2,
+and 4 out of the currently available 0-5.  The only currently
+public event that requires this feature to report valid counts
+is PMCx003 "Retired SSE/AVX Operations".
+
+Note that the CPU family logic in amd_core_pmu_init() is changed
+so as to be able to selectively add initialization for features
+available in ranges of backward-compatible CPU families.  This
+Large Increment per Cycle feature is expected to be retained
+in future families.
+
+A side-effect of assigning a new get_constraints function for f17h
+disables calling the old (prior to f15h) amd_get_event_constraints
+implementation left enabled by commit e40ed1542dd7 ("perf/x86: Add perf
+support for AMD family-17h processors"), which is no longer
+necessary since those North Bridge event codes are obsoleted.
+
+Also fix a spelling mistake whilst in the area (calulating ->
+calculating).
+
+Fixes: e40ed1542dd7 ("perf/x86: Add perf support for AMD family-17h processors")
+Signed-off-by: Kim Phillips <kim.phillips@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20191114183720.19887-2-kim.phillips@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/amd/core.c   | 91 ++++++++++++++++++++++++------------
+ arch/x86/events/perf_event.h |  2 +
+ 2 files changed, 63 insertions(+), 30 deletions(-)
+
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index dede714b46e83..3253797fa8a14 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -302,6 +302,25 @@ static inline int amd_pmu_addr_offset(int index, bool eventsel)
+ 	return offset;
+ }
+ 
++/*
++ * AMD64 events are detected based on their event codes.
++ */
++static inline unsigned int amd_get_event_code(struct hw_perf_event *hwc)
++{
++	return ((hwc->config >> 24) & 0x0f00) | (hwc->config & 0x00ff);
++}
++
++static inline bool amd_is_pair_event_code(struct hw_perf_event *hwc)
++{
++	if (!(x86_pmu.flags & PMU_FL_PAIR))
++		return false;
++
++	switch (amd_get_event_code(hwc)) {
++	case 0x003:	return true;	/* Retired SSE/AVX FLOPs */
++	default:	return false;
++	}
++}
++
+ static int amd_core_hw_config(struct perf_event *event)
+ {
+ 	if (event->attr.exclude_host && event->attr.exclude_guest)
+@@ -320,14 +339,6 @@ static int amd_core_hw_config(struct perf_event *event)
+ 	return 0;
+ }
+ 
+-/*
+- * AMD64 events are detected based on their event codes.
+- */
+-static inline unsigned int amd_get_event_code(struct hw_perf_event *hwc)
+-{
+-	return ((hwc->config >> 24) & 0x0f00) | (hwc->config & 0x00ff);
+-}
+-
+ static inline int amd_is_nb_event(struct hw_perf_event *hwc)
+ {
+ 	return (hwc->config & 0xe0) == 0xe0;
+@@ -856,6 +867,20 @@ amd_get_event_constraints_f15h(struct cpu_hw_events *cpuc, int idx,
+ 	}
+ }
+ 
++static struct event_constraint pair_constraint;
++
++static struct event_constraint *
++amd_get_event_constraints_f17h(struct cpu_hw_events *cpuc, int idx,
++			       struct perf_event *event)
++{
++	struct hw_perf_event *hwc = &event->hw;
++
++	if (amd_is_pair_event_code(hwc))
++		return &pair_constraint;
++
++	return &unconstrained;
++}
++
+ static ssize_t amd_event_sysfs_show(char *page, u64 config)
+ {
+ 	u64 event = (config & ARCH_PERFMON_EVENTSEL_EVENT) |
+@@ -899,33 +924,15 @@ static __initconst const struct x86_pmu amd_pmu = {
+ 
+ static int __init amd_core_pmu_init(void)
+ {
++	u64 even_ctr_mask = 0ULL;
++	int i;
++
+ 	if (!boot_cpu_has(X86_FEATURE_PERFCTR_CORE))
+ 		return 0;
+ 
+-	/* Avoid calulating the value each time in the NMI handler */
++	/* Avoid calculating the value each time in the NMI handler */
+ 	perf_nmi_window = msecs_to_jiffies(100);
+ 
+-	switch (boot_cpu_data.x86) {
+-	case 0x15:
+-		pr_cont("Fam15h ");
+-		x86_pmu.get_event_constraints = amd_get_event_constraints_f15h;
+-		break;
+-	case 0x17:
+-		pr_cont("Fam17h ");
+-		/*
+-		 * In family 17h, there are no event constraints in the PMC hardware.
+-		 * We fallback to using default amd_get_event_constraints.
+-		 */
+-		break;
+-	case 0x18:
+-		pr_cont("Fam18h ");
+-		/* Using default amd_get_event_constraints. */
+-		break;
+-	default:
+-		pr_err("core perfctr but no constraints; unknown hardware!\n");
+-		return -ENODEV;
+-	}
+-
+ 	/*
+ 	 * If core performance counter extensions exists, we must use
+ 	 * MSR_F15H_PERF_CTL/MSR_F15H_PERF_CTR msrs. See also
+@@ -940,6 +947,30 @@ static int __init amd_core_pmu_init(void)
+ 	 */
+ 	x86_pmu.amd_nb_constraints = 0;
+ 
++	if (boot_cpu_data.x86 == 0x15) {
++		pr_cont("Fam15h ");
++		x86_pmu.get_event_constraints = amd_get_event_constraints_f15h;
++	}
++	if (boot_cpu_data.x86 >= 0x17) {
++		pr_cont("Fam17h+ ");
++		/*
++		 * Family 17h and compatibles have constraints for Large
++		 * Increment per Cycle events: they may only be assigned an
++		 * even numbered counter that has a consecutive adjacent odd
++		 * numbered counter following it.
++		 */
++		for (i = 0; i < x86_pmu.num_counters - 1; i += 2)
++			even_ctr_mask |= 1 << i;
++
++		pair_constraint = (struct event_constraint)
++				    __EVENT_CONSTRAINT(0, even_ctr_mask, 0,
++				    x86_pmu.num_counters / 2, 0,
++				    PERF_X86_EVENT_PAIR);
++
++		x86_pmu.get_event_constraints = amd_get_event_constraints_f17h;
++		x86_pmu.flags |= PMU_FL_PAIR;
++	}
++
+ 	pr_cont("core perfctr, ");
+ 	return 0;
+ }
+diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
+index 930611db8f9ad..e2fd363de6490 100644
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -77,6 +77,7 @@ static inline bool constraint_match(struct event_constraint *c, u64 ecode)
+ #define PERF_X86_EVENT_AUTO_RELOAD	0x0200 /* use PEBS auto-reload */
+ #define PERF_X86_EVENT_LARGE_PEBS	0x0400 /* use large PEBS */
+ #define PERF_X86_EVENT_PEBS_VIA_PT	0x0800 /* use PT buffer for PEBS */
++#define PERF_X86_EVENT_PAIR		0x1000 /* Large Increment per Cycle */
+ 
+ struct amd_nb {
+ 	int nb_id;  /* NorthBridge id */
+@@ -743,6 +744,7 @@ do {									\
+ #define PMU_FL_EXCL_ENABLED	0x8 /* exclusive counter active */
+ #define PMU_FL_PEBS_ALL		0x10 /* all events are valid PEBS events */
+ #define PMU_FL_TFA		0x20 /* deal with TSX force abort */
++#define PMU_FL_PAIR		0x40 /* merge counters for large incr. events */
+ 
+ #define EVENT_VAR(_id)  event_attr_##_id
+ #define EVENT_PTR(_id) &event_attr_##_id.attr.attr
+-- 
+2.20.1
+
diff --git a/queue-5.5/pinctrl-baytrail-do-not-clear-irq-flags-on-direct-ir.patch b/queue-5.5/pinctrl-baytrail-do-not-clear-irq-flags-on-direct-ir.patch
new file mode 100644
index 00000000000..7038bb936a9
--- /dev/null
+++ b/queue-5.5/pinctrl-baytrail-do-not-clear-irq-flags-on-direct-ir.patch
@@ -0,0 +1,60 @@
+From 50cb2f59c9409b9268e2cf41566e5d99f64046ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Dec 2019 00:04:47 +0100
+Subject: pinctrl: baytrail: Do not clear IRQ flags on direct-irq enabled pins
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a23680594da7a9e2696dbcf4f023e9273e2fa40b ]
+
+Suspending Goodix touchscreens requires changing the interrupt pin to
+output before sending them a power-down command. Followed by wiggling
+the interrupt pin to wake the device up, after which it is put back
+in input mode.
+
+On Bay Trail devices with a Goodix touchscreen direct-irq mode is used
+in combination with listing the pin as a normal GpioIo resource.
+
+This works fine, until the goodix driver gets rmmod-ed and then insmod-ed
+again. In this case byt_gpio_disable_free() calls
+byt_gpio_clear_triggering() which clears the IRQ flags and after that the
+(direct) IRQ no longer triggers.
+
+This commit fixes this by adding a check for the BYT_DIRECT_IRQ_EN flag
+to byt_gpio_clear_triggering().
+
+Note that byt_gpio_clear_triggering() only gets called from
+byt_gpio_disable_free() for direct-irq enabled pins, as these are excluded
+from the irq_valid mask by byt_init_irq_valid_mask().
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-baytrail.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index 72ffd19448e50..ce9cf50121bd5 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -753,7 +753,13 @@ static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned int offset)
+ 
+ 	raw_spin_lock_irqsave(&byt_lock, flags);
+ 	value = readl(reg);
+-	value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
++
++	/* Do not clear direct-irq enabled IRQs (from gpio_disable_free) */
++	if (value & BYT_DIRECT_IRQ_EN)
++		/* nothing to do */ ;
++	else
++		value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
++
+ 	writel(value, reg);
+ 	raw_spin_unlock_irqrestore(&byt_lock, flags);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/pinctrl-sh-pfc-sh7264-fix-can-function-gpios.patch b/queue-5.5/pinctrl-sh-pfc-sh7264-fix-can-function-gpios.patch
new file mode 100644
index 00000000000..38165943a6f
--- /dev/null
+++ b/queue-5.5/pinctrl-sh-pfc-sh7264-fix-can-function-gpios.patch
@@ -0,0 +1,94 @@
+From 5465ac44d5746d0d318525949858945eafd2a39a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 20:48:09 +0100
+Subject: pinctrl: sh-pfc: sh7264: Fix CAN function GPIOs
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 55b1cb1f03ad5eea39897d0c74035e02deddcff2 ]
+
+pinmux_func_gpios[] contains a hole due to the missing function GPIO
+definition for the "CTX0&CTX1" signal, which is the logical "AND" of the
+two CAN outputs.
+
+Fix this by:
+  - Renaming CRX0_CRX1_MARK to CTX0_CTX1_MARK, as PJ2MD[2:0]=010
+    configures the combined "CTX0&CTX1" output signal,
+  - Renaming CRX0X1_MARK to CRX0_CRX1_MARK, as PJ3MD[1:0]=10 configures
+    the shared "CRX0/CRX1" input signal, which is fed to both CAN
+    inputs,
+  - Adding the missing function GPIO definition for "CTX0&CTX1" to
+    pinmux_func_gpios[],
+  - Moving all CAN enums next to each other.
+
+See SH7262 Group, SH7264 Group User's Manual: Hardware, Rev. 4.00:
+  [1] Figure 1.2 (3) (Pin Assignment for the SH7264 Group (1-Mbyte
+      Version),
+  [2] Figure 1.2 (4) Pin Assignment for the SH7264 Group (640-Kbyte
+      Version,
+  [3] Table 1.4 List of Pins,
+  [4] Figure 20.29 Connection Example when Using This Module as 1-Channel
+      Module (64 Mailboxes x 1 Channel),
+  [5] Table 32.10 Multiplexed Pins (Port J),
+  [6] Section 32.2.30 (3) Port J Control Register 0 (PJCR0).
+
+Note that the last 2 disagree about PJ2MD[2:0], which is probably the
+root cause of this bug.  But considering [4], "CTx0&CTx1" in [5] must
+be correct, and "CRx0&CRx1" in [6] must be wrong.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191218194812.12741-4-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7264.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+index 4a95867deb8af..5a026601d4f9a 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+@@ -497,17 +497,15 @@ enum {
+ 	SD_WP_MARK, SD_CLK_MARK, SD_CMD_MARK,
+ 	CRX0_MARK, CRX1_MARK,
+ 	CTX0_MARK, CTX1_MARK,
++	CRX0_CRX1_MARK, CTX0_CTX1_MARK,
+ 
+ 	PWM1A_MARK, PWM1B_MARK, PWM1C_MARK, PWM1D_MARK,
+ 	PWM1E_MARK, PWM1F_MARK, PWM1G_MARK, PWM1H_MARK,
+ 	PWM2A_MARK, PWM2B_MARK, PWM2C_MARK, PWM2D_MARK,
+ 	PWM2E_MARK, PWM2F_MARK, PWM2G_MARK, PWM2H_MARK,
+ 	IERXD_MARK, IETXD_MARK,
+-	CRX0_CRX1_MARK,
+ 	WDTOVF_MARK,
+ 
+-	CRX0X1_MARK,
+-
+ 	/* DMAC */
+ 	TEND0_MARK, DACK0_MARK, DREQ0_MARK,
+ 	TEND1_MARK, DACK1_MARK, DREQ1_MARK,
+@@ -995,12 +993,12 @@ static const u16 pinmux_data[] = {
+ 
+ 	PINMUX_DATA(PJ3_DATA, PJ3MD_00),
+ 	PINMUX_DATA(CRX1_MARK, PJ3MD_01),
+-	PINMUX_DATA(CRX0X1_MARK, PJ3MD_10),
++	PINMUX_DATA(CRX0_CRX1_MARK, PJ3MD_10),
+ 	PINMUX_DATA(IRQ1_PJ_MARK, PJ3MD_11),
+ 
+ 	PINMUX_DATA(PJ2_DATA, PJ2MD_000),
+ 	PINMUX_DATA(CTX1_MARK, PJ2MD_001),
+-	PINMUX_DATA(CRX0_CRX1_MARK, PJ2MD_010),
++	PINMUX_DATA(CTX0_CTX1_MARK, PJ2MD_010),
+ 	PINMUX_DATA(CS2_MARK, PJ2MD_011),
+ 	PINMUX_DATA(SCK0_MARK, PJ2MD_100),
+ 	PINMUX_DATA(LCD_M_DISP_MARK, PJ2MD_101),
+@@ -1245,6 +1243,7 @@ static const struct pinmux_func pinmux_func_gpios[] = {
+ 	GPIO_FN(CTX1),
+ 	GPIO_FN(CRX1),
+ 	GPIO_FN(CTX0),
++	GPIO_FN(CTX0_CTX1),
+ 	GPIO_FN(CRX0),
+ 	GPIO_FN(CRX0_CRX1),
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/pinctrl-sh-pfc-sh7269-fix-can-function-gpios.patch b/queue-5.5/pinctrl-sh-pfc-sh7269-fix-can-function-gpios.patch
new file mode 100644
index 00000000000..026d91c2a97
--- /dev/null
+++ b/queue-5.5/pinctrl-sh-pfc-sh7269-fix-can-function-gpios.patch
@@ -0,0 +1,184 @@
+From 60ead8f3bf91136ca7ab089c2e1accf9d46c8ea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 20:48:10 +0100
+Subject: pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 02aeb2f21530c98fc3ca51028eda742a3fafbd9f ]
+
+pinmux_func_gpios[] contains a hole due to the missing function GPIO
+definition for the "CTX0&CTX1" signal, which is the logical "AND" of the
+first two CAN outputs.
+
+A closer look reveals other issues:
+  - Some functionality is available on alternative pins, but the
+    PINMUX_DATA() entries is using the wrong marks,
+  - Several configurations are missing.
+
+Fix this by:
+  - Renaming CTX0CTX1CTX2_MARK, CRX0CRX1_PJ22_MARK, and
+    CRX0CRX1CRX2_PJ20_MARK to CTX0_CTX1_CTX2_MARK, CRX0_CRX1_PJ22_MARK,
+    resp. CRX0_CRX1_CRX2_PJ20_MARK for consistency with the
+    corresponding enum IDs,
+  - Adding all missing enum IDs and marks,
+  - Use the right (*_PJ2x) variants for alternative pins,
+  - Adding all missing configurations to pinmux_data[],
+  - Adding all missing function GPIO definitions to pinmux_func_gpios[].
+
+See SH7268 Group, SH7269 Group User’s Manual: Hardware, Rev. 2.00:
+  [1] Table 1.4 List of Pins
+  [2] Figure 23.29 Connection Example when Using Channels 0 and 1 as One
+      Channel (64 Mailboxes × 1 Channel) and Channel 2 as One Channel
+      (32 Mailboxes × 1 Channel),
+  [3] Figure 23.30 Connection Example when Using Channels 0, 1, and 2 as
+      One Channel (96 Mailboxes × 1 Channel),
+  [4] Table 48.3 Multiplexed Pins (Port B),
+  [5] Table 48.4 Multiplexed Pins (Port C),
+  [6] Table 48.10 Multiplexed Pins (Port J),
+  [7] Section 48.2.4 Port B Control Registers 0 to 5 (PBCR0 to PBCR5).
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191218194812.12741-5-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/include/cpu-sh2a/cpu/sh7269.h | 11 ++++++--
+ drivers/pinctrl/sh-pfc/pfc-sh7269.c   | 39 ++++++++++++++++++---------
+ 2 files changed, 36 insertions(+), 14 deletions(-)
+
+diff --git a/arch/sh/include/cpu-sh2a/cpu/sh7269.h b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
+index d516e5d488180..b887cc402b712 100644
+--- a/arch/sh/include/cpu-sh2a/cpu/sh7269.h
++++ b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
+@@ -78,8 +78,15 @@ enum {
+ 	GPIO_FN_WDTOVF,
+ 
+ 	/* CAN */
+-	GPIO_FN_CTX1, GPIO_FN_CRX1, GPIO_FN_CTX0, GPIO_FN_CTX0_CTX1,
+-	GPIO_FN_CRX0, GPIO_FN_CRX0_CRX1, GPIO_FN_CRX0_CRX1_CRX2,
++	GPIO_FN_CTX2, GPIO_FN_CRX2,
++	GPIO_FN_CTX1, GPIO_FN_CRX1,
++	GPIO_FN_CTX0, GPIO_FN_CRX0,
++	GPIO_FN_CTX0_CTX1, GPIO_FN_CRX0_CRX1,
++	GPIO_FN_CTX0_CTX1_CTX2, GPIO_FN_CRX0_CRX1_CRX2,
++	GPIO_FN_CTX2_PJ21, GPIO_FN_CRX2_PJ20,
++	GPIO_FN_CTX1_PJ23, GPIO_FN_CRX1_PJ22,
++	GPIO_FN_CTX0_CTX1_PJ23, GPIO_FN_CRX0_CRX1_PJ22,
++	GPIO_FN_CTX0_CTX1_CTX2_PJ21, GPIO_FN_CRX0_CRX1_CRX2_PJ20,
+ 
+ 	/* DMAC */
+ 	GPIO_FN_TEND0, GPIO_FN_DACK0, GPIO_FN_DREQ0,
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+index 6cbb18ef77dc0..d20974a55d93a 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+@@ -737,13 +737,12 @@ enum {
+ 	CRX0_MARK, CTX0_MARK,
+ 	CRX1_MARK, CTX1_MARK,
+ 	CRX2_MARK, CTX2_MARK,
+-	CRX0_CRX1_MARK,
+-	CRX0_CRX1_CRX2_MARK,
+-	CTX0CTX1CTX2_MARK,
++	CRX0_CRX1_MARK, CTX0_CTX1_MARK,
++	CRX0_CRX1_CRX2_MARK, CTX0_CTX1_CTX2_MARK,
+ 	CRX1_PJ22_MARK, CTX1_PJ23_MARK,
+ 	CRX2_PJ20_MARK, CTX2_PJ21_MARK,
+-	CRX0CRX1_PJ22_MARK,
+-	CRX0CRX1CRX2_PJ20_MARK,
++	CRX0_CRX1_PJ22_MARK, CTX0_CTX1_PJ23_MARK,
++	CRX0_CRX1_CRX2_PJ20_MARK, CTX0_CTX1_CTX2_PJ21_MARK,
+ 
+ 	/* VDC */
+ 	DV_CLK_MARK,
+@@ -821,6 +820,7 @@ static const u16 pinmux_data[] = {
+ 	PINMUX_DATA(CS3_MARK, PC8MD_001),
+ 	PINMUX_DATA(TXD7_MARK, PC8MD_010),
+ 	PINMUX_DATA(CTX1_MARK, PC8MD_011),
++	PINMUX_DATA(CTX0_CTX1_MARK, PC8MD_100),
+ 
+ 	PINMUX_DATA(PC7_DATA, PC7MD_000),
+ 	PINMUX_DATA(CKE_MARK, PC7MD_001),
+@@ -833,11 +833,12 @@ static const u16 pinmux_data[] = {
+ 	PINMUX_DATA(CAS_MARK, PC6MD_001),
+ 	PINMUX_DATA(SCK7_MARK, PC6MD_010),
+ 	PINMUX_DATA(CTX0_MARK, PC6MD_011),
++	PINMUX_DATA(CTX0_CTX1_CTX2_MARK, PC6MD_100),
+ 
+ 	PINMUX_DATA(PC5_DATA, PC5MD_000),
+ 	PINMUX_DATA(RAS_MARK, PC5MD_001),
+ 	PINMUX_DATA(CRX0_MARK, PC5MD_011),
+-	PINMUX_DATA(CTX0CTX1CTX2_MARK, PC5MD_100),
++	PINMUX_DATA(CTX0_CTX1_CTX2_MARK, PC5MD_100),
+ 	PINMUX_DATA(IRQ0_PC_MARK, PC5MD_101),
+ 
+ 	PINMUX_DATA(PC4_DATA, PC4MD_00),
+@@ -1289,30 +1290,32 @@ static const u16 pinmux_data[] = {
+ 	PINMUX_DATA(LCD_DATA23_PJ23_MARK, PJ23MD_010),
+ 	PINMUX_DATA(LCD_TCON6_MARK, PJ23MD_011),
+ 	PINMUX_DATA(IRQ3_PJ_MARK, PJ23MD_100),
+-	PINMUX_DATA(CTX1_MARK, PJ23MD_101),
++	PINMUX_DATA(CTX1_PJ23_MARK, PJ23MD_101),
++	PINMUX_DATA(CTX0_CTX1_PJ23_MARK, PJ23MD_110),
+ 
+ 	PINMUX_DATA(PJ22_DATA, PJ22MD_000),
+ 	PINMUX_DATA(DV_DATA22_MARK, PJ22MD_001),
+ 	PINMUX_DATA(LCD_DATA22_PJ22_MARK, PJ22MD_010),
+ 	PINMUX_DATA(LCD_TCON5_MARK, PJ22MD_011),
+ 	PINMUX_DATA(IRQ2_PJ_MARK, PJ22MD_100),
+-	PINMUX_DATA(CRX1_MARK, PJ22MD_101),
+-	PINMUX_DATA(CRX0_CRX1_MARK, PJ22MD_110),
++	PINMUX_DATA(CRX1_PJ22_MARK, PJ22MD_101),
++	PINMUX_DATA(CRX0_CRX1_PJ22_MARK, PJ22MD_110),
+ 
+ 	PINMUX_DATA(PJ21_DATA, PJ21MD_000),
+ 	PINMUX_DATA(DV_DATA21_MARK, PJ21MD_001),
+ 	PINMUX_DATA(LCD_DATA21_PJ21_MARK, PJ21MD_010),
+ 	PINMUX_DATA(LCD_TCON4_MARK, PJ21MD_011),
+ 	PINMUX_DATA(IRQ1_PJ_MARK, PJ21MD_100),
+-	PINMUX_DATA(CTX2_MARK, PJ21MD_101),
++	PINMUX_DATA(CTX2_PJ21_MARK, PJ21MD_101),
++	PINMUX_DATA(CTX0_CTX1_CTX2_PJ21_MARK, PJ21MD_110),
+ 
+ 	PINMUX_DATA(PJ20_DATA, PJ20MD_000),
+ 	PINMUX_DATA(DV_DATA20_MARK, PJ20MD_001),
+ 	PINMUX_DATA(LCD_DATA20_PJ20_MARK, PJ20MD_010),
+ 	PINMUX_DATA(LCD_TCON3_MARK, PJ20MD_011),
+ 	PINMUX_DATA(IRQ0_PJ_MARK, PJ20MD_100),
+-	PINMUX_DATA(CRX2_MARK, PJ20MD_101),
+-	PINMUX_DATA(CRX0CRX1CRX2_PJ20_MARK, PJ20MD_110),
++	PINMUX_DATA(CRX2_PJ20_MARK, PJ20MD_101),
++	PINMUX_DATA(CRX0_CRX1_CRX2_PJ20_MARK, PJ20MD_110),
+ 
+ 	PINMUX_DATA(PJ19_DATA, PJ19MD_000),
+ 	PINMUX_DATA(DV_DATA19_MARK, PJ19MD_001),
+@@ -1663,12 +1666,24 @@ static const struct pinmux_func pinmux_func_gpios[] = {
+ 	GPIO_FN(WDTOVF),
+ 
+ 	/* CAN */
++	GPIO_FN(CTX2),
++	GPIO_FN(CRX2),
+ 	GPIO_FN(CTX1),
+ 	GPIO_FN(CRX1),
+ 	GPIO_FN(CTX0),
+ 	GPIO_FN(CRX0),
++	GPIO_FN(CTX0_CTX1),
+ 	GPIO_FN(CRX0_CRX1),
++	GPIO_FN(CTX0_CTX1_CTX2),
+ 	GPIO_FN(CRX0_CRX1_CRX2),
++	GPIO_FN(CTX2_PJ21),
++	GPIO_FN(CRX2_PJ20),
++	GPIO_FN(CTX1_PJ23),
++	GPIO_FN(CRX1_PJ22),
++	GPIO_FN(CTX0_CTX1_PJ23),
++	GPIO_FN(CRX0_CRX1_PJ22),
++	GPIO_FN(CTX0_CTX1_CTX2_PJ21),
++	GPIO_FN(CRX0_CRX1_CRX2_PJ20),
+ 
+ 	/* DMAC */
+ 	GPIO_FN(TEND0),
+-- 
+2.20.1
+
diff --git a/queue-5.5/pinctrl-tigerlake-tiger-lake-uses-_hid-enumeration.patch b/queue-5.5/pinctrl-tigerlake-tiger-lake-uses-_hid-enumeration.patch
new file mode 100644
index 00000000000..494b20b1147
--- /dev/null
+++ b/queue-5.5/pinctrl-tigerlake-tiger-lake-uses-_hid-enumeration.patch
@@ -0,0 +1,643 @@
+From 8ea7627e4e7c801b81286e971e49358eef3aef4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 14:09:02 +0300
+Subject: pinctrl: tigerlake: Tiger Lake uses _HID enumeration
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit cd0a32371db73d0b50536a7ca4f036abddff0d1d ]
+
+Turns out that Tiger Lake GPIO will be enumerated using _HID method where
+there is only a single ACPI device and multiple BARs so rework the driver
+to support that scheme instead.
+
+Fixes: c9ccf71fc807 ("pinctrl: intel: Add Intel Tiger Lake pin controller support")
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-tigerlake.c | 547 ++++++++++------------
+ 1 file changed, 250 insertions(+), 297 deletions(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-tigerlake.c b/drivers/pinctrl/intel/pinctrl-tigerlake.c
+index 58572b15b3ce3..08a86f6fdea6e 100644
+--- a/drivers/pinctrl/intel/pinctrl-tigerlake.c
++++ b/drivers/pinctrl/intel/pinctrl-tigerlake.c
+@@ -2,7 +2,7 @@
+ /*
+  * Intel Tiger Lake PCH pinctrl/GPIO driver
+  *
+- * Copyright (C) 2019, Intel Corporation
++ * Copyright (C) 2019 - 2020, Intel Corporation
+  * Authors: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+  *          Mika Westerberg <mika.westerberg@linux.intel.com>
+  */
+@@ -21,15 +21,19 @@
+ #define TGL_GPI_IS	0x100
+ #define TGL_GPI_IE	0x120
+ 
+-#define TGL_GPP(r, s, e)				\
++#define TGL_NO_GPIO	-1
++
++#define TGL_GPP(r, s, e, g)				\
+ 	{						\
+ 		.reg_num = (r),				\
+ 		.base = (s),				\
+ 		.size = ((e) - (s) + 1),		\
++		.gpio_base = (g),			\
+ 	}
+ 
+-#define TGL_COMMUNITY(s, e, g)				\
++#define TGL_COMMUNITY(b, s, e, g)			\
+ 	{						\
++		.barno = (b),				\
+ 		.padown_offset = TGL_PAD_OWN,		\
+ 		.padcfglock_offset = TGL_PADCFGLOCK,	\
+ 		.hostown_offset = TGL_HOSTSW_OWN,	\
+@@ -42,7 +46,7 @@
+ 	}
+ 
+ /* Tiger Lake-LP */
+-static const struct pinctrl_pin_desc tgllp_community0_pins[] = {
++static const struct pinctrl_pin_desc tgllp_pins[] = {
+ 	/* GPP_B */
+ 	PINCTRL_PIN(0, "CORE_VID_0"),
+ 	PINCTRL_PIN(1, "CORE_VID_1"),
+@@ -113,324 +117,273 @@ static const struct pinctrl_pin_desc tgllp_community0_pins[] = {
+ 	PINCTRL_PIN(64, "GPPC_A_22"),
+ 	PINCTRL_PIN(65, "I2S1_SCLK"),
+ 	PINCTRL_PIN(66, "ESPI_CLK_LOOPBK"),
+-};
+-
+-static const struct intel_padgroup tgllp_community0_gpps[] = {
+-	TGL_GPP(0, 0, 25),	/* GPP_B */
+-	TGL_GPP(1, 26, 41),	/* GPP_T */
+-	TGL_GPP(2, 42, 66),	/* GPP_A */
+-};
+-
+-static const struct intel_community tgllp_community0[] = {
+-	TGL_COMMUNITY(0, 66, tgllp_community0_gpps),
+-};
+-
+-static const struct intel_pinctrl_soc_data tgllp_community0_soc_data = {
+-	.uid = "0",
+-	.pins = tgllp_community0_pins,
+-	.npins = ARRAY_SIZE(tgllp_community0_pins),
+-	.communities = tgllp_community0,
+-	.ncommunities = ARRAY_SIZE(tgllp_community0),
+-};
+-
+-static const struct pinctrl_pin_desc tgllp_community1_pins[] = {
+ 	/* GPP_S */
+-	PINCTRL_PIN(0, "SNDW0_CLK"),
+-	PINCTRL_PIN(1, "SNDW0_DATA"),
+-	PINCTRL_PIN(2, "SNDW1_CLK"),
+-	PINCTRL_PIN(3, "SNDW1_DATA"),
+-	PINCTRL_PIN(4, "SNDW2_CLK"),
+-	PINCTRL_PIN(5, "SNDW2_DATA"),
+-	PINCTRL_PIN(6, "SNDW3_CLK"),
+-	PINCTRL_PIN(7, "SNDW3_DATA"),
++	PINCTRL_PIN(67, "SNDW0_CLK"),
++	PINCTRL_PIN(68, "SNDW0_DATA"),
++	PINCTRL_PIN(69, "SNDW1_CLK"),
++	PINCTRL_PIN(70, "SNDW1_DATA"),
++	PINCTRL_PIN(71, "SNDW2_CLK"),
++	PINCTRL_PIN(72, "SNDW2_DATA"),
++	PINCTRL_PIN(73, "SNDW3_CLK"),
++	PINCTRL_PIN(74, "SNDW3_DATA"),
+ 	/* GPP_H */
+-	PINCTRL_PIN(8, "GPPC_H_0"),
+-	PINCTRL_PIN(9, "GPPC_H_1"),
+-	PINCTRL_PIN(10, "GPPC_H_2"),
+-	PINCTRL_PIN(11, "SX_EXIT_HOLDOFFB"),
+-	PINCTRL_PIN(12, "I2C2_SDA"),
+-	PINCTRL_PIN(13, "I2C2_SCL"),
+-	PINCTRL_PIN(14, "I2C3_SDA"),
+-	PINCTRL_PIN(15, "I2C3_SCL"),
+-	PINCTRL_PIN(16, "I2C4_SDA"),
+-	PINCTRL_PIN(17, "I2C4_SCL"),
+-	PINCTRL_PIN(18, "SRCCLKREQB_4"),
+-	PINCTRL_PIN(19, "SRCCLKREQB_5"),
+-	PINCTRL_PIN(20, "M2_SKT2_CFG_0"),
+-	PINCTRL_PIN(21, "M2_SKT2_CFG_1"),
+-	PINCTRL_PIN(22, "M2_SKT2_CFG_2"),
+-	PINCTRL_PIN(23, "M2_SKT2_CFG_3"),
+-	PINCTRL_PIN(24, "DDPB_CTRLCLK"),
+-	PINCTRL_PIN(25, "DDPB_CTRLDATA"),
+-	PINCTRL_PIN(26, "CPU_C10_GATEB"),
+-	PINCTRL_PIN(27, "TIME_SYNC_0"),
+-	PINCTRL_PIN(28, "IMGCLKOUT_1"),
+-	PINCTRL_PIN(29, "IMGCLKOUT_2"),
+-	PINCTRL_PIN(30, "IMGCLKOUT_3"),
+-	PINCTRL_PIN(31, "IMGCLKOUT_4"),
++	PINCTRL_PIN(75, "GPPC_H_0"),
++	PINCTRL_PIN(76, "GPPC_H_1"),
++	PINCTRL_PIN(77, "GPPC_H_2"),
++	PINCTRL_PIN(78, "SX_EXIT_HOLDOFFB"),
++	PINCTRL_PIN(79, "I2C2_SDA"),
++	PINCTRL_PIN(80, "I2C2_SCL"),
++	PINCTRL_PIN(81, "I2C3_SDA"),
++	PINCTRL_PIN(82, "I2C3_SCL"),
++	PINCTRL_PIN(83, "I2C4_SDA"),
++	PINCTRL_PIN(84, "I2C4_SCL"),
++	PINCTRL_PIN(85, "SRCCLKREQB_4"),
++	PINCTRL_PIN(86, "SRCCLKREQB_5"),
++	PINCTRL_PIN(87, "M2_SKT2_CFG_0"),
++	PINCTRL_PIN(88, "M2_SKT2_CFG_1"),
++	PINCTRL_PIN(89, "M2_SKT2_CFG_2"),
++	PINCTRL_PIN(90, "M2_SKT2_CFG_3"),
++	PINCTRL_PIN(91, "DDPB_CTRLCLK"),
++	PINCTRL_PIN(92, "DDPB_CTRLDATA"),
++	PINCTRL_PIN(93, "CPU_C10_GATEB"),
++	PINCTRL_PIN(94, "TIME_SYNC_0"),
++	PINCTRL_PIN(95, "IMGCLKOUT_1"),
++	PINCTRL_PIN(96, "IMGCLKOUT_2"),
++	PINCTRL_PIN(97, "IMGCLKOUT_3"),
++	PINCTRL_PIN(98, "IMGCLKOUT_4"),
+ 	/* GPP_D */
+-	PINCTRL_PIN(32, "ISH_GP_0"),
+-	PINCTRL_PIN(33, "ISH_GP_1"),
+-	PINCTRL_PIN(34, "ISH_GP_2"),
+-	PINCTRL_PIN(35, "ISH_GP_3"),
+-	PINCTRL_PIN(36, "IMGCLKOUT_0"),
+-	PINCTRL_PIN(37, "SRCCLKREQB_0"),
+-	PINCTRL_PIN(38, "SRCCLKREQB_1"),
+-	PINCTRL_PIN(39, "SRCCLKREQB_2"),
+-	PINCTRL_PIN(40, "SRCCLKREQB_3"),
+-	PINCTRL_PIN(41, "ISH_SPI_CSB"),
+-	PINCTRL_PIN(42, "ISH_SPI_CLK"),
+-	PINCTRL_PIN(43, "ISH_SPI_MISO"),
+-	PINCTRL_PIN(44, "ISH_SPI_MOSI"),
+-	PINCTRL_PIN(45, "ISH_UART0_RXD"),
+-	PINCTRL_PIN(46, "ISH_UART0_TXD"),
+-	PINCTRL_PIN(47, "ISH_UART0_RTSB"),
+-	PINCTRL_PIN(48, "ISH_UART0_CTSB"),
+-	PINCTRL_PIN(49, "ISH_GP_4"),
+-	PINCTRL_PIN(50, "ISH_GP_5"),
+-	PINCTRL_PIN(51, "I2S_MCLK1_OUT"),
+-	PINCTRL_PIN(52, "GSPI2_CLK_LOOPBK"),
++	PINCTRL_PIN(99, "ISH_GP_0"),
++	PINCTRL_PIN(100, "ISH_GP_1"),
++	PINCTRL_PIN(101, "ISH_GP_2"),
++	PINCTRL_PIN(102, "ISH_GP_3"),
++	PINCTRL_PIN(103, "IMGCLKOUT_0"),
++	PINCTRL_PIN(104, "SRCCLKREQB_0"),
++	PINCTRL_PIN(105, "SRCCLKREQB_1"),
++	PINCTRL_PIN(106, "SRCCLKREQB_2"),
++	PINCTRL_PIN(107, "SRCCLKREQB_3"),
++	PINCTRL_PIN(108, "ISH_SPI_CSB"),
++	PINCTRL_PIN(109, "ISH_SPI_CLK"),
++	PINCTRL_PIN(110, "ISH_SPI_MISO"),
++	PINCTRL_PIN(111, "ISH_SPI_MOSI"),
++	PINCTRL_PIN(112, "ISH_UART0_RXD"),
++	PINCTRL_PIN(113, "ISH_UART0_TXD"),
++	PINCTRL_PIN(114, "ISH_UART0_RTSB"),
++	PINCTRL_PIN(115, "ISH_UART0_CTSB"),
++	PINCTRL_PIN(116, "ISH_GP_4"),
++	PINCTRL_PIN(117, "ISH_GP_5"),
++	PINCTRL_PIN(118, "I2S_MCLK1_OUT"),
++	PINCTRL_PIN(119, "GSPI2_CLK_LOOPBK"),
+ 	/* GPP_U */
+-	PINCTRL_PIN(53, "UART3_RXD"),
+-	PINCTRL_PIN(54, "UART3_TXD"),
+-	PINCTRL_PIN(55, "UART3_RTSB"),
+-	PINCTRL_PIN(56, "UART3_CTSB"),
+-	PINCTRL_PIN(57, "GSPI3_CS0B"),
+-	PINCTRL_PIN(58, "GSPI3_CLK"),
+-	PINCTRL_PIN(59, "GSPI3_MISO"),
+-	PINCTRL_PIN(60, "GSPI3_MOSI"),
+-	PINCTRL_PIN(61, "GSPI4_CS0B"),
+-	PINCTRL_PIN(62, "GSPI4_CLK"),
+-	PINCTRL_PIN(63, "GSPI4_MISO"),
+-	PINCTRL_PIN(64, "GSPI4_MOSI"),
+-	PINCTRL_PIN(65, "GSPI5_CS0B"),
+-	PINCTRL_PIN(66, "GSPI5_CLK"),
+-	PINCTRL_PIN(67, "GSPI5_MISO"),
+-	PINCTRL_PIN(68, "GSPI5_MOSI"),
+-	PINCTRL_PIN(69, "GSPI6_CS0B"),
+-	PINCTRL_PIN(70, "GSPI6_CLK"),
+-	PINCTRL_PIN(71, "GSPI6_MISO"),
+-	PINCTRL_PIN(72, "GSPI6_MOSI"),
+-	PINCTRL_PIN(73, "GSPI3_CLK_LOOPBK"),
+-	PINCTRL_PIN(74, "GSPI4_CLK_LOOPBK"),
+-	PINCTRL_PIN(75, "GSPI5_CLK_LOOPBK"),
+-	PINCTRL_PIN(76, "GSPI6_CLK_LOOPBK"),
++	PINCTRL_PIN(120, "UART3_RXD"),
++	PINCTRL_PIN(121, "UART3_TXD"),
++	PINCTRL_PIN(122, "UART3_RTSB"),
++	PINCTRL_PIN(123, "UART3_CTSB"),
++	PINCTRL_PIN(124, "GSPI3_CS0B"),
++	PINCTRL_PIN(125, "GSPI3_CLK"),
++	PINCTRL_PIN(126, "GSPI3_MISO"),
++	PINCTRL_PIN(127, "GSPI3_MOSI"),
++	PINCTRL_PIN(128, "GSPI4_CS0B"),
++	PINCTRL_PIN(129, "GSPI4_CLK"),
++	PINCTRL_PIN(130, "GSPI4_MISO"),
++	PINCTRL_PIN(131, "GSPI4_MOSI"),
++	PINCTRL_PIN(132, "GSPI5_CS0B"),
++	PINCTRL_PIN(133, "GSPI5_CLK"),
++	PINCTRL_PIN(134, "GSPI5_MISO"),
++	PINCTRL_PIN(135, "GSPI5_MOSI"),
++	PINCTRL_PIN(136, "GSPI6_CS0B"),
++	PINCTRL_PIN(137, "GSPI6_CLK"),
++	PINCTRL_PIN(138, "GSPI6_MISO"),
++	PINCTRL_PIN(139, "GSPI6_MOSI"),
++	PINCTRL_PIN(140, "GSPI3_CLK_LOOPBK"),
++	PINCTRL_PIN(141, "GSPI4_CLK_LOOPBK"),
++	PINCTRL_PIN(142, "GSPI5_CLK_LOOPBK"),
++	PINCTRL_PIN(143, "GSPI6_CLK_LOOPBK"),
+ 	/* vGPIO */
+-	PINCTRL_PIN(77, "CNV_BTEN"),
+-	PINCTRL_PIN(78, "CNV_BT_HOST_WAKEB"),
+-	PINCTRL_PIN(79, "CNV_BT_IF_SELECT"),
+-	PINCTRL_PIN(80, "vCNV_BT_UART_TXD"),
+-	PINCTRL_PIN(81, "vCNV_BT_UART_RXD"),
+-	PINCTRL_PIN(82, "vCNV_BT_UART_CTS_B"),
+-	PINCTRL_PIN(83, "vCNV_BT_UART_RTS_B"),
+-	PINCTRL_PIN(84, "vCNV_MFUART1_TXD"),
+-	PINCTRL_PIN(85, "vCNV_MFUART1_RXD"),
+-	PINCTRL_PIN(86, "vCNV_MFUART1_CTS_B"),
+-	PINCTRL_PIN(87, "vCNV_MFUART1_RTS_B"),
+-	PINCTRL_PIN(88, "vUART0_TXD"),
+-	PINCTRL_PIN(89, "vUART0_RXD"),
+-	PINCTRL_PIN(90, "vUART0_CTS_B"),
+-	PINCTRL_PIN(91, "vUART0_RTS_B"),
+-	PINCTRL_PIN(92, "vISH_UART0_TXD"),
+-	PINCTRL_PIN(93, "vISH_UART0_RXD"),
+-	PINCTRL_PIN(94, "vISH_UART0_CTS_B"),
+-	PINCTRL_PIN(95, "vISH_UART0_RTS_B"),
+-	PINCTRL_PIN(96, "vCNV_BT_I2S_BCLK"),
+-	PINCTRL_PIN(97, "vCNV_BT_I2S_WS_SYNC"),
+-	PINCTRL_PIN(98, "vCNV_BT_I2S_SDO"),
+-	PINCTRL_PIN(99, "vCNV_BT_I2S_SDI"),
+-	PINCTRL_PIN(100, "vI2S2_SCLK"),
+-	PINCTRL_PIN(101, "vI2S2_SFRM"),
+-	PINCTRL_PIN(102, "vI2S2_TXD"),
+-	PINCTRL_PIN(103, "vI2S2_RXD"),
+-};
+-
+-static const struct intel_padgroup tgllp_community1_gpps[] = {
+-	TGL_GPP(0, 0, 7),	/* GPP_S */
+-	TGL_GPP(1, 8, 31),	/* GPP_H */
+-	TGL_GPP(2, 32, 52),	/* GPP_D */
+-	TGL_GPP(3, 53, 76),	/* GPP_U */
+-	TGL_GPP(4, 77, 103),	/* vGPIO */
+-};
+-
+-static const struct intel_community tgllp_community1[] = {
+-	TGL_COMMUNITY(0, 103, tgllp_community1_gpps),
+-};
+-
+-static const struct intel_pinctrl_soc_data tgllp_community1_soc_data = {
+-	.uid = "1",
+-	.pins = tgllp_community1_pins,
+-	.npins = ARRAY_SIZE(tgllp_community1_pins),
+-	.communities = tgllp_community1,
+-	.ncommunities = ARRAY_SIZE(tgllp_community1),
+-};
+-
+-static const struct pinctrl_pin_desc tgllp_community4_pins[] = {
++	PINCTRL_PIN(144, "CNV_BTEN"),
++	PINCTRL_PIN(145, "CNV_BT_HOST_WAKEB"),
++	PINCTRL_PIN(146, "CNV_BT_IF_SELECT"),
++	PINCTRL_PIN(147, "vCNV_BT_UART_TXD"),
++	PINCTRL_PIN(148, "vCNV_BT_UART_RXD"),
++	PINCTRL_PIN(149, "vCNV_BT_UART_CTS_B"),
++	PINCTRL_PIN(150, "vCNV_BT_UART_RTS_B"),
++	PINCTRL_PIN(151, "vCNV_MFUART1_TXD"),
++	PINCTRL_PIN(152, "vCNV_MFUART1_RXD"),
++	PINCTRL_PIN(153, "vCNV_MFUART1_CTS_B"),
++	PINCTRL_PIN(154, "vCNV_MFUART1_RTS_B"),
++	PINCTRL_PIN(155, "vUART0_TXD"),
++	PINCTRL_PIN(156, "vUART0_RXD"),
++	PINCTRL_PIN(157, "vUART0_CTS_B"),
++	PINCTRL_PIN(158, "vUART0_RTS_B"),
++	PINCTRL_PIN(159, "vISH_UART0_TXD"),
++	PINCTRL_PIN(160, "vISH_UART0_RXD"),
++	PINCTRL_PIN(161, "vISH_UART0_CTS_B"),
++	PINCTRL_PIN(162, "vISH_UART0_RTS_B"),
++	PINCTRL_PIN(163, "vCNV_BT_I2S_BCLK"),
++	PINCTRL_PIN(164, "vCNV_BT_I2S_WS_SYNC"),
++	PINCTRL_PIN(165, "vCNV_BT_I2S_SDO"),
++	PINCTRL_PIN(166, "vCNV_BT_I2S_SDI"),
++	PINCTRL_PIN(167, "vI2S2_SCLK"),
++	PINCTRL_PIN(168, "vI2S2_SFRM"),
++	PINCTRL_PIN(169, "vI2S2_TXD"),
++	PINCTRL_PIN(170, "vI2S2_RXD"),
+ 	/* GPP_C */
+-	PINCTRL_PIN(0, "SMBCLK"),
+-	PINCTRL_PIN(1, "SMBDATA"),
+-	PINCTRL_PIN(2, "SMBALERTB"),
+-	PINCTRL_PIN(3, "SML0CLK"),
+-	PINCTRL_PIN(4, "SML0DATA"),
+-	PINCTRL_PIN(5, "SML0ALERTB"),
+-	PINCTRL_PIN(6, "SML1CLK"),
+-	PINCTRL_PIN(7, "SML1DATA"),
+-	PINCTRL_PIN(8, "UART0_RXD"),
+-	PINCTRL_PIN(9, "UART0_TXD"),
+-	PINCTRL_PIN(10, "UART0_RTSB"),
+-	PINCTRL_PIN(11, "UART0_CTSB"),
+-	PINCTRL_PIN(12, "UART1_RXD"),
+-	PINCTRL_PIN(13, "UART1_TXD"),
+-	PINCTRL_PIN(14, "UART1_RTSB"),
+-	PINCTRL_PIN(15, "UART1_CTSB"),
+-	PINCTRL_PIN(16, "I2C0_SDA"),
+-	PINCTRL_PIN(17, "I2C0_SCL"),
+-	PINCTRL_PIN(18, "I2C1_SDA"),
+-	PINCTRL_PIN(19, "I2C1_SCL"),
+-	PINCTRL_PIN(20, "UART2_RXD"),
+-	PINCTRL_PIN(21, "UART2_TXD"),
+-	PINCTRL_PIN(22, "UART2_RTSB"),
+-	PINCTRL_PIN(23, "UART2_CTSB"),
++	PINCTRL_PIN(171, "SMBCLK"),
++	PINCTRL_PIN(172, "SMBDATA"),
++	PINCTRL_PIN(173, "SMBALERTB"),
++	PINCTRL_PIN(174, "SML0CLK"),
++	PINCTRL_PIN(175, "SML0DATA"),
++	PINCTRL_PIN(176, "SML0ALERTB"),
++	PINCTRL_PIN(177, "SML1CLK"),
++	PINCTRL_PIN(178, "SML1DATA"),
++	PINCTRL_PIN(179, "UART0_RXD"),
++	PINCTRL_PIN(180, "UART0_TXD"),
++	PINCTRL_PIN(181, "UART0_RTSB"),
++	PINCTRL_PIN(182, "UART0_CTSB"),
++	PINCTRL_PIN(183, "UART1_RXD"),
++	PINCTRL_PIN(184, "UART1_TXD"),
++	PINCTRL_PIN(185, "UART1_RTSB"),
++	PINCTRL_PIN(186, "UART1_CTSB"),
++	PINCTRL_PIN(187, "I2C0_SDA"),
++	PINCTRL_PIN(188, "I2C0_SCL"),
++	PINCTRL_PIN(189, "I2C1_SDA"),
++	PINCTRL_PIN(190, "I2C1_SCL"),
++	PINCTRL_PIN(191, "UART2_RXD"),
++	PINCTRL_PIN(192, "UART2_TXD"),
++	PINCTRL_PIN(193, "UART2_RTSB"),
++	PINCTRL_PIN(194, "UART2_CTSB"),
+ 	/* GPP_F */
+-	PINCTRL_PIN(24, "CNV_BRI_DT"),
+-	PINCTRL_PIN(25, "CNV_BRI_RSP"),
+-	PINCTRL_PIN(26, "CNV_RGI_DT"),
+-	PINCTRL_PIN(27, "CNV_RGI_RSP"),
+-	PINCTRL_PIN(28, "CNV_RF_RESET_B"),
+-	PINCTRL_PIN(29, "GPPC_F_5"),
+-	PINCTRL_PIN(30, "CNV_PA_BLANKING"),
+-	PINCTRL_PIN(31, "GPPC_F_7"),
+-	PINCTRL_PIN(32, "I2S_MCLK2_INOUT"),
+-	PINCTRL_PIN(33, "BOOTMPC"),
+-	PINCTRL_PIN(34, "GPPC_F_10"),
+-	PINCTRL_PIN(35, "GPPC_F_11"),
+-	PINCTRL_PIN(36, "GSXDOUT"),
+-	PINCTRL_PIN(37, "GSXSLOAD"),
+-	PINCTRL_PIN(38, "GSXDIN"),
+-	PINCTRL_PIN(39, "GSXSRESETB"),
+-	PINCTRL_PIN(40, "GSXCLK"),
+-	PINCTRL_PIN(41, "GMII_MDC"),
+-	PINCTRL_PIN(42, "GMII_MDIO"),
+-	PINCTRL_PIN(43, "SRCCLKREQB_6"),
+-	PINCTRL_PIN(44, "EXT_PWR_GATEB"),
+-	PINCTRL_PIN(45, "EXT_PWR_GATE2B"),
+-	PINCTRL_PIN(46, "VNN_CTRL"),
+-	PINCTRL_PIN(47, "V1P05_CTRL"),
+-	PINCTRL_PIN(48, "GPPF_CLK_LOOPBACK"),
++	PINCTRL_PIN(195, "CNV_BRI_DT"),
++	PINCTRL_PIN(196, "CNV_BRI_RSP"),
++	PINCTRL_PIN(197, "CNV_RGI_DT"),
++	PINCTRL_PIN(198, "CNV_RGI_RSP"),
++	PINCTRL_PIN(199, "CNV_RF_RESET_B"),
++	PINCTRL_PIN(200, "GPPC_F_5"),
++	PINCTRL_PIN(201, "CNV_PA_BLANKING"),
++	PINCTRL_PIN(202, "GPPC_F_7"),
++	PINCTRL_PIN(203, "I2S_MCLK2_INOUT"),
++	PINCTRL_PIN(204, "BOOTMPC"),
++	PINCTRL_PIN(205, "GPPC_F_10"),
++	PINCTRL_PIN(206, "GPPC_F_11"),
++	PINCTRL_PIN(207, "GSXDOUT"),
++	PINCTRL_PIN(208, "GSXSLOAD"),
++	PINCTRL_PIN(209, "GSXDIN"),
++	PINCTRL_PIN(210, "GSXSRESETB"),
++	PINCTRL_PIN(211, "GSXCLK"),
++	PINCTRL_PIN(212, "GMII_MDC"),
++	PINCTRL_PIN(213, "GMII_MDIO"),
++	PINCTRL_PIN(214, "SRCCLKREQB_6"),
++	PINCTRL_PIN(215, "EXT_PWR_GATEB"),
++	PINCTRL_PIN(216, "EXT_PWR_GATE2B"),
++	PINCTRL_PIN(217, "VNN_CTRL"),
++	PINCTRL_PIN(218, "V1P05_CTRL"),
++	PINCTRL_PIN(219, "GPPF_CLK_LOOPBACK"),
+ 	/* HVCMOS */
+-	PINCTRL_PIN(49, "L_BKLTEN"),
+-	PINCTRL_PIN(50, "L_BKLTCTL"),
+-	PINCTRL_PIN(51, "L_VDDEN"),
+-	PINCTRL_PIN(52, "SYS_PWROK"),
+-	PINCTRL_PIN(53, "SYS_RESETB"),
+-	PINCTRL_PIN(54, "MLK_RSTB"),
++	PINCTRL_PIN(220, "L_BKLTEN"),
++	PINCTRL_PIN(221, "L_BKLTCTL"),
++	PINCTRL_PIN(222, "L_VDDEN"),
++	PINCTRL_PIN(223, "SYS_PWROK"),
++	PINCTRL_PIN(224, "SYS_RESETB"),
++	PINCTRL_PIN(225, "MLK_RSTB"),
+ 	/* GPP_E */
+-	PINCTRL_PIN(55, "SATAXPCIE_0"),
+-	PINCTRL_PIN(56, "SPI1_IO_2"),
+-	PINCTRL_PIN(57, "SPI1_IO_3"),
+-	PINCTRL_PIN(58, "CPU_GP_0"),
+-	PINCTRL_PIN(59, "SATA_DEVSLP_0"),
+-	PINCTRL_PIN(60, "SATA_DEVSLP_1"),
+-	PINCTRL_PIN(61, "GPPC_E_6"),
+-	PINCTRL_PIN(62, "CPU_GP_1"),
+-	PINCTRL_PIN(63, "SPI1_CS1B"),
+-	PINCTRL_PIN(64, "USB2_OCB_0"),
+-	PINCTRL_PIN(65, "SPI1_CSB"),
+-	PINCTRL_PIN(66, "SPI1_CLK"),
+-	PINCTRL_PIN(67, "SPI1_MISO_IO_1"),
+-	PINCTRL_PIN(68, "SPI1_MOSI_IO_0"),
+-	PINCTRL_PIN(69, "DDSP_HPD_A"),
+-	PINCTRL_PIN(70, "ISH_GP_6"),
+-	PINCTRL_PIN(71, "ISH_GP_7"),
+-	PINCTRL_PIN(72, "GPPC_E_17"),
+-	PINCTRL_PIN(73, "DDP1_CTRLCLK"),
+-	PINCTRL_PIN(74, "DDP1_CTRLDATA"),
+-	PINCTRL_PIN(75, "DDP2_CTRLCLK"),
+-	PINCTRL_PIN(76, "DDP2_CTRLDATA"),
+-	PINCTRL_PIN(77, "DDPA_CTRLCLK"),
+-	PINCTRL_PIN(78, "DDPA_CTRLDATA"),
+-	PINCTRL_PIN(79, "SPI1_CLK_LOOPBK"),
++	PINCTRL_PIN(226, "SATAXPCIE_0"),
++	PINCTRL_PIN(227, "SPI1_IO_2"),
++	PINCTRL_PIN(228, "SPI1_IO_3"),
++	PINCTRL_PIN(229, "CPU_GP_0"),
++	PINCTRL_PIN(230, "SATA_DEVSLP_0"),
++	PINCTRL_PIN(231, "SATA_DEVSLP_1"),
++	PINCTRL_PIN(232, "GPPC_E_6"),
++	PINCTRL_PIN(233, "CPU_GP_1"),
++	PINCTRL_PIN(234, "SPI1_CS1B"),
++	PINCTRL_PIN(235, "USB2_OCB_0"),
++	PINCTRL_PIN(236, "SPI1_CSB"),
++	PINCTRL_PIN(237, "SPI1_CLK"),
++	PINCTRL_PIN(238, "SPI1_MISO_IO_1"),
++	PINCTRL_PIN(239, "SPI1_MOSI_IO_0"),
++	PINCTRL_PIN(240, "DDSP_HPD_A"),
++	PINCTRL_PIN(241, "ISH_GP_6"),
++	PINCTRL_PIN(242, "ISH_GP_7"),
++	PINCTRL_PIN(243, "GPPC_E_17"),
++	PINCTRL_PIN(244, "DDP1_CTRLCLK"),
++	PINCTRL_PIN(245, "DDP1_CTRLDATA"),
++	PINCTRL_PIN(246, "DDP2_CTRLCLK"),
++	PINCTRL_PIN(247, "DDP2_CTRLDATA"),
++	PINCTRL_PIN(248, "DDPA_CTRLCLK"),
++	PINCTRL_PIN(249, "DDPA_CTRLDATA"),
++	PINCTRL_PIN(250, "SPI1_CLK_LOOPBK"),
+ 	/* JTAG */
+-	PINCTRL_PIN(80, "JTAG_TDO"),
+-	PINCTRL_PIN(81, "JTAGX"),
+-	PINCTRL_PIN(82, "PRDYB"),
+-	PINCTRL_PIN(83, "PREQB"),
+-	PINCTRL_PIN(84, "CPU_TRSTB"),
+-	PINCTRL_PIN(85, "JTAG_TDI"),
+-	PINCTRL_PIN(86, "JTAG_TMS"),
+-	PINCTRL_PIN(87, "JTAG_TCK"),
+-	PINCTRL_PIN(88, "DBG_PMODE"),
+-};
+-
+-static const struct intel_padgroup tgllp_community4_gpps[] = {
+-	TGL_GPP(0, 0, 23),	/* GPP_C */
+-	TGL_GPP(1, 24, 48),	/* GPP_F */
+-	TGL_GPP(2, 49, 54),	/* HVCMOS */
+-	TGL_GPP(3, 55, 79),	/* GPP_E */
+-	TGL_GPP(4, 80, 88),	/* JTAG */
++	PINCTRL_PIN(251, "JTAG_TDO"),
++	PINCTRL_PIN(252, "JTAGX"),
++	PINCTRL_PIN(253, "PRDYB"),
++	PINCTRL_PIN(254, "PREQB"),
++	PINCTRL_PIN(255, "CPU_TRSTB"),
++	PINCTRL_PIN(256, "JTAG_TDI"),
++	PINCTRL_PIN(257, "JTAG_TMS"),
++	PINCTRL_PIN(258, "JTAG_TCK"),
++	PINCTRL_PIN(259, "DBG_PMODE"),
++	/* GPP_R */
++	PINCTRL_PIN(260, "HDA_BCLK"),
++	PINCTRL_PIN(261, "HDA_SYNC"),
++	PINCTRL_PIN(262, "HDA_SDO"),
++	PINCTRL_PIN(263, "HDA_SDI_0"),
++	PINCTRL_PIN(264, "HDA_RSTB"),
++	PINCTRL_PIN(265, "HDA_SDI_1"),
++	PINCTRL_PIN(266, "GPP_R_6"),
++	PINCTRL_PIN(267, "GPP_R_7"),
++	/* SPI */
++	PINCTRL_PIN(268, "SPI0_IO_2"),
++	PINCTRL_PIN(269, "SPI0_IO_3"),
++	PINCTRL_PIN(270, "SPI0_MOSI_IO_0"),
++	PINCTRL_PIN(271, "SPI0_MISO_IO_1"),
++	PINCTRL_PIN(272, "SPI0_TPM_CSB"),
++	PINCTRL_PIN(273, "SPI0_FLASH_0_CSB"),
++	PINCTRL_PIN(274, "SPI0_FLASH_1_CSB"),
++	PINCTRL_PIN(275, "SPI0_CLK"),
++	PINCTRL_PIN(276, "SPI0_CLK_LOOPBK"),
+ };
+ 
+-static const struct intel_community tgllp_community4[] = {
+-	TGL_COMMUNITY(0, 88, tgllp_community4_gpps),
++static const struct intel_padgroup tgllp_community0_gpps[] = {
++	TGL_GPP(0, 0, 25, 0),			/* GPP_B */
++	TGL_GPP(1, 26, 41, 32),			/* GPP_T */
++	TGL_GPP(2, 42, 66, 64),			/* GPP_A */
+ };
+ 
+-static const struct intel_pinctrl_soc_data tgllp_community4_soc_data = {
+-	.uid = "4",
+-	.pins = tgllp_community4_pins,
+-	.npins = ARRAY_SIZE(tgllp_community4_pins),
+-	.communities = tgllp_community4,
+-	.ncommunities = ARRAY_SIZE(tgllp_community4),
++static const struct intel_padgroup tgllp_community1_gpps[] = {
++	TGL_GPP(0, 67, 74, 96),			/* GPP_S */
++	TGL_GPP(1, 75, 98, 128),		/* GPP_H */
++	TGL_GPP(2, 99, 119, 160),		/* GPP_D */
++	TGL_GPP(3, 120, 143, 192),		/* GPP_U */
++	TGL_GPP(4, 144, 170, 224),		/* vGPIO */
+ };
+ 
+-static const struct pinctrl_pin_desc tgllp_community5_pins[] = {
+-	/* GPP_R */
+-	PINCTRL_PIN(0, "HDA_BCLK"),
+-	PINCTRL_PIN(1, "HDA_SYNC"),
+-	PINCTRL_PIN(2, "HDA_SDO"),
+-	PINCTRL_PIN(3, "HDA_SDI_0"),
+-	PINCTRL_PIN(4, "HDA_RSTB"),
+-	PINCTRL_PIN(5, "HDA_SDI_1"),
+-	PINCTRL_PIN(6, "GPP_R_6"),
+-	PINCTRL_PIN(7, "GPP_R_7"),
+-	/* SPI */
+-	PINCTRL_PIN(8, "SPI0_IO_2"),
+-	PINCTRL_PIN(9, "SPI0_IO_3"),
+-	PINCTRL_PIN(10, "SPI0_MOSI_IO_0"),
+-	PINCTRL_PIN(11, "SPI0_MISO_IO_1"),
+-	PINCTRL_PIN(12, "SPI0_TPM_CSB"),
+-	PINCTRL_PIN(13, "SPI0_FLASH_0_CSB"),
+-	PINCTRL_PIN(14, "SPI0_FLASH_1_CSB"),
+-	PINCTRL_PIN(15, "SPI0_CLK"),
+-	PINCTRL_PIN(16, "SPI0_CLK_LOOPBK"),
++static const struct intel_padgroup tgllp_community4_gpps[] = {
++	TGL_GPP(0, 171, 194, 256),		/* GPP_C */
++	TGL_GPP(1, 195, 219, 288),		/* GPP_F */
++	TGL_GPP(2, 220, 225, TGL_NO_GPIO),	/* HVCMOS */
++	TGL_GPP(3, 226, 250, 320),		/* GPP_E */
++	TGL_GPP(4, 251, 259, TGL_NO_GPIO),	/* JTAG */
+ };
+ 
+ static const struct intel_padgroup tgllp_community5_gpps[] = {
+-	TGL_GPP(0, 0, 7),	/* GPP_R */
+-	TGL_GPP(1, 8, 16),	/* SPI */
+-};
+-
+-static const struct intel_community tgllp_community5[] = {
+-	TGL_COMMUNITY(0, 16, tgllp_community5_gpps),
++	TGL_GPP(0, 260, 267, 352),		/* GPP_R */
++	TGL_GPP(1, 268, 276, TGL_NO_GPIO),	/* SPI */
+ };
+ 
+-static const struct intel_pinctrl_soc_data tgllp_community5_soc_data = {
+-	.uid = "5",
+-	.pins = tgllp_community5_pins,
+-	.npins = ARRAY_SIZE(tgllp_community5_pins),
+-	.communities = tgllp_community5,
+-	.ncommunities = ARRAY_SIZE(tgllp_community5),
++static const struct intel_community tgllp_communities[] = {
++	TGL_COMMUNITY(0, 0, 66, tgllp_community0_gpps),
++	TGL_COMMUNITY(1, 67, 170, tgllp_community1_gpps),
++	TGL_COMMUNITY(2, 171, 259, tgllp_community4_gpps),
++	TGL_COMMUNITY(3, 260, 276, tgllp_community5_gpps),
+ };
+ 
+-static const struct intel_pinctrl_soc_data *tgllp_soc_data_array[] = {
+-	&tgllp_community0_soc_data,
+-	&tgllp_community1_soc_data,
+-	&tgllp_community4_soc_data,
+-	&tgllp_community5_soc_data,
+-	NULL
++static const struct intel_pinctrl_soc_data tgllp_soc_data = {
++	.pins = tgllp_pins,
++	.npins = ARRAY_SIZE(tgllp_pins),
++	.communities = tgllp_communities,
++	.ncommunities = ARRAY_SIZE(tgllp_communities),
+ };
+ 
+ static const struct acpi_device_id tgl_pinctrl_acpi_match[] = {
+-	{ "INT34C5", (kernel_ulong_t)tgllp_soc_data_array },
++	{ "INT34C5", (kernel_ulong_t)&tgllp_soc_data },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(acpi, tgl_pinctrl_acpi_match);
+@@ -438,7 +391,7 @@ MODULE_DEVICE_TABLE(acpi, tgl_pinctrl_acpi_match);
+ static INTEL_PINCTRL_PM_OPS(tgl_pinctrl_pm_ops);
+ 
+ static struct platform_driver tgl_pinctrl_driver = {
+-	.probe = intel_pinctrl_probe_by_uid,
++	.probe = intel_pinctrl_probe_by_hid,
+ 	.driver = {
+ 		.name = "tigerlake-pinctrl",
+ 		.acpi_match_table = tgl_pinctrl_acpi_match,
+-- 
+2.20.1
+
diff --git a/queue-5.5/pm-devfreq-add-debugfs-support-with-devfreq_summary-.patch b/queue-5.5/pm-devfreq-add-debugfs-support-with-devfreq_summary-.patch
new file mode 100644
index 00000000000..da071454d1c
--- /dev/null
+++ b/queue-5.5/pm-devfreq-add-debugfs-support-with-devfreq_summary-.patch
@@ -0,0 +1,173 @@
+From e34e8fdc4745ab8c448fac53f41c98b4700fd802 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Dec 2019 14:23:49 +0900
+Subject: PM / devfreq: Add debugfs support with devfreq_summary file
+
+From: Chanwoo Choi <cw00.choi@samsung.com>
+
+[ Upstream commit 490a421bc575d1bf391a6ad5b582dcfbd0037724 ]
+
+Add debugfs interface to provide debugging information of devfreq device.
+It contains 'devfreq_summary' entry to show the summary of registered
+devfreq devices as following and the additional debugfs file will be added.
+- /sys/kernel/debug/devfreq/devfreq_summary
+
+[Detailed description of each field of 'devfreq_summary' debugfs file]
+- dev_name	: Device name of h/w
+- dev		: Device name made by devfreq core
+- parent_dev	: If devfreq device uses the passive governor,
+		  show parent devfreq device name. Otherwise, show 'null'.
+- governor	: Devfreq governor name
+- polling_ms	: If devfreq device uses the simple_ondemand governor,
+		  polling_ms is necessary for the period. (unit: millisecond)
+- cur_freq_Hz	: Current frequency (unit: Hz)
+- min_freq_Hz	: Minimum frequency (unit: Hz)
+- max_freq_Hz	: Maximum frequency (unit: Hz)
+
+[For example on Exynos5422-based Odroid-XU3 board]
+$ cat /sys/kernel/debug/devfreq/devfreq_summary
+dev_name                       dev        parent_dev governor        polling_ms  cur_freq_Hz  min_freq_Hz  max_freq_Hz
+------------------------------ ---------- ---------- --------------- ---------- ------------ ------------ ------------
+10c20000.memory-controller     devfreq0   null       simple_ondemand          0    165000000    165000000    825000000
+soc:bus_wcore                  devfreq1   null       simple_ondemand         50    532000000     88700000    532000000
+soc:bus_noc                    devfreq2   devfreq1   passive                  0    111000000     66600000    111000000
+soc:bus_fsys_apb               devfreq3   devfreq1   passive                  0    222000000    111000000    222000000
+soc:bus_fsys                   devfreq4   devfreq1   passive                  0    200000000     75000000    200000000
+soc:bus_fsys2                  devfreq5   devfreq1   passive                  0    200000000     75000000    200000000
+soc:bus_mfc                    devfreq6   devfreq1   passive                  0    333000000     83250000    333000000
+soc:bus_gen                    devfreq7   devfreq1   passive                  0    266000000     88700000    266000000
+soc:bus_peri                   devfreq8   devfreq1   passive                  0     66600000     66600000     66600000
+soc:bus_g2d                    devfreq9   devfreq1   passive                  0    333000000     83250000    333000000
+soc:bus_g2d_acp                devfreq10  devfreq1   passive                  0    266000000     66500000    266000000
+soc:bus_jpeg                   devfreq11  devfreq1   passive                  0    300000000     75000000    300000000
+soc:bus_jpeg_apb               devfreq12  devfreq1   passive                  0    166500000     83250000    166500000
+soc:bus_disp1_fimd             devfreq13  devfreq1   passive                  0    200000000    120000000    200000000
+soc:bus_disp1                  devfreq14  devfreq1   passive                  0    300000000    120000000    300000000
+soc:bus_gscl_scaler            devfreq15  devfreq1   passive                  0    300000000    150000000    300000000
+soc:bus_mscl                   devfreq16  devfreq1   passive                  0    666000000     84000000    666000000
+
+[lkp: Reported the build error]
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/devfreq.c | 82 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 82 insertions(+)
+
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 554d155106a5f..e99f082d15df5 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -10,6 +10,7 @@
+ #include <linux/kernel.h>
+ #include <linux/kmod.h>
+ #include <linux/sched.h>
++#include <linux/debugfs.h>
+ #include <linux/errno.h>
+ #include <linux/err.h>
+ #include <linux/init.h>
+@@ -33,6 +34,7 @@
+ #define HZ_PER_KHZ	1000
+ 
+ static struct class *devfreq_class;
++static struct dentry *devfreq_debugfs;
+ 
+ /*
+  * devfreq core provides delayed work based load monitoring helper
+@@ -1614,6 +1616,81 @@ static struct attribute *devfreq_attrs[] = {
+ };
+ ATTRIBUTE_GROUPS(devfreq);
+ 
++/**
++ * devfreq_summary_show() - Show the summary of the devfreq devices
++ * @s:		seq_file instance to show the summary of devfreq devices
++ * @data:	not used
++ *
++ * Show the summary of the devfreq devices via 'devfreq_summary' debugfs file.
++ * It helps that user can know the detailed information of the devfreq devices.
++ *
++ * Return 0 always because it shows the information without any data change.
++ */
++static int devfreq_summary_show(struct seq_file *s, void *data)
++{
++	struct devfreq *devfreq;
++	struct devfreq *p_devfreq = NULL;
++	unsigned long cur_freq, min_freq, max_freq;
++	unsigned int polling_ms;
++
++	seq_printf(s, "%-30s %-10s %-10s %-15s %10s %12s %12s %12s\n",
++			"dev_name",
++			"dev",
++			"parent_dev",
++			"governor",
++			"polling_ms",
++			"cur_freq_Hz",
++			"min_freq_Hz",
++			"max_freq_Hz");
++	seq_printf(s, "%30s %10s %10s %15s %10s %12s %12s %12s\n",
++			"------------------------------",
++			"----------",
++			"----------",
++			"---------------",
++			"----------",
++			"------------",
++			"------------",
++			"------------");
++
++	mutex_lock(&devfreq_list_lock);
++
++	list_for_each_entry_reverse(devfreq, &devfreq_list, node) {
++#if IS_ENABLED(CONFIG_DEVFREQ_GOV_PASSIVE)
++		if (!strncmp(devfreq->governor_name, DEVFREQ_GOV_PASSIVE,
++							DEVFREQ_NAME_LEN)) {
++			struct devfreq_passive_data *data = devfreq->data;
++
++			if (data)
++				p_devfreq = data->parent;
++		} else {
++			p_devfreq = NULL;
++		}
++#endif
++
++		mutex_lock(&devfreq->lock);
++		cur_freq = devfreq->previous_freq,
++		get_freq_range(devfreq, &min_freq, &max_freq);
++		polling_ms = devfreq->profile->polling_ms,
++		mutex_unlock(&devfreq->lock);
++
++		seq_printf(s,
++			"%-30s %-10s %-10s %-15s %10d %12ld %12ld %12ld\n",
++			dev_name(devfreq->dev.parent),
++			dev_name(&devfreq->dev),
++			p_devfreq ? dev_name(&p_devfreq->dev) : "null",
++			devfreq->governor_name,
++			polling_ms,
++			cur_freq,
++			min_freq,
++			max_freq);
++	}
++
++	mutex_unlock(&devfreq_list_lock);
++
++	return 0;
++}
++DEFINE_SHOW_ATTRIBUTE(devfreq_summary);
++
+ static int __init devfreq_init(void)
+ {
+ 	devfreq_class = class_create(THIS_MODULE, "devfreq");
+@@ -1630,6 +1707,11 @@ static int __init devfreq_init(void)
+ 	}
+ 	devfreq_class->dev_groups = devfreq_groups;
+ 
++	devfreq_debugfs = debugfs_create_dir("devfreq", NULL);
++	debugfs_create_file("devfreq_summary", 0444,
++				devfreq_debugfs, NULL,
++				&devfreq_summary_fops);
++
+ 	return 0;
+ }
+ subsys_initcall(devfreq_init);
+-- 
+2.20.1
+
diff --git a/queue-5.5/pm-devfreq-change-time-stats-to-64-bit.patch b/queue-5.5/pm-devfreq-change-time-stats-to-64-bit.patch
new file mode 100644
index 00000000000..3a3f0876d70
--- /dev/null
+++ b/queue-5.5/pm-devfreq-change-time-stats-to-64-bit.patch
@@ -0,0 +1,95 @@
+From 7214d2ee4e7de00d23a4df9e125a707f56520c3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 15:55:25 +0100
+Subject: PM / devfreq: Change time stats to 64-bit
+
+From: Kamil Konieczny <k.konieczny@samsung.com>
+
+[ Upstream commit b76b3479dab948bea0a98b6d263eb56d8f358528 ]
+
+Change time stats counting to bigger type by using 64-bit jiffies.
+This will make devfreq stats code look similar to cpufreq stats and
+prevents overflow (for HZ = 1000 after 49.7 days).
+
+Signed-off-by: Kamil Konieczny <k.konieczny@samsung.com>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/devfreq.c | 14 +++++++-------
+ include/linux/devfreq.h   |  4 ++--
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 07602083c743e..554d155106a5f 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -209,10 +209,10 @@ static int set_freq_table(struct devfreq *devfreq)
+ int devfreq_update_status(struct devfreq *devfreq, unsigned long freq)
+ {
+ 	int lev, prev_lev, ret = 0;
+-	unsigned long cur_time;
++	u64 cur_time;
+ 
+ 	lockdep_assert_held(&devfreq->lock);
+-	cur_time = jiffies;
++	cur_time = get_jiffies_64();
+ 
+ 	/* Immediately exit if previous_freq is not initialized yet. */
+ 	if (!devfreq->previous_freq)
+@@ -535,7 +535,7 @@ void devfreq_monitor_resume(struct devfreq *devfreq)
+ 			msecs_to_jiffies(devfreq->profile->polling_ms));
+ 
+ out_update:
+-	devfreq->last_stat_updated = jiffies;
++	devfreq->last_stat_updated = get_jiffies_64();
+ 	devfreq->stop_polling = false;
+ 
+ 	if (devfreq->profile->get_cur_freq &&
+@@ -820,7 +820,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
+ 
+ 	devfreq->time_in_state = devm_kcalloc(&devfreq->dev,
+ 			devfreq->profile->max_state,
+-			sizeof(unsigned long),
++			sizeof(*devfreq->time_in_state),
+ 			GFP_KERNEL);
+ 	if (!devfreq->time_in_state) {
+ 		mutex_unlock(&devfreq->lock);
+@@ -828,7 +828,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
+ 		goto err_devfreq;
+ 	}
+ 
+-	devfreq->last_stat_updated = jiffies;
++	devfreq->last_stat_updated = get_jiffies_64();
+ 
+ 	srcu_init_notifier_head(&devfreq->transition_notifier_list);
+ 
+@@ -1589,8 +1589,8 @@ static ssize_t trans_stat_show(struct device *dev,
+ 		for (j = 0; j < max_state; j++)
+ 			len += sprintf(buf + len, "%10u",
+ 				devfreq->trans_table[(i * max_state) + j]);
+-		len += sprintf(buf + len, "%10u\n",
+-			jiffies_to_msecs(devfreq->time_in_state[i]));
++		len += sprintf(buf + len, "%10llu\n", (u64)
++			jiffies64_to_msecs(devfreq->time_in_state[i]));
+ 	}
+ 
+ 	len += sprintf(buf + len, "Total transition : %u\n",
+diff --git a/include/linux/devfreq.h b/include/linux/devfreq.h
+index fb376b5b72819..95816a8e3d266 100644
+--- a/include/linux/devfreq.h
++++ b/include/linux/devfreq.h
+@@ -177,8 +177,8 @@ struct devfreq {
+ 	/* information for device frequency transition */
+ 	unsigned int total_trans;
+ 	unsigned int *trans_table;
+-	unsigned long *time_in_state;
+-	unsigned long last_stat_updated;
++	u64 *time_in_state;
++	u64 last_stat_updated;
+ 
+ 	struct srcu_notifier_head transition_notifier_list;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/pm-devfreq-exynos-ppmu-fix-excessive-stack-usage.patch b/queue-5.5/pm-devfreq-exynos-ppmu-fix-excessive-stack-usage.patch
new file mode 100644
index 00000000000..b6054c5b1f1
--- /dev/null
+++ b/queue-5.5/pm-devfreq-exynos-ppmu-fix-excessive-stack-usage.patch
@@ -0,0 +1,74 @@
+From d261c34bff692293b77e6c3ca1827e863887a85c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 16:26:48 +0200
+Subject: PM / devfreq: exynos-ppmu: Fix excessive stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit d4556f5e99d5f603913bac01adaff8670cb2d08b ]
+
+Putting a 'struct devfreq_event_dev' object on the stack is generally
+a bad idea and here it leads to a warnig about potential stack overflow:
+
+drivers/devfreq/event/exynos-ppmu.c:643:12: error: stack frame size of 1040 bytes in function 'exynos_ppmu_probe' [-Werror,-Wframe-larger-than=]
+
+There is no real need for the device structure, only the string inside
+it, so add an internal helper function that simply takes the string
+as its argument and remove the device structure.
+
+Fixes: 1dd62c66d345 ("PM / devfreq: events: extend events by type of counted data")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+[cw00.choi: Fix the issue from 'desc->name' to 'desc[j].name']
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/event/exynos-ppmu.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/devfreq/event/exynos-ppmu.c b/drivers/devfreq/event/exynos-ppmu.c
+index 85c7a77bf3f0d..055deea42c373 100644
+--- a/drivers/devfreq/event/exynos-ppmu.c
++++ b/drivers/devfreq/event/exynos-ppmu.c
+@@ -101,17 +101,22 @@ static struct __exynos_ppmu_events {
+ 	PPMU_EVENT(dmc1_1),
+ };
+ 
+-static int exynos_ppmu_find_ppmu_id(struct devfreq_event_dev *edev)
++static int __exynos_ppmu_find_ppmu_id(const char *edev_name)
+ {
+ 	int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(ppmu_events); i++)
+-		if (!strcmp(edev->desc->name, ppmu_events[i].name))
++		if (!strcmp(edev_name, ppmu_events[i].name))
+ 			return ppmu_events[i].id;
+ 
+ 	return -EINVAL;
+ }
+ 
++static int exynos_ppmu_find_ppmu_id(struct devfreq_event_dev *edev)
++{
++	return __exynos_ppmu_find_ppmu_id(edev->desc->name);
++}
++
+ /*
+  * The devfreq-event ops structure for PPMU v1.1
+  */
+@@ -556,13 +561,11 @@ static int of_get_devfreq_events(struct device_node *np,
+ 			 * use default if not.
+ 			 */
+ 			if (info->ppmu_type == EXYNOS_TYPE_PPMU_V2) {
+-				struct devfreq_event_dev edev;
+ 				int id;
+ 				/* Not all registers take the same value for
+ 				 * read+write data count.
+ 				 */
+-				edev.desc = &desc[j];
+-				id = exynos_ppmu_find_ppmu_id(&edev);
++				id = __exynos_ppmu_find_ppmu_id(desc[j].name);
+ 
+ 				switch (id) {
+ 				case PPMU_PMNCNT0:
+-- 
+2.20.1
+
diff --git a/queue-5.5/pm-devfreq-rk3399_dmc-add-compile_test-and-have_arm_.patch b/queue-5.5/pm-devfreq-rk3399_dmc-add-compile_test-and-have_arm_.patch
new file mode 100644
index 00000000000..ae342fdb6f3
--- /dev/null
+++ b/queue-5.5/pm-devfreq-rk3399_dmc-add-compile_test-and-have_arm_.patch
@@ -0,0 +1,53 @@
+From cafeb5c6b7d506abd105a6bc5337be2745a556d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:20:30 +0900
+Subject: PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC
+ dependency
+
+From: Chanwoo Choi <cw00.choi@samsung.com>
+
+[ Upstream commit eff5d31f7407fa9d31fb840106f1593399457298 ]
+
+To build test, add COMPILE_TEST depedency to both ARM_RK3399_DMC_DEVFREQ
+and DEVFREQ_EVENT_ROCKCHIP_DFI configuration. And ARM_RK3399_DMC_DEVFREQ
+used the SMCCC interface so that add HAVE_ARM_SMCCC dependency to prevent
+the build break.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/Kconfig       | 3 ++-
+ drivers/devfreq/event/Kconfig | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/devfreq/Kconfig b/drivers/devfreq/Kconfig
+index 35535833b6f78..c7804635e89ea 100644
+--- a/drivers/devfreq/Kconfig
++++ b/drivers/devfreq/Kconfig
+@@ -115,7 +115,8 @@ config ARM_TEGRA20_DEVFREQ
+ 
+ config ARM_RK3399_DMC_DEVFREQ
+ 	tristate "ARM RK3399 DMC DEVFREQ Driver"
+-	depends on ARCH_ROCKCHIP
++	depends on (ARCH_ROCKCHIP && HAVE_ARM_SMCCC) || \
++		(COMPILE_TEST && HAVE_ARM_SMCCC)
+ 	select DEVFREQ_EVENT_ROCKCHIP_DFI
+ 	select DEVFREQ_GOV_SIMPLE_ONDEMAND
+ 	select PM_DEVFREQ_EVENT
+diff --git a/drivers/devfreq/event/Kconfig b/drivers/devfreq/event/Kconfig
+index cef2cf5347ca7..a53e0a6ffdfeb 100644
+--- a/drivers/devfreq/event/Kconfig
++++ b/drivers/devfreq/event/Kconfig
+@@ -34,7 +34,7 @@ config DEVFREQ_EVENT_EXYNOS_PPMU
+ 
+ config DEVFREQ_EVENT_ROCKCHIP_DFI
+ 	tristate "ROCKCHIP DFI DEVFREQ event Driver"
+-	depends on ARCH_ROCKCHIP
++	depends on ARCH_ROCKCHIP || COMPILE_TEST
+ 	help
+ 	  This add the devfreq-event driver for Rockchip SoC. It provides DFI
+ 	  (DDR Monitor Module) driver to count ddr load.
+-- 
+2.20.1
+
diff --git a/queue-5.5/powerpc-do-not-consider-weak-unresolved-symbol-reloc.patch b/queue-5.5/powerpc-do-not-consider-weak-unresolved-symbol-reloc.patch
new file mode 100644
index 00000000000..727cda0691c
--- /dev/null
+++ b/queue-5.5/powerpc-do-not-consider-weak-unresolved-symbol-reloc.patch
@@ -0,0 +1,105 @@
+From d587b22d1b72accc51d1abe8b506f259e930e867 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jan 2020 12:03:35 -0500
+Subject: powerpc: Do not consider weak unresolved symbol relocations as bad
+
+From: Alexandre Ghiti <alex@ghiti.fr>
+
+[ Upstream commit 43e76cd368fbb67e767da5363ffeaa3989993c8c ]
+
+Commit 8580ac9404f6 ("bpf: Process in-kernel BTF") introduced two weak
+symbols that may be unresolved at link time which result in an absolute
+relocation to 0. relocs_check.sh emits the following warning:
+
+"WARNING: 2 bad relocations
+c000000001a41478 R_PPC64_ADDR64    _binary__btf_vmlinux_bin_start
+c000000001a41480 R_PPC64_ADDR64    _binary__btf_vmlinux_bin_end"
+
+whereas those relocations are legitimate even for a relocatable kernel
+compiled with -pie option.
+
+relocs_check.sh already excluded some weak unresolved symbols explicitly:
+remove those hardcoded symbols and add some logic that parses the symbols
+using nm, retrieves all the weak unresolved symbols and excludes those from
+the list of the potential bad relocations.
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200118170335.21440-1-alex@ghiti.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile.postlink     |  4 ++--
+ arch/powerpc/tools/relocs_check.sh | 20 ++++++++++++--------
+ 2 files changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/arch/powerpc/Makefile.postlink b/arch/powerpc/Makefile.postlink
+index 134f12f89b92b..2268396ff4bba 100644
+--- a/arch/powerpc/Makefile.postlink
++++ b/arch/powerpc/Makefile.postlink
+@@ -17,11 +17,11 @@ quiet_cmd_head_check = CHKHEAD $@
+ quiet_cmd_relocs_check = CHKREL  $@
+ ifdef CONFIG_PPC_BOOK3S_64
+       cmd_relocs_check =						\
+-	$(CONFIG_SHELL) $(srctree)/arch/powerpc/tools/relocs_check.sh "$(OBJDUMP)" "$@" ; \
++	$(CONFIG_SHELL) $(srctree)/arch/powerpc/tools/relocs_check.sh "$(OBJDUMP)" "$(NM)" "$@" ; \
+ 	$(BASH) $(srctree)/arch/powerpc/tools/unrel_branch_check.sh "$(OBJDUMP)" "$@"
+ else
+       cmd_relocs_check =						\
+-	$(CONFIG_SHELL) $(srctree)/arch/powerpc/tools/relocs_check.sh "$(OBJDUMP)" "$@"
++	$(CONFIG_SHELL) $(srctree)/arch/powerpc/tools/relocs_check.sh "$(OBJDUMP)" "$(NM)" "$@"
+ endif
+ 
+ # `@true` prevents complaint when there is nothing to be done
+diff --git a/arch/powerpc/tools/relocs_check.sh b/arch/powerpc/tools/relocs_check.sh
+index 7b9fe0a567cf3..014e00e74d2b6 100755
+--- a/arch/powerpc/tools/relocs_check.sh
++++ b/arch/powerpc/tools/relocs_check.sh
+@@ -10,14 +10,21 @@
+ # based on relocs_check.pl
+ # Copyright © 2009 IBM Corporation
+ 
+-if [ $# -lt 2 ]; then
+-	echo "$0 [path to objdump] [path to vmlinux]" 1>&2
++if [ $# -lt 3 ]; then
++	echo "$0 [path to objdump] [path to nm] [path to vmlinux]" 1>&2
+ 	exit 1
+ fi
+ 
+-# Have Kbuild supply the path to objdump so we handle cross compilation.
++# Have Kbuild supply the path to objdump and nm so we handle cross compilation.
+ objdump="$1"
+-vmlinux="$2"
++nm="$2"
++vmlinux="$3"
++
++# Remove from the bad relocations those that match an undefined weak symbol
++# which will result in an absolute relocation to 0.
++# Weak unresolved symbols are of that form in nm output:
++# "                  w _binary__btf_vmlinux_bin_end"
++undef_weak_symbols=$($nm "$vmlinux" | awk '$1 ~ /w/ { print $2 }')
+ 
+ bad_relocs=$(
+ $objdump -R "$vmlinux" |
+@@ -26,8 +33,6 @@ $objdump -R "$vmlinux" |
+ 	# These relocations are okay
+ 	# On PPC64:
+ 	#	R_PPC64_RELATIVE, R_PPC64_NONE
+-	#	R_PPC64_ADDR64 mach_<name>
+-	#	R_PPC64_ADDR64 __crc_<name>
+ 	# On PPC:
+ 	#	R_PPC_RELATIVE, R_PPC_ADDR16_HI,
+ 	#	R_PPC_ADDR16_HA,R_PPC_ADDR16_LO,
+@@ -39,8 +44,7 @@ R_PPC_ADDR16_HI
+ R_PPC_ADDR16_HA
+ R_PPC_RELATIVE
+ R_PPC_NONE' |
+-	grep -E -v '\<R_PPC64_ADDR64[[:space:]]+mach_' |
+-	grep -E -v '\<R_PPC64_ADDR64[[:space:]]+__crc_'
++	([ "$undef_weak_symbols" ] && grep -F -w -v "$undef_weak_symbols" || cat)
+ )
+ 
+ if [ -z "$bad_relocs" ]; then
+-- 
+2.20.1
+
diff --git a/queue-5.5/powerpc-iov-move-vf-pdev-fixup-into-pcibios_fixup_io.patch b/queue-5.5/powerpc-iov-move-vf-pdev-fixup-into-pcibios_fixup_io.patch
new file mode 100644
index 00000000000..3b616e22907
--- /dev/null
+++ b/queue-5.5/powerpc-iov-move-vf-pdev-fixup-into-pcibios_fixup_io.patch
@@ -0,0 +1,123 @@
+From 8c588acecb4214a5b0feec70255bce2819a9d725 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 18:02:05 +1100
+Subject: powerpc/iov: Move VF pdev fixup into pcibios_fixup_iov()
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 965c94f309be58fbcc6c8d3e4f123376c5970d79 ]
+
+An ioda_pe for each VF is allocated in pnv_pci_sriov_enable() before
+the pci_dev for the VF is created. We need to set the pe->pdev pointer
+at some point after the pci_dev is created. Currently we do that in:
+
+pcibios_bus_add_device()
+	pnv_pci_dma_dev_setup() (via phb->ops.dma_dev_setup)
+		/* fixup is done here */
+		pnv_pci_ioda_dma_dev_setup() (via pnv_phb->dma_dev_setup)
+
+The fixup needs to be done before setting up DMA for for the VF's PE,
+but there's no real reason to delay it until this point. Move the
+fixup into pnv_pci_ioda_fixup_iov() so the ordering is:
+
+	pcibios_add_device()
+		pnv_pci_ioda_fixup_iov() (via ppc_md.pcibios_fixup_sriov)
+
+	pcibios_bus_add_device()
+		...
+
+This isn't strictly required, but it's a slightly more logical place
+to do the fixup and it simplifies pnv_pci_dma_dev_setup().
+
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200110070207.439-4-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/pci-ioda.c | 29 +++++++++++++++++++----
+ arch/powerpc/platforms/powernv/pci.c      | 14 -----------
+ 2 files changed, 25 insertions(+), 18 deletions(-)
+
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 4374836b033b4..67e4628dd5274 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -2900,9 +2900,6 @@ static void pnv_pci_ioda_fixup_iov_resources(struct pci_dev *pdev)
+ 	struct pci_dn *pdn;
+ 	int mul, total_vfs;
+ 
+-	if (!pdev->is_physfn || pci_dev_is_added(pdev))
+-		return;
+-
+ 	pdn = pci_get_pdn(pdev);
+ 	pdn->vfs_expanded = 0;
+ 	pdn->m64_single_mode = false;
+@@ -2977,6 +2974,30 @@ truncate_iov:
+ 		res->end = res->start - 1;
+ 	}
+ }
++
++static void pnv_pci_ioda_fixup_iov(struct pci_dev *pdev)
++{
++	if (WARN_ON(pci_dev_is_added(pdev)))
++		return;
++
++	if (pdev->is_virtfn) {
++		struct pnv_ioda_pe *pe = pnv_ioda_get_pe(pdev);
++
++		/*
++		 * VF PEs are single-device PEs so their pdev pointer needs to
++		 * be set. The pdev doesn't exist when the PE is allocated (in
++		 * (pcibios_sriov_enable()) so we fix it up here.
++		 */
++		pe->pdev = pdev;
++		WARN_ON(!(pe->flags & PNV_IODA_PE_VF));
++	} else if (pdev->is_physfn) {
++		/*
++		 * For PFs adjust their allocated IOV resources to match what
++		 * the PHB can support using it's M64 BAR table.
++		 */
++		pnv_pci_ioda_fixup_iov_resources(pdev);
++	}
++}
+ #endif /* CONFIG_PCI_IOV */
+ 
+ static void pnv_ioda_setup_pe_res(struct pnv_ioda_pe *pe,
+@@ -3873,7 +3894,7 @@ static void __init pnv_pci_init_ioda_phb(struct device_node *np,
+ 	ppc_md.pcibios_default_alignment = pnv_pci_default_alignment;
+ 
+ #ifdef CONFIG_PCI_IOV
+-	ppc_md.pcibios_fixup_sriov = pnv_pci_ioda_fixup_iov_resources;
++	ppc_md.pcibios_fixup_sriov = pnv_pci_ioda_fixup_iov;
+ 	ppc_md.pcibios_iov_resource_alignment = pnv_pci_iov_resource_alignment;
+ 	ppc_md.pcibios_sriov_enable = pnv_pcibios_sriov_enable;
+ 	ppc_md.pcibios_sriov_disable = pnv_pcibios_sriov_disable;
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index e8e58a2cccddf..8307e1f4086cb 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -814,20 +814,6 @@ void pnv_pci_dma_dev_setup(struct pci_dev *pdev)
+ {
+ 	struct pci_controller *hose = pci_bus_to_host(pdev->bus);
+ 	struct pnv_phb *phb = hose->private_data;
+-#ifdef CONFIG_PCI_IOV
+-	struct pnv_ioda_pe *pe;
+-
+-	/* Fix the VF pdn PE number */
+-	if (pdev->is_virtfn) {
+-		list_for_each_entry(pe, &phb->ioda.pe_list, list) {
+-			if (pe->rid == ((pdev->bus->number << 8) |
+-			    (pdev->devfn & 0xff))) {
+-				pe->pdev = pdev;
+-				break;
+-			}
+-		}
+-	}
+-#endif /* CONFIG_PCI_IOV */
+ 
+ 	if (phb && phb->dma_dev_setup)
+ 		phb->dma_dev_setup(phb, pdev);
+-- 
+2.20.1
+
diff --git a/queue-5.5/powerpc-mm-don-t-log-user-reads-to-0xffffffff.patch b/queue-5.5/powerpc-mm-don-t-log-user-reads-to-0xffffffff.patch
new file mode 100644
index 00000000000..5c13e3e96bc
--- /dev/null
+++ b/queue-5.5/powerpc-mm-don-t-log-user-reads-to-0xffffffff.patch
@@ -0,0 +1,43 @@
+From 2be1721f08df54b5586772a752349d89cde60d32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Dec 2019 07:54:22 +0000
+Subject: powerpc/mm: Don't log user reads to 0xffffffff
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 0f9aee0cb9da7db7d96f63cfa2dc5e4f1bffeb87 ]
+
+Running vdsotest leaves many times the following log:
+
+  [   79.629901] vdsotest[396]: User access of kernel address (ffffffff) - exploit attempt? (uid: 0)
+
+A pointer set to (-1) is likely a programming error similar to
+a NULL pointer and is not worth logging as an exploit attempt.
+
+Don't log user accesses to 0xffffffff.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/0728849e826ba16f1fbd6fa7f5c6cc87bd64e097.1577087627.git.christophe.leroy@c-s.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/fault.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 1baeb045f7f4b..e083a9f67f701 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -354,6 +354,9 @@ static void sanity_check_fault(bool is_write, bool is_user,
+ 	 * Userspace trying to access kernel address, we get PROTFAULT for that.
+ 	 */
+ 	if (is_user && address >= TASK_SIZE) {
++		if ((long)address == -1)
++			return;
++
+ 		pr_crit_ratelimited("%s[%d]: User access of kernel address (%lx) - exploit attempt? (uid: %d)\n",
+ 				   current->comm, current->pid, address,
+ 				   from_kuid(&init_user_ns, current_uid()));
+-- 
+2.20.1
+
diff --git a/queue-5.5/powerpc-powernv-iov-ensure-the-pdn-for-vfs-always-co.patch b/queue-5.5/powerpc-powernv-iov-ensure-the-pdn-for-vfs-always-co.patch
new file mode 100644
index 00000000000..37e36387733
--- /dev/null
+++ b/queue-5.5/powerpc-powernv-iov-ensure-the-pdn-for-vfs-always-co.patch
@@ -0,0 +1,167 @@
+From ce15450ae2ed48d439a0eb2cce7248460125a38b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 19:54:22 +1100
+Subject: powerpc/powernv/iov: Ensure the pdn for VFs always contains a valid
+ PE number
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 3b5b9997b331e77ce967eba2c4bc80dc3134a7fe ]
+
+On pseries there is a bug with adding hotplugged devices to an IOMMU
+group. For a number of dumb reasons fixing that bug first requires
+re-working how VFs are configured on PowerNV. For background, on
+PowerNV we use the pcibios_sriov_enable() hook to do two things:
+
+  1. Create a pci_dn structure for each of the VFs, and
+  2. Configure the PHB's internal BARs so the MMIO range for each VF
+     maps to a unique PE.
+
+Roughly speaking a PE is the hardware counterpart to a Linux IOMMU
+group since all the devices in a PE share the same IOMMU table. A PE
+also defines the set of devices that should be isolated in response to
+a PCI error (i.e. bad DMA, UR/CA, AER events, etc). When isolated all
+MMIO and DMA traffic to and from devicein the PE is blocked by the
+root complex until the PE is recovered by the OS.
+
+The requirement to block MMIO causes a giant headache because the P8
+PHB generally uses a fixed mapping between MMIO addresses and PEs. As
+a result we need to delay configuring the IOMMU groups for device
+until after MMIO resources are assigned. For physical devices (i.e.
+non-VFs) the PE assignment is done in pcibios_setup_bridge() which is
+called immediately after the MMIO resources for downstream
+devices (and the bridge's windows) are assigned. For VFs the setup is
+more complicated because:
+
+  a) pcibios_setup_bridge() is not called again when VFs are activated, and
+  b) The pci_dev for VFs are created by generic code which runs after
+     pcibios_sriov_enable() is called.
+
+The work around for this is a two step process:
+
+  1. A fixup in pcibios_add_device() is used to initialised the cached
+     pe_number in pci_dn, then
+  2. A bus notifier then adds the device to the IOMMU group for the PE
+     specified in pci_dn->pe_number.
+
+A side effect fixing the pseries bug mentioned in the first paragraph
+is moving the fixup out of pcibios_add_device() and into
+pcibios_bus_add_device(), which is called much later. This results in
+step 2. failing because pci_dn->pe_number won't be initialised when
+the bus notifier is run.
+
+We can fix this by removing the need for the fixup. The PE for a VF is
+known before the VF is even scanned so we can initialise
+pci_dn->pe_number pcibios_sriov_enable() instead. Unfortunately,
+moving the initialisation causes two problems:
+
+  1. We trip the WARN_ON() in the current fixup code, and
+  2. The EEH core clears pdn->pe_number when recovering a VF and
+     relies on the fixup to correctly re-set it.
+
+The only justification for either of these is a comment in
+eeh_rmv_device() suggesting that pdn->pe_number *must* be set to
+IODA_INVALID_PE in order for the VF to be scanned. However, this
+comment appears to have no basis in reality. Both bugs can be fixed by
+just deleting the code.
+
+Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191028085424.12006-1-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c          |  6 ------
+ arch/powerpc/platforms/powernv/pci-ioda.c | 19 +++++++++++++++----
+ arch/powerpc/platforms/powernv/pci.c      |  4 ----
+ 3 files changed, 15 insertions(+), 14 deletions(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 3dd1a422fc29d..a1eaffe868de4 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -525,12 +525,6 @@ static void eeh_rmv_device(struct eeh_dev *edev, void *userdata)
+ 
+ 		pci_iov_remove_virtfn(edev->physfn, pdn->vf_index);
+ 		edev->pdev = NULL;
+-
+-		/*
+-		 * We have to set the VF PE number to invalid one, which is
+-		 * required to plug the VF successfully.
+-		 */
+-		pdn->pe_number = IODA_INVALID_PE;
+ #endif
+ 		if (rmv_data)
+ 			list_add(&edev->rmv_entry, &rmv_data->removed_vf_list);
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index da1068a9c2637..4374836b033b4 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -1558,6 +1558,10 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+ 
+ 	/* Reserve PE for each VF */
+ 	for (vf_index = 0; vf_index < num_vfs; vf_index++) {
++		int vf_devfn = pci_iov_virtfn_devfn(pdev, vf_index);
++		int vf_bus = pci_iov_virtfn_bus(pdev, vf_index);
++		struct pci_dn *vf_pdn;
++
+ 		if (pdn->m64_single_mode)
+ 			pe_num = pdn->pe_num_map[vf_index];
+ 		else
+@@ -1570,13 +1574,11 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+ 		pe->pbus = NULL;
+ 		pe->parent_dev = pdev;
+ 		pe->mve_number = -1;
+-		pe->rid = (pci_iov_virtfn_bus(pdev, vf_index) << 8) |
+-			   pci_iov_virtfn_devfn(pdev, vf_index);
++		pe->rid = (vf_bus << 8) | vf_devfn;
+ 
+ 		pe_info(pe, "VF %04d:%02d:%02d.%d associated with PE#%x\n",
+ 			hose->global_number, pdev->bus->number,
+-			PCI_SLOT(pci_iov_virtfn_devfn(pdev, vf_index)),
+-			PCI_FUNC(pci_iov_virtfn_devfn(pdev, vf_index)), pe_num);
++			PCI_SLOT(vf_devfn), PCI_FUNC(vf_devfn), pe_num);
+ 
+ 		if (pnv_ioda_configure_pe(phb, pe)) {
+ 			/* XXX What do we do here ? */
+@@ -1590,6 +1592,15 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+ 		list_add_tail(&pe->list, &phb->ioda.pe_list);
+ 		mutex_unlock(&phb->ioda.pe_list_mutex);
+ 
++		/* associate this pe to it's pdn */
++		list_for_each_entry(vf_pdn, &pdn->parent->child_list, list) {
++			if (vf_pdn->busno == vf_bus &&
++			    vf_pdn->devfn == vf_devfn) {
++				vf_pdn->pe_number = pe_num;
++				break;
++			}
++		}
++
+ 		pnv_pci_ioda2_setup_dma_pe(phb, pe);
+ #ifdef CONFIG_IOMMU_API
+ 		iommu_register_group(&pe->table_group,
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index c0bea75ac27bf..e8e58a2cccddf 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -816,16 +816,12 @@ void pnv_pci_dma_dev_setup(struct pci_dev *pdev)
+ 	struct pnv_phb *phb = hose->private_data;
+ #ifdef CONFIG_PCI_IOV
+ 	struct pnv_ioda_pe *pe;
+-	struct pci_dn *pdn;
+ 
+ 	/* Fix the VF pdn PE number */
+ 	if (pdev->is_virtfn) {
+-		pdn = pci_get_pdn(pdev);
+-		WARN_ON(pdn->pe_number != IODA_INVALID_PE);
+ 		list_for_each_entry(pe, &phb->ioda.pe_list, list) {
+ 			if (pe->rid == ((pdev->bus->number << 8) |
+ 			    (pdev->devfn & 0xff))) {
+-				pdn->pe_number = pe->pe_number;
+ 				pe->pdev = pdev;
+ 				break;
+ 			}
+-- 
+2.20.1
+
diff --git a/queue-5.5/powerpc-pseries-lparcfg-fix-display-of-maximum-memor.patch b/queue-5.5/powerpc-pseries-lparcfg-fix-display-of-maximum-memor.patch
new file mode 100644
index 00000000000..e5562947bc7
--- /dev/null
+++ b/queue-5.5/powerpc-pseries-lparcfg-fix-display-of-maximum-memor.patch
@@ -0,0 +1,41 @@
+From bb4d994ec1e53e050e43d367df4689c786b0ff01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 08:53:59 -0600
+Subject: powerpc/pseries/lparcfg: Fix display of Maximum Memory
+
+From: Michael Bringmann <mwb@linux.ibm.com>
+
+[ Upstream commit f1dbc1c5c70d0d4c60b5d467ba941fba167c12f6 ]
+
+Correct overflow problem in calculation and display of Maximum Memory
+value to syscfg.
+
+Signed-off-by: Michael Bringmann <mwb@linux.ibm.com>
+[mpe: Only n_lmbs needs casting to unsigned long]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/5577aef8-1d5a-ca95-ff0a-9c7b5977e5bf@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/lparcfg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
+index e33e8bc4b69bd..38c306551f76b 100644
+--- a/arch/powerpc/platforms/pseries/lparcfg.c
++++ b/arch/powerpc/platforms/pseries/lparcfg.c
+@@ -435,10 +435,10 @@ static void maxmem_data(struct seq_file *m)
+ {
+ 	unsigned long maxmem = 0;
+ 
+-	maxmem += drmem_info->n_lmbs * drmem_info->lmb_size;
++	maxmem += (unsigned long)drmem_info->n_lmbs * drmem_info->lmb_size;
+ 	maxmem += hugetlb_total_pages() * PAGE_SIZE;
+ 
+-	seq_printf(m, "MaxMem=%ld\n", maxmem);
++	seq_printf(m, "MaxMem=%lu\n", maxmem);
+ }
+ 
+ static int pseries_lparcfg_data(struct seq_file *m, void *v)
+-- 
+2.20.1
+
diff --git a/queue-5.5/powerpc-sriov-remove-vf-eeh_dev-state-when-disabling.patch b/queue-5.5/powerpc-sriov-remove-vf-eeh_dev-state-when-disabling.patch
new file mode 100644
index 00000000000..52243cfacb3
--- /dev/null
+++ b/queue-5.5/powerpc-sriov-remove-vf-eeh_dev-state-when-disabling.patch
@@ -0,0 +1,57 @@
+From da8fdf6691c85f7e933087fcba5768a781215541 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2019 16:26:53 +1000
+Subject: powerpc/sriov: Remove VF eeh_dev state when disabling SR-IOV
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 1fb4124ca9d456656a324f1ee29b7bf942f59ac8 ]
+
+When disabling virtual functions on an SR-IOV adapter we currently do not
+correctly remove the EEH state for the now-dead virtual functions. When
+removing the pci_dn that was created for the VF when SR-IOV was enabled
+we free the corresponding eeh_dev without removing it from the child device
+list of the eeh_pe that contained it. This can result in crashes due to the
+use-after-free.
+
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Reviewed-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Tested-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190821062655.19735-1-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/pci_dn.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/pci_dn.c b/arch/powerpc/kernel/pci_dn.c
+index 9524009ca1ae4..d876eda926094 100644
+--- a/arch/powerpc/kernel/pci_dn.c
++++ b/arch/powerpc/kernel/pci_dn.c
+@@ -244,9 +244,22 @@ void remove_dev_pci_data(struct pci_dev *pdev)
+ 				continue;
+ 
+ #ifdef CONFIG_EEH
+-			/* Release EEH device for the VF */
++			/*
++			 * Release EEH state for this VF. The PCI core
++			 * has already torn down the pci_dev for this VF, but
++			 * we're responsible to removing the eeh_dev since it
++			 * has the same lifetime as the pci_dn that spawned it.
++			 */
+ 			edev = pdn_to_eeh_dev(pdn);
+ 			if (edev) {
++				/*
++				 * We allocate pci_dn's for the totalvfs count,
++				 * but only only the vfs that were activated
++				 * have a configured PE.
++				 */
++				if (edev->pe)
++					eeh_rmv_from_parent_pe(edev);
++
+ 				pdn->edev = NULL;
+ 				kfree(edev);
+ 			}
+-- 
+2.20.1
+
diff --git a/queue-5.5/printk-fix-exclusive_console-replaying.patch b/queue-5.5/printk-fix-exclusive_console-replaying.patch
new file mode 100644
index 00000000000..04cc4cd0970
--- /dev/null
+++ b/queue-5.5/printk-fix-exclusive_console-replaying.patch
@@ -0,0 +1,58 @@
+From 80beb1cbd037d1e488735ba2140006140d1d1ca2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 12:59:22 +0106
+Subject: printk: fix exclusive_console replaying
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit def97da136515cb289a14729292c193e0a93bc64 ]
+
+Commit f92b070f2dc8 ("printk: Do not miss new messages when replaying
+the log") introduced a new variable @exclusive_console_stop_seq to
+store when an exclusive console should stop printing. It should be
+set to the @console_seq value at registration. However, @console_seq
+is previously set to @syslog_seq so that the exclusive console knows
+where to begin. This results in the exclusive console immediately
+reactivating all the other consoles and thus repeating the messages
+for those consoles.
+
+Set @console_seq after @exclusive_console_stop_seq has stored the
+current @console_seq value.
+
+Fixes: f92b070f2dc8 ("printk: Do not miss new messages when replaying the log")
+Link: http://lkml.kernel.org/r/20191219115322.31160-1-john.ogness@linutronix.de
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 1ef6f75d92f1f..fada22dc4ab6c 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2770,8 +2770,6 @@ void register_console(struct console *newcon)
+ 		 * for us.
+ 		 */
+ 		logbuf_lock_irqsave(flags);
+-		console_seq = syslog_seq;
+-		console_idx = syslog_idx;
+ 		/*
+ 		 * We're about to replay the log buffer.  Only do this to the
+ 		 * just-registered console to avoid excessive message spam to
+@@ -2783,6 +2781,8 @@ void register_console(struct console *newcon)
+ 		 */
+ 		exclusive_console = newcon;
+ 		exclusive_console_stop_seq = console_seq;
++		console_seq = syslog_seq;
++		console_idx = syslog_idx;
+ 		logbuf_unlock_irqrestore(flags);
+ 	}
+ 	console_unlock();
+-- 
+2.20.1
+
diff --git a/queue-5.5/pwm-omap-dmtimer-remove-pwm-chip-in-.remove-before-m.patch b/queue-5.5/pwm-omap-dmtimer-remove-pwm-chip-in-.remove-before-m.patch
new file mode 100644
index 00000000000..a457e3fe5f2
--- /dev/null
+++ b/queue-5.5/pwm-omap-dmtimer-remove-pwm-chip-in-.remove-before-m.patch
@@ -0,0 +1,53 @@
+From e55c178a903573eb39df2e52c2946aac98e961e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2019 10:03:54 +0100
+Subject: pwm: omap-dmtimer: Remove PWM chip in .remove before making it
+ unfunctional
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 43efdc8f0e6d7088ec61bd55a73bf853f002d043 ]
+
+In the old code (e.g.) mutex_destroy() was called before
+pwmchip_remove(). Between these two calls it is possible that a PWM
+callback is used which tries to grab the mutex.
+
+Fixes: 6604c6556db9 ("pwm: Add PWM driver for OMAP using dual-mode timers")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-omap-dmtimer.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-omap-dmtimer.c b/drivers/pwm/pwm-omap-dmtimer.c
+index 6cfeb0e1cc679..e36fcad668a68 100644
+--- a/drivers/pwm/pwm-omap-dmtimer.c
++++ b/drivers/pwm/pwm-omap-dmtimer.c
+@@ -361,6 +361,11 @@ put:
+ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+ {
+ 	struct pwm_omap_dmtimer_chip *omap = platform_get_drvdata(pdev);
++	int ret;
++
++	ret = pwmchip_remove(&omap->chip);
++	if (ret)
++		return ret;
+ 
+ 	if (pm_runtime_active(&omap->dm_timer_pdev->dev))
+ 		omap->pdata->stop(omap->dm_timer);
+@@ -369,7 +374,7 @@ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+ 
+ 	mutex_destroy(&omap->mutex);
+ 
+-	return pwmchip_remove(&omap->chip);
++	return 0;
+ }
+ 
+ static const struct of_device_id pwm_omap_dmtimer_of_match[] = {
+-- 
+2.20.1
+
diff --git a/queue-5.5/pwm-omap-dmtimer-simplify-error-handling.patch b/queue-5.5/pwm-omap-dmtimer-simplify-error-handling.patch
new file mode 100644
index 00000000000..2e27066eb27
--- /dev/null
+++ b/queue-5.5/pwm-omap-dmtimer-simplify-error-handling.patch
@@ -0,0 +1,85 @@
+From 29184e837afd6c3c815f766c342cf56eebed7878 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2019 10:03:55 +0100
+Subject: pwm: omap-dmtimer: Simplify error handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit c4cf7aa57eb83b108d2d9c6c37c143388fee2a4d ]
+
+Instead of doing error handling in the middle of ->probe(), move error
+handling and freeing the reference to timer to the end.
+
+This fixes a resource leak as dm_timer wasn't freed when allocating
+*omap failed.
+
+Implementation note: The put: label was never reached without a goto and
+ret being unequal to 0, so the removed return statement is fine.
+
+Fixes: 6604c6556db9 ("pwm: Add PWM driver for OMAP using dual-mode timers")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-omap-dmtimer.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pwm/pwm-omap-dmtimer.c b/drivers/pwm/pwm-omap-dmtimer.c
+index 00772fc534906..6cfeb0e1cc679 100644
+--- a/drivers/pwm/pwm-omap-dmtimer.c
++++ b/drivers/pwm/pwm-omap-dmtimer.c
+@@ -298,15 +298,10 @@ static int pwm_omap_dmtimer_probe(struct platform_device *pdev)
+ 		goto put;
+ 	}
+ 
+-put:
+-	of_node_put(timer);
+-	if (ret < 0)
+-		return ret;
+-
+ 	omap = devm_kzalloc(&pdev->dev, sizeof(*omap), GFP_KERNEL);
+ 	if (!omap) {
+-		pdata->free(dm_timer);
+-		return -ENOMEM;
++		ret = -ENOMEM;
++		goto err_alloc_omap;
+ 	}
+ 
+ 	omap->pdata = pdata;
+@@ -339,13 +334,28 @@ put:
+ 	ret = pwmchip_add(&omap->chip);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "failed to register PWM\n");
+-		omap->pdata->free(omap->dm_timer);
+-		return ret;
++		goto err_pwmchip_add;
+ 	}
+ 
++	of_node_put(timer);
++
+ 	platform_set_drvdata(pdev, omap);
+ 
+ 	return 0;
++
++err_pwmchip_add:
++
++	/*
++	 * *omap is allocated using devm_kzalloc,
++	 * so no free necessary here
++	 */
++err_alloc_omap:
++
++	pdata->free(dm_timer);
++put:
++	of_node_put(timer);
++
++	return ret;
+ }
+ 
+ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+-- 
+2.20.1
+
diff --git a/queue-5.5/pwm-remove-set-but-not-set-variable-pwm.patch b/queue-5.5/pwm-remove-set-but-not-set-variable-pwm.patch
new file mode 100644
index 00000000000..f9633d00dbd
--- /dev/null
+++ b/queue-5.5/pwm-remove-set-but-not-set-variable-pwm.patch
@@ -0,0 +1,51 @@
+From 3e61b82b1ca5c44032646de7b222036f1bc6760f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 19:51:43 +0800
+Subject: pwm: Remove set but not set variable 'pwm'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: yu kuai <yukuai3@huawei.com>
+
+[ Upstream commit 9871abffc81048e20f02e15d6aa4558a44ad53ea ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+	drivers/pwm/pwm-pca9685.c: In function ‘pca9685_pwm_gpio_free’:
+	drivers/pwm/pwm-pca9685.c:162:21: warning: variable ‘pwm’ set but not used [-Wunused-but-set-variable]
+
+It is never used, and so can be removed. In that case, hold and release
+the lock 'pca->lock' can be removed since nothing will be done between
+them.
+
+Fixes: e926b12c611c ("pwm: Clear chip_data in pwm_put()")
+Signed-off-by: yu kuai <yukuai3@huawei.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-pca9685.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
+index 168684b02ebce..b07bdca3d510d 100644
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -159,13 +159,9 @@ static void pca9685_pwm_gpio_set(struct gpio_chip *gpio, unsigned int offset,
+ static void pca9685_pwm_gpio_free(struct gpio_chip *gpio, unsigned int offset)
+ {
+ 	struct pca9685 *pca = gpiochip_get_data(gpio);
+-	struct pwm_device *pwm;
+ 
+ 	pca9685_pwm_gpio_set(gpio, offset, 0);
+ 	pm_runtime_put(pca->chip.dev);
+-	mutex_lock(&pca->lock);
+-	pwm = &pca->chip.pwms[offset];
+-	mutex_unlock(&pca->lock);
+ }
+ 
+ static int pca9685_pwm_gpio_get_direction(struct gpio_chip *chip,
+-- 
+2.20.1
+
diff --git a/queue-5.5/pxa168fb-fix-the-function-used-to-release-some-memor.patch b/queue-5.5/pxa168fb-fix-the-function-used-to-release-some-memor.patch
new file mode 100644
index 00000000000..97e35212dbc
--- /dev/null
+++ b/queue-5.5/pxa168fb-fix-the-function-used-to-release-some-memor.patch
@@ -0,0 +1,57 @@
+From 0466f716b53c9c6189b881aee3b5e2cb5893f3c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Aug 2019 12:00:24 +0200
+Subject: pxa168fb: Fix the function used to release some memory in an error
+ handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3c911fe799d1c338d94b78e7182ad452c37af897 ]
+
+In the probe function, some resources are allocated using 'dma_alloc_wc()',
+they should be released with 'dma_free_wc()', not 'dma_free_coherent()'.
+
+We already use 'dma_free_wc()' in the remove function, but not in the
+error handling path of the probe function.
+
+Also, remove a useless 'PAGE_ALIGN()'. 'info->fix.smem_len' is already
+PAGE_ALIGNed.
+
+Fixes: 638772c7553f ("fb: add support of LCD display controller on pxa168/910 (base layer)")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Lubomir Rintel <lkundrak@v3.sk>
+CC: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190831100024.3248-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/pxa168fb.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/video/fbdev/pxa168fb.c b/drivers/video/fbdev/pxa168fb.c
+index 1410f476e135d..1fc50fc0694bc 100644
+--- a/drivers/video/fbdev/pxa168fb.c
++++ b/drivers/video/fbdev/pxa168fb.c
+@@ -766,8 +766,8 @@ failed_free_cmap:
+ failed_free_clk:
+ 	clk_disable_unprepare(fbi->clk);
+ failed_free_fbmem:
+-	dma_free_coherent(fbi->dev, info->fix.smem_len,
+-			info->screen_base, fbi->fb_start_dma);
++	dma_free_wc(fbi->dev, info->fix.smem_len,
++		    info->screen_base, fbi->fb_start_dma);
+ failed_free_info:
+ 	kfree(info);
+ 
+@@ -801,7 +801,7 @@ static int pxa168fb_remove(struct platform_device *pdev)
+ 
+ 	irq = platform_get_irq(pdev, 0);
+ 
+-	dma_free_wc(fbi->dev, PAGE_ALIGN(info->fix.smem_len),
++	dma_free_wc(fbi->dev, info->fix.smem_len,
+ 		    info->screen_base, info->fix.smem_start);
+ 
+ 	clk_disable_unprepare(fbi->clk);
+-- 
+2.20.1
+
diff --git a/queue-5.5/r8169-check-that-realtek-phy-driver-module-is-loaded.patch b/queue-5.5/r8169-check-that-realtek-phy-driver-module-is-loaded.patch
new file mode 100644
index 00000000000..296e8b8af6c
--- /dev/null
+++ b/queue-5.5/r8169-check-that-realtek-phy-driver-module-is-loaded.patch
@@ -0,0 +1,47 @@
+From bc22c7944f1aab46d11748d1a09e8adc81c1090d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 16:53:37 +0100
+Subject: r8169: check that Realtek PHY driver module is loaded
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit f325937735498afb054a0195291bbf68d0b60be5 ]
+
+Some users complained about problems with r8169 and it turned out that
+the generic PHY driver was used instead instead of the dedicated one.
+In all cases reason was that r8169.ko was in initramfs, but realtek.ko
+not. Manually adding realtek.ko to initramfs fixed the issues.
+Root cause seems to be that tools like dracut and genkernel don't
+consider softdeps. Add a check for loaded Realtek PHY driver module
+and provide the user with a hint if it's not loaded.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 92a590154bb9f..2d2d22f86dc6f 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -6831,6 +6831,15 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	int chipset, region;
+ 	int jumbo_max, rc;
+ 
++	/* Some tools for creating an initramfs don't consider softdeps, then
++	 * r8169.ko may be in initramfs, but realtek.ko not. Then the generic
++	 * PHY driver is used that doesn't work with most chip versions.
++	 */
++	if (!driver_find("RTL8201CP Ethernet", &mdio_bus_type)) {
++		dev_err(&pdev->dev, "realtek.ko not loaded, maybe it needs to be added to initramfs?\n");
++		return -ENOENT;
++	}
++
+ 	dev = devm_alloc_etherdev(&pdev->dev, sizeof (*tp));
+ 	if (!dev)
+ 		return -ENOMEM;
+-- 
+2.20.1
+
diff --git a/queue-5.5/radeon-insert-10ms-sleep-in-dce5_crtc_load_lut.patch b/queue-5.5/radeon-insert-10ms-sleep-in-dce5_crtc_load_lut.patch
new file mode 100644
index 00000000000..81bcabf8b54
--- /dev/null
+++ b/queue-5.5/radeon-insert-10ms-sleep-in-dce5_crtc_load_lut.patch
@@ -0,0 +1,53 @@
+From 1fe6f408c99af5badeae6215b328c0adff99bab5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 17:09:52 +0100
+Subject: radeon: insert 10ms sleep in dce5_crtc_load_lut
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+[ Upstream commit ec3d65082d7dabad6fa8f66a8ef166f2d522d6b2 ]
+
+Per at least one tester this is enough magic to recover the regression
+introduced for some people (but not all) in
+
+commit b8e2b0199cc377617dc238f5106352c06dcd3fa2
+Author: Peter Rosin <peda@axentia.se>
+Date:   Tue Jul 4 12:36:57 2017 +0200
+
+    drm/fb-helper: factor out pseudo-palette
+
+which for radeon had the side-effect of refactoring out a seemingly
+redudant writing of the color palette.
+
+10ms in a fairly slow modeset path feels like an acceptable form of
+duct-tape, so maybe worth a shot and see what sticks.
+
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Michel Dänzer <michel.daenzer@amd.com>
+References: https://bugzilla.kernel.org/show_bug.cgi?id=198123
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index e81b01f8db90e..0826efd9b5f51 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -127,6 +127,8 @@ static void dce5_crtc_load_lut(struct drm_crtc *crtc)
+ 
+ 	DRM_DEBUG_KMS("%d\n", radeon_crtc->crtc_id);
+ 
++	msleep(10);
++
+ 	WREG32(NI_INPUT_CSC_CONTROL + radeon_crtc->crtc_offset,
+ 	       (NI_INPUT_CSC_GRPH_MODE(NI_INPUT_CSC_BYPASS) |
+ 		NI_INPUT_CSC_OVL_MODE(NI_INPUT_CSC_BYPASS)));
+-- 
+2.20.1
+
diff --git a/queue-5.5/raid6-test-fix-a-compilation-error.patch b/queue-5.5/raid6-test-fix-a-compilation-error.patch
new file mode 100644
index 00000000000..061bf8bf55c
--- /dev/null
+++ b/queue-5.5/raid6-test-fix-a-compilation-error.patch
@@ -0,0 +1,58 @@
+From 788a49df546c759903c9211723830cf47f30cada Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 10:21:26 +0800
+Subject: raid6/test: fix a compilation error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
+
+[ Upstream commit 6b8651aac1dca6140dd7fb4c9fec2736ed3f6223 ]
+
+The compilation error is redeclaration showed as following:
+
+        In file included from ../../../include/linux/limits.h:6,
+                         from /usr/include/x86_64-linux-gnu/bits/local_lim.h:38,
+                         from /usr/include/x86_64-linux-gnu/bits/posix1_lim.h:161,
+                         from /usr/include/limits.h:183,
+                         from /usr/lib/gcc/x86_64-linux-gnu/8/include-fixed/limits.h:194,
+                         from /usr/lib/gcc/x86_64-linux-gnu/8/include-fixed/syslimits.h:7,
+                         from /usr/lib/gcc/x86_64-linux-gnu/8/include-fixed/limits.h:34,
+                         from ../../../include/linux/raid/pq.h:30,
+                         from algos.c:14:
+        ../../../include/linux/types.h:114:15: error: conflicting types for ‘int64_t’
+         typedef s64   int64_t;
+                       ^~~~~~~
+        In file included from /usr/include/stdint.h:34,
+                         from /usr/lib/gcc/x86_64-linux-gnu/8/include/stdint.h:9,
+                         from /usr/include/inttypes.h:27,
+                         from ../../../include/linux/raid/pq.h:29,
+                         from algos.c:14:
+        /usr/include/x86_64-linux-gnu/bits/stdint-intn.h:27:19: note: previous \
+        declaration of ‘int64_t’ was here
+         typedef __int64_t int64_t;
+
+Fixes: 54d50897d544 ("linux/kernel.h: split *_MAX and *_MIN macros into <linux/limits.h>")
+Signed-off-by: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/raid/pq.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/include/linux/raid/pq.h b/include/linux/raid/pq.h
+index 0832c9b66852e..0b6e7ad9cd2a8 100644
+--- a/include/linux/raid/pq.h
++++ b/include/linux/raid/pq.h
+@@ -27,7 +27,6 @@ extern const char raid6_empty_zero_page[PAGE_SIZE];
+ 
+ #include <errno.h>
+ #include <inttypes.h>
+-#include <limits.h>
+ #include <stddef.h>
+ #include <sys/mman.h>
+ #include <sys/time.h>
+-- 
+2.20.1
+
diff --git a/queue-5.5/raid6-test-fix-a-compilation-warning.patch b/queue-5.5/raid6-test-fix-a-compilation-warning.patch
new file mode 100644
index 00000000000..22e4984404c
--- /dev/null
+++ b/queue-5.5/raid6-test-fix-a-compilation-warning.patch
@@ -0,0 +1,59 @@
+From 8eeb4edb1adb7429ab1976ed95fa79706fb11581 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 10:21:27 +0800
+Subject: raid6/test: fix a compilation warning
+
+From: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
+
+[ Upstream commit 5e5ac01c2b8802921fee680518a986011cb59820 ]
+
+The compilation warning is redefination showed as following:
+
+        In file included from tables.c:2:
+        ../../../include/linux/export.h:180: warning: "EXPORT_SYMBOL" redefined
+         #define EXPORT_SYMBOL(sym)  __EXPORT_SYMBOL(sym, "")
+
+        In file included from tables.c:1:
+        ../../../include/linux/raid/pq.h:61: note: this is the location of the previous definition
+         #define EXPORT_SYMBOL(sym)
+
+Fixes: 69a94abb82ee ("export.h, genksyms: do not make genksyms calculate CRC of trimmed symbols")
+Signed-off-by: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/raid/pq.h | 2 ++
+ lib/raid6/mktables.c    | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/raid/pq.h b/include/linux/raid/pq.h
+index 0b6e7ad9cd2a8..e0ddb47f44020 100644
+--- a/include/linux/raid/pq.h
++++ b/include/linux/raid/pq.h
+@@ -58,7 +58,9 @@ extern const char raid6_empty_zero_page[PAGE_SIZE];
+ #define enable_kernel_altivec()
+ #define disable_kernel_altivec()
+ 
++#undef	EXPORT_SYMBOL
+ #define EXPORT_SYMBOL(sym)
++#undef	EXPORT_SYMBOL_GPL
+ #define EXPORT_SYMBOL_GPL(sym)
+ #define MODULE_LICENSE(licence)
+ #define MODULE_DESCRIPTION(desc)
+diff --git a/lib/raid6/mktables.c b/lib/raid6/mktables.c
+index 9c485df1308fb..f02e10fa62381 100644
+--- a/lib/raid6/mktables.c
++++ b/lib/raid6/mktables.c
+@@ -56,8 +56,8 @@ int main(int argc, char *argv[])
+ 	uint8_t v;
+ 	uint8_t exptbl[256], invtbl[256];
+ 
+-	printf("#include <linux/raid/pq.h>\n");
+ 	printf("#include <linux/export.h>\n");
++	printf("#include <linux/raid/pq.h>\n");
+ 
+ 	/* Compute multiplication table */
+ 	printf("\nconst u8  __attribute__((aligned(256)))\n"
+-- 
+2.20.1
+
diff --git a/queue-5.5/rbd-work-around-wuninitialized-warning.patch b/queue-5.5/rbd-work-around-wuninitialized-warning.patch
new file mode 100644
index 00000000000..7610dba85e1
--- /dev/null
+++ b/queue-5.5/rbd-work-around-wuninitialized-warning.patch
@@ -0,0 +1,44 @@
+From e5d22b68e9e2dfc1d2de86259a6425952319ca43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 22:01:04 +0100
+Subject: rbd: work around -Wuninitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a55e601b2f02df5db7070e9a37bd655c9c576a52 ]
+
+gcc -O3 warns about a dummy variable that is passed
+down into rbd_img_fill_nodata without being initialized:
+
+drivers/block/rbd.c: In function 'rbd_img_fill_nodata':
+drivers/block/rbd.c:2573:13: error: 'dummy' is used uninitialized in this function [-Werror=uninitialized]
+  fctx->iter = *fctx->pos;
+
+Since this is a dummy, I assume the warning is harmless, but
+it's better to initialize it anyway and avoid the warning.
+
+Fixes: mmtom ("init/Kconfig: enable -O3 for all arches")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rbd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 2b184563cd32e..38dcb39051a7f 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2662,7 +2662,7 @@ static int rbd_img_fill_nodata(struct rbd_img_request *img_req,
+ 			       u64 off, u64 len)
+ {
+ 	struct ceph_file_extent ex = { off, len };
+-	union rbd_img_fill_iter dummy;
++	union rbd_img_fill_iter dummy = {};
+ 	struct rbd_img_fill_ctx fctx = {
+ 		.pos_type = OBJ_REQUEST_NODATA,
+ 		.pos = &dummy,
+-- 
+2.20.1
+
diff --git a/queue-5.5/rcu-fix-data-race-due-to-atomic_t-copy-by-value.patch b/queue-5.5/rcu-fix-data-race-due-to-atomic_t-copy-by-value.patch
new file mode 100644
index 00000000000..1e7a10e10d4
--- /dev/null
+++ b/queue-5.5/rcu-fix-data-race-due-to-atomic_t-copy-by-value.patch
@@ -0,0 +1,132 @@
+From a896a2da00787a4c22ac748f9aa4d4612573ce68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 17:57:43 +0200
+Subject: rcu: Fix data-race due to atomic_t copy-by-value
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 6cf539a87a61a4fbc43f625267dbcbcf283872ed ]
+
+This fixes a data-race where `atomic_t dynticks` is copied by value. The
+copy is performed non-atomically, resulting in a data-race if `dynticks`
+is updated concurrently.
+
+This data-race was found with KCSAN:
+==================================================================
+BUG: KCSAN: data-race in dyntick_save_progress_counter / rcu_irq_enter
+
+write to 0xffff989dbdbe98e0 of 4 bytes by task 10 on cpu 3:
+ atomic_add_return include/asm-generic/atomic-instrumented.h:78 [inline]
+ rcu_dynticks_snap kernel/rcu/tree.c:310 [inline]
+ dyntick_save_progress_counter+0x43/0x1b0 kernel/rcu/tree.c:984
+ force_qs_rnp+0x183/0x200 kernel/rcu/tree.c:2286
+ rcu_gp_fqs kernel/rcu/tree.c:1601 [inline]
+ rcu_gp_fqs_loop+0x71/0x880 kernel/rcu/tree.c:1653
+ rcu_gp_kthread+0x22c/0x3b0 kernel/rcu/tree.c:1799
+ kthread+0x1b5/0x200 kernel/kthread.c:255
+ <snip>
+
+read to 0xffff989dbdbe98e0 of 4 bytes by task 154 on cpu 7:
+ rcu_nmi_enter_common kernel/rcu/tree.c:828 [inline]
+ rcu_irq_enter+0xda/0x240 kernel/rcu/tree.c:870
+ irq_enter+0x5/0x50 kernel/softirq.c:347
+ <snip>
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 7 PID: 154 Comm: kworker/7:1H Not tainted 5.3.0+ #5
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
+Workqueue: kblockd blk_mq_run_work_fn
+==================================================================
+
+Signed-off-by: Marco Elver <elver@google.com>
+Cc: Paul E. McKenney <paulmck@kernel.org>
+Cc: Josh Triplett <josh@joshtriplett.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Joel Fernandes <joel@joelfernandes.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: rcu@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/rcu.h |  4 ++--
+ kernel/rcu/tree.c          | 11 ++++++-----
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/include/trace/events/rcu.h b/include/trace/events/rcu.h
+index 66122602bd085..697e2c0624dcd 100644
+--- a/include/trace/events/rcu.h
++++ b/include/trace/events/rcu.h
+@@ -449,7 +449,7 @@ TRACE_EVENT_RCU(rcu_fqs,
+  */
+ TRACE_EVENT_RCU(rcu_dyntick,
+ 
+-	TP_PROTO(const char *polarity, long oldnesting, long newnesting, atomic_t dynticks),
++	TP_PROTO(const char *polarity, long oldnesting, long newnesting, int dynticks),
+ 
+ 	TP_ARGS(polarity, oldnesting, newnesting, dynticks),
+ 
+@@ -464,7 +464,7 @@ TRACE_EVENT_RCU(rcu_dyntick,
+ 		__entry->polarity = polarity;
+ 		__entry->oldnesting = oldnesting;
+ 		__entry->newnesting = newnesting;
+-		__entry->dynticks = atomic_read(&dynticks);
++		__entry->dynticks = dynticks;
+ 	),
+ 
+ 	TP_printk("%s %lx %lx %#3x", __entry->polarity,
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 1694a6b57ad8c..6145e08a14072 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -577,7 +577,7 @@ static void rcu_eqs_enter(bool user)
+ 	}
+ 
+ 	lockdep_assert_irqs_disabled();
+-	trace_rcu_dyntick(TPS("Start"), rdp->dynticks_nesting, 0, rdp->dynticks);
++	trace_rcu_dyntick(TPS("Start"), rdp->dynticks_nesting, 0, atomic_read(&rdp->dynticks));
+ 	WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) && !user && !is_idle_task(current));
+ 	rdp = this_cpu_ptr(&rcu_data);
+ 	do_nocb_deferred_wakeup(rdp);
+@@ -650,14 +650,15 @@ static __always_inline void rcu_nmi_exit_common(bool irq)
+ 	 * leave it in non-RCU-idle state.
+ 	 */
+ 	if (rdp->dynticks_nmi_nesting != 1) {
+-		trace_rcu_dyntick(TPS("--="), rdp->dynticks_nmi_nesting, rdp->dynticks_nmi_nesting - 2, rdp->dynticks);
++		trace_rcu_dyntick(TPS("--="), rdp->dynticks_nmi_nesting, rdp->dynticks_nmi_nesting - 2,
++				  atomic_read(&rdp->dynticks));
+ 		WRITE_ONCE(rdp->dynticks_nmi_nesting, /* No store tearing. */
+ 			   rdp->dynticks_nmi_nesting - 2);
+ 		return;
+ 	}
+ 
+ 	/* This NMI interrupted an RCU-idle CPU, restore RCU-idleness. */
+-	trace_rcu_dyntick(TPS("Startirq"), rdp->dynticks_nmi_nesting, 0, rdp->dynticks);
++	trace_rcu_dyntick(TPS("Startirq"), rdp->dynticks_nmi_nesting, 0, atomic_read(&rdp->dynticks));
+ 	WRITE_ONCE(rdp->dynticks_nmi_nesting, 0); /* Avoid store tearing. */
+ 
+ 	if (irq)
+@@ -744,7 +745,7 @@ static void rcu_eqs_exit(bool user)
+ 	rcu_dynticks_task_exit();
+ 	rcu_dynticks_eqs_exit();
+ 	rcu_cleanup_after_idle();
+-	trace_rcu_dyntick(TPS("End"), rdp->dynticks_nesting, 1, rdp->dynticks);
++	trace_rcu_dyntick(TPS("End"), rdp->dynticks_nesting, 1, atomic_read(&rdp->dynticks));
+ 	WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) && !user && !is_idle_task(current));
+ 	WRITE_ONCE(rdp->dynticks_nesting, 1);
+ 	WARN_ON_ONCE(rdp->dynticks_nmi_nesting);
+@@ -833,7 +834,7 @@ static __always_inline void rcu_nmi_enter_common(bool irq)
+ 	}
+ 	trace_rcu_dyntick(incby == 1 ? TPS("Endirq") : TPS("++="),
+ 			  rdp->dynticks_nmi_nesting,
+-			  rdp->dynticks_nmi_nesting + incby, rdp->dynticks);
++			  rdp->dynticks_nmi_nesting + incby, atomic_read(&rdp->dynticks));
+ 	WRITE_ONCE(rdp->dynticks_nmi_nesting, /* Prevent store tearing. */
+ 		   rdp->dynticks_nmi_nesting + incby);
+ 	barrier();
+-- 
+2.20.1
+
diff --git a/queue-5.5/rcu-fix-missed-wakeup-of-exp_wq-waiters.patch b/queue-5.5/rcu-fix-missed-wakeup-of-exp_wq-waiters.patch
new file mode 100644
index 00000000000..7ba2ab4f68b
--- /dev/null
+++ b/queue-5.5/rcu-fix-missed-wakeup-of-exp_wq-waiters.patch
@@ -0,0 +1,102 @@
+From f5d85d4688fc9d20df8dea262acce06b11d9e900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 03:17:07 +0000
+Subject: rcu: Fix missed wakeup of exp_wq waiters
+
+From: Neeraj Upadhyay <neeraju@codeaurora.org>
+
+[ Upstream commit fd6bc19d7676a060a171d1cf3dcbf6fd797eb05f ]
+
+Tasks waiting within exp_funnel_lock() for an expedited grace period to
+elapse can be starved due to the following sequence of events:
+
+1.	Tasks A and B both attempt to start an expedited grace
+	period at about the same time.	This grace period will have
+	completed when the lower four bits of the rcu_state structure's
+	->expedited_sequence field are 0b'0100', for example, when the
+	initial value of this counter is zero.	Task A wins, and thus
+	does the actual work of starting the grace period, including
+	acquiring the rcu_state structure's .exp_mutex and sets the
+	counter to 0b'0001'.
+
+2.	Because task B lost the race to start the grace period, it
+	waits on ->expedited_sequence to reach 0b'0100' inside of
+	exp_funnel_lock(). This task therefore blocks on the rcu_node
+	structure's ->exp_wq[1] field, keeping in mind that the
+	end-of-grace-period value of ->expedited_sequence (0b'0100')
+	is shifted down two bits before indexing the ->exp_wq[] field.
+
+3.	Task C attempts to start another expedited grace period,
+	but blocks on ->exp_mutex, which is still held by Task A.
+
+4.	The aforementioned expedited grace period completes, so that
+	->expedited_sequence now has the value 0b'0100'.  A kworker task
+	therefore acquires the rcu_state structure's ->exp_wake_mutex
+	and starts awakening any tasks waiting for this grace period.
+
+5.	One of the first tasks awakened happens to be Task A.  Task A
+	therefore releases the rcu_state structure's ->exp_mutex,
+	which allows Task C to start the next expedited grace period,
+	which causes the lower four bits of the rcu_state structure's
+	->expedited_sequence field to become 0b'0101'.
+
+6.	Task C's expedited grace period completes, so that the lower four
+	bits of the rcu_state structure's ->expedited_sequence field now
+	become 0b'1000'.
+
+7.	The kworker task from step 4 above continues its wakeups.
+	Unfortunately, the wake_up_all() refetches the rcu_state
+	structure's .expedited_sequence field:
+
+	wake_up_all(&rnp->exp_wq[rcu_seq_ctr(rcu_state.expedited_sequence) & 0x3]);
+
+	This results in the wakeup being applied to the rcu_node
+	structure's ->exp_wq[2] field, which is unfortunate given that
+	Task B is instead waiting on ->exp_wq[1].
+
+On a busy system, no harm is done (or at least no permanent harm is done).
+Some later expedited grace period will redo the wakeup.  But on a quiet
+system, such as many embedded systems, it might be a good long time before
+there was another expedited grace period.  On such embedded systems,
+this situation could therefore result in a system hang.
+
+This issue manifested as DPM device timeout during suspend (which
+usually qualifies as a quiet time) due to a SCSI device being stuck in
+_synchronize_rcu_expedited(), with the following stack trace:
+
+	schedule()
+	synchronize_rcu_expedited()
+	synchronize_rcu()
+	scsi_device_quiesce()
+	scsi_bus_suspend()
+	dpm_run_callback()
+	__device_suspend()
+
+This commit therefore prevents such delays, timeouts, and hangs by
+making rcu_exp_wait_wake() use its "s" argument consistently instead of
+refetching from rcu_state.expedited_sequence.
+
+Fixes: 3b5f668e715b ("rcu: Overlap wakeups with next expedited grace period")
+Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_exp.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
+index 69c5aa64fcfd6..f504ac8317797 100644
+--- a/kernel/rcu/tree_exp.h
++++ b/kernel/rcu/tree_exp.h
+@@ -558,7 +558,7 @@ static void rcu_exp_wait_wake(unsigned long s)
+ 			spin_unlock(&rnp->exp_lock);
+ 		}
+ 		smp_mb(); /* All above changes before wakeup. */
+-		wake_up_all(&rnp->exp_wq[rcu_seq_ctr(rcu_state.expedited_sequence) & 0x3]);
++		wake_up_all(&rnp->exp_wq[rcu_seq_ctr(s) & 0x3]);
+ 	}
+ 	trace_rcu_exp_grace_period(rcu_state.name, s, TPS("endwake"));
+ 	mutex_unlock(&rcu_state.exp_wake_mutex);
+-- 
+2.20.1
+
diff --git a/queue-5.5/rcu-nocb-fix-dump_tree-hierarchy-print-always-active.patch b/queue-5.5/rcu-nocb-fix-dump_tree-hierarchy-print-always-active.patch
new file mode 100644
index 00000000000..19063c822a4
--- /dev/null
+++ b/queue-5.5/rcu-nocb-fix-dump_tree-hierarchy-print-always-active.patch
@@ -0,0 +1,81 @@
+From e2358dceca73dfb64b7f8dd8f0ace8d19a0b3b9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 19:49:10 +0000
+Subject: rcu/nocb: Fix dump_tree hierarchy print always active
+
+From: Stefan Reiter <stefan@pimaker.at>
+
+[ Upstream commit 610dea36d3083a977e4f156206cbe1eaa2a532f0 ]
+
+Commit 18cd8c93e69e ("rcu/nocb: Print gp/cb kthread hierarchy if
+dump_tree") added print statements to rcu_organize_nocb_kthreads for
+debugging, but incorrectly guarded them, causing the function to always
+spew out its message.
+
+This patch fixes it by guarding both pr_alert statements with dump_tree,
+while also changing the second pr_alert to a pr_cont, to print the
+hierarchy in a single line (assuming that's how it was supposed to
+work).
+
+Fixes: 18cd8c93e69e ("rcu/nocb: Print gp/cb kthread hierarchy if dump_tree")
+Signed-off-by: Stefan Reiter <stefan@pimaker.at>
+[ paulmck: Make single-nocbs-CPU GP kthreads look less erroneous. ]
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_plugin.h | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
+index f849e7429816f..f7118842a2b88 100644
+--- a/kernel/rcu/tree_plugin.h
++++ b/kernel/rcu/tree_plugin.h
+@@ -2322,6 +2322,8 @@ static void __init rcu_organize_nocb_kthreads(void)
+ {
+ 	int cpu;
+ 	bool firsttime = true;
++	bool gotnocbs = false;
++	bool gotnocbscbs = true;
+ 	int ls = rcu_nocb_gp_stride;
+ 	int nl = 0;  /* Next GP kthread. */
+ 	struct rcu_data *rdp;
+@@ -2344,21 +2346,31 @@ static void __init rcu_organize_nocb_kthreads(void)
+ 		rdp = per_cpu_ptr(&rcu_data, cpu);
+ 		if (rdp->cpu >= nl) {
+ 			/* New GP kthread, set up for CBs & next GP. */
++			gotnocbs = true;
+ 			nl = DIV_ROUND_UP(rdp->cpu + 1, ls) * ls;
+ 			rdp->nocb_gp_rdp = rdp;
+ 			rdp_gp = rdp;
+-			if (!firsttime && dump_tree)
+-				pr_cont("\n");
+-			firsttime = false;
+-			pr_alert("%s: No-CB GP kthread CPU %d:", __func__, cpu);
++			if (dump_tree) {
++				if (!firsttime)
++					pr_cont("%s\n", gotnocbscbs
++							? "" : " (self only)");
++				gotnocbscbs = false;
++				firsttime = false;
++				pr_alert("%s: No-CB GP kthread CPU %d:",
++					 __func__, cpu);
++			}
+ 		} else {
+ 			/* Another CB kthread, link to previous GP kthread. */
++			gotnocbscbs = true;
+ 			rdp->nocb_gp_rdp = rdp_gp;
+ 			rdp_prev->nocb_next_cb_rdp = rdp;
+-			pr_alert(" %d", cpu);
++			if (dump_tree)
++				pr_cont(" %d", cpu);
+ 		}
+ 		rdp_prev = rdp;
+ 	}
++	if (gotnocbs && dump_tree)
++		pr_cont("%s\n", gotnocbscbs ? "" : " (self only)");
+ }
+ 
+ /*
+-- 
+2.20.1
+
diff --git a/queue-5.5/rcu-use-write_once-for-assignments-to-pprev-for-hlis.patch b/queue-5.5/rcu-use-write_once-for-assignments-to-pprev-for-hlis.patch
new file mode 100644
index 00000000000..950b0730b41
--- /dev/null
+++ b/queue-5.5/rcu-use-write_once-for-assignments-to-pprev-for-hlis.patch
@@ -0,0 +1,169 @@
+From 14731c7e937cc364f06c94acdb3d0bbfda32b6bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2019 09:42:13 -0800
+Subject: rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit 860c8802ace14c646864795e057349c9fb2d60ad ]
+
+Eric Dumazet supplied a KCSAN report of a bug that forces use
+of hlist_unhashed_lockless() from sk_unhashed():
+
+------------------------------------------------------------------------
+
+BUG: KCSAN: data-race in inet_unhash / inet_unhash
+
+write to 0xffff8880a69a0170 of 8 bytes by interrupt on cpu 1:
+ __hlist_nulls_del include/linux/list_nulls.h:88 [inline]
+ hlist_nulls_del_init_rcu include/linux/rculist_nulls.h:36 [inline]
+ __sk_nulls_del_node_init_rcu include/net/sock.h:676 [inline]
+ inet_unhash+0x38f/0x4a0 net/ipv4/inet_hashtables.c:612
+ tcp_set_state+0xfa/0x3e0 net/ipv4/tcp.c:2249
+ tcp_done+0x93/0x1e0 net/ipv4/tcp.c:3854
+ tcp_write_err+0x7e/0xc0 net/ipv4/tcp_timer.c:56
+ tcp_retransmit_timer+0x9b8/0x16d0 net/ipv4/tcp_timer.c:479
+ tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:599
+ tcp_write_timer+0xd1/0xf0 net/ipv4/tcp_timer.c:619
+ call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
+ expire_timers kernel/time/timer.c:1449 [inline]
+ __run_timers kernel/time/timer.c:1773 [inline]
+ __run_timers kernel/time/timer.c:1740 [inline]
+ run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
+ __do_softirq+0x115/0x33f kernel/softirq.c:292
+ invoke_softirq kernel/softirq.c:373 [inline]
+ irq_exit+0xbb/0xe0 kernel/softirq.c:413
+ exiting_irq arch/x86/include/asm/apic.h:536 [inline]
+ smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
+ apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
+ native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71
+ arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571
+ default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
+ cpuidle_idle_call kernel/sched/idle.c:154 [inline]
+ do_idle+0x1af/0x280 kernel/sched/idle.c:263
+ cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:355
+ start_secondary+0x208/0x260 arch/x86/kernel/smpboot.c:264
+ secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
+
+read to 0xffff8880a69a0170 of 8 bytes by interrupt on cpu 0:
+ sk_unhashed include/net/sock.h:607 [inline]
+ inet_unhash+0x3d/0x4a0 net/ipv4/inet_hashtables.c:592
+ tcp_set_state+0xfa/0x3e0 net/ipv4/tcp.c:2249
+ tcp_done+0x93/0x1e0 net/ipv4/tcp.c:3854
+ tcp_write_err+0x7e/0xc0 net/ipv4/tcp_timer.c:56
+ tcp_retransmit_timer+0x9b8/0x16d0 net/ipv4/tcp_timer.c:479
+ tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:599
+ tcp_write_timer+0xd1/0xf0 net/ipv4/tcp_timer.c:619
+ call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
+ expire_timers kernel/time/timer.c:1449 [inline]
+ __run_timers kernel/time/timer.c:1773 [inline]
+ __run_timers kernel/time/timer.c:1740 [inline]
+ run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
+ __do_softirq+0x115/0x33f kernel/softirq.c:292
+ invoke_softirq kernel/softirq.c:373 [inline]
+ irq_exit+0xbb/0xe0 kernel/softirq.c:413
+ exiting_irq arch/x86/include/asm/apic.h:536 [inline]
+ smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
+ apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
+ native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71
+ arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571
+ default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
+ cpuidle_idle_call kernel/sched/idle.c:154 [inline]
+ do_idle+0x1af/0x280 kernel/sched/idle.c:263
+ cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:355
+ rest_init+0xec/0xf6 init/main.c:452
+ arch_call_rest_init+0x17/0x37
+ start_kernel+0x838/0x85e init/main.c:786
+ x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490
+ x86_64_start_kernel+0x72/0x76 arch/x86/kernel/head64.c:471
+ secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc6+ #0
+Hardware name: Google Google Compute Engine/Google Compute Engine,
+BIOS Google 01/01/2011
+
+------------------------------------------------------------------------
+
+This commit therefore replaces C-language assignments with WRITE_ONCE()
+in include/linux/list_nulls.h and include/linux/rculist_nulls.h.
+
+Reported-by: Eric Dumazet <edumazet@google.com> # For KCSAN
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/list_nulls.h    | 8 ++++----
+ include/linux/rculist_nulls.h | 8 ++++----
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/include/linux/list_nulls.h b/include/linux/list_nulls.h
+index 3ef96743db8da..1ecd35664e0d3 100644
+--- a/include/linux/list_nulls.h
++++ b/include/linux/list_nulls.h
+@@ -72,10 +72,10 @@ static inline void hlist_nulls_add_head(struct hlist_nulls_node *n,
+ 	struct hlist_nulls_node *first = h->first;
+ 
+ 	n->next = first;
+-	n->pprev = &h->first;
++	WRITE_ONCE(n->pprev, &h->first);
+ 	h->first = n;
+ 	if (!is_a_nulls(first))
+-		first->pprev = &n->next;
++		WRITE_ONCE(first->pprev, &n->next);
+ }
+ 
+ static inline void __hlist_nulls_del(struct hlist_nulls_node *n)
+@@ -85,13 +85,13 @@ static inline void __hlist_nulls_del(struct hlist_nulls_node *n)
+ 
+ 	WRITE_ONCE(*pprev, next);
+ 	if (!is_a_nulls(next))
+-		next->pprev = pprev;
++		WRITE_ONCE(next->pprev, pprev);
+ }
+ 
+ static inline void hlist_nulls_del(struct hlist_nulls_node *n)
+ {
+ 	__hlist_nulls_del(n);
+-	n->pprev = LIST_POISON2;
++	WRITE_ONCE(n->pprev, LIST_POISON2);
+ }
+ 
+ /**
+diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
+index 61974c4c566be..90f2e2232c6d7 100644
+--- a/include/linux/rculist_nulls.h
++++ b/include/linux/rculist_nulls.h
+@@ -34,7 +34,7 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)
+ {
+ 	if (!hlist_nulls_unhashed(n)) {
+ 		__hlist_nulls_del(n);
+-		n->pprev = NULL;
++		WRITE_ONCE(n->pprev, NULL);
+ 	}
+ }
+ 
+@@ -66,7 +66,7 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)
+ static inline void hlist_nulls_del_rcu(struct hlist_nulls_node *n)
+ {
+ 	__hlist_nulls_del(n);
+-	n->pprev = LIST_POISON2;
++	WRITE_ONCE(n->pprev, LIST_POISON2);
+ }
+ 
+ /**
+@@ -94,10 +94,10 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n,
+ 	struct hlist_nulls_node *first = h->first;
+ 
+ 	n->next = first;
+-	n->pprev = &h->first;
++	WRITE_ONCE(n->pprev, &h->first);
+ 	rcu_assign_pointer(hlist_nulls_first_rcu(h), n);
+ 	if (!is_a_nulls(first))
+-		first->pprev = &n->next;
++		WRITE_ONCE(first->pprev, &n->next);
+ }
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-5.5/rdma-hns-avoid-printing-address-of-mtt-page.patch b/queue-5.5/rdma-hns-avoid-printing-address-of-mtt-page.patch
new file mode 100644
index 00000000000..23d505ae101
--- /dev/null
+++ b/queue-5.5/rdma-hns-avoid-printing-address-of-mtt-page.patch
@@ -0,0 +1,38 @@
+From 25a0df30adb92eec1f116d6c007e8fd76546cc47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 20:21:10 +0800
+Subject: RDMA/hns: Avoid printing address of mtt page
+
+From: Wenpeng Liang <liangwenpeng@huawei.com>
+
+[ Upstream commit eca44507c3e908b7362696a4d6a11d90371334c6 ]
+
+Address of a page shouldn't be printed in case of security issues.
+
+Link: https://lore.kernel.org/r/1578313276-29080-2-git-send-email-liweihang@huawei.com
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
+index 9ad19170c3f97..95765560c1cfb 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
+@@ -1064,8 +1064,8 @@ int hns_roce_ib_umem_write_mtt(struct hns_roce_dev *hr_dev,
+ 		if (!(npage % (1 << (mtt->page_shift - PAGE_SHIFT)))) {
+ 			if (page_addr & ((1 << mtt->page_shift) - 1)) {
+ 				dev_err(dev,
+-					"page_addr 0x%llx is not page_shift %d alignment!\n",
+-					page_addr, mtt->page_shift);
++					"page_addr is not page_shift %d alignment!\n",
++					mtt->page_shift);
+ 				ret = -EINVAL;
+ 				goto out;
+ 			}
+-- 
+2.20.1
+
diff --git a/queue-5.5/rdma-mlx5-don-t-fake-udata-for-kernel-path.patch b/queue-5.5/rdma-mlx5-don-t-fake-udata-for-kernel-path.patch
new file mode 100644
index 00000000000..0252ce0eb19
--- /dev/null
+++ b/queue-5.5/rdma-mlx5-don-t-fake-udata-for-kernel-path.patch
@@ -0,0 +1,169 @@
+From ba340024daa7cd57d53c778d588ac958b9cb1bb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 14:43:35 +0200
+Subject: RDMA/mlx5: Don't fake udata for kernel path
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+[ Upstream commit 4835709176e8ccf6561abc9f5c405293e008095f ]
+
+Kernel paths must not set udata and provide NULL pointer,
+instead of faking zeroed udata struct.
+
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 34 +++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 997cbfe4b90ce..760630c7aae71 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -815,6 +815,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 				struct ib_device_attr *props,
+ 				struct ib_udata *uhw)
+ {
++	size_t uhw_outlen = (uhw) ? uhw->outlen : 0;
+ 	struct mlx5_ib_dev *dev = to_mdev(ibdev);
+ 	struct mlx5_core_dev *mdev = dev->mdev;
+ 	int err = -ENOMEM;
+@@ -828,12 +829,12 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 	u64 max_tso;
+ 
+ 	resp_len = sizeof(resp.comp_mask) + sizeof(resp.response_length);
+-	if (uhw->outlen && uhw->outlen < resp_len)
++	if (uhw_outlen && uhw_outlen < resp_len)
+ 		return -EINVAL;
+ 
+ 	resp.response_length = resp_len;
+ 
+-	if (uhw->inlen && !ib_is_udata_cleared(uhw, 0, uhw->inlen))
++	if (uhw && uhw->inlen && !ib_is_udata_cleared(uhw, 0, uhw->inlen))
+ 		return -EINVAL;
+ 
+ 	memset(props, 0, sizeof(*props));
+@@ -897,7 +898,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 			props->raw_packet_caps |=
+ 				IB_RAW_PACKET_CAP_CVLAN_STRIPPING;
+ 
+-		if (field_avail(typeof(resp), tso_caps, uhw->outlen)) {
++		if (field_avail(typeof(resp), tso_caps, uhw_outlen)) {
+ 			max_tso = MLX5_CAP_ETH(mdev, max_lso_cap);
+ 			if (max_tso) {
+ 				resp.tso_caps.max_tso = 1 << max_tso;
+@@ -907,7 +908,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 			}
+ 		}
+ 
+-		if (field_avail(typeof(resp), rss_caps, uhw->outlen)) {
++		if (field_avail(typeof(resp), rss_caps, uhw_outlen)) {
+ 			resp.rss_caps.rx_hash_function =
+ 						MLX5_RX_HASH_FUNC_TOEPLITZ;
+ 			resp.rss_caps.rx_hash_fields_mask =
+@@ -927,9 +928,9 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 			resp.response_length += sizeof(resp.rss_caps);
+ 		}
+ 	} else {
+-		if (field_avail(typeof(resp), tso_caps, uhw->outlen))
++		if (field_avail(typeof(resp), tso_caps, uhw_outlen))
+ 			resp.response_length += sizeof(resp.tso_caps);
+-		if (field_avail(typeof(resp), rss_caps, uhw->outlen))
++		if (field_avail(typeof(resp), rss_caps, uhw_outlen))
+ 			resp.response_length += sizeof(resp.rss_caps);
+ 	}
+ 
+@@ -1054,7 +1055,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 						MLX5_MAX_CQ_PERIOD;
+ 	}
+ 
+-	if (field_avail(typeof(resp), cqe_comp_caps, uhw->outlen)) {
++	if (field_avail(typeof(resp), cqe_comp_caps, uhw_outlen)) {
+ 		resp.response_length += sizeof(resp.cqe_comp_caps);
+ 
+ 		if (MLX5_CAP_GEN(dev->mdev, cqe_compression)) {
+@@ -1072,7 +1073,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 		}
+ 	}
+ 
+-	if (field_avail(typeof(resp), packet_pacing_caps, uhw->outlen) &&
++	if (field_avail(typeof(resp), packet_pacing_caps, uhw_outlen) &&
+ 	    raw_support) {
+ 		if (MLX5_CAP_QOS(mdev, packet_pacing) &&
+ 		    MLX5_CAP_GEN(mdev, qos)) {
+@@ -1091,7 +1092,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 	}
+ 
+ 	if (field_avail(typeof(resp), mlx5_ib_support_multi_pkt_send_wqes,
+-			uhw->outlen)) {
++			uhw_outlen)) {
+ 		if (MLX5_CAP_ETH(mdev, multi_pkt_send_wqe))
+ 			resp.mlx5_ib_support_multi_pkt_send_wqes =
+ 				MLX5_IB_ALLOW_MPW;
+@@ -1104,7 +1105,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 			sizeof(resp.mlx5_ib_support_multi_pkt_send_wqes);
+ 	}
+ 
+-	if (field_avail(typeof(resp), flags, uhw->outlen)) {
++	if (field_avail(typeof(resp), flags, uhw_outlen)) {
+ 		resp.response_length += sizeof(resp.flags);
+ 
+ 		if (MLX5_CAP_GEN(mdev, cqe_compression_128))
+@@ -1120,8 +1121,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 		resp.flags |= MLX5_IB_QUERY_DEV_RESP_FLAGS_SCAT2CQE_DCT;
+ 	}
+ 
+-	if (field_avail(typeof(resp), sw_parsing_caps,
+-			uhw->outlen)) {
++	if (field_avail(typeof(resp), sw_parsing_caps, uhw_outlen)) {
+ 		resp.response_length += sizeof(resp.sw_parsing_caps);
+ 		if (MLX5_CAP_ETH(mdev, swp)) {
+ 			resp.sw_parsing_caps.sw_parsing_offloads |=
+@@ -1141,7 +1141,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 		}
+ 	}
+ 
+-	if (field_avail(typeof(resp), striding_rq_caps, uhw->outlen) &&
++	if (field_avail(typeof(resp), striding_rq_caps, uhw_outlen) &&
+ 	    raw_support) {
+ 		resp.response_length += sizeof(resp.striding_rq_caps);
+ 		if (MLX5_CAP_GEN(mdev, striding_rq)) {
+@@ -1164,8 +1164,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 		}
+ 	}
+ 
+-	if (field_avail(typeof(resp), tunnel_offloads_caps,
+-			uhw->outlen)) {
++	if (field_avail(typeof(resp), tunnel_offloads_caps, uhw_outlen)) {
+ 		resp.response_length += sizeof(resp.tunnel_offloads_caps);
+ 		if (MLX5_CAP_ETH(mdev, tunnel_stateless_vxlan))
+ 			resp.tunnel_offloads_caps |=
+@@ -1186,7 +1185,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ 				MLX5_IB_TUNNELED_OFFLOADS_MPLS_UDP;
+ 	}
+ 
+-	if (uhw->outlen) {
++	if (uhw_outlen) {
+ 		err = ib_copy_to_udata(uhw, &resp, resp.response_length);
+ 
+ 		if (err)
+@@ -4771,7 +4770,6 @@ static int __get_port_caps(struct mlx5_ib_dev *dev, u8 port)
+ 	struct ib_device_attr *dprops = NULL;
+ 	struct ib_port_attr *pprops = NULL;
+ 	int err = -ENOMEM;
+-	struct ib_udata uhw = {.inlen = 0, .outlen = 0};
+ 
+ 	pprops = kzalloc(sizeof(*pprops), GFP_KERNEL);
+ 	if (!pprops)
+@@ -4781,7 +4779,7 @@ static int __get_port_caps(struct mlx5_ib_dev *dev, u8 port)
+ 	if (!dprops)
+ 		goto out;
+ 
+-	err = mlx5_ib_query_device(&dev->ib_dev, dprops, &uhw);
++	err = mlx5_ib_query_device(&dev->ib_dev, dprops, NULL);
+ 	if (err) {
+ 		mlx5_ib_warn(dev, "query_device failed %d\n", err);
+ 		goto out;
+-- 
+2.20.1
+
diff --git a/queue-5.5/rdma-rxe-fix-error-type-of-mmap_offset.patch b/queue-5.5/rdma-rxe-fix-error-type-of-mmap_offset.patch
new file mode 100644
index 00000000000..03aadee72f3
--- /dev/null
+++ b/queue-5.5/rdma-rxe-fix-error-type-of-mmap_offset.patch
@@ -0,0 +1,38 @@
+From 462e28b82d3ecc2da155824f953dc92687479796 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Dec 2019 19:36:13 +0800
+Subject: RDMA/rxe: Fix error type of mmap_offset
+
+From: Jiewei Ke <kejiewei.cn@gmail.com>
+
+[ Upstream commit 6ca18d8927d468c763571f78c9a7387a69ffa020 ]
+
+The type of mmap_offset should be u64 instead of int to match the type of
+mminfo.offset. If otherwise, after we create several thousands of CQs, it
+will run into overflow issues.
+
+Link: https://lore.kernel.org/r/20191227113613.5020-1-kejiewei.cn@gmail.com
+Signed-off-by: Jiewei Ke <kejiewei.cn@gmail.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_verbs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index 95834206c80c3..92de39c4a7c1e 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -408,7 +408,7 @@ struct rxe_dev {
+ 	struct list_head	pending_mmaps;
+ 
+ 	spinlock_t		mmap_offset_lock; /* guard mmap_offset */
+-	int			mmap_offset;
++	u64			mmap_offset;
+ 
+ 	atomic64_t		stats_counters[RXE_NUM_OF_COUNTERS];
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch b/queue-5.5/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch
new file mode 100644
index 00000000000..158eaf1520c
--- /dev/null
+++ b/queue-5.5/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch
@@ -0,0 +1,90 @@
+From 8c433fb82bc79a88433a1f13396feb6e26346676 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 14:33:10 +0000
+Subject: RDMA/uverbs: Remove needs_kfree_rcu from uverbs_obj_type_class
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+[ Upstream commit 8bdf9dd984c18375d1090ddeb1792511f619c5c1 ]
+
+After device disassociation the uapi_objects are destroyed and freed,
+however it is still possible that core code can be holding a kref on the
+uobject. When it finally goes to uverbs_uobject_free() via the kref_put()
+it can trigger a use-after-free on the uapi_object.
+
+Since needs_kfree_rcu is a micro optimization that only benefits file
+uobjects, just get rid of it. There is no harm in using kfree_rcu even if
+it isn't required, and the number of involved objects is small.
+
+Link: https://lore.kernel.org/r/20200113143306.GA28717@ziepe.ca
+Signed-off-by: Michael Guralnik <michaelgur@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/rdma_core.c | 23 +----------------------
+ include/rdma/uverbs_types.h         |  1 -
+ 2 files changed, 1 insertion(+), 23 deletions(-)
+
+diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
+index 6c72773faf291..17bdbe38fdfa5 100644
+--- a/drivers/infiniband/core/rdma_core.c
++++ b/drivers/infiniband/core/rdma_core.c
+@@ -49,13 +49,7 @@ void uverbs_uobject_get(struct ib_uobject *uobject)
+ 
+ static void uverbs_uobject_free(struct kref *ref)
+ {
+-	struct ib_uobject *uobj =
+-		container_of(ref, struct ib_uobject, ref);
+-
+-	if (uobj->uapi_object->type_class->needs_kfree_rcu)
+-		kfree_rcu(uobj, rcu);
+-	else
+-		kfree(uobj);
++	kfree_rcu(container_of(ref, struct ib_uobject, ref), rcu);
+ }
+ 
+ void uverbs_uobject_put(struct ib_uobject *uobject)
+@@ -744,20 +738,6 @@ const struct uverbs_obj_type_class uverbs_idr_class = {
+ 	.lookup_put = lookup_put_idr_uobject,
+ 	.destroy_hw = destroy_hw_idr_uobject,
+ 	.remove_handle = remove_handle_idr_uobject,
+-	/*
+-	 * When we destroy an object, we first just lock it for WRITE and
+-	 * actually DESTROY it in the finalize stage. So, the problematic
+-	 * scenario is when we just started the finalize stage of the
+-	 * destruction (nothing was executed yet). Now, the other thread
+-	 * fetched the object for READ access, but it didn't lock it yet.
+-	 * The DESTROY thread continues and starts destroying the object.
+-	 * When the other thread continue - without the RCU, it would
+-	 * access freed memory. However, the rcu_read_lock delays the free
+-	 * until the rcu_read_lock of the READ operation quits. Since the
+-	 * exclusive lock of the object is still taken by the DESTROY flow, the
+-	 * READ operation will get -EBUSY and it'll just bail out.
+-	 */
+-	.needs_kfree_rcu = true,
+ };
+ EXPORT_SYMBOL(uverbs_idr_class);
+ 
+@@ -920,7 +900,6 @@ const struct uverbs_obj_type_class uverbs_fd_class = {
+ 	.lookup_put = lookup_put_fd_uobject,
+ 	.destroy_hw = destroy_hw_fd_uobject,
+ 	.remove_handle = remove_handle_fd_uobject,
+-	.needs_kfree_rcu = false,
+ };
+ EXPORT_SYMBOL(uverbs_fd_class);
+ 
+diff --git a/include/rdma/uverbs_types.h b/include/rdma/uverbs_types.h
+index d57a5ba00c743..0b0f5a5f392de 100644
+--- a/include/rdma/uverbs_types.h
++++ b/include/rdma/uverbs_types.h
+@@ -98,7 +98,6 @@ struct uverbs_obj_type_class {
+ 				       enum rdma_remove_reason why,
+ 				       struct uverbs_attr_bundle *attrs);
+ 	void (*remove_handle)(struct ib_uobject *uobj);
+-	u8    needs_kfree_rcu;
+ };
+ 
+ struct uverbs_obj_type {
+-- 
+2.20.1
+
diff --git a/queue-5.5/regulator-core-fix-exported-symbols-to-the-exported-.patch b/queue-5.5/regulator-core-fix-exported-symbols-to-the-exported-.patch
new file mode 100644
index 00000000000..874f49ed0e2
--- /dev/null
+++ b/queue-5.5/regulator-core-fix-exported-symbols-to-the-exported-.patch
@@ -0,0 +1,49 @@
+From b6191036c3dd22bbd31a4e2d32e6e701f6af6cd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 13:39:21 +0100
+Subject: regulator: core: Fix exported symbols to the exported GPL version
+
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+
+[ Upstream commit 3d7610e8da993539346dce6f7c909fd3d56bf4d5 ]
+
+Change the exported symbols introduced by commit e9153311491da
+("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage")
+from EXPORT_SYMBOL() to EXPORT_SYMBOL_GPL(), like is used for all the core
+parts.
+
+Fixes: e9153311491da ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage")
+Reported-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/20200120123921.1204339-1-enric.balletbo@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index e7d167ce326cb..d015d99cb59d9 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -3470,7 +3470,7 @@ int regulator_set_voltage_rdev(struct regulator_dev *rdev, int min_uV,
+ out:
+ 	return ret;
+ }
+-EXPORT_SYMBOL(regulator_set_voltage_rdev);
++EXPORT_SYMBOL_GPL(regulator_set_voltage_rdev);
+ 
+ static int regulator_limit_voltage_step(struct regulator_dev *rdev,
+ 					int *current_uV, int *min_uV)
+@@ -4035,7 +4035,7 @@ int regulator_get_voltage_rdev(struct regulator_dev *rdev)
+ 		return ret;
+ 	return ret - rdev->constraints->uV_offset;
+ }
+-EXPORT_SYMBOL(regulator_get_voltage_rdev);
++EXPORT_SYMBOL_GPL(regulator_get_voltage_rdev);
+ 
+ /**
+  * regulator_get_voltage - get regulator output voltage
+-- 
+2.20.1
+
diff --git a/queue-5.5/regulator-rk808-lower-log-level-on-optional-gpios-be.patch b/queue-5.5/regulator-rk808-lower-log-level-on-optional-gpios-be.patch
new file mode 100644
index 00000000000..61a48c90ac9
--- /dev/null
+++ b/queue-5.5/regulator-rk808-lower-log-level-on-optional-gpios-be.patch
@@ -0,0 +1,45 @@
+From a63adafca58e5f994a3f8adbb61ffe53ccca62dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 17:47:09 +0100
+Subject: regulator: rk808: Lower log level on optional GPIOs being not
+ available
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit b8a039d37792067c1a380dc710361905724b9b2f ]
+
+RK808 can leverage a couple of GPIOs to tweak the ramp rate during DVS
+(Dynamic Voltage Scaling). These GPIOs are entirely optional but a
+dev_warn() appeared when cleaning this driver to use a more up-to-date
+gpiod API. At least reduce the log level to 'info' as it is totally
+fine to not populate these GPIO on a hardware design.
+
+This change is trivial but it is worth not polluting the logs during
+bringup phase by having real warnings and errors sorted out
+correctly.
+
+Fixes: a13eaf02e2d6 ("regulator: rk808: make better use of the gpiod API")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/r/20191203164709.11127-1-miquel.raynal@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/rk808-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
+index 5b40032264846..31f79fda3238b 100644
+--- a/drivers/regulator/rk808-regulator.c
++++ b/drivers/regulator/rk808-regulator.c
+@@ -1282,7 +1282,7 @@ static int rk808_regulator_dt_parse_pdata(struct device *dev,
+ 		}
+ 
+ 		if (!pdata->dvs_gpio[i]) {
+-			dev_warn(dev, "there is no dvs%d gpio\n", i);
++			dev_info(dev, "there is no dvs%d gpio\n", i);
+ 			continue;
+ 		}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/regulator-vctrl-regulator-avoid-deadlock-getting-and.patch b/queue-5.5/regulator-vctrl-regulator-avoid-deadlock-getting-and.patch
new file mode 100644
index 00000000000..dfdcfd8e0d1
--- /dev/null
+++ b/queue-5.5/regulator-vctrl-regulator-avoid-deadlock-getting-and.patch
@@ -0,0 +1,174 @@
+From d67be136b389160d1935aee743e806fd8b9b626d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 10:45:43 +0100
+Subject: regulator: vctrl-regulator: Avoid deadlock getting and setting the
+ voltage
+
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+
+[ Upstream commit e9153311491da9d9863ead9888a1613531cb4a1b ]
+
+`cat /sys/kernel/debug/regulator/regulator_summary` ends on a deadlock
+when you have a voltage controlled regulator (vctrl).
+
+The problem is that the vctrl_get_voltage() and vctrl_set_voltage() calls the
+regulator_get_voltage() and regulator_set_voltage() and that will try to lock
+again the dependent regulators (the regulator supplying the control voltage).
+
+Fix the issue by exporting the unlocked version of the regulator_get_voltage()
+and regulator_set_voltage() API so drivers that need it, like the voltage
+controlled regulator driver can use it.
+
+Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking")
+Reported-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/20200116094543.2847321-1-enric.balletbo@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c            |  2 ++
+ drivers/regulator/vctrl-regulator.c | 38 +++++++++++++++++------------
+ 2 files changed, 25 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 03d79fee2987e..e7d167ce326cb 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -3470,6 +3470,7 @@ int regulator_set_voltage_rdev(struct regulator_dev *rdev, int min_uV,
+ out:
+ 	return ret;
+ }
++EXPORT_SYMBOL(regulator_set_voltage_rdev);
+ 
+ static int regulator_limit_voltage_step(struct regulator_dev *rdev,
+ 					int *current_uV, int *min_uV)
+@@ -4034,6 +4035,7 @@ int regulator_get_voltage_rdev(struct regulator_dev *rdev)
+ 		return ret;
+ 	return ret - rdev->constraints->uV_offset;
+ }
++EXPORT_SYMBOL(regulator_get_voltage_rdev);
+ 
+ /**
+  * regulator_get_voltage - get regulator output voltage
+diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c
+index 9a9ee81881098..cbadb1c996790 100644
+--- a/drivers/regulator/vctrl-regulator.c
++++ b/drivers/regulator/vctrl-regulator.c
+@@ -11,10 +11,13 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
++#include <linux/regulator/coupler.h>
+ #include <linux/regulator/driver.h>
+ #include <linux/regulator/of_regulator.h>
+ #include <linux/sort.h>
+ 
++#include "internal.h"
++
+ struct vctrl_voltage_range {
+ 	int min_uV;
+ 	int max_uV;
+@@ -79,7 +82,7 @@ static int vctrl_calc_output_voltage(struct vctrl_data *vctrl, int ctrl_uV)
+ static int vctrl_get_voltage(struct regulator_dev *rdev)
+ {
+ 	struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
+-	int ctrl_uV = regulator_get_voltage(vctrl->ctrl_reg);
++	int ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev);
+ 
+ 	return vctrl_calc_output_voltage(vctrl, ctrl_uV);
+ }
+@@ -90,16 +93,16 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
+ {
+ 	struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
+ 	struct regulator *ctrl_reg = vctrl->ctrl_reg;
+-	int orig_ctrl_uV = regulator_get_voltage(ctrl_reg);
++	int orig_ctrl_uV = regulator_get_voltage_rdev(ctrl_reg->rdev);
+ 	int uV = vctrl_calc_output_voltage(vctrl, orig_ctrl_uV);
+ 	int ret;
+ 
+ 	if (req_min_uV >= uV || !vctrl->ovp_threshold)
+ 		/* voltage rising or no OVP */
+-		return regulator_set_voltage(
+-			ctrl_reg,
++		return regulator_set_voltage_rdev(ctrl_reg->rdev,
+ 			vctrl_calc_ctrl_voltage(vctrl, req_min_uV),
+-			vctrl_calc_ctrl_voltage(vctrl, req_max_uV));
++			vctrl_calc_ctrl_voltage(vctrl, req_max_uV),
++			PM_SUSPEND_ON);
+ 
+ 	while (uV > req_min_uV) {
+ 		int max_drop_uV = (uV * vctrl->ovp_threshold) / 100;
+@@ -114,9 +117,10 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
+ 		next_uV = max_t(int, req_min_uV, uV - max_drop_uV);
+ 		next_ctrl_uV = vctrl_calc_ctrl_voltage(vctrl, next_uV);
+ 
+-		ret = regulator_set_voltage(ctrl_reg,
++		ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
++					    next_ctrl_uV,
+ 					    next_ctrl_uV,
+-					    next_ctrl_uV);
++					    PM_SUSPEND_ON);
+ 		if (ret)
+ 			goto err;
+ 
+@@ -130,7 +134,8 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
+ 
+ err:
+ 	/* Try to go back to original voltage */
+-	regulator_set_voltage(ctrl_reg, orig_ctrl_uV, orig_ctrl_uV);
++	regulator_set_voltage_rdev(ctrl_reg->rdev, orig_ctrl_uV, orig_ctrl_uV,
++				   PM_SUSPEND_ON);
+ 
+ 	return ret;
+ }
+@@ -155,9 +160,10 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
+ 
+ 	if (selector >= vctrl->sel || !vctrl->ovp_threshold) {
+ 		/* voltage rising or no OVP */
+-		ret = regulator_set_voltage(ctrl_reg,
++		ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
++					    vctrl->vtable[selector].ctrl,
+ 					    vctrl->vtable[selector].ctrl,
+-					    vctrl->vtable[selector].ctrl);
++					    PM_SUSPEND_ON);
+ 		if (!ret)
+ 			vctrl->sel = selector;
+ 
+@@ -173,9 +179,10 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
+ 		else
+ 			next_sel = vctrl->vtable[vctrl->sel].ovp_min_sel;
+ 
+-		ret = regulator_set_voltage(ctrl_reg,
++		ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
+ 					    vctrl->vtable[next_sel].ctrl,
+-					    vctrl->vtable[next_sel].ctrl);
++					    vctrl->vtable[next_sel].ctrl,
++					    PM_SUSPEND_ON);
+ 		if (ret) {
+ 			dev_err(&rdev->dev,
+ 				"failed to set control voltage to %duV\n",
+@@ -195,9 +202,10 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
+ err:
+ 	if (vctrl->sel != orig_sel) {
+ 		/* Try to go back to original voltage */
+-		if (!regulator_set_voltage(ctrl_reg,
++		if (!regulator_set_voltage_rdev(ctrl_reg->rdev,
++					   vctrl->vtable[orig_sel].ctrl,
+ 					   vctrl->vtable[orig_sel].ctrl,
+-					   vctrl->vtable[orig_sel].ctrl))
++					   PM_SUSPEND_ON))
+ 			vctrl->sel = orig_sel;
+ 		else
+ 			dev_warn(&rdev->dev,
+@@ -482,7 +490,7 @@ static int vctrl_probe(struct platform_device *pdev)
+ 		if (ret)
+ 			return ret;
+ 
+-		ctrl_uV = regulator_get_voltage(vctrl->ctrl_reg);
++		ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev);
+ 		if (ctrl_uV < 0) {
+ 			dev_err(&pdev->dev, "failed to get control voltage\n");
+ 			return ctrl_uV;
+-- 
+2.20.1
+
diff --git a/queue-5.5/reiserfs-fix-spurious-unlock-in-reiserfs_fill_super-.patch b/queue-5.5/reiserfs-fix-spurious-unlock-in-reiserfs_fill_super-.patch
new file mode 100644
index 00000000000..de6005de1b1
--- /dev/null
+++ b/queue-5.5/reiserfs-fix-spurious-unlock-in-reiserfs_fill_super-.patch
@@ -0,0 +1,36 @@
+From 8f96a048581e03cb00693cc7a0cf1cfc5fc21137 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:35:58 +0100
+Subject: reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 4d5c1adaf893b8aa52525d2b81995e949bcb3239 ]
+
+When we fail to allocate string for journal device name we jump to
+'error' label which tries to unlock reiserfs write lock which is not
+held. Jump to 'error_unlocked' instead.
+
+Fixes: f32485be8397 ("reiserfs: delay reiserfs lock until journal initialization")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/reiserfs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index d127af64283e3..a6bce5b1fb1dc 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -1948,7 +1948,7 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
+ 		if (!sbi->s_jdev) {
+ 			SWARN(silent, s, "", "Cannot allocate memory for "
+ 				"journal device name");
+-			goto error;
++			goto error_unlocked;
+ 		}
+ 	}
+ #ifdef CONFIG_QUOTA
+-- 
+2.20.1
+
diff --git a/queue-5.5/reiserfs-prevent-null-pointer-dereference-in-reiserf.patch b/queue-5.5/reiserfs-prevent-null-pointer-dereference-in-reiserf.patch
new file mode 100644
index 00000000000..c6890d75a5e
--- /dev/null
+++ b/queue-5.5/reiserfs-prevent-null-pointer-dereference-in-reiserf.patch
@@ -0,0 +1,44 @@
+From 00fc0206f6d37b40985cb7ad8a8576303c763c41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:17:26 -0800
+Subject: reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
+
+From: Yunfeng Ye <yeyunfeng@huawei.com>
+
+[ Upstream commit aacee5446a2a1aa35d0a49dab289552578657fb4 ]
+
+The variable inode may be NULL in reiserfs_insert_item(), but there is
+no check before accessing the member of inode.
+
+Fix this by adding NULL pointer check before calling reiserfs_debug().
+
+Link: http://lkml.kernel.org/r/79c5135d-ff25-1cc9-4e99-9f572b88cc00@huawei.com
+Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
+Cc: zhengbin <zhengbin13@huawei.com>
+Cc: Hu Shiyuan <hushiyuan@huawei.com>
+Cc: Feilong Lin <linfeilong@huawei.com>
+Cc: Jan Kara <jack@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/reiserfs/stree.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
+index da9ebe33882b7..bb4973aefbb18 100644
+--- a/fs/reiserfs/stree.c
++++ b/fs/reiserfs/stree.c
+@@ -2246,7 +2246,8 @@ error_out:
+ 	/* also releases the path */
+ 	unfix_nodes(&s_ins_balance);
+ #ifdef REISERQUOTA_DEBUG
+-	reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
++	if (inode)
++		reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
+ 		       "reiserquota insert_item(): freeing %u id=%u type=%c",
+ 		       quota_bytes, inode->i_uid, head2type(ih));
+ #endif
+-- 
+2.20.1
+
diff --git a/queue-5.5/remoteproc-initialize-rproc_class-before-use.patch b/queue-5.5/remoteproc-initialize-rproc_class-before-use.patch
new file mode 100644
index 00000000000..5b08a53d5a9
--- /dev/null
+++ b/queue-5.5/remoteproc-initialize-rproc_class-before-use.patch
@@ -0,0 +1,73 @@
+From fae8315f04c4a93b9507483ada3ab9189d31e159 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 May 2019 17:52:23 -0500
+Subject: remoteproc: Initialize rproc_class before use
+
+From: Brandon Maier <brandon.maier@rockwellcollins.com>
+
+[ Upstream commit a8f40111d184098cd2b3dc0c7170c42250a5fa09 ]
+
+The remoteproc_core and remoteproc drivers all initialize with module_init().
+However remoteproc drivers need the rproc_class during their probe. If one of
+the remoteproc drivers runs init and gets through probe before
+remoteproc_init() runs, a NULL pointer access of rproc_class's `glue_dirs`
+spinlock occurs.
+
+> Unable to handle kernel NULL pointer dereference at virtual address 000000dc
+> pgd = c0004000
+> [000000dc] *pgd=00000000
+> Internal error: Oops: 5 [#1] PREEMPT ARM
+> Modules linked in:
+> CPU: 0 PID: 1 Comm: swapper Tainted: G        W       4.14.106-rt56 #1
+> Hardware name: Generic OMAP36xx (Flattened Device Tree)
+> task: c6050000 task.stack: c604a000
+> PC is at rt_spin_lock+0x40/0x6c
+> LR is at rt_spin_lock+0x28/0x6c
+> pc : [<c0523c90>]    lr : [<c0523c78>]    psr: 60000013
+> sp : c604bdc0  ip : 00000000  fp : 00000000
+> r10: 00000000  r9 : c61c7c10  r8 : c6269c20
+> r7 : c0905888  r6 : c6269c20  r5 : 00000000  r4 : 000000d4
+> r3 : 000000dc  r2 : c6050000  r1 : 00000002  r0 : 000000d4
+> Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
+...
+> [<c0523c90>] (rt_spin_lock) from [<c03b65a4>] (get_device_parent+0x54/0x17c)
+> [<c03b65a4>] (get_device_parent) from [<c03b6bec>] (device_add+0xe0/0x5b4)
+> [<c03b6bec>] (device_add) from [<c042adf4>] (rproc_add+0x18/0xd8)
+> [<c042adf4>] (rproc_add) from [<c01110e4>] (my_rproc_probe+0x158/0x204)
+> [<c01110e4>] (my_rproc_probe) from [<c03bb6b8>] (platform_drv_probe+0x34/0x70)
+> [<c03bb6b8>] (platform_drv_probe) from [<c03b9dd4>] (driver_probe_device+0x2c8/0x420)
+> [<c03b9dd4>] (driver_probe_device) from [<c03ba02c>] (__driver_attach+0x100/0x11c)
+> [<c03ba02c>] (__driver_attach) from [<c03b7d08>] (bus_for_each_dev+0x7c/0xc0)
+> [<c03b7d08>] (bus_for_each_dev) from [<c03b910c>] (bus_add_driver+0x1cc/0x264)
+> [<c03b910c>] (bus_add_driver) from [<c03ba714>] (driver_register+0x78/0xf8)
+> [<c03ba714>] (driver_register) from [<c010181c>] (do_one_initcall+0x100/0x190)
+> [<c010181c>] (do_one_initcall) from [<c0800de8>] (kernel_init_freeable+0x130/0x1d0)
+> [<c0800de8>] (kernel_init_freeable) from [<c051eee8>] (kernel_init+0x8/0x114)
+> [<c051eee8>] (kernel_init) from [<c01175b0>] (ret_from_fork+0x14/0x24)
+> Code: e2843008 e3c2203f f5d3f000 e5922010 (e193cf9f)
+> ---[ end trace 0000000000000002 ]---
+
+Signed-off-by: Brandon Maier <brandon.maier@rockwellcollins.com>
+Link: https://lore.kernel.org/r/20190530225223.136420-1-brandon.maier@rockwellcollins.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/remoteproc_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
+index 307df98347ba2..8115f945151b3 100644
+--- a/drivers/remoteproc/remoteproc_core.c
++++ b/drivers/remoteproc/remoteproc_core.c
+@@ -2223,7 +2223,7 @@ static int __init remoteproc_init(void)
+ 
+ 	return 0;
+ }
+-module_init(remoteproc_init);
++subsys_initcall(remoteproc_init);
+ 
+ static void __exit remoteproc_exit(void)
+ {
+-- 
+2.20.1
+
diff --git a/queue-5.5/remoteproc-q6v5-mss-remove-mem-clk-from-the-active-p.patch b/queue-5.5/remoteproc-q6v5-mss-remove-mem-clk-from-the-active-p.patch
new file mode 100644
index 00000000000..5f29a6a815a
--- /dev/null
+++ b/queue-5.5/remoteproc-q6v5-mss-remove-mem-clk-from-the-active-p.patch
@@ -0,0 +1,37 @@
+From 26d165b6a92426ddb5349ee08b2561a631852424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 18:52:13 +0530
+Subject: remoteproc: q6v5-mss: Remove mem clk from the active pool
+
+From: Sibi Sankar <sibis@codeaurora.org>
+
+[ Upstream commit 6ba519aa13758dd55248f3a6f939536656df2661 ]
+
+Currently the mem clk is voted upon from both the active and proxy pool on
+MSM8998 SoCs where only a proxy vote should suffice. Fix this by removing
+mem clk from the active pool.
+
+Fixes: 1665cbd5731fa ("remoteproc: qcom_q6v5_mss: Add support for MSM8998")
+Signed-off-by: Sibi Sankar <sibis@codeaurora.org>
+Link: https://lore.kernel.org/r/20191218132217.28141-2-sibis@codeaurora.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_mss.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
+index 471128a2e7239..164fc2a53ef11 100644
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -1594,7 +1594,6 @@ static const struct rproc_hexagon_res msm8998_mss = {
+ 	.active_clk_names = (char*[]){
+ 			"iface",
+ 			"bus",
+-			"mem",
+ 			"gpll0_mss",
+ 			"mnoc_axi",
+ 			"snoc_axi",
+-- 
+2.20.1
+
diff --git a/queue-5.5/reset-uniphier-add-scssi-reset-control-for-each-chan.patch b/queue-5.5/reset-uniphier-add-scssi-reset-control-for-each-chan.patch
new file mode 100644
index 00000000000..fc5aeef1d43
--- /dev/null
+++ b/queue-5.5/reset-uniphier-add-scssi-reset-control-for-each-chan.patch
@@ -0,0 +1,63 @@
+From 10e450857a2ffce2b76d933b2c3eaa6ff62ede5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2019 13:19:19 +0900
+Subject: reset: uniphier: Add SCSSI reset control for each channel
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit f4aec227e985e31d2fdc5608daf48e3de19157b7 ]
+
+SCSSI has reset controls for each channel in the SoCs newer than Pro4,
+so this adds missing reset controls for channel 1, 2 and 3. And more, this
+moves MCSSI reset ID after SCSSI.
+
+Fixes: 6b39fd590aeb ("reset: uniphier: add reset control support for SPI")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/reset-uniphier.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/reset/reset-uniphier.c b/drivers/reset/reset-uniphier.c
+index 74e589f5dd6a6..279e535bf5d80 100644
+--- a/drivers/reset/reset-uniphier.c
++++ b/drivers/reset/reset-uniphier.c
+@@ -193,8 +193,8 @@ static const struct uniphier_reset_data uniphier_pro5_sd_reset_data[] = {
+ #define UNIPHIER_PERI_RESET_FI2C(id, ch)		\
+ 	UNIPHIER_RESETX((id), 0x114, 24 + (ch))
+ 
+-#define UNIPHIER_PERI_RESET_SCSSI(id)			\
+-	UNIPHIER_RESETX((id), 0x110, 17)
++#define UNIPHIER_PERI_RESET_SCSSI(id, ch)		\
++	UNIPHIER_RESETX((id), 0x110, 17 + (ch))
+ 
+ #define UNIPHIER_PERI_RESET_MCSSI(id)			\
+ 	UNIPHIER_RESETX((id), 0x114, 14)
+@@ -209,7 +209,7 @@ static const struct uniphier_reset_data uniphier_ld4_peri_reset_data[] = {
+ 	UNIPHIER_PERI_RESET_I2C(6, 2),
+ 	UNIPHIER_PERI_RESET_I2C(7, 3),
+ 	UNIPHIER_PERI_RESET_I2C(8, 4),
+-	UNIPHIER_PERI_RESET_SCSSI(11),
++	UNIPHIER_PERI_RESET_SCSSI(11, 0),
+ 	UNIPHIER_RESET_END,
+ };
+ 
+@@ -225,8 +225,11 @@ static const struct uniphier_reset_data uniphier_pro4_peri_reset_data[] = {
+ 	UNIPHIER_PERI_RESET_FI2C(8, 4),
+ 	UNIPHIER_PERI_RESET_FI2C(9, 5),
+ 	UNIPHIER_PERI_RESET_FI2C(10, 6),
+-	UNIPHIER_PERI_RESET_SCSSI(11),
+-	UNIPHIER_PERI_RESET_MCSSI(12),
++	UNIPHIER_PERI_RESET_SCSSI(11, 0),
++	UNIPHIER_PERI_RESET_SCSSI(12, 1),
++	UNIPHIER_PERI_RESET_SCSSI(13, 2),
++	UNIPHIER_PERI_RESET_SCSSI(14, 3),
++	UNIPHIER_PERI_RESET_MCSSI(15),
+ 	UNIPHIER_RESET_END,
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/revert-drm-amdgpu-enable-vcn-dpg-on-raven-and-raven2.patch b/queue-5.5/revert-drm-amdgpu-enable-vcn-dpg-on-raven-and-raven2.patch
new file mode 100644
index 00000000000..7d661689bfe
--- /dev/null
+++ b/queue-5.5/revert-drm-amdgpu-enable-vcn-dpg-on-raven-and-raven2.patch
@@ -0,0 +1,51 @@
+From 0f530b9390799f04717047c64a2bcf924d328146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 09:19:20 -0500
+Subject: Revert "drm/amdgpu: enable VCN DPG on Raven and Raven2"
+
+From: Thong Thai <thong.thai@amd.com>
+
+[ Upstream commit d515959125f24767d02e82587a11e444eeba0e7b ]
+
+This reverts commit a4840d91c984f93b2acdcd44441d624bbc1af0d2.
+
+Reverting due to power efficiency issues seen on Raven 1 and 2
+when DPG mode is enabled.
+
+Signed-off-by: Thong Thai <thong.thai@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc15.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
+index 8e1640bc07aff..04ea7cd692955 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -1145,9 +1145,7 @@ static int soc15_common_early_init(void *handle)
+ 				AMD_CG_SUPPORT_SDMA_LS |
+ 				AMD_CG_SUPPORT_VCN_MGCG;
+ 
+-			adev->pg_flags = AMD_PG_SUPPORT_SDMA |
+-				AMD_PG_SUPPORT_VCN |
+-				AMD_PG_SUPPORT_VCN_DPG;
++			adev->pg_flags = AMD_PG_SUPPORT_SDMA | AMD_PG_SUPPORT_VCN;
+ 		} else if (adev->pdev->device == 0x15d8) {
+ 			adev->cg_flags = AMD_CG_SUPPORT_GFX_MGCG |
+ 				AMD_CG_SUPPORT_GFX_MGLS |
+@@ -1190,9 +1188,7 @@ static int soc15_common_early_init(void *handle)
+ 				AMD_CG_SUPPORT_SDMA_LS |
+ 				AMD_CG_SUPPORT_VCN_MGCG;
+ 
+-			adev->pg_flags = AMD_PG_SUPPORT_SDMA |
+-				AMD_PG_SUPPORT_VCN |
+-				AMD_PG_SUPPORT_VCN_DPG;
++			adev->pg_flags = AMD_PG_SUPPORT_SDMA | AMD_PG_SUPPORT_VCN;
+ 		}
+ 		break;
+ 	case CHIP_ARCTURUS:
+-- 
+2.20.1
+
diff --git a/queue-5.5/revert-nfp-abm-fix-memory-leak-in-nfp_abm_u32_knode_.patch b/queue-5.5/revert-nfp-abm-fix-memory-leak-in-nfp_abm_u32_knode_.patch
new file mode 100644
index 00000000000..03a58cc1087
--- /dev/null
+++ b/queue-5.5/revert-nfp-abm-fix-memory-leak-in-nfp_abm_u32_knode_.patch
@@ -0,0 +1,74 @@
+From 2afa473c2c97c9d44f73ddeba6445254e3c9af23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 10:20:32 -0800
+Subject: Revert "nfp: abm: fix memory leak in nfp_abm_u32_knode_replace"
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 1d1997db870f4058676439ef7014390ba9e24eb2 ]
+
+This reverts commit 78beef629fd9 ("nfp: abm: fix memory leak in
+nfp_abm_u32_knode_replace").
+
+The quoted commit does not fix anything and resulted in a bogus
+CVE-2019-19076.
+
+If match is NULL then it is known there is no matching entry in
+list, hence, calling nfp_abm_u32_knode_delete() is pointless.
+
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: John Hurley <john.hurley@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/abm/cls.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/abm/cls.c b/drivers/net/ethernet/netronome/nfp/abm/cls.c
+index 9f8a1f69c0c4c..23ebddfb95325 100644
+--- a/drivers/net/ethernet/netronome/nfp/abm/cls.c
++++ b/drivers/net/ethernet/netronome/nfp/abm/cls.c
+@@ -176,10 +176,8 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink,
+ 	u8 mask, val;
+ 	int err;
+ 
+-	if (!nfp_abm_u32_check_knode(alink->abm, knode, proto, extack)) {
+-		err = -EOPNOTSUPP;
++	if (!nfp_abm_u32_check_knode(alink->abm, knode, proto, extack))
+ 		goto err_delete;
+-	}
+ 
+ 	tos_off = proto == htons(ETH_P_IP) ? 16 : 20;
+ 
+@@ -200,18 +198,14 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink,
+ 		if ((iter->val & cmask) == (val & cmask) &&
+ 		    iter->band != knode->res->classid) {
+ 			NL_SET_ERR_MSG_MOD(extack, "conflict with already offloaded filter");
+-			err = -EOPNOTSUPP;
+ 			goto err_delete;
+ 		}
+ 	}
+ 
+ 	if (!match) {
+ 		match = kzalloc(sizeof(*match), GFP_KERNEL);
+-		if (!match) {
+-			err = -ENOMEM;
+-			goto err_delete;
+-		}
+-
++		if (!match)
++			return -ENOMEM;
+ 		list_add(&match->list, &alink->dscp_map);
+ 	}
+ 	match->handle = knode->handle;
+@@ -227,7 +221,7 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink,
+ 
+ err_delete:
+ 	nfp_abm_u32_knode_delete(alink, knode);
+-	return err;
++	return -EOPNOTSUPP;
+ }
+ 
+ static int nfp_abm_setup_tc_block_cb(enum tc_setup_type type,
+-- 
+2.20.1
+
diff --git a/queue-5.5/rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-n.patch b/queue-5.5/rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-n.patch
new file mode 100644
index 00000000000..d9731a566ee
--- /dev/null
+++ b/queue-5.5/rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-n.patch
@@ -0,0 +1,74 @@
+From b9e4daaa69beb6a08dd15aed4c051425e65928b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 18:13:49 +0100
+Subject: rtc: i2c/spi: Avoid inclusion of REGMAP support when not needed
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 34719de919af07682861cb0fa2bcf64da33ecf44 ]
+
+Merely enabling I2C and RTC selects REGMAP_I2C and REGMAP_SPI, even when
+no driver needs it.  While the former can be moduler, the latter cannot,
+and thus becomes built-in.
+
+Fix this by moving the select statements for REGMAP_I2C and REGMAP_SPI
+from the RTC_I2C_AND_SPI helper to the individual drivers that depend on
+it.
+
+Note that the comment for RTC_I2C_AND_SPI refers to SND_SOC_I2C_AND_SPI
+for more information, but the latter does not select REGMAP_{I2C,SPI}
+itself, and defers that to the individual drivers, too.
+
+Fixes: 080481f54ef62121 ("rtc: merge ds3232 and ds3234")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Reported-by: kbuild test robot <lkp@intel.com>
+Reported-by: kbuild test robot <lkp@intel.com>
+Link: https://lore.kernel.org/r/20200112171349.22268-1-geert@linux-m68k.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/Kconfig | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
+index d77515d8382c7..738fa07188409 100644
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -848,14 +848,14 @@ config RTC_I2C_AND_SPI
+ 	default m if I2C=m
+ 	default y if I2C=y
+ 	default y if SPI_MASTER=y
+-	select REGMAP_I2C if I2C
+-	select REGMAP_SPI if SPI_MASTER
+ 
+ comment "SPI and I2C RTC drivers"
+ 
+ config RTC_DRV_DS3232
+ 	tristate "Dallas/Maxim DS3232/DS3234"
+ 	depends on RTC_I2C_AND_SPI
++	select REGMAP_I2C if I2C
++	select REGMAP_SPI if SPI_MASTER
+ 	help
+ 	  If you say yes here you get support for Dallas Semiconductor
+ 	  DS3232 and DS3234 real-time clock chips. If an interrupt is associated
+@@ -875,6 +875,8 @@ config RTC_DRV_DS3232_HWMON
+ config RTC_DRV_PCF2127
+ 	tristate "NXP PCF2127"
+ 	depends on RTC_I2C_AND_SPI
++	select REGMAP_I2C if I2C
++	select REGMAP_SPI if SPI_MASTER
+ 	select WATCHDOG_CORE if WATCHDOG
+ 	help
+ 	  If you say yes here you get support for the NXP PCF2127/29 RTC
+@@ -891,6 +893,8 @@ config RTC_DRV_PCF2127
+ config RTC_DRV_RV3029C2
+ 	tristate "Micro Crystal RV3029/3049"
+ 	depends on RTC_I2C_AND_SPI
++	select REGMAP_I2C if I2C
++	select REGMAP_SPI if SPI_MASTER
+ 	help
+ 	  If you say yes here you get support for the Micro Crystal
+ 	  RV3029 and RV3049 RTC chips.
+-- 
+2.20.1
+
diff --git a/queue-5.5/rtlwifi-rtl_pci-fix-wcast-function-type.patch b/queue-5.5/rtlwifi-rtl_pci-fix-wcast-function-type.patch
new file mode 100644
index 00000000000..3accb267f4b
--- /dev/null
+++ b/queue-5.5/rtlwifi-rtl_pci-fix-wcast-function-type.patch
@@ -0,0 +1,58 @@
+From e6159c4ed5264d7eb7bab20fc25400f2d558f59b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:29 +0700
+Subject: rtlwifi: rtl_pci: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit cb775c88da5d48a85d99d95219f637b6fad2e0e9 ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index f88d26535978d..25335bd2873b6 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -1061,13 +1061,15 @@ done:
+ 	return ret;
+ }
+ 
+-static void _rtl_pci_irq_tasklet(struct ieee80211_hw *hw)
++static void _rtl_pci_irq_tasklet(unsigned long data)
+ {
++	struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+ 	_rtl_pci_tx_chk_waitq(hw);
+ }
+ 
+-static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
++static void _rtl_pci_prepare_bcn_tasklet(unsigned long data)
+ {
++	struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+ 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ 	struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+@@ -1193,10 +1195,10 @@ static void _rtl_pci_init_struct(struct ieee80211_hw *hw,
+ 
+ 	/*task */
+ 	tasklet_init(&rtlpriv->works.irq_tasklet,
+-		     (void (*)(unsigned long))_rtl_pci_irq_tasklet,
++		     _rtl_pci_irq_tasklet,
+ 		     (unsigned long)hw);
+ 	tasklet_init(&rtlpriv->works.irq_prepare_bcn_tasklet,
+-		     (void (*)(unsigned long))_rtl_pci_prepare_bcn_tasklet,
++		     _rtl_pci_prepare_bcn_tasklet,
+ 		     (unsigned long)hw);
+ 	INIT_WORK(&rtlpriv->works.lps_change_work,
+ 		  rtl_lps_change_work_callback);
+-- 
+2.20.1
+
diff --git a/queue-5.5/rtw88-fix-potential-null-skb-access-in-tx-isr.patch b/queue-5.5/rtw88-fix-potential-null-skb-access-in-tx-isr.patch
new file mode 100644
index 00000000000..744c2acaabb
--- /dev/null
+++ b/queue-5.5/rtw88-fix-potential-null-skb-access-in-tx-isr.patch
@@ -0,0 +1,43 @@
+From 42a6455205b47ae0517880ad4ab274496219b6d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 16:08:07 +0800
+Subject: rtw88: fix potential NULL skb access in TX ISR
+
+From: Yan-Hsuan Chuang <yhchuang@realtek.com>
+
+[ Upstream commit f4f84ff8377d4cedf18317747bc407b2cf657d0f ]
+
+Sometimes the TX queue may be empty and we could possible
+dequeue a NULL pointer, crash the kernel. If the skb is NULL
+then there is nothing to do, just leave the ISR.
+
+And the TX queue should not be empty here, so print an error
+to see if there is anything wrong for DMA ring.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
+index a58e8276a41a3..a6746b5a9ff2d 100644
+--- a/drivers/net/wireless/realtek/rtw88/pci.c
++++ b/drivers/net/wireless/realtek/rtw88/pci.c
+@@ -832,6 +832,11 @@ static void rtw_pci_tx_isr(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci,
+ 
+ 	while (count--) {
+ 		skb = skb_dequeue(&ring->queue);
++		if (!skb) {
++			rtw_err(rtwdev, "failed to dequeue %d skb TX queue %d, BD=0x%08x, rp %d -> %d\n",
++				count, hw_queue, bd_idx, ring->r.rp, cur_rp);
++			break;
++		}
+ 		tx_data = rtw_pci_get_tx_data(skb);
+ 		pci_unmap_single(rtwpci->pdev, tx_data->dma, skb->len,
+ 				 PCI_DMA_TODEVICE);
+-- 
+2.20.1
+
diff --git a/queue-5.5/rtw88-fix-rate-mask-for-1ss-chip.patch b/queue-5.5/rtw88-fix-rate-mask-for-1ss-chip.patch
new file mode 100644
index 00000000000..6b53db639a1
--- /dev/null
+++ b/queue-5.5/rtw88-fix-rate-mask-for-1ss-chip.patch
@@ -0,0 +1,68 @@
+From 10bb08c0bceed97c3707995fb5c5f6d996b533eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 17:21:46 +0800
+Subject: rtw88: fix rate mask for 1SS chip
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 35a68fa5f96a80797e11b6952a47c5a84939a7bf ]
+
+The rate mask is used to tell firmware the supported rate depends on
+negotiation. We loop 2 times for all VHT/HT 2SS rate mask first, and then
+only keep the part according to chip's NSS.
+
+This commit fixes the logic error of '&' operations for VHT/HT rate, and
+we should run this logic before adding legacy rate.
+
+To access HT MCS map, index 0/1 represent MCS 0-7/8-15 respectively. Use
+NL80211_BAND_xxx is incorrect, so fix it as well.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Reviewed-by: Chris Chiu <chiu@endlessm.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index ae61415e16654..f369ddca953af 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -706,8 +706,8 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
+ 		if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
+ 			is_support_sgi = true;
+ 	} else if (sta->ht_cap.ht_supported) {
+-		ra_mask |= (sta->ht_cap.mcs.rx_mask[NL80211_BAND_5GHZ] << 20) |
+-			   (sta->ht_cap.mcs.rx_mask[NL80211_BAND_2GHZ] << 12);
++		ra_mask |= (sta->ht_cap.mcs.rx_mask[1] << 20) |
++			   (sta->ht_cap.mcs.rx_mask[0] << 12);
+ 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
+ 			stbc_en = HT_STBC_EN;
+ 		if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
+@@ -717,6 +717,9 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
+ 			is_support_sgi = true;
+ 	}
+ 
++	if (efuse->hw_cap.nss == 1)
++		ra_mask &= RA_MASK_VHT_RATES_1SS | RA_MASK_HT_RATES_1SS;
++
+ 	if (hal->current_band_type == RTW_BAND_5G) {
+ 		ra_mask |= (u64)sta->supp_rates[NL80211_BAND_5GHZ] << 4;
+ 		if (sta->vht_cap.vht_supported) {
+@@ -750,11 +753,6 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
+ 		wireless_set = 0;
+ 	}
+ 
+-	if (efuse->hw_cap.nss == 1) {
+-		ra_mask &= RA_MASK_VHT_RATES_1SS;
+-		ra_mask &= RA_MASK_HT_RATES_1SS;
+-	}
+-
+ 	switch (sta->bandwidth) {
+ 	case IEEE80211_STA_RX_BW_80:
+ 		bw_mode = RTW_CHANNEL_WIDTH_80;
+-- 
+2.20.1
+
diff --git a/queue-5.5/s390-adjust-mpacked-stack-support-check-for-clang-10.patch b/queue-5.5/s390-adjust-mpacked-stack-support-check-for-clang-10.patch
new file mode 100644
index 00000000000..3cf162d23f4
--- /dev/null
+++ b/queue-5.5/s390-adjust-mpacked-stack-support-check-for-clang-10.patch
@@ -0,0 +1,49 @@
+From c10f7faea6c329fdd3546d6b4b05ac4448e11959 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 14:46:00 +0100
+Subject: s390: adjust -mpacked-stack support check for clang 10
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 253b3c4b2920e07ce9e2b18800b9b65245e2fafa ]
+
+clang 10 introduces -mpacked-stack compiler option implementation. At the
+same time currently it does not support a combination of -mpacked-stack
+and -mbackchain. This leads to the following build error:
+
+clang: error: unsupported option '-mpacked-stack with -mbackchain' for
+target 's390x-ibm-linux'
+
+If/when clang adds support for a combination of -mpacked-stack and
+-mbackchain it would also require -msoft-float (like gcc does). According
+to Ulrich Weigand "stack slot assigned to the kernel backchain overlaps
+the stack slot assigned to the FPR varargs (both are required to be
+placed immediately after the saved r15 slot if present)."
+
+Extend -mpacked-stack compiler option support check to include all 3
+options -mpacked-stack -mbackchain -msoft-float which must present to
+support -mpacked-stack with -mbackchain.
+
+Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/Makefile b/arch/s390/Makefile
+index ba8556bb0fb15..e0e3a465bbfd6 100644
+--- a/arch/s390/Makefile
++++ b/arch/s390/Makefile
+@@ -69,7 +69,7 @@ cflags-y += -Wa,-I$(srctree)/arch/$(ARCH)/include
+ #
+ cflags-$(CONFIG_FRAME_POINTER) += -fno-optimize-sibling-calls
+ 
+-ifeq ($(call cc-option-yn,-mpacked-stack),y)
++ifeq ($(call cc-option-yn,-mpacked-stack -mbackchain -msoft-float),y)
+ cflags-$(CONFIG_PACK_STACK)  += -mpacked-stack -D__PACK_STACK
+ aflags-$(CONFIG_PACK_STACK)  += -D__PACK_STACK
+ endif
+-- 
+2.20.1
+
diff --git a/queue-5.5/s390-fix-__emit_bug-macro.patch b/queue-5.5/s390-fix-__emit_bug-macro.patch
new file mode 100644
index 00000000000..e3edf34332c
--- /dev/null
+++ b/queue-5.5/s390-fix-__emit_bug-macro.patch
@@ -0,0 +1,201 @@
+From 787d0409238da41993a9c918d46041247e3df07e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 13:42:27 +0100
+Subject: s390: fix __EMIT_BUG() macro
+
+From: Sven Schnelle <svens@linux.ibm.com>
+
+[ Upstream commit 17248ea0367465f4aaef728f6af661ed38e38cf1 ]
+
+Setting a kprobe on getname_flags() failed:
+
+$ echo 'p:tmr1 getname_flags +0(%r2):ustring' > kprobe_events
+-bash: echo: write error: Invalid argument
+
+Debugging the kprobes code showed that the address of
+getname_flags() is contained in the __bug_table. Kprobes
+doesn't allow to set probes at BUG() locations.
+
+$ objdump -j  __bug_table -x build/fs/namei.o
+[..]
+0000000000000108 R_390_PC32        .text+0x00000000000075a8
+000000000000010c R_390_PC32        .L223+0x0000000000000004
+
+I was expecting getname_flags() to start with a BUG(), but:
+
+7598:       e3 20 10 00 00 04       lg      %r2,0(%r1)
+759e:       c0 f4 00 00 00 00       jg      759e <putname+0x7e>
+75a0: R_390_PLT32DBL    kmem_cache_free+0x2
+75a4:       a7 f4 00 01             j       75a6 <putname+0x86>
+
+00000000000075a8 <getname_flags>:
+75a8:       c0 04 00 00 00 00       brcl    0,75a8 <getname_flags>
+75ae:       eb 6f f0 48 00 24       stmg    %r6,%r15,72(%r15)
+75b4:       b9 04 00 ef             lgr     %r14,%r15
+75b8:       e3 f0 ff a8 ff 71       lay     %r15,-88(%r15)
+
+So the BUG() is actually the last opcode of the previous function.
+Fix this by switching to using the MONITOR CALL (MC) instruction,
+and set the entry in __bug_table to the beginning of that MC.
+
+Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/head.S        |  2 +-
+ arch/s390/include/asm/bug.h  | 16 ++++++--------
+ arch/s390/kernel/entry.h     |  1 +
+ arch/s390/kernel/pgm_check.S |  2 +-
+ arch/s390/kernel/traps.c     | 41 +++++++++++++++++++++++++++++++-----
+ 5 files changed, 46 insertions(+), 16 deletions(-)
+
+diff --git a/arch/s390/boot/head.S b/arch/s390/boot/head.S
+index 4b86a8d3c1219..dae10961d0724 100644
+--- a/arch/s390/boot/head.S
++++ b/arch/s390/boot/head.S
+@@ -329,7 +329,7 @@ ENTRY(startup_kdump)
+ 	.quad	.Lduct			# cr5: primary-aste origin
+ 	.quad	0			# cr6:	I/O interrupts
+ 	.quad	0			# cr7:	secondary space segment table
+-	.quad	0			# cr8:	access registers translation
++	.quad	0x0000000000008000	# cr8:	access registers translation
+ 	.quad	0			# cr9:	tracing off
+ 	.quad	0			# cr10: tracing off
+ 	.quad	0			# cr11: tracing off
+diff --git a/arch/s390/include/asm/bug.h b/arch/s390/include/asm/bug.h
+index a2b11ac00f607..7725f8006fdfb 100644
+--- a/arch/s390/include/asm/bug.h
++++ b/arch/s390/include/asm/bug.h
+@@ -10,15 +10,14 @@
+ 
+ #define __EMIT_BUG(x) do {					\
+ 	asm_inline volatile(					\
+-		"0:	j	0b+2\n"				\
+-		"1:\n"						\
++		"0:	mc	0,0\n"				\
+ 		".section .rodata.str,\"aMS\",@progbits,1\n"	\
+-		"2:	.asciz	\""__FILE__"\"\n"		\
++		"1:	.asciz	\""__FILE__"\"\n"		\
+ 		".previous\n"					\
+ 		".section __bug_table,\"awM\",@progbits,%2\n"	\
+-		"3:	.long	1b-3b,2b-3b\n"			\
++		"2:	.long	0b-2b,1b-2b\n"			\
+ 		"	.short	%0,%1\n"			\
+-		"	.org	3b+%2\n"			\
++		"	.org	2b+%2\n"			\
+ 		".previous\n"					\
+ 		: : "i" (__LINE__),				\
+ 		    "i" (x),					\
+@@ -29,12 +28,11 @@
+ 
+ #define __EMIT_BUG(x) do {					\
+ 	asm_inline volatile(					\
+-		"0:	j	0b+2\n"				\
+-		"1:\n"						\
++		"0:	mc	0,0\n"				\
+ 		".section __bug_table,\"awM\",@progbits,%1\n"	\
+-		"2:	.long	1b-2b\n"			\
++		"1:	.long	0b-1b\n"			\
+ 		"	.short	%0\n"				\
+-		"	.org	2b+%1\n"			\
++		"	.org	1b+%1\n"			\
+ 		".previous\n"					\
+ 		: : "i" (x),					\
+ 		    "i" (sizeof(struct bug_entry)));		\
+diff --git a/arch/s390/kernel/entry.h b/arch/s390/kernel/entry.h
+index b2956d49b6ad7..1d3927e01a5fd 100644
+--- a/arch/s390/kernel/entry.h
++++ b/arch/s390/kernel/entry.h
+@@ -45,6 +45,7 @@ void specification_exception(struct pt_regs *regs);
+ void transaction_exception(struct pt_regs *regs);
+ void translation_exception(struct pt_regs *regs);
+ void vector_exception(struct pt_regs *regs);
++void monitor_event_exception(struct pt_regs *regs);
+ 
+ void do_per_trap(struct pt_regs *regs);
+ void do_report_trap(struct pt_regs *regs, int si_signo, int si_code, char *str);
+diff --git a/arch/s390/kernel/pgm_check.S b/arch/s390/kernel/pgm_check.S
+index 59dee9d3bebf1..eee3a482195a6 100644
+--- a/arch/s390/kernel/pgm_check.S
++++ b/arch/s390/kernel/pgm_check.S
+@@ -81,7 +81,7 @@ PGM_CHECK_DEFAULT			/* 3c */
+ PGM_CHECK_DEFAULT			/* 3d */
+ PGM_CHECK_DEFAULT			/* 3e */
+ PGM_CHECK_DEFAULT			/* 3f */
+-PGM_CHECK_DEFAULT			/* 40 */
++PGM_CHECK(monitor_event_exception)	/* 40 */
+ PGM_CHECK_DEFAULT			/* 41 */
+ PGM_CHECK_DEFAULT			/* 42 */
+ PGM_CHECK_DEFAULT			/* 43 */
+diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
+index 164c0282b41ae..dc75588d78943 100644
+--- a/arch/s390/kernel/traps.c
++++ b/arch/s390/kernel/traps.c
+@@ -53,11 +53,6 @@ void do_report_trap(struct pt_regs *regs, int si_signo, int si_code, char *str)
+                 if (fixup)
+ 			regs->psw.addr = extable_fixup(fixup);
+ 		else {
+-			enum bug_trap_type btt;
+-
+-			btt = report_bug(regs->psw.addr, regs);
+-			if (btt == BUG_TRAP_TYPE_WARN)
+-				return;
+ 			die(regs, str);
+ 		}
+         }
+@@ -245,6 +240,27 @@ void space_switch_exception(struct pt_regs *regs)
+ 	do_trap(regs, SIGILL, ILL_PRVOPC, "space switch event");
+ }
+ 
++void monitor_event_exception(struct pt_regs *regs)
++{
++	const struct exception_table_entry *fixup;
++
++	if (user_mode(regs))
++		return;
++
++	switch (report_bug(regs->psw.addr - (regs->int_code >> 16), regs)) {
++	case BUG_TRAP_TYPE_NONE:
++		fixup = s390_search_extables(regs->psw.addr);
++		if (fixup)
++			regs->psw.addr = extable_fixup(fixup);
++		break;
++	case BUG_TRAP_TYPE_WARN:
++		break;
++	case BUG_TRAP_TYPE_BUG:
++		die(regs, "monitor event");
++		break;
++	}
++}
++
+ void kernel_stack_overflow(struct pt_regs *regs)
+ {
+ 	bust_spinlocks(1);
+@@ -255,8 +271,23 @@ void kernel_stack_overflow(struct pt_regs *regs)
+ }
+ NOKPROBE_SYMBOL(kernel_stack_overflow);
+ 
++static void test_monitor_call(void)
++{
++	int val = 1;
++
++	asm volatile(
++		"	mc	0,0\n"
++		"0:	xgr	%0,%0\n"
++		"1:\n"
++		EX_TABLE(0b,1b)
++		: "+d" (val));
++	if (!val)
++		panic("Monitor call doesn't work!\n");
++}
++
+ void __init trap_init(void)
+ {
+ 	sort_extable(__start_dma_ex_table, __stop_dma_ex_table);
+ 	local_mcck_enable();
++	test_monitor_call();
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/s390-ftrace-generate-traced-function-stack-frame.patch b/queue-5.5/s390-ftrace-generate-traced-function-stack-frame.patch
new file mode 100644
index 00000000000..b9ddb8dd0f1
--- /dev/null
+++ b/queue-5.5/s390-ftrace-generate-traced-function-stack-frame.patch
@@ -0,0 +1,103 @@
+From 4c071d62cecf600b5c4493293b93d9dcc5162d82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 14:33:39 +0100
+Subject: s390/ftrace: generate traced function stack frame
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 45f7a0da600d3c409b5ad8d5ddddacd98ddc8840 ]
+
+Currently backtrace from ftraced function does not contain ftraced
+function itself. e.g. for "path_openat":
+
+arch_stack_walk+0x15c/0x2d8
+stack_trace_save+0x50/0x68
+stack_trace_call+0x15e/0x3d8
+ftrace_graph_caller+0x0/0x1c <-- ftrace code
+do_filp_open+0x7c/0xe8 <-- ftraced function caller
+do_open_execat+0x76/0x1b8
+open_exec+0x52/0x78
+load_elf_binary+0x180/0x1160
+search_binary_handler+0x8e/0x288
+load_script+0x2a8/0x2b8
+search_binary_handler+0x8e/0x288
+__do_execve_file.isra.39+0x6fa/0xb40
+__s390x_sys_execve+0x56/0x68
+system_call+0xdc/0x2d8
+
+Ftraced function is expected in the backtrace by ftrace kselftests, which
+are now failing. It would also be nice to have it for clarity reasons.
+
+"ftrace_caller" itself is called without stack frame allocated for it
+and does not store its caller (ftraced function). Instead it simply
+allocates a stack frame for "ftrace_trace_function" and sets backchain
+to point to ftraced function stack frame (which contains ftraced function
+caller in saved r14).
+
+To fix this issue make "ftrace_caller" allocate a stack frame
+for itself just to store ftraced function for the stack unwinder.
+As a result backtrace looks like the following:
+
+arch_stack_walk+0x15c/0x2d8
+stack_trace_save+0x50/0x68
+stack_trace_call+0x15e/0x3d8
+ftrace_graph_caller+0x0/0x1c <-- ftrace code
+path_openat+0x6/0xd60  <-- ftraced function
+do_filp_open+0x7c/0xe8 <-- ftraced function caller
+do_open_execat+0x76/0x1b8
+open_exec+0x52/0x78
+load_elf_binary+0x180/0x1160
+search_binary_handler+0x8e/0x288
+load_script+0x2a8/0x2b8
+search_binary_handler+0x8e/0x288
+__do_execve_file.isra.39+0x6fa/0xb40
+__s390x_sys_execve+0x56/0x68
+system_call+0xdc/0x2d8
+
+Reported-by: Sven Schnelle <sven.schnelle@ibm.com>
+Tested-by: Sven Schnelle <sven.schnelle@ibm.com>
+Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/mcount.S | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
+index c3597d2e2ae0e..f942341429b1c 100644
+--- a/arch/s390/kernel/mcount.S
++++ b/arch/s390/kernel/mcount.S
+@@ -26,6 +26,12 @@ ENDPROC(ftrace_stub)
+ #define STACK_PTREGS	  (STACK_FRAME_OVERHEAD)
+ #define STACK_PTREGS_GPRS (STACK_PTREGS + __PT_GPRS)
+ #define STACK_PTREGS_PSW  (STACK_PTREGS + __PT_PSW)
++#ifdef __PACK_STACK
++/* allocate just enough for r14, r15 and backchain */
++#define TRACED_FUNC_FRAME_SIZE	24
++#else
++#define TRACED_FUNC_FRAME_SIZE	STACK_FRAME_OVERHEAD
++#endif
+ 
+ ENTRY(_mcount)
+ 	BR_EX	%r14
+@@ -40,9 +46,16 @@ ENTRY(ftrace_caller)
+ #if !(defined(CC_USING_HOTPATCH) || defined(CC_USING_NOP_MCOUNT))
+ 	aghi	%r0,MCOUNT_RETURN_FIXUP
+ #endif
+-	aghi	%r15,-STACK_FRAME_SIZE
++	# allocate stack frame for ftrace_caller to contain traced function
++	aghi	%r15,-TRACED_FUNC_FRAME_SIZE
+ 	stg	%r1,__SF_BACKCHAIN(%r15)
++	stg	%r0,(__SF_GPRS+8*8)(%r15)
++	stg	%r15,(__SF_GPRS+9*8)(%r15)
++	# allocate pt_regs and stack frame for ftrace_trace_function
++	aghi	%r15,-STACK_FRAME_SIZE
+ 	stg	%r1,(STACK_PTREGS_GPRS+15*8)(%r15)
++	aghi	%r1,-TRACED_FUNC_FRAME_SIZE
++	stg	%r1,__SF_BACKCHAIN(%r15)
+ 	stg	%r0,(STACK_PTREGS_PSW+8)(%r15)
+ 	stmg	%r2,%r14,(STACK_PTREGS_GPRS+2*8)(%r15)
+ #ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
+-- 
+2.20.1
+
diff --git a/queue-5.5/s390-pci-fix-possible-deadlock-in-recover_store.patch b/queue-5.5/s390-pci-fix-possible-deadlock-in-recover_store.patch
new file mode 100644
index 00000000000..4bda5e624f6
--- /dev/null
+++ b/queue-5.5/s390-pci-fix-possible-deadlock-in-recover_store.patch
@@ -0,0 +1,216 @@
+From e27bd56647e2b4d1f1b97ca8c232892075ddf819 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 09:16:59 +0100
+Subject: s390/pci: Fix possible deadlock in recover_store()
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 576c75e36c689bec6a940e807bae27291ab0c0de ]
+
+With zpci_disable() working, lockdep detected a potential deadlock
+(lockdep output at the end).
+
+The deadlock is between recovering a PCI function via the
+
+/sys/bus/pci/devices/<dev>/recover
+
+attribute vs powering it off via
+
+/sys/bus/pci/slots/<slot>/power.
+
+The fix is analogous to the changes in commit 0ee223b2e1f6 ("scsi: core:
+Avoid that SCSI device removal through sysfs triggers a deadlock")
+that fixed a potential deadlock on removing a SCSI device via sysfs.
+
+[  204.830107] ======================================================
+[  204.830109] WARNING: possible circular locking dependency detected
+[  204.830111] 5.5.0-rc2-06072-gbc03ecc9a672 #6 Tainted: G        W
+[  204.830112] ------------------------------------------------------
+[  204.830113] bash/1034 is trying to acquire lock:
+[  204.830115] 0000000192a1a610 (kn->count#200){++++}, at: kernfs_remove_by_name_ns+0x5c/0xa8
+[  204.830122]
+               but task is already holding lock:
+[  204.830123] 00000000c16134a8 (pci_rescan_remove_lock){+.+.}, at: pci_stop_and_remove_bus_device_locked+0x26/0x48
+[  204.830128]
+               which lock already depends on the new lock.
+
+[  204.830129]
+               the existing dependency chain (in reverse order) is:
+[  204.830130]
+               -> #1 (pci_rescan_remove_lock){+.+.}:
+[  204.830134]        validate_chain+0x93a/0xd08
+[  204.830136]        __lock_acquire+0x4ae/0x9d0
+[  204.830137]        lock_acquire+0x114/0x280
+[  204.830140]        __mutex_lock+0xa2/0x960
+[  204.830142]        mutex_lock_nested+0x32/0x40
+[  204.830145]        recover_store+0x4c/0xa8
+[  204.830147]        kernfs_fop_write+0xe6/0x218
+[  204.830151]        vfs_write+0xb0/0x1b8
+[  204.830152]        ksys_write+0x6c/0xf8
+[  204.830154]        system_call+0xd8/0x2d8
+[  204.830155]
+               -> #0 (kn->count#200){++++}:
+[  204.830187]        check_noncircular+0x1e6/0x240
+[  204.830189]        check_prev_add+0xfc/0xdb0
+[  204.830190]        validate_chain+0x93a/0xd08
+[  204.830192]        __lock_acquire+0x4ae/0x9d0
+[  204.830193]        lock_acquire+0x114/0x280
+[  204.830194]        __kernfs_remove.part.0+0x2e4/0x360
+[  204.830196]        kernfs_remove_by_name_ns+0x5c/0xa8
+[  204.830198]        remove_files.isra.0+0x4c/0x98
+[  204.830199]        sysfs_remove_group+0x66/0xc8
+[  204.830201]        sysfs_remove_groups+0x46/0x68
+[  204.830204]        device_remove_attrs+0x52/0x90
+[  204.830207]        device_del+0x182/0x418
+[  204.830208]        pci_remove_bus_device+0x8a/0x130
+[  204.830210]        pci_stop_and_remove_bus_device_locked+0x3a/0x48
+[  204.830212]        disable_slot+0x68/0x100
+[  204.830213]        power_write_file+0x7c/0x130
+[  204.830215]        kernfs_fop_write+0xe6/0x218
+[  204.830217]        vfs_write+0xb0/0x1b8
+[  204.830218]        ksys_write+0x6c/0xf8
+[  204.830220]        system_call+0xd8/0x2d8
+[  204.830221]
+               other info that might help us debug this:
+
+[  204.830223]  Possible unsafe locking scenario:
+
+[  204.830224]        CPU0                    CPU1
+[  204.830225]        ----                    ----
+[  204.830226]   lock(pci_rescan_remove_lock);
+[  204.830227]                                lock(kn->count#200);
+[  204.830229]                                lock(pci_rescan_remove_lock);
+[  204.830231]   lock(kn->count#200);
+[  204.830233]
+                *** DEADLOCK ***
+
+[  204.830234] 4 locks held by bash/1034:
+[  204.830235]  #0: 00000001b6fbc498 (sb_writers#4){.+.+}, at: vfs_write+0x158/0x1b8
+[  204.830239]  #1: 000000018c9f5090 (&of->mutex){+.+.}, at: kernfs_fop_write+0xaa/0x218
+[  204.830242]  #2: 00000001f7da0810 (kn->count#235){.+.+}, at: kernfs_fop_write+0xb6/0x218
+[  204.830245]  #3: 00000000c16134a8 (pci_rescan_remove_lock){+.+.}, at: pci_stop_and_remove_bus_device_locked+0x26/0x48
+[  204.830248]
+               stack backtrace:
+[  204.830250] CPU: 2 PID: 1034 Comm: bash Tainted: G        W         5.5.0-rc2-06072-gbc03ecc9a672 #6
+[  204.830252] Hardware name: IBM 8561 T01 703 (LPAR)
+[  204.830253] Call Trace:
+[  204.830257]  [<00000000c05e10c0>] show_stack+0x88/0xf0
+[  204.830260]  [<00000000c112dca4>] dump_stack+0xa4/0xe0
+[  204.830261]  [<00000000c0694c06>] check_noncircular+0x1e6/0x240
+[  204.830263]  [<00000000c0695bec>] check_prev_add+0xfc/0xdb0
+[  204.830264]  [<00000000c06971da>] validate_chain+0x93a/0xd08
+[  204.830266]  [<00000000c06994c6>] __lock_acquire+0x4ae/0x9d0
+[  204.830267]  [<00000000c069867c>] lock_acquire+0x114/0x280
+[  204.830269]  [<00000000c09ca15c>] __kernfs_remove.part.0+0x2e4/0x360
+[  204.830270]  [<00000000c09cb5c4>] kernfs_remove_by_name_ns+0x5c/0xa8
+[  204.830272]  [<00000000c09cee14>] remove_files.isra.0+0x4c/0x98
+[  204.830274]  [<00000000c09cf2ae>] sysfs_remove_group+0x66/0xc8
+[  204.830276]  [<00000000c09cf356>] sysfs_remove_groups+0x46/0x68
+[  204.830278]  [<00000000c0e3dfe2>] device_remove_attrs+0x52/0x90
+[  204.830280]  [<00000000c0e40382>] device_del+0x182/0x418
+[  204.830281]  [<00000000c0dcfd7a>] pci_remove_bus_device+0x8a/0x130
+[  204.830283]  [<00000000c0dcfe92>] pci_stop_and_remove_bus_device_locked+0x3a/0x48
+[  204.830285]  [<00000000c0de7190>] disable_slot+0x68/0x100
+[  204.830286]  [<00000000c0de6514>] power_write_file+0x7c/0x130
+[  204.830288]  [<00000000c09cc846>] kernfs_fop_write+0xe6/0x218
+[  204.830290]  [<00000000c08f3480>] vfs_write+0xb0/0x1b8
+[  204.830291]  [<00000000c08f378c>] ksys_write+0x6c/0xf8
+[  204.830293]  [<00000000c1154374>] system_call+0xd8/0x2d8
+[  204.830294] INFO: lockdep is turned off.
+
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/pci/pci_sysfs.c | 63 ++++++++++++++++++++++++++-------------
+ 1 file changed, 42 insertions(+), 21 deletions(-)
+
+diff --git a/arch/s390/pci/pci_sysfs.c b/arch/s390/pci/pci_sysfs.c
+index a433ba01a3175..215f17437a4f6 100644
+--- a/arch/s390/pci/pci_sysfs.c
++++ b/arch/s390/pci/pci_sysfs.c
+@@ -13,6 +13,8 @@
+ #include <linux/stat.h>
+ #include <linux/pci.h>
+ 
++#include "../../../drivers/pci/pci.h"
++
+ #include <asm/sclp.h>
+ 
+ #define zpci_attr(name, fmt, member)					\
+@@ -49,31 +51,50 @@ static DEVICE_ATTR_RO(mio_enabled);
+ static ssize_t recover_store(struct device *dev, struct device_attribute *attr,
+ 			     const char *buf, size_t count)
+ {
++	struct kernfs_node *kn;
+ 	struct pci_dev *pdev = to_pci_dev(dev);
+ 	struct zpci_dev *zdev = to_zpci(pdev);
+-	int ret;
+-
+-	if (!device_remove_file_self(dev, attr))
+-		return count;
+-
++	int ret = 0;
++
++	/* Can't use device_remove_self() here as that would lead us to lock
++	 * the pci_rescan_remove_lock while holding the device' kernfs lock.
++	 * This would create a possible deadlock with disable_slot() which is
++	 * not directly protected by the device' kernfs lock but takes it
++	 * during the device removal which happens under
++	 * pci_rescan_remove_lock.
++	 *
++	 * This is analogous to sdev_store_delete() in
++	 * drivers/scsi/scsi_sysfs.c
++	 */
++	kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
++	WARN_ON_ONCE(!kn);
++	/* device_remove_file() serializes concurrent calls ignoring all but
++	 * the first
++	 */
++	device_remove_file(dev, attr);
++
++	/* A concurrent call to recover_store() may slip between
++	 * sysfs_break_active_protection() and the sysfs file removal.
++	 * Once it unblocks from pci_lock_rescan_remove() the original pdev
++	 * will already be removed.
++	 */
+ 	pci_lock_rescan_remove();
+-	pci_stop_and_remove_bus_device(pdev);
+-	ret = zpci_disable_device(zdev);
+-	if (ret)
+-		goto error;
+-
+-	ret = zpci_enable_device(zdev);
+-	if (ret)
+-		goto error;
+-
+-	pci_rescan_bus(zdev->bus);
++	if (pci_dev_is_added(pdev)) {
++		pci_stop_and_remove_bus_device(pdev);
++		ret = zpci_disable_device(zdev);
++		if (ret)
++			goto out;
++
++		ret = zpci_enable_device(zdev);
++		if (ret)
++			goto out;
++		pci_rescan_bus(zdev->bus);
++	}
++out:
+ 	pci_unlock_rescan_remove();
+-
+-	return count;
+-
+-error:
+-	pci_unlock_rescan_remove();
+-	return ret;
++	if (kn)
++		sysfs_unbreak_active_protection(kn);
++	return ret ? ret : count;
+ }
+ static DEVICE_ATTR_WO(recover);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/s390-pci-recover-handle-in-clp_set_pci_fn.patch b/queue-5.5/s390-pci-recover-handle-in-clp_set_pci_fn.patch
new file mode 100644
index 00000000000..dcbbbfbe877
--- /dev/null
+++ b/queue-5.5/s390-pci-recover-handle-in-clp_set_pci_fn.patch
@@ -0,0 +1,194 @@
+From b25305f03d55c942a7008afa31dc51ba01ab5572 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 09:34:46 +0100
+Subject: s390/pci: Recover handle in clp_set_pci_fn()
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 17cdec960cf776b20b1fb08c622221babe591d51 ]
+
+When we try to recover a PCI function using
+
+    echo 1 > /sys/bus/pci/devices/<id>/recover
+
+or manually with
+
+    echo 1 > /sys/bus/pci/devices/<id>/remove
+    echo 0 > /sys/bus/pci/slots/<slot>/power
+    echo 1 > /sys/bus/pci/slots/<slot>/power
+
+clp_disable_fn() / clp_enable_fn() call clp_set_pci_fn() to first
+disable and then reenable the function.
+
+When the function is already in the requested state we may be left with
+an invalid function handle.
+
+To get a new valid handle we do a clp_list_pci() call. For this we need
+both the function ID and function handle in clp_set_pci_fn() so pass the
+zdev and get both.
+
+To simplify things also pull setting the refreshed function handle into
+clp_set_pci_fn()
+
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/pci.h |  2 +-
+ arch/s390/pci/pci.c         |  2 +-
+ arch/s390/pci/pci_clp.c     | 48 ++++++++++++++++++++++---------------
+ 3 files changed, 31 insertions(+), 21 deletions(-)
+
+diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
+index 3a06c264ea533..b05187ce5dbdc 100644
+--- a/arch/s390/include/asm/pci.h
++++ b/arch/s390/include/asm/pci.h
+@@ -180,7 +180,7 @@ void zpci_remove_reserved_devices(void);
+ /* CLP */
+ int clp_scan_pci_devices(void);
+ int clp_rescan_pci_devices(void);
+-int clp_rescan_pci_devices_simple(void);
++int clp_rescan_pci_devices_simple(u32 *fid);
+ int clp_add_pci_device(u32, u32, int);
+ int clp_enable_fh(struct zpci_dev *, u8);
+ int clp_disable_fh(struct zpci_dev *);
+diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
+index 8e872951c07ba..bc61ea18e88d9 100644
+--- a/arch/s390/pci/pci.c
++++ b/arch/s390/pci/pci.c
+@@ -939,5 +939,5 @@ subsys_initcall_sync(pci_base_init);
+ void zpci_rescan(void)
+ {
+ 	if (zpci_is_enabled())
+-		clp_rescan_pci_devices_simple();
++		clp_rescan_pci_devices_simple(NULL);
+ }
+diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
+index 4c613e569fe08..0d3d8f170ea42 100644
+--- a/arch/s390/pci/pci_clp.c
++++ b/arch/s390/pci/pci_clp.c
+@@ -240,12 +240,14 @@ error:
+ }
+ 
+ /*
+- * Enable/Disable a given PCI function defined by its function handle.
++ * Enable/Disable a given PCI function and update its function handle if
++ * necessary
+  */
+-static int clp_set_pci_fn(u32 *fh, u8 nr_dma_as, u8 command)
++static int clp_set_pci_fn(struct zpci_dev *zdev, u8 nr_dma_as, u8 command)
+ {
+ 	struct clp_req_rsp_set_pci *rrb;
+ 	int rc, retries = 100;
++	u32 fid = zdev->fid;
+ 
+ 	rrb = clp_alloc_block(GFP_KERNEL);
+ 	if (!rrb)
+@@ -256,7 +258,7 @@ static int clp_set_pci_fn(u32 *fh, u8 nr_dma_as, u8 command)
+ 		rrb->request.hdr.len = sizeof(rrb->request);
+ 		rrb->request.hdr.cmd = CLP_SET_PCI_FN;
+ 		rrb->response.hdr.len = sizeof(rrb->response);
+-		rrb->request.fh = *fh;
++		rrb->request.fh = zdev->fh;
+ 		rrb->request.oc = command;
+ 		rrb->request.ndas = nr_dma_as;
+ 
+@@ -269,12 +271,17 @@ static int clp_set_pci_fn(u32 *fh, u8 nr_dma_as, u8 command)
+ 		}
+ 	} while (rrb->response.hdr.rsp == CLP_RC_SETPCIFN_BUSY);
+ 
+-	if (!rc && rrb->response.hdr.rsp == CLP_RC_OK)
+-		*fh = rrb->response.fh;
+-	else {
++	if (rc || rrb->response.hdr.rsp != CLP_RC_OK) {
+ 		zpci_err("Set PCI FN:\n");
+ 		zpci_err_clp(rrb->response.hdr.rsp, rc);
+-		rc = -EIO;
++	}
++
++	if (!rc && rrb->response.hdr.rsp == CLP_RC_OK) {
++		zdev->fh = rrb->response.fh;
++	} else if (!rc && rrb->response.hdr.rsp == CLP_RC_SETPCIFN_ALRDY &&
++			rrb->response.fh == 0) {
++		/* Function is already in desired state - update handle */
++		rc = clp_rescan_pci_devices_simple(&fid);
+ 	}
+ 	clp_free_block(rrb);
+ 	return rc;
+@@ -282,18 +289,17 @@ static int clp_set_pci_fn(u32 *fh, u8 nr_dma_as, u8 command)
+ 
+ int clp_enable_fh(struct zpci_dev *zdev, u8 nr_dma_as)
+ {
+-	u32 fh = zdev->fh;
+ 	int rc;
+ 
+-	rc = clp_set_pci_fn(&fh, nr_dma_as, CLP_SET_ENABLE_PCI_FN);
+-	zpci_dbg(3, "ena fid:%x, fh:%x, rc:%d\n", zdev->fid, fh, rc);
++	rc = clp_set_pci_fn(zdev, nr_dma_as, CLP_SET_ENABLE_PCI_FN);
++	zpci_dbg(3, "ena fid:%x, fh:%x, rc:%d\n", zdev->fid, zdev->fh, rc);
+ 	if (rc)
+ 		goto out;
+ 
+-	zdev->fh = fh;
+ 	if (zpci_use_mio(zdev)) {
+-		rc = clp_set_pci_fn(&fh, nr_dma_as, CLP_SET_ENABLE_MIO);
+-		zpci_dbg(3, "ena mio fid:%x, fh:%x, rc:%d\n", zdev->fid, fh, rc);
++		rc = clp_set_pci_fn(zdev, nr_dma_as, CLP_SET_ENABLE_MIO);
++		zpci_dbg(3, "ena mio fid:%x, fh:%x, rc:%d\n",
++				zdev->fid, zdev->fh, rc);
+ 		if (rc)
+ 			clp_disable_fh(zdev);
+ 	}
+@@ -309,11 +315,8 @@ int clp_disable_fh(struct zpci_dev *zdev)
+ 	if (!zdev_enabled(zdev))
+ 		return 0;
+ 
+-	rc = clp_set_pci_fn(&fh, 0, CLP_SET_DISABLE_PCI_FN);
++	rc = clp_set_pci_fn(zdev, 0, CLP_SET_DISABLE_PCI_FN);
+ 	zpci_dbg(3, "dis fid:%x, fh:%x, rc:%d\n", zdev->fid, fh, rc);
+-	if (!rc)
+-		zdev->fh = fh;
+-
+ 	return rc;
+ }
+ 
+@@ -370,10 +373,14 @@ static void __clp_add(struct clp_fh_list_entry *entry, void *data)
+ static void __clp_update(struct clp_fh_list_entry *entry, void *data)
+ {
+ 	struct zpci_dev *zdev;
++	u32 *fid = data;
+ 
+ 	if (!entry->vendor_id)
+ 		return;
+ 
++	if (fid && *fid != entry->fid)
++		return;
++
+ 	zdev = get_zdev_by_fid(entry->fid);
+ 	if (!zdev)
+ 		return;
+@@ -413,7 +420,10 @@ int clp_rescan_pci_devices(void)
+ 	return rc;
+ }
+ 
+-int clp_rescan_pci_devices_simple(void)
++/* Rescan PCI functions and refresh function handles. If fid is non-NULL only
++ * refresh the handle of the function matching @fid
++ */
++int clp_rescan_pci_devices_simple(u32 *fid)
+ {
+ 	struct clp_req_rsp_list_pci *rrb;
+ 	int rc;
+@@ -422,7 +432,7 @@ int clp_rescan_pci_devices_simple(void)
+ 	if (!rrb)
+ 		return -ENOMEM;
+ 
+-	rc = clp_list_pci(rrb, NULL, __clp_update);
++	rc = clp_list_pci(rrb, fid, __clp_update);
+ 
+ 	clp_free_block(rrb);
+ 	return rc;
+-- 
+2.20.1
+
diff --git a/queue-5.5/samples-bpf-set-fno-stack-protector-when-building-bp.patch b/queue-5.5/samples-bpf-set-fno-stack-protector-when-building-bp.patch
new file mode 100644
index 00000000000..92694a942d6
--- /dev/null
+++ b/queue-5.5/samples-bpf-set-fno-stack-protector-when-building-bp.patch
@@ -0,0 +1,46 @@
+From 60b910c3097c0f9a0a2fe9fa1060ddd2bfe64d91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 11:38:19 +0100
+Subject: samples/bpf: Set -fno-stack-protector when building BPF programs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 450278977acbf494a20367c22fbb38729772d1fc ]
+
+It seems Clang can in some cases turn on stack protection by default, which
+doesn't work with BPF. This was reported once before[0], but it seems the
+flag to explicitly turn off the stack protector wasn't added to the
+Makefile, so do that now.
+
+The symptom of this is compile errors like the following:
+
+error: <unknown>:0:0: in function bpf_prog1 i32 (%struct.__sk_buff*): A call to built-in function '__stack_chk_fail' is not supported.
+
+[0] https://www.spinics.net/lists/netdev/msg556400.html
+
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20191216103819.359535-1-toke@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
+index c0147a8cf1882..06ebe3104cc03 100644
+--- a/samples/bpf/Makefile
++++ b/samples/bpf/Makefile
+@@ -236,6 +236,7 @@ BTF_LLVM_PROBE := $(shell echo "int main() { return 0; }" | \
+ 			  readelf -S ./llvm_btf_verify.o | grep BTF; \
+ 			  /bin/rm -f ./llvm_btf_verify.o)
+ 
++BPF_EXTRA_CFLAGS += -fno-stack-protector
+ ifneq ($(BTF_LLVM_PROBE),)
+ 	BPF_EXTRA_CFLAGS += -g
+ else
+-- 
+2.20.1
+
diff --git a/queue-5.5/sched-core-fix-size-of-rq-uclamp-initialization.patch b/queue-5.5/sched-core-fix-size-of-rq-uclamp-initialization.patch
new file mode 100644
index 00000000000..20eb7ba045b
--- /dev/null
+++ b/queue-5.5/sched-core-fix-size-of-rq-uclamp-initialization.patch
@@ -0,0 +1,39 @@
+From 8c570193b0dbbc2f98217816ad53e7ea708839be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Dec 2019 15:44:04 +0800
+Subject: sched/core: Fix size of rq::uclamp initialization
+
+From: Li Guanglei <guanglei.li@unisoc.com>
+
+[ Upstream commit dcd6dffb0a75741471297724640733fa4e958d72 ]
+
+rq::uclamp is an array of struct uclamp_rq, make sure we clear the
+whole thing.
+
+Fixes: 69842cba9ace ("sched/uclamp: Add CPU's clamp buckets refcountinga")
+Signed-off-by: Li Guanglei <guanglei.li@unisoc.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Qais Yousef <qais.yousef@arm.com>
+Link: https://lkml.kernel.org/r/1577259844-12677-1-git-send-email-guangleix.li@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 894fb81313fd1..b2564d62a0f74 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1253,7 +1253,8 @@ static void __init init_uclamp(void)
+ 	mutex_init(&uclamp_mutex);
+ 
+ 	for_each_possible_cpu(cpu) {
+-		memset(&cpu_rq(cpu)->uclamp, 0, sizeof(struct uclamp_rq));
++		memset(&cpu_rq(cpu)->uclamp, 0,
++				sizeof(struct uclamp_rq)*UCLAMP_CNT);
+ 		cpu_rq(cpu)->uclamp_flags = 0;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/sched-topology-assert-non-numa-topology-masks-don-t-.patch b/queue-5.5/sched-topology-assert-non-numa-topology-masks-don-t-.patch
new file mode 100644
index 00000000000..fa15f660bf7
--- /dev/null
+++ b/queue-5.5/sched-topology-assert-non-numa-topology-masks-don-t-.patch
@@ -0,0 +1,144 @@
+From bfaf123fb4427241b6e0ba741ab9846bebc29b3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 16:09:15 +0000
+Subject: sched/topology: Assert non-NUMA topology masks don't (partially)
+ overlap
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit ccf74128d66ce937876184ad55db2e0276af08d3 ]
+
+topology.c::get_group() relies on the assumption that non-NUMA domains do
+not partially overlap. Zeng Tao pointed out in [1] that such topology
+descriptions, while completely bogus, can end up being exposed to the
+scheduler.
+
+In his example (8 CPUs, 2-node system), we end up with:
+  MC span for CPU3 == 3-7
+  MC span for CPU4 == 4-7
+
+The first pass through get_group(3, sdd@MC) will result in the following
+sched_group list:
+
+  3 -> 4 -> 5 -> 6 -> 7
+  ^                  /
+   `----------------'
+
+And a later pass through get_group(4, sdd@MC) will "corrupt" that to:
+
+  3 -> 4 -> 5 -> 6 -> 7
+       ^             /
+	`-----------'
+
+which will completely break things like 'while (sg != sd->groups)' when
+using CPU3's base sched_domain.
+
+There already are some architecture-specific checks in place such as
+x86/kernel/smpboot.c::topology.sane(), but this is something we can detect
+in the core scheduler, so it seems worthwhile to do so.
+
+Warn and abort the construction of the sched domains if such a broken
+topology description is detected. Note that this is somewhat
+expensive (O(t.c²), 't' non-NUMA topology levels and 'c' CPUs) and could be
+gated under SCHED_DEBUG if deemed necessary.
+
+Testing
+=======
+
+Dietmar managed to reproduce this using the following qemu incantation:
+
+  $ qemu-system-aarch64 -kernel ./Image -hda ./qemu-image-aarch64.img \
+  -append 'root=/dev/vda console=ttyAMA0 loglevel=8 sched_debug' -smp \
+  cores=8 --nographic -m 512 -cpu cortex-a53 -machine virt -numa \
+  node,cpus=0-2,nodeid=0 -numa node,cpus=3-7,nodeid=1
+
+alongside the following drivers/base/arch_topology.c hack (AIUI wouldn't be
+needed if '-smp cores=X, sockets=Y' would work with qemu):
+
+8<---
+@@ -465,6 +465,9 @@ void update_siblings_masks(unsigned int cpuid)
+ 		if (cpuid_topo->package_id != cpu_topo->package_id)
+ 			continue;
+
++		if ((cpu < 4 && cpuid > 3) || (cpu > 3 && cpuid < 4))
++			continue;
++
+ 		cpumask_set_cpu(cpuid, &cpu_topo->core_sibling);
+ 		cpumask_set_cpu(cpu, &cpuid_topo->core_sibling);
+
+8<---
+
+[1]: https://lkml.kernel.org/r/1577088979-8545-1-git-send-email-prime.zeng@hisilicon.com
+
+Reported-by: Zeng Tao <prime.zeng@hisilicon.com>
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20200115160915.22575-1-valentin.schneider@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/topology.c | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index 6ec1e595b1d42..dfb64c08a407a 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -1879,6 +1879,42 @@ static struct sched_domain *build_sched_domain(struct sched_domain_topology_leve
+ 	return sd;
+ }
+ 
++/*
++ * Ensure topology masks are sane, i.e. there are no conflicts (overlaps) for
++ * any two given CPUs at this (non-NUMA) topology level.
++ */
++static bool topology_span_sane(struct sched_domain_topology_level *tl,
++			      const struct cpumask *cpu_map, int cpu)
++{
++	int i;
++
++	/* NUMA levels are allowed to overlap */
++	if (tl->flags & SDTL_OVERLAP)
++		return true;
++
++	/*
++	 * Non-NUMA levels cannot partially overlap - they must be either
++	 * completely equal or completely disjoint. Otherwise we can end up
++	 * breaking the sched_group lists - i.e. a later get_group() pass
++	 * breaks the linking done for an earlier span.
++	 */
++	for_each_cpu(i, cpu_map) {
++		if (i == cpu)
++			continue;
++		/*
++		 * We should 'and' all those masks with 'cpu_map' to exactly
++		 * match the topology we're about to build, but that can only
++		 * remove CPUs, which only lessens our ability to detect
++		 * overlaps
++		 */
++		if (!cpumask_equal(tl->mask(cpu), tl->mask(i)) &&
++		    cpumask_intersects(tl->mask(cpu), tl->mask(i)))
++			return false;
++	}
++
++	return true;
++}
++
+ /*
+  * Find the sched_domain_topology_level where all CPU capacities are visible
+  * for all CPUs.
+@@ -1975,6 +2011,9 @@ build_sched_domains(const struct cpumask *cpu_map, struct sched_domain_attr *att
+ 				has_asym = true;
+ 			}
+ 
++			if (WARN_ON(!topology_span_sane(tl, cpu_map, i)))
++				goto error;
++
+ 			sd = build_sched_domain(tl, cpu_map, attr, sd, dflags, i);
+ 
+ 			if (tl == sched_domain_topology)
+-- 
+2.20.1
+
diff --git a/queue-5.5/scsi-aic7xxx-adjust-indentation-in-ahc_find_syncrate.patch b/queue-5.5/scsi-aic7xxx-adjust-indentation-in-ahc_find_syncrate.patch
new file mode 100644
index 00000000000..d28d42cef91
--- /dev/null
+++ b/queue-5.5/scsi-aic7xxx-adjust-indentation-in-ahc_find_syncrate.patch
@@ -0,0 +1,54 @@
+From bee2371668a0a6a3c6938598565a208cc6a59f1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 18:42:20 -0700
+Subject: scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 4dbc96ad65c45cdd4e895ed7ae4c151b780790c5 ]
+
+Clang warns:
+
+../drivers/scsi/aic7xxx/aic7xxx_core.c:2317:5: warning: misleading
+indentation; statement is not part of the previous 'if'
+[-Wmisleading-indentation]
+                        if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
+                        ^
+../drivers/scsi/aic7xxx/aic7xxx_core.c:2310:4: note: previous statement
+is here
+                        if (syncrate == &ahc_syncrates[maxsync])
+                        ^
+1 warning generated.
+
+This warning occurs because there is a space amongst the tabs on this
+line. Remove it so that the indentation is consistent with the Linux kernel
+coding style and clang no longer warns.
+
+This has been a problem since the beginning of git history hence no fixes
+tag.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/817
+Link: https://lore.kernel.org/r/20191218014220.52746-1-natechancellor@gmail.com
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/aic7xxx/aic7xxx_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c
+index a9d40d3b90efc..4190a025381a5 100644
+--- a/drivers/scsi/aic7xxx/aic7xxx_core.c
++++ b/drivers/scsi/aic7xxx/aic7xxx_core.c
+@@ -2314,7 +2314,7 @@ ahc_find_syncrate(struct ahc_softc *ahc, u_int *period,
+ 			 * At some speeds, we only support
+ 			 * ST transfers.
+ 			 */
+-		 	if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
++			if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
+ 				*ppr_options &= ~MSG_EXT_PPR_DT_REQ;
+ 			break;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-5.5/scsi-iscsi-don-t-destroy-session-if-there-are-outsta.patch b/queue-5.5/scsi-iscsi-don-t-destroy-session-if-there-are-outsta.patch
new file mode 100644
index 00000000000..ea8c666fe20
--- /dev/null
+++ b/queue-5.5/scsi-iscsi-don-t-destroy-session-if-there-are-outsta.patch
@@ -0,0 +1,138 @@
+From f1ec488df3850b61aea448755f27e8e560a08c21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Dec 2019 15:31:48 -0500
+Subject: scsi: iscsi: Don't destroy session if there are outstanding
+ connections
+
+From: Nick Black <nlb@google.com>
+
+[ Upstream commit 54155ed4199c7aa3fd20866648024ab63c96d579 ]
+
+A faulty userspace that calls destroy_session() before destroying the
+connections can trigger the failure.  This patch prevents the issue by
+refusing to destroy the session if there are outstanding connections.
+
+------------[ cut here ]------------
+kernel BUG at mm/slub.c:306!
+invalid opcode: 0000 [#1] SMP PTI
+CPU: 1 PID: 1224 Comm: iscsid Not tainted 5.4.0-rc2.iscsi+ #7
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
+RIP: 0010:__slab_free+0x181/0x350
+[...]
+[ 1209.686056] RSP: 0018:ffffa93d4074fae0 EFLAGS: 00010246
+[ 1209.686694] RAX: ffff934efa5ad800 RBX: 000000008010000a RCX: ffff934efa5ad800
+[ 1209.687651] RDX: ffff934efa5ad800 RSI: ffffeb4041e96b00 RDI: ffff934efd402c40
+[ 1209.688582] RBP: ffffa93d4074fb80 R08: 0000000000000001 R09: ffffffffbb5dfa26
+[ 1209.689425] R10: ffff934efa5ad800 R11: 0000000000000001 R12: ffffeb4041e96b00
+[ 1209.690285] R13: ffff934efa5ad800 R14: ffff934efd402c40 R15: 0000000000000000
+[ 1209.691213] FS:  00007f7945dfb540(0000) GS:ffff934efda80000(0000) knlGS:0000000000000000
+[ 1209.692316] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 1209.693013] CR2: 000055877fd3da80 CR3: 0000000077384000 CR4: 00000000000006e0
+[ 1209.693897] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 1209.694773] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 1209.695631] Call Trace:
+[ 1209.695957]  ? __wake_up_common_lock+0x8a/0xc0
+[ 1209.696712]  iscsi_pool_free+0x26/0x40
+[ 1209.697263]  iscsi_session_teardown+0x2f/0xf0
+[ 1209.698117]  iscsi_sw_tcp_session_destroy+0x45/0x60
+[ 1209.698831]  iscsi_if_rx+0xd88/0x14e0
+[ 1209.699370]  netlink_unicast+0x16f/0x200
+[ 1209.699932]  netlink_sendmsg+0x21a/0x3e0
+[ 1209.700446]  sock_sendmsg+0x4f/0x60
+[ 1209.700902]  ___sys_sendmsg+0x2ae/0x320
+[ 1209.701451]  ? cp_new_stat+0x150/0x180
+[ 1209.701922]  __sys_sendmsg+0x59/0xa0
+[ 1209.702357]  do_syscall_64+0x52/0x160
+[ 1209.702812]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 1209.703419] RIP: 0033:0x7f7946433914
+[...]
+[ 1209.706084] RSP: 002b:00007fffb99f2378 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+[ 1209.706994] RAX: ffffffffffffffda RBX: 000055bc869eac20 RCX: 00007f7946433914
+[ 1209.708082] RDX: 0000000000000000 RSI: 00007fffb99f2390 RDI: 0000000000000005
+[ 1209.709120] RBP: 00007fffb99f2390 R08: 000055bc84fe9320 R09: 00007fffb99f1f07
+[ 1209.710110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000038
+[ 1209.711085] R13: 000055bc8502306e R14: 0000000000000000 R15: 0000000000000000
+ Modules linked in:
+ ---[ end trace a2d933ede7f730d8 ]---
+
+Link: https://lore.kernel.org/r/20191226203148.2172200-1-krisman@collabora.com
+Signed-off-by: Nick Black <nlb@google.com>
+Co-developed-by: Salman Qazi <sqazi@google.com>
+Signed-off-by: Salman Qazi <sqazi@google.com>
+Co-developed-by: Junho Ryu <jayr@google.com>
+Signed-off-by: Junho Ryu <jayr@google.com>
+Co-developed-by: Khazhismel Kumykov <khazhy@google.com>
+Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
+Co-developed-by: Gabriel Krisman Bertazi <krisman@collabora.com>
+Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/iscsi_tcp.c            |  4 ++++
+ drivers/scsi/scsi_transport_iscsi.c | 26 +++++++++++++++++++++++---
+ 2 files changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
+index 0bc63a7ab41c8..b5dd1caae5e92 100644
+--- a/drivers/scsi/iscsi_tcp.c
++++ b/drivers/scsi/iscsi_tcp.c
+@@ -887,6 +887,10 @@ free_host:
+ static void iscsi_sw_tcp_session_destroy(struct iscsi_cls_session *cls_session)
+ {
+ 	struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
++	struct iscsi_session *session = cls_session->dd_data;
++
++	if (WARN_ON_ONCE(session->leadconn))
++		return;
+ 
+ 	iscsi_tcp_r2tpool_free(cls_session->dd_data);
+ 	iscsi_session_teardown(cls_session);
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index ed8d9709b9b96..271afea654e2b 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2947,6 +2947,24 @@ iscsi_set_path(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+ 	return err;
+ }
+ 
++static int iscsi_session_has_conns(int sid)
++{
++	struct iscsi_cls_conn *conn;
++	unsigned long flags;
++	int found = 0;
++
++	spin_lock_irqsave(&connlock, flags);
++	list_for_each_entry(conn, &connlist, conn_list) {
++		if (iscsi_conn_get_sid(conn) == sid) {
++			found = 1;
++			break;
++		}
++	}
++	spin_unlock_irqrestore(&connlock, flags);
++
++	return found;
++}
++
+ static int
+ iscsi_set_iface_params(struct iscsi_transport *transport,
+ 		       struct iscsi_uevent *ev, uint32_t len)
+@@ -3524,10 +3542,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
+ 		break;
+ 	case ISCSI_UEVENT_DESTROY_SESSION:
+ 		session = iscsi_session_lookup(ev->u.d_session.sid);
+-		if (session)
+-			transport->destroy_session(session);
+-		else
++		if (!session)
+ 			err = -EINVAL;
++		else if (iscsi_session_has_conns(ev->u.d_session.sid))
++			err = -EBUSY;
++		else
++			transport->destroy_session(session);
+ 		break;
+ 	case ISCSI_UEVENT_UNBIND_SESSION:
+ 		session = iscsi_session_lookup(ev->u.d_session.sid);
+-- 
+2.20.1
+
diff --git a/queue-5.5/scsi-lpfc-fix-rework-setting-of-fdmi-symbolic-node-n.patch b/queue-5.5/scsi-lpfc-fix-rework-setting-of-fdmi-symbolic-node-n.patch
new file mode 100644
index 00000000000..cf68363eed0
--- /dev/null
+++ b/queue-5.5/scsi-lpfc-fix-rework-setting-of-fdmi-symbolic-node-n.patch
@@ -0,0 +1,94 @@
+From 6e35fac1b30f18502b1e862b0805bf5092141bb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 15:58:00 -0800
+Subject: scsi: lpfc: Fix: Rework setting of fdmi symbolic node name
+ registration
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit df9166bfa7750bade5737ffc91fbd432e0354442 ]
+
+This patch reworks the fdmi symbolic node name data for the following two
+issues:
+
+ - Correcting extraneous periods following the DV and HN fdmi data fields.
+
+ - Avoiding buffer overflow issues when formatting the data.
+
+The fix to the fist issue is to just remove the characters.
+
+The fix to the second issue has all data being staged in temporary storage
+before being moved to the real buffer.
+
+Link: https://lore.kernel.org/r/20191218235808.31922-3-jsmart2021@gmail.com
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_ct.c | 42 +++++++++++++++++++------------------
+ 1 file changed, 22 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
+index 99c9bb249758c..1b4dbb28fb419 100644
+--- a/drivers/scsi/lpfc/lpfc_ct.c
++++ b/drivers/scsi/lpfc/lpfc_ct.c
+@@ -1493,33 +1493,35 @@ int
+ lpfc_vport_symbolic_node_name(struct lpfc_vport *vport, char *symbol,
+ 	size_t size)
+ {
+-	char fwrev[FW_REV_STR_SIZE];
+-	int n;
++	char fwrev[FW_REV_STR_SIZE] = {0};
++	char tmp[MAXHOSTNAMELEN] = {0};
+ 
+-	lpfc_decode_firmware_rev(vport->phba, fwrev, 0);
++	memset(symbol, 0, size);
+ 
+-	n = scnprintf(symbol, size, "Emulex %s", vport->phba->ModelName);
+-	if (size < n)
+-		return n;
++	scnprintf(tmp, sizeof(tmp), "Emulex %s", vport->phba->ModelName);
++	if (strlcat(symbol, tmp, size) >= size)
++		goto buffer_done;
+ 
+-	n += scnprintf(symbol + n, size - n, " FV%s", fwrev);
+-	if (size < n)
+-		return n;
++	lpfc_decode_firmware_rev(vport->phba, fwrev, 0);
++	scnprintf(tmp, sizeof(tmp), " FV%s", fwrev);
++	if (strlcat(symbol, tmp, size) >= size)
++		goto buffer_done;
+ 
+-	n += scnprintf(symbol + n, size - n, " DV%s.",
+-		      lpfc_release_version);
+-	if (size < n)
+-		return n;
++	scnprintf(tmp, sizeof(tmp), " DV%s", lpfc_release_version);
++	if (strlcat(symbol, tmp, size) >= size)
++		goto buffer_done;
+ 
+-	n += scnprintf(symbol + n, size - n, " HN:%s.",
+-		      init_utsname()->nodename);
+-	if (size < n)
+-		return n;
++	scnprintf(tmp, sizeof(tmp), " HN:%s", init_utsname()->nodename);
++	if (strlcat(symbol, tmp, size) >= size)
++		goto buffer_done;
+ 
+ 	/* Note :- OS name is "Linux" */
+-	n += scnprintf(symbol + n, size - n, " OS:%s",
+-		      init_utsname()->sysname);
+-	return n;
++	scnprintf(tmp, sizeof(tmp), " OS:%s", init_utsname()->sysname);
++	strlcat(symbol, tmp, size);
++
++buffer_done:
++	return strnlen(symbol, size);
++
+ }
+ 
+ static uint32_t
+-- 
+2.20.1
+
diff --git a/queue-5.5/scsi-ufs-complete-pending-requests-in-host-reset-and.patch b/queue-5.5/scsi-ufs-complete-pending-requests-in-host-reset-and.patch
new file mode 100644
index 00000000000..68153d504e0
--- /dev/null
+++ b/queue-5.5/scsi-ufs-complete-pending-requests-in-host-reset-and.patch
@@ -0,0 +1,122 @@
+From c65691262ab535e7d6ac8b4fe78a0f46873464f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 22:53:33 -0800
+Subject: scsi: ufs: Complete pending requests in host reset and restore path
+
+From: Can Guo <cang@codeaurora.org>
+
+[ Upstream commit 2df74b6985b51e77756e2e8faa16c45ca3ba53c5 ]
+
+In UFS host reset and restore path, before probe, we stop and start the
+host controller once. After host controller is stopped, the pending
+requests, if any, are cleared from the doorbell, but no completion IRQ
+would be raised due to the hba is stopped.  These pending requests shall be
+completed along with the first NOP_OUT command (as it is the first command
+which can raise a transfer completion IRQ) sent during probe.  Since the
+OCSs of these pending requests are not SUCCESS (because they are not yet
+literally finished), their UPIUs shall be dumped. When there are multiple
+pending requests, the UPIU dump can be overwhelming and may lead to
+stability issues because it is in atomic context.  Therefore, before probe,
+complete these pending requests right after host controller is stopped and
+silence the UPIU dump from them.
+
+Link: https://lore.kernel.org/r/1574751214-8321-5-git-send-email-cang@qti.qualcomm.com
+Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Tested-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 24 ++++++++++--------------
+ drivers/scsi/ufs/ufshcd.h |  2 ++
+ 2 files changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 3fbf9ea16c64e..7d8300c9a0148 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -4799,7 +4799,7 @@ ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
+ 		break;
+ 	} /* end of switch */
+ 
+-	if (host_byte(result) != DID_OK)
++	if ((host_byte(result) != DID_OK) && !hba->silence_err_logs)
+ 		ufshcd_print_trs(hba, 1 << lrbp->task_tag, true);
+ 	return result;
+ }
+@@ -5351,8 +5351,8 @@ static void ufshcd_err_handler(struct work_struct *work)
+ 
+ 	/*
+ 	 * if host reset is required then skip clearing the pending
+-	 * transfers forcefully because they will automatically get
+-	 * cleared after link startup.
++	 * transfers forcefully because they will get cleared during
++	 * host reset and restore
+ 	 */
+ 	if (needs_reset)
+ 		goto skip_pending_xfer_clear;
+@@ -6282,9 +6282,15 @@ static int ufshcd_host_reset_and_restore(struct ufs_hba *hba)
+ 	int err;
+ 	unsigned long flags;
+ 
+-	/* Reset the host controller */
++	/*
++	 * Stop the host controller and complete the requests
++	 * cleared by h/w
++	 */
+ 	spin_lock_irqsave(hba->host->host_lock, flags);
+ 	ufshcd_hba_stop(hba, false);
++	hba->silence_err_logs = true;
++	ufshcd_complete_requests(hba);
++	hba->silence_err_logs = false;
+ 	spin_unlock_irqrestore(hba->host->host_lock, flags);
+ 
+ 	/* scale up clocks to max frequency before full reinitialization */
+@@ -6318,7 +6324,6 @@ out:
+ static int ufshcd_reset_and_restore(struct ufs_hba *hba)
+ {
+ 	int err = 0;
+-	unsigned long flags;
+ 	int retries = MAX_HOST_RESET_RETRIES;
+ 
+ 	do {
+@@ -6328,15 +6333,6 @@ static int ufshcd_reset_and_restore(struct ufs_hba *hba)
+ 		err = ufshcd_host_reset_and_restore(hba);
+ 	} while (err && --retries);
+ 
+-	/*
+-	 * After reset the door-bell might be cleared, complete
+-	 * outstanding requests in s/w here.
+-	 */
+-	spin_lock_irqsave(hba->host->host_lock, flags);
+-	ufshcd_transfer_req_compl(hba);
+-	ufshcd_tmc_handler(hba);
+-	spin_unlock_irqrestore(hba->host->host_lock, flags);
+-
+ 	return err;
+ }
+ 
+diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
+index 2740f6941ec69..2e59f9d8ab89e 100644
+--- a/drivers/scsi/ufs/ufshcd.h
++++ b/drivers/scsi/ufs/ufshcd.h
+@@ -513,6 +513,7 @@ struct ufs_stats {
+  * @uic_error: UFS interconnect layer error status
+  * @saved_err: sticky error mask
+  * @saved_uic_err: sticky UIC error mask
++ * @silence_err_logs: flag to silence error logs
+  * @dev_cmd: ufs device management command information
+  * @last_dme_cmd_tstamp: time stamp of the last completed DME command
+  * @auto_bkops_enabled: to track whether bkops is enabled in device
+@@ -670,6 +671,7 @@ struct ufs_hba {
+ 	u32 saved_err;
+ 	u32 saved_uic_err;
+ 	struct ufs_stats ufs_stats;
++	bool silence_err_logs;
+ 
+ 	/* Device management request data */
+ 	struct ufs_dev_cmd dev_cmd;
+-- 
+2.20.1
+
diff --git a/queue-5.5/scsi-ufs-mediatek-add-apply_dev_quirks-variant-opera.patch b/queue-5.5/scsi-ufs-mediatek-add-apply_dev_quirks-variant-opera.patch
new file mode 100644
index 00000000000..dd55ba0fadc
--- /dev/null
+++ b/queue-5.5/scsi-ufs-mediatek-add-apply_dev_quirks-variant-opera.patch
@@ -0,0 +1,68 @@
+From 231d9f37f56708e0b54048ab9aa7e1309387d6c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 15:11:47 +0800
+Subject: scsi: ufs-mediatek: add apply_dev_quirks variant operation
+
+From: Stanley Chu <stanley.chu@mediatek.com>
+
+[ Upstream commit ea92c32bd336efba89c5b09cf609e6e26e963796 ]
+
+Add vendor-specific variant callback "apply_dev_quirks" to MediaTek UFS
+driver.
+
+Cc: Alim Akhtar <alim.akhtar@samsung.com>
+Cc: Asutosh Das <asutoshd@codeaurora.org>
+Cc: Avri Altman <avri.altman@wdc.com>
+Cc: Bart Van Assche <bvanassche@acm.org>
+Cc: Bean Huo <beanhuo@micron.com>
+Cc: Can Guo <cang@codeaurora.org>
+Cc: Matthias Brugger <matthias.bgg@gmail.com>
+Link: https://lore.kernel.org/r/1578726707-6596-3-git-send-email-stanley.chu@mediatek.com
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufs-mediatek.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/scsi/ufs/ufs-mediatek.c b/drivers/scsi/ufs/ufs-mediatek.c
+index 83e28edc3ac5b..8a21f49caf0d9 100644
+--- a/drivers/scsi/ufs/ufs-mediatek.c
++++ b/drivers/scsi/ufs/ufs-mediatek.c
+@@ -13,6 +13,7 @@
+ 
+ #include "ufshcd.h"
+ #include "ufshcd-pltfrm.h"
++#include "ufs_quirks.h"
+ #include "unipro.h"
+ #include "ufs-mediatek.h"
+ 
+@@ -289,6 +290,15 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ 	return 0;
+ }
+ 
++static int ufs_mtk_apply_dev_quirks(struct ufs_hba *hba,
++				    struct ufs_dev_desc *card)
++{
++	if (card->wmanufacturerid == UFS_VENDOR_SAMSUNG)
++		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_TACTIVATE), 6);
++
++	return 0;
++}
++
+ /**
+  * struct ufs_hba_mtk_vops - UFS MTK specific variant operations
+  *
+@@ -301,6 +311,7 @@ static struct ufs_hba_variant_ops ufs_hba_mtk_vops = {
+ 	.setup_clocks        = ufs_mtk_setup_clocks,
+ 	.link_startup_notify = ufs_mtk_link_startup_notify,
+ 	.pwr_change_notify   = ufs_mtk_pwr_change_notify,
++	.apply_dev_quirks    = ufs_mtk_apply_dev_quirks,
+ 	.suspend             = ufs_mtk_suspend,
+ 	.resume              = ufs_mtk_resume,
+ };
+-- 
+2.20.1
+
diff --git a/queue-5.5/scsi-ufs-pass-device-information-to-apply_dev_quirks.patch b/queue-5.5/scsi-ufs-pass-device-information-to-apply_dev_quirks.patch
new file mode 100644
index 00000000000..b6bb73f2959
--- /dev/null
+++ b/queue-5.5/scsi-ufs-pass-device-information-to-apply_dev_quirks.patch
@@ -0,0 +1,117 @@
+From bc4cd60dd8436a3939ad548d04bca5e58741ce02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 15:11:46 +0800
+Subject: scsi: ufs: pass device information to apply_dev_quirks
+
+From: Stanley Chu <stanley.chu@mediatek.com>
+
+[ Upstream commit c40ad6b7fcd35bc4d36db820c7737e1aa18d5d41 ]
+
+Pass UFS device information to vendor-specific variant callback
+"apply_dev_quirks" because some platform vendors need to know such
+information to apply special handling or quirks in specific devices.
+
+At the same time, modify existing vendor implementations according to the
+new interface for those vendor drivers which will be built-in or built as a
+module alone with UFS core driver.
+
+[mkp: clarified commit desc]
+
+Cc: Alim Akhtar <alim.akhtar@samsung.com>
+Cc: Asutosh Das <asutoshd@codeaurora.org>
+Cc: Avri Altman <avri.altman@wdc.com>
+Cc: Bart Van Assche <bvanassche@acm.org>
+Cc: Bean Huo <beanhuo@micron.com>
+Cc: Can Guo <cang@codeaurora.org>
+Cc: Matthias Brugger <matthias.bgg@gmail.com>
+Link: https://lore.kernel.org/r/1578726707-6596-2-git-send-email-stanley.chu@mediatek.com
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufs-qcom.c | 3 ++-
+ drivers/scsi/ufs/ufshcd.c   | 8 ++++----
+ drivers/scsi/ufs/ufshcd.h   | 7 ++++---
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c
+index c69c29a1ceb90..ebb5c66e069fa 100644
+--- a/drivers/scsi/ufs/ufs-qcom.c
++++ b/drivers/scsi/ufs/ufs-qcom.c
+@@ -949,7 +949,8 @@ out:
+ 	return err;
+ }
+ 
+-static int ufs_qcom_apply_dev_quirks(struct ufs_hba *hba)
++static int ufs_qcom_apply_dev_quirks(struct ufs_hba *hba,
++				     struct ufs_dev_desc *card)
+ {
+ 	int err = 0;
+ 
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 7d8300c9a0148..5340a980d24b8 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -6798,7 +6798,8 @@ out:
+ 	return ret;
+ }
+ 
+-static void ufshcd_tune_unipro_params(struct ufs_hba *hba)
++static void ufshcd_tune_unipro_params(struct ufs_hba *hba,
++				      struct ufs_dev_desc *card)
+ {
+ 	if (ufshcd_is_unipro_pa_params_tuning_req(hba)) {
+ 		ufshcd_tune_pa_tactivate(hba);
+@@ -6812,7 +6813,7 @@ static void ufshcd_tune_unipro_params(struct ufs_hba *hba)
+ 	if (hba->dev_quirks & UFS_DEVICE_QUIRK_HOST_PA_TACTIVATE)
+ 		ufshcd_quirk_tune_host_pa_tactivate(hba);
+ 
+-	ufshcd_vops_apply_dev_quirks(hba);
++	ufshcd_vops_apply_dev_quirks(hba, card);
+ }
+ 
+ static void ufshcd_clear_dbg_ufs_stats(struct ufs_hba *hba)
+@@ -6975,10 +6976,9 @@ static int ufshcd_probe_hba(struct ufs_hba *hba)
+ 	}
+ 
+ 	ufs_fixup_device_setup(hba, &card);
++	ufshcd_tune_unipro_params(hba, &card);
+ 	ufs_put_device_desc(&card);
+ 
+-	ufshcd_tune_unipro_params(hba);
+-
+ 	/* UFS device is also active now */
+ 	ufshcd_set_ufs_dev_active(hba);
+ 	ufshcd_force_reset_auto_bkops(hba);
+diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
+index 2e59f9d8ab89e..46bec0e18c724 100644
+--- a/drivers/scsi/ufs/ufshcd.h
++++ b/drivers/scsi/ufs/ufshcd.h
+@@ -322,7 +322,7 @@ struct ufs_hba_variant_ops {
+ 	void	(*setup_task_mgmt)(struct ufs_hba *, int, u8);
+ 	void    (*hibern8_notify)(struct ufs_hba *, enum uic_cmd_dme,
+ 					enum ufs_notify_change_status);
+-	int	(*apply_dev_quirks)(struct ufs_hba *);
++	int	(*apply_dev_quirks)(struct ufs_hba *, struct ufs_dev_desc *);
+ 	int     (*suspend)(struct ufs_hba *, enum ufs_pm_op);
+ 	int     (*resume)(struct ufs_hba *, enum ufs_pm_op);
+ 	void	(*dbg_register_dump)(struct ufs_hba *hba);
+@@ -1057,10 +1057,11 @@ static inline void ufshcd_vops_hibern8_notify(struct ufs_hba *hba,
+ 		return hba->vops->hibern8_notify(hba, cmd, status);
+ }
+ 
+-static inline int ufshcd_vops_apply_dev_quirks(struct ufs_hba *hba)
++static inline int ufshcd_vops_apply_dev_quirks(struct ufs_hba *hba,
++					       struct ufs_dev_desc *card)
+ {
+ 	if (hba->vops && hba->vops->apply_dev_quirks)
+-		return hba->vops->apply_dev_quirks(hba);
++		return hba->vops->apply_dev_quirks(hba, card);
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/selftests-bpf-reset-global-state-between-reuseport-t.patch b/queue-5.5/selftests-bpf-reset-global-state-between-reuseport-t.patch
new file mode 100644
index 00000000000..8c561b5c409
--- /dev/null
+++ b/queue-5.5/selftests-bpf-reset-global-state-between-reuseport-t.patch
@@ -0,0 +1,64 @@
+From af46ecfddea6ae24e7412529a62bf18f90b34939 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 11:27:54 +0000
+Subject: selftests: bpf: Reset global state between reuseport test runs
+
+From: Lorenz Bauer <lmb@cloudflare.com>
+
+[ Upstream commit 51bad0f05616c43d6d34b0a19bcc9bdab8e8fb39 ]
+
+Currently, there is a lot of false positives if a single reuseport test
+fails. This is because expected_results and the result map are not cleared.
+
+Zero both after individual test runs, which fixes the mentioned false
+positives.
+
+Fixes: 91134d849a0e ("bpf: Test BPF_PROG_TYPE_SK_REUSEPORT")
+Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20200124112754.19664-5-lmb@cloudflare.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/test_select_reuseport.c        | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_select_reuseport.c b/tools/testing/selftests/bpf/test_select_reuseport.c
+index 7566c13eb51a7..079d0f5a29091 100644
+--- a/tools/testing/selftests/bpf/test_select_reuseport.c
++++ b/tools/testing/selftests/bpf/test_select_reuseport.c
+@@ -30,7 +30,7 @@
+ #define REUSEPORT_ARRAY_SIZE 32
+ 
+ static int result_map, tmp_index_ovr_map, linum_map, data_check_map;
+-static enum result expected_results[NR_RESULTS];
++static __u32 expected_results[NR_RESULTS];
+ static int sk_fds[REUSEPORT_ARRAY_SIZE];
+ static int reuseport_array, outer_map;
+ static int select_by_skb_data_prog;
+@@ -662,7 +662,19 @@ static void setup_per_test(int type, unsigned short family, bool inany)
+ 
+ static void cleanup_per_test(void)
+ {
+-	int i, err;
++	int i, err, zero = 0;
++
++	memset(expected_results, 0, sizeof(expected_results));
++
++	for (i = 0; i < NR_RESULTS; i++) {
++		err = bpf_map_update_elem(result_map, &i, &zero, BPF_ANY);
++		RET_IF(err, "reset elem in result_map",
++		       "i:%u err:%d errno:%d\n", i, err, errno);
++	}
++
++	err = bpf_map_update_elem(linum_map, &zero, &zero, BPF_ANY);
++	RET_IF(err, "reset line number in linum_map", "err:%d errno:%d\n",
++	       err, errno);
+ 
+ 	for (i = 0; i < REUSEPORT_ARRAY_SIZE; i++)
+ 		close(sk_fds[i]);
+-- 
+2.20.1
+
diff --git a/queue-5.5/selftests-eeh-bump-eeh-wait-time-to-60s.patch b/queue-5.5/selftests-eeh-bump-eeh-wait-time-to-60s.patch
new file mode 100644
index 00000000000..dbcb2dc5d2f
--- /dev/null
+++ b/queue-5.5/selftests-eeh-bump-eeh-wait-time-to-60s.patch
@@ -0,0 +1,51 @@
+From 3faf59eb1c054eeeed8ac41ba13faa248f921c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 14:11:25 +1100
+Subject: selftests/eeh: Bump EEH wait time to 60s
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 414f50434aa2463202a5b35e844f4125dd1a7101 ]
+
+Some newer cards supported by aacraid can take up to 40s to recover
+after an EEH event. This causes spurious failures in the basic EEH
+self-test since the current maximim timeout is only 30s.
+
+Fix the immediate issue by bumping the timeout to a default of 60s,
+and allow the wait time to be specified via an environmental variable
+(EEH_MAX_WAIT).
+
+Reported-by: Steve Best <sbest@redhat.com>
+Suggested-by: Douglas Miller <dougmill@us.ibm.com>
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200122031125.25991-1-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/eeh/eeh-functions.sh | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/eeh/eeh-functions.sh b/tools/testing/selftests/powerpc/eeh/eeh-functions.sh
+index 26112ab5cdf42..f52ed92b53e74 100755
+--- a/tools/testing/selftests/powerpc/eeh/eeh-functions.sh
++++ b/tools/testing/selftests/powerpc/eeh/eeh-functions.sh
+@@ -53,9 +53,13 @@ eeh_one_dev() {
+ 	# is a no-op.
+ 	echo $dev >/sys/kernel/debug/powerpc/eeh_dev_check
+ 
+-	# Enforce a 30s timeout for recovery. Even the IPR, which is infamously
+-	# slow to reset, should recover within 30s.
+-	max_wait=30
++	# Default to a 60s timeout when waiting for a device to recover. This
++	# is an arbitrary default which can be overridden by setting the
++	# EEH_MAX_WAIT environmental variable when required.
++
++	# The current record holder for longest recovery time is:
++	#  "Adaptec Series 8 12G SAS/PCIe 3" at 39 seconds
++	max_wait=${EEH_MAX_WAIT:=60}
+ 
+ 	for i in `seq 0 ${max_wait}` ; do
+ 		if pe_ok $dev ; then
+-- 
+2.20.1
+
diff --git a/queue-5.5/selftests-net-make-so_txtime-more-robust-to-timer-va.patch b/queue-5.5/selftests-net-make-so_txtime-more-robust-to-timer-va.patch
new file mode 100644
index 00000000000..a4d2ca602da
--- /dev/null
+++ b/queue-5.5/selftests-net-make-so_txtime-more-robust-to-timer-va.patch
@@ -0,0 +1,226 @@
+From 6120a125920ca1331afe4ec270e9f8bd22010530 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:36:46 -0500
+Subject: selftests/net: make so_txtime more robust to timer variance
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit ea6a547669b37453f2b1a5d85188d75b3613dfaa ]
+
+The SO_TXTIME test depends on accurate timers. In some virtualized
+environments the test has been reported to be flaky. This is easily
+reproduced by disabling kvm acceleration in Qemu.
+
+Allow greater variance in a run and retry to further reduce flakiness.
+
+Observed errors are one of two kinds: either the packet arrives too
+early or late at recv(), or it was dropped in the qdisc itself and the
+recv() call times out.
+
+In the latter case, the qdisc queues a notification to the error
+queue of the send socket. Also explicitly report this cause.
+
+Link: https://lore.kernel.org/netdev/CA+FuTSdYOnJCsGuj43xwV1jxvYsaoa_LzHQF9qMyhrkLrivxKw@mail.gmail.com
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/so_txtime.c  | 84 +++++++++++++++++++++++-
+ tools/testing/selftests/net/so_txtime.sh |  9 ++-
+ 2 files changed, 88 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/net/so_txtime.c b/tools/testing/selftests/net/so_txtime.c
+index 34df4c8882afb..383bac05ac324 100644
+--- a/tools/testing/selftests/net/so_txtime.c
++++ b/tools/testing/selftests/net/so_txtime.c
+@@ -12,7 +12,11 @@
+ #include <arpa/inet.h>
+ #include <error.h>
+ #include <errno.h>
++#include <inttypes.h>
+ #include <linux/net_tstamp.h>
++#include <linux/errqueue.h>
++#include <linux/ipv6.h>
++#include <linux/tcp.h>
+ #include <stdbool.h>
+ #include <stdlib.h>
+ #include <stdio.h>
+@@ -28,7 +32,7 @@ static int	cfg_clockid	= CLOCK_TAI;
+ static bool	cfg_do_ipv4;
+ static bool	cfg_do_ipv6;
+ static uint16_t	cfg_port	= 8000;
+-static int	cfg_variance_us	= 2000;
++static int	cfg_variance_us	= 4000;
+ 
+ static uint64_t glob_tstart;
+ 
+@@ -43,6 +47,9 @@ static struct timed_send cfg_in[MAX_NUM_PKT];
+ static struct timed_send cfg_out[MAX_NUM_PKT];
+ static int cfg_num_pkt;
+ 
++static int cfg_errq_level;
++static int cfg_errq_type;
++
+ static uint64_t gettime_ns(void)
+ {
+ 	struct timespec ts;
+@@ -90,13 +97,15 @@ static void do_send_one(int fdt, struct timed_send *ts)
+ 
+ }
+ 
+-static void do_recv_one(int fdr, struct timed_send *ts)
++static bool do_recv_one(int fdr, struct timed_send *ts)
+ {
+ 	int64_t tstop, texpect;
+ 	char rbuf[2];
+ 	int ret;
+ 
+ 	ret = recv(fdr, rbuf, sizeof(rbuf), 0);
++	if (ret == -1 && errno == EAGAIN)
++		return true;
+ 	if (ret == -1)
+ 		error(1, errno, "read");
+ 	if (ret != 1)
+@@ -113,6 +122,8 @@ static void do_recv_one(int fdr, struct timed_send *ts)
+ 
+ 	if (labs(tstop - texpect) > cfg_variance_us)
+ 		error(1, 0, "exceeds variance (%d us)", cfg_variance_us);
++
++	return false;
+ }
+ 
+ static void do_recv_verify_empty(int fdr)
+@@ -125,12 +136,70 @@ static void do_recv_verify_empty(int fdr)
+ 		error(1, 0, "recv: not empty as expected (%d, %d)", ret, errno);
+ }
+ 
++static void do_recv_errqueue_timeout(int fdt)
++{
++	char control[CMSG_SPACE(sizeof(struct sock_extended_err)) +
++		     CMSG_SPACE(sizeof(struct sockaddr_in6))] = {0};
++	char data[sizeof(struct ipv6hdr) +
++		  sizeof(struct tcphdr) + 1];
++	struct sock_extended_err *err;
++	struct msghdr msg = {0};
++	struct iovec iov = {0};
++	struct cmsghdr *cm;
++	int64_t tstamp = 0;
++	int ret;
++
++	iov.iov_base = data;
++	iov.iov_len = sizeof(data);
++
++	msg.msg_iov = &iov;
++	msg.msg_iovlen = 1;
++
++	msg.msg_control = control;
++	msg.msg_controllen = sizeof(control);
++
++	while (1) {
++		ret = recvmsg(fdt, &msg, MSG_ERRQUEUE);
++		if (ret == -1 && errno == EAGAIN)
++			break;
++		if (ret == -1)
++			error(1, errno, "errqueue");
++		if (msg.msg_flags != MSG_ERRQUEUE)
++			error(1, 0, "errqueue: flags 0x%x\n", msg.msg_flags);
++
++		cm = CMSG_FIRSTHDR(&msg);
++		if (cm->cmsg_level != cfg_errq_level ||
++		    cm->cmsg_type != cfg_errq_type)
++			error(1, 0, "errqueue: type 0x%x.0x%x\n",
++				    cm->cmsg_level, cm->cmsg_type);
++
++		err = (struct sock_extended_err *)CMSG_DATA(cm);
++		if (err->ee_origin != SO_EE_ORIGIN_TXTIME)
++			error(1, 0, "errqueue: origin 0x%x\n", err->ee_origin);
++		if (err->ee_code != ECANCELED)
++			error(1, 0, "errqueue: code 0x%x\n", err->ee_code);
++
++		tstamp = ((int64_t) err->ee_data) << 32 | err->ee_info;
++		tstamp -= (int64_t) glob_tstart;
++		tstamp /= 1000 * 1000;
++		fprintf(stderr, "send: pkt %c at %" PRId64 "ms dropped\n",
++				data[ret - 1], tstamp);
++
++		msg.msg_flags = 0;
++		msg.msg_controllen = sizeof(control);
++	}
++
++	error(1, 0, "recv: timeout");
++}
++
+ static void setsockopt_txtime(int fd)
+ {
+ 	struct sock_txtime so_txtime_val = { .clockid = cfg_clockid };
+ 	struct sock_txtime so_txtime_val_read = { 0 };
+ 	socklen_t vallen = sizeof(so_txtime_val);
+ 
++	so_txtime_val.flags = SOF_TXTIME_REPORT_ERRORS;
++
+ 	if (setsockopt(fd, SOL_SOCKET, SO_TXTIME,
+ 		       &so_txtime_val, sizeof(so_txtime_val)))
+ 		error(1, errno, "setsockopt txtime");
+@@ -194,7 +263,8 @@ static void do_test(struct sockaddr *addr, socklen_t alen)
+ 	for (i = 0; i < cfg_num_pkt; i++)
+ 		do_send_one(fdt, &cfg_in[i]);
+ 	for (i = 0; i < cfg_num_pkt; i++)
+-		do_recv_one(fdr, &cfg_out[i]);
++		if (do_recv_one(fdr, &cfg_out[i]))
++			do_recv_errqueue_timeout(fdt);
+ 
+ 	do_recv_verify_empty(fdr);
+ 
+@@ -280,6 +350,10 @@ int main(int argc, char **argv)
+ 		addr6.sin6_family = AF_INET6;
+ 		addr6.sin6_port = htons(cfg_port);
+ 		addr6.sin6_addr = in6addr_loopback;
++
++		cfg_errq_level = SOL_IPV6;
++		cfg_errq_type = IPV6_RECVERR;
++
+ 		do_test((void *)&addr6, sizeof(addr6));
+ 	}
+ 
+@@ -289,6 +363,10 @@ int main(int argc, char **argv)
+ 		addr4.sin_family = AF_INET;
+ 		addr4.sin_port = htons(cfg_port);
+ 		addr4.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
++
++		cfg_errq_level = SOL_IP;
++		cfg_errq_type = IP_RECVERR;
++
+ 		do_test((void *)&addr4, sizeof(addr4));
+ 	}
+ 
+diff --git a/tools/testing/selftests/net/so_txtime.sh b/tools/testing/selftests/net/so_txtime.sh
+index 5aa519328a5b5..3f7800eaecb1e 100755
+--- a/tools/testing/selftests/net/so_txtime.sh
++++ b/tools/testing/selftests/net/so_txtime.sh
+@@ -5,7 +5,12 @@
+ 
+ # Run in network namespace
+ if [[ $# -eq 0 ]]; then
+-	./in_netns.sh $0 __subprocess
++	if ! ./in_netns.sh $0 __subprocess; then
++		# test is time sensitive, can be flaky
++		echo "test failed: retry once"
++		./in_netns.sh $0 __subprocess
++	fi
++
+ 	exit $?
+ fi
+ 
+@@ -18,7 +23,7 @@ tc qdisc add dev lo root fq
+ ./so_txtime -4 -6 -c mono a,10,b,20 a,10,b,20
+ ./so_txtime -4 -6 -c mono a,20,b,10 b,20,a,20
+ 
+-if tc qdisc replace dev lo root etf clockid CLOCK_TAI delta 200000; then
++if tc qdisc replace dev lo root etf clockid CLOCK_TAI delta 400000; then
+ 	! ./so_txtime -4 -6 -c tai a,-1 a,-1
+ 	! ./so_txtime -4 -6 -c tai a,0 a,0
+ 	./so_txtime -4 -6 -c tai a,10 a,10
+-- 
+2.20.1
+
diff --git a/queue-5.5/selftests-settings-tests-can-be-in-subsubdirs.patch b/queue-5.5/selftests-settings-tests-can-be-in-subsubdirs.patch
new file mode 100644
index 00000000000..304d82c8fda
--- /dev/null
+++ b/queue-5.5/selftests-settings-tests-can-be-in-subsubdirs.patch
@@ -0,0 +1,60 @@
+From 80a07676a8ef58bfa4b312863b0e370007e5abda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 19:12:20 +0200
+Subject: selftests: settings: tests can be in subsubdirs
+
+From: Matthieu Baerts <matthieu.baerts@tessares.net>
+
+[ Upstream commit ac87813d4372f4c005264acbe3b7f00c1dee37c4 ]
+
+Commit 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second
+timeout per test") adds support for a new per-test-directory "settings"
+file. But this only works for tests not in a sub-subdirectories, e.g.
+
+ - tools/testing/selftests/rtc (rtc) is OK,
+ - tools/testing/selftests/net/mptcp (net/mptcp) is not.
+
+We have to increase the timeout for net/mptcp tests which are not
+upstreamed yet but this fix is valid for other tests if they need to add
+a "settings" file, see the full list with:
+
+  tools/testing/selftests/*/*/**/Makefile
+
+Note that this patch changes the text header message printed at the end
+of the execution but this text is modified only for the tests that are
+in sub-subdirectories, e.g.
+
+  ok 1 selftests: net/mptcp: mptcp_connect.sh
+
+Before we had:
+
+  ok 1 selftests: mptcp: mptcp_connect.sh
+
+But showing the full target name is probably better, just in case a
+subsubdir has the same name as another one in another subdirectory.
+
+Fixes: 852c8cbf34d3 (selftests/kselftest/runner.sh: Add 45 second timeout per test)
+Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kselftest/runner.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/kselftest/runner.sh b/tools/testing/selftests/kselftest/runner.sh
+index a8d20cbb711cf..e84d901f85672 100644
+--- a/tools/testing/selftests/kselftest/runner.sh
++++ b/tools/testing/selftests/kselftest/runner.sh
+@@ -91,7 +91,7 @@ run_one()
+ run_many()
+ {
+ 	echo "TAP version 13"
+-	DIR=$(basename "$PWD")
++	DIR="${PWD#${BASE_DIR}/}"
+ 	test_num=0
+ 	total=$(echo "$@" | wc -w)
+ 	echo "1..$total"
+-- 
+2.20.1
+
diff --git a/queue-5.5/selftests-uninitialized-variable-in-test_cgcore_proc.patch b/queue-5.5/selftests-uninitialized-variable-in-test_cgcore_proc.patch
new file mode 100644
index 00000000000..b7124079fb6
--- /dev/null
+++ b/queue-5.5/selftests-uninitialized-variable-in-test_cgcore_proc.patch
@@ -0,0 +1,40 @@
+From fabc4b976c450524dfe373e7743528a5b51136ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 08:46:29 +0300
+Subject: selftests: Uninitialized variable in test_cgcore_proc_migration()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 192c197cbca599321de95a4cf15c2fa0681140d3 ]
+
+The "c_threads" variable is used in the error handling code before it
+has been initialized
+
+Fixes: 11318989c381 ("selftests: cgroup: Add task migration tests")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Michal Koutný <mkoutny@suse.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/cgroup/test_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c
+index c5ca669feb2bd..e19ce940cd6a2 100644
+--- a/tools/testing/selftests/cgroup/test_core.c
++++ b/tools/testing/selftests/cgroup/test_core.c
+@@ -369,7 +369,7 @@ static void *dummy_thread_fn(void *arg)
+ static int test_cgcore_proc_migration(const char *root)
+ {
+ 	int ret = KSFT_FAIL;
+-	int t, c_threads, n_threads = 13;
++	int t, c_threads = 0, n_threads = 13;
+ 	char *src = NULL, *dst = NULL;
+ 	pthread_t threads[n_threads];
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/selinux-ensure-we-cleanup-the-internal-avc-counters-.patch b/queue-5.5/selinux-ensure-we-cleanup-the-internal-avc-counters-.patch
new file mode 100644
index 00000000000..fc00e1a80e6
--- /dev/null
+++ b/queue-5.5/selinux-ensure-we-cleanup-the-internal-avc-counters-.patch
@@ -0,0 +1,95 @@
+From 0e38e7216aff3560285bb2d01763bc83fccae54f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 20:39:46 -0500
+Subject: selinux: ensure we cleanup the internal AVC counters on error in
+ avc_insert()
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit d8db60cb23e49a92cf8cada3297395c7fa50fdf8 ]
+
+Fix avc_insert() to call avc_node_kill() if we've already allocated
+an AVC node and the code fails to insert the node in the cache.
+
+Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls")
+Reported-by: rsiddoji@codeaurora.org
+Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
+Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/avc.c | 51 ++++++++++++++++++++----------------------
+ 1 file changed, 24 insertions(+), 27 deletions(-)
+
+diff --git a/security/selinux/avc.c b/security/selinux/avc.c
+index 23dc888ae3056..6646300f7ccb2 100644
+--- a/security/selinux/avc.c
++++ b/security/selinux/avc.c
+@@ -617,40 +617,37 @@ static struct avc_node *avc_insert(struct selinux_avc *avc,
+ 	struct avc_node *pos, *node = NULL;
+ 	int hvalue;
+ 	unsigned long flag;
++	spinlock_t *lock;
++	struct hlist_head *head;
+ 
+ 	if (avc_latest_notif_update(avc, avd->seqno, 1))
+-		goto out;
++		return NULL;
+ 
+ 	node = avc_alloc_node(avc);
+-	if (node) {
+-		struct hlist_head *head;
+-		spinlock_t *lock;
+-		int rc = 0;
+-
+-		hvalue = avc_hash(ssid, tsid, tclass);
+-		avc_node_populate(node, ssid, tsid, tclass, avd);
+-		rc = avc_xperms_populate(node, xp_node);
+-		if (rc) {
+-			kmem_cache_free(avc_node_cachep, node);
+-			return NULL;
+-		}
+-		head = &avc->avc_cache.slots[hvalue];
+-		lock = &avc->avc_cache.slots_lock[hvalue];
++	if (!node)
++		return NULL;
+ 
+-		spin_lock_irqsave(lock, flag);
+-		hlist_for_each_entry(pos, head, list) {
+-			if (pos->ae.ssid == ssid &&
+-			    pos->ae.tsid == tsid &&
+-			    pos->ae.tclass == tclass) {
+-				avc_node_replace(avc, node, pos);
+-				goto found;
+-			}
++	avc_node_populate(node, ssid, tsid, tclass, avd);
++	if (avc_xperms_populate(node, xp_node)) {
++		avc_node_kill(avc, node);
++		return NULL;
++	}
++
++	hvalue = avc_hash(ssid, tsid, tclass);
++	head = &avc->avc_cache.slots[hvalue];
++	lock = &avc->avc_cache.slots_lock[hvalue];
++	spin_lock_irqsave(lock, flag);
++	hlist_for_each_entry(pos, head, list) {
++		if (pos->ae.ssid == ssid &&
++			pos->ae.tsid == tsid &&
++			pos->ae.tclass == tclass) {
++			avc_node_replace(avc, node, pos);
++			goto found;
+ 		}
+-		hlist_add_head_rcu(&node->list, head);
+-found:
+-		spin_unlock_irqrestore(lock, flag);
+ 	}
+-out:
++	hlist_add_head_rcu(&node->list, head);
++found:
++	spin_unlock_irqrestore(lock, flag);
+ 	return node;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/selinux-ensure-we-cleanup-the-internal-avc-counters-.patch-8688 b/queue-5.5/selinux-ensure-we-cleanup-the-internal-avc-counters-.patch-8688
new file mode 100644
index 00000000000..004a1e7cfef
--- /dev/null
+++ b/queue-5.5/selinux-ensure-we-cleanup-the-internal-avc-counters-.patch-8688
@@ -0,0 +1,40 @@
+From da6e6345987b2be2405218e464ac13afc091977d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 17:25:47 +0530
+Subject: selinux: ensure we cleanup the internal AVC counters on error in
+ avc_update()
+
+From: Jaihind Yadav <jaihindyadav@codeaurora.org>
+
+[ Upstream commit 030b995ad9ece9fa2d218af4429c1c78c2342096 ]
+
+In AVC update we don't call avc_node_kill() when avc_xperms_populate()
+fails, resulting in the avc->avc_cache.active_nodes counter having a
+false value.  In last patch this changes was missed , so correcting it.
+
+Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls")
+Signed-off-by: Jaihind Yadav <jaihindyadav@codeaurora.org>
+Signed-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>
+[PM: merge fuzz, minor description cleanup]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/avc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/selinux/avc.c b/security/selinux/avc.c
+index 6646300f7ccb2..d18cb32a242ae 100644
+--- a/security/selinux/avc.c
++++ b/security/selinux/avc.c
+@@ -891,7 +891,7 @@ static int avc_update_node(struct selinux_avc *avc,
+ 	if (orig->ae.xp_node) {
+ 		rc = avc_xperms_populate(node, orig->ae.xp_node);
+ 		if (rc) {
+-			kmem_cache_free(avc_node_cachep, node);
++			avc_node_kill(avc, node);
+ 			goto out_unlock;
+ 		}
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.5/series b/queue-5.5/series
index eddc7df9b99..7b0700d8503 100644
--- a/queue-5.5/series
+++ b/queue-5.5/series
@@ -4,3 +4,396 @@ net-smc-fix-leak-of-kernel-memory-to-user-space.patch
 net-dsa-tag_qca-make-sure-there-is-headroom-for-tag.patch
 net-sched-matchall-add-missing-validation-of-tca_matchall_flags.patch
 net-sched-flower-add-missing-validation-of-tca_flower_flags.patch
+drm-gma500-fixup-fbdev-stolen-size-usage-evaluation.patch
+drm-dp_mst-fix-multiple-frees-of-tx-bytes.patch
+ath10k-fix-qmi-init-error-handling.patch
+wil6210-fix-break-that-is-never-reached-because-of-z.patch
+drm-virtio-fix-byteorder-handling-in-virtio_gpu_cmd_.patch
+drm-qxl-complete-exception-handling-in-qxl_device_in.patch
+nfsd4-avoid-null-deference-on-strange-copy-compounds.patch
+rcu-nocb-fix-dump_tree-hierarchy-print-always-active.patch
+rcu-fix-missed-wakeup-of-exp_wq-waiters.patch
+soc-fsl-qe-change-return-type-of-cpm_muram_alloc-to-.patch
+rcu-fix-data-race-due-to-atomic_t-copy-by-value.patch
+dmaengine-ti-edma-add-missed-operations.patch
+f2fs-preallocate-dio-blocks-when-forcing-buffered_io.patch
+f2fs-call-f2fs_balance_fs-outside-of-locked-page.patch
+media-meson-add-missing-allocation-failure-check-on-.patch
+clk-meson-pll-fix-by-0-division-in-__pll_params_to_r.patch
+cpu-hotplug-stop_machine-fix-stop_machine-vs-hotplug.patch
+drm-rcar-du-recognize-renesas-vsps-in-addition-to-vs.patch
+dmaengine-ti-edma-fix-error-return-code-in-edma_prob.patch
+brcmfmac-fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch
+brcmfmac-fix-use-after-free-in-brcmf_sdio_readframes.patch
+pci-fix-pci_add_dma_alias-bitmask-size.patch
+drm-amd-display-map-odm-memory-correctly-when-doing-.patch
+leds-pca963x-fix-open-drain-initialization.patch
+ext4-fix-ext4_dax_read-write-inode-locking-sequence-.patch
+alsa-ctl-allow-tlv-read-operation-for-callback-type-.patch
+gianfar-fix-tx-timestamping-with-a-stacked-dsa-drive.patch
+pinctrl-sh-pfc-sh7264-fix-can-function-gpios.patch
+printk-fix-exclusive_console-replaying.patch
+drm-mipi_dbi-fix-off-by-one-bugs-in-mipi_dbi_blank.patch
+drm-msm-adreno-fix-zap-vs-no-zap-handling.patch
+pxa168fb-fix-the-function-used-to-release-some-memor.patch
+media-ov5640-fix-check-for-pll1-exceeding-max-allowe.patch
+media-i2c-mt9v032-fix-enum-mbus-codes-and-frame-size.patch
+media-sun4i-csi-deal-with-dram-offset.patch
+media-sun4i-csi-fix-data-sampling-polarity-handling.patch
+media-sun4i-csi-fix-hv-sync-polarity-handling.patch
+clk-at91-sam9x60-fix-programmable-clock-prescaler.patch
+powerpc-powernv-iov-ensure-the-pdn-for-vfs-always-co.patch
+clk-meson-meson8b-make-the-ccf-use-the-glitch-free-m.patch
+gpio-gpio-grgpio-fix-possible-sleep-in-atomic-contex.patch
+iommu-vt-d-fix-off-by-one-in-pasid-allocation.patch
+x86-fpu-deactivate-fpu-state-after-failure-during-st.patch
+dm-raid-table-line-rebuild-status-fixes.patch
+char-random-silence-a-lockdep-splat-with-printk.patch
+media-sti-bdisp-fix-a-possible-sleep-in-atomic-conte.patch
+kernel-module-fix-memleak-in-module_add_modinfo_attr.patch
+ib-core-let-ib-core-distribute-cache-update-events.patch
+pinctrl-baytrail-do-not-clear-irq-flags-on-direct-ir.patch
+kprobes-fix-optimize_kprobe-unoptimize_kprobe-cancel.patch
+efi-x86-map-the-entire-efi-vendor-string-before-copy.patch
+sparc-add-.exit.data-section.patch
+net-ethernet-ixp4xx-standard-module-init.patch
+raid6-test-fix-a-compilation-error.patch
+iio-imu-st_lsm6dsx-check-return-value-from-st_lsm6ds.patch
+uio-fix-a-sleep-in-atomic-context-bug-in-uio_dmem_ge.patch
+drm-amdgpu-sriov-workaround-on-rev_id-for-navi12-und.patch
+spi-fsl-lpspi-fix-only-one-cs-gpio-working.patch
+drm-nouveau-nouveau-fix-incorrect-sizeof-on-args.src.patch
+usb-gadget-udc-fix-possible-sleep-in-atomic-context-.patch
+usb-dwc2-fix-in-fifo-allocation.patch
+clocksource-drivers-bcm2835_timer-fix-memory-leak-of.patch
+drm-amd-display-clear-state-after-exiting-fixed-acti.patch
+kselftest-minimise-dependency-of-get_size-on-c-libra.patch
+jbd2-clear-jbd2_abort-flag-before-journal_reset-to-u.patch
+ext4-fix-deadlock-allocating-bio_post_read_ctx-from-.patch
+clk-ti-dra7-fix-parent-for-gmac_clkctrl.patch
+x86-sysfb-fix-check-for-bad-vram-size.patch
+pwm-omap-dmtimer-simplify-error-handling.patch
+udf-allow-writing-to-rewritable-partitions.patch
+dmaengine-fsl-qdma-fix-duplicated-argument-to.patch
+wan-hdlc_x25-fix-skb-handling.patch
+irqchip-gic-v3-its-fix-get_vlpi_map-breakage-with-do.patch
+s390-pci-fix-possible-deadlock-in-recover_store.patch
+backlight-qcom-wled-fix-unsigned-comparison-to-zero.patch
+powerpc-iov-move-vf-pdev-fixup-into-pcibios_fixup_io.patch
+tracing-fix-tracing_stat-return-values-in-error-hand.patch
+tracing-fix-very-unlikely-race-of-registering-two-st.patch
+arm-8952-1-disable-kmemleak-on-xip-kernels.patch
+ext4-jbd2-ensure-panic-when-aborting-with-zero-errno.patch
+ath10k-correct-the-dma-direction-for-management-tx-b.patch
+rtw88-fix-rate-mask-for-1ss-chip.patch
+brcmfmac-sdio-fix-oob-interrupt-initialization-on-br.patch
+selftests-settings-tests-can-be-in-subsubdirs.patch
+rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-n.patch
+drm-amd-display-retrain-dongles-when-sink_count-beco.patch
+tracing-simplify-assignment-parsing-for-hist-trigger.patch
+nbd-add-a-flush_workqueue-in-nbd_start_device.patch
+kvm-s390-enotsupp-eopnotsupp-fixups.patch
+btrfs-keep-pages-dirty-when-using-btrfs_writepage_fi.patch
+drivers-block-zram-zram_drv.c-fix-error-return-codes.patch
+block-bfq-do-not-plug-i-o-for-bfq_queues-with-no-pro.patch
+kconfig-fix-broken-dependency-in-randconfig-generate.patch
+clk-qcom-don-t-overwrite-cfg-in-clk_rcg2_dfs_populat.patch
+clk-qcom-rcg2-don-t-crash-if-our-parent-can-t-be-fou.patch
+drm-amdkfd-fix-a-bug-in-sdma-rlc-queue-counting-unde.patch
+bpf-sockhash-synchronize_rcu-before-free-ing-map.patch
+drm-amd-display-renoir-chroma-viewport-wa.patch
+drm-amdgpu-remove-4-set-but-not-used-variable-in-amd.patch
+drm-amdgpu-dm-do-not-throw-an-error-for-a-display-wi.patch
+ath10k-correct-the-tlv-len-of-ath10k_wmi_tlv_op_gen_.patch
+drm-amdgpu-ensure-ret-is-always-initialized-when-usi.patch
+drm-panel-simple-add-logic-pd-type-28-display-suppor.patch
+arm64-dts-rockchip-fix-nanopc-t4-cooling-maps.patch
+modules-lockdep-suppress-suspicious-rcu-usage-warnin.patch
+asoc-intel-sof_rt5682-add-quirk-for-number-of-hdmi-d.patch
+asoc-intel-sof_rt5682-add-support-for-tgl-max98357a-.patch
+asoc-sof-intel-hda-solve-msi-issues-by-merging-ipc-a.patch
+regulator-rk808-lower-log-level-on-optional-gpios-be.patch
+net-wan-fsl_ucc_hdlc-reject-muram-offsets-above-64k.patch
+revert-drm-amdgpu-enable-vcn-dpg-on-raven-and-raven2.patch
+nfc-port100-convert-cpu_to_le16-le16_to_cpu-e1-e2-to.patch
+arm64-dts-allwinner-h6-add-pmu-mode.patch
+arm64-dts-allwinner-h5-add-pmu-node.patch
+arm-dts-allwinner-h3-add-pmu-node.patch
+opp-free-static-opps-on-errors-while-adding-them.patch
+selinux-ensure-we-cleanup-the-internal-avc-counters-.patch
+enetc-remove-variable-tc_max_sized_frame-set-but-not.patch
+arm64-dts-qcom-msm8996-disable-usb2-phy-suspend-by-c.patch
+padata-validate-cpumask-without-removed-cpu-during-o.patch
+padata-always-acquire-cpu_hotplug_lock-before-pinst-.patch
+clk-imx-add-correct-failure-handling-for-clk-based-h.patch
+arm-exynos_defconfig-bring-back-explicitly-wanted-op.patch
+arm-dts-imx6-rdu2-disable-wp-for-usdhc2-and-usdhc3.patch
+arm-dts-imx6-rdu2-limit-usbh1-to-full-speed.patch
+ima-check-ima-policy-flag.patch
+bus-ti-sysc-implement-quirk-handling-for-clkdm_noaut.patch
+pci-iproc-apply-quirk_paxc_bridge-for-module-as-well.patch
+media-cx23885-add-support-for-avermedia-ce310b.patch
+pci-add-generic-quirk-for-increasing-d3hot-delay.patch
+pci-increase-d3-delay-for-amd-ryzen5-7-xhci-controll.patch
+revert-nfp-abm-fix-memory-leak-in-nfp_abm_u32_knode_.patch
+gpu-drm-ingenic-avoid-null-pointer-deference-in-plan.patch
+selftests-net-make-so_txtime-more-robust-to-timer-va.patch
+media-v4l2-device.h-explicitly-compare-grp-id-mask-t.patch
+reiserfs-fix-spurious-unlock-in-reiserfs_fill_super-.patch
+samples-bpf-set-fno-stack-protector-when-building-bp.patch
+r8169-check-that-realtek-phy-driver-module-is-loaded.patch
+fore200e-fix-incorrect-checks-of-null-pointer-derefe.patch
+isdn-don-t-mark-kcapi_proc_exit-as-__exit.patch
+x86-mce-therm_throt-mark-throttle_active_work-as-__m.patch
+arm-omap2-pdata-quirks-add-prm-data-for-reset-suppor.patch
+netfilter-nft_tunnel-add-the-missing-erspan_version-.patch
+alsa-usx2y-adjust-indentation-in-snd_usx2y_hwdep_dsp.patch
+nfs-fix-timstamp-debug-prints.patch
+pci-add-nr_devfns-parameter-to-pci_add_dma_alias.patch
+pci-add-dma-alias-quirk-for-plx-pex-ntb.patch
+b43legacy-fix-wcast-function-type.patch
+ipw2x00-fix-wcast-function-type.patch
+iwlegacy-fix-wcast-function-type.patch
+rtlwifi-rtl_pci-fix-wcast-function-type.patch
+orinoco-avoid-assertion-in-case-of-null-pointer.patch
+drm-amd-display-fix-update_bw_bounding_box-calcs.patch
+drm-amd-display-lower-dpp-dto-only-when-safe.patch
+drm-amdgpu-fix-double-gpu_recovery-for-nv-of-sriov.patch
+drm-amdgpu-fix-kiq-ring-test-fail-in-tdr-of-sriov.patch
+clk-qcom-smd-add-missing-bimc-clock.patch
+acpica-disassembler-create-buffer-fields-in-acpi_par.patch
+nfsd-clone-should-commit-src-file-metadata-too.patch
+scsi-ufs-complete-pending-requests-in-host-reset-and.patch
+scsi-aic7xxx-adjust-indentation-in-ahc_find_syncrate.patch
+crypto-inside-secure-add-unspecified-has_iomem-depen.patch
+crypto-amlogic-add-unspecified-has_iomem-dependency.patch
+drm-mediatek-handle-events-when-enabling-disabling-c.patch
+clk-renesas-rcar-gen3-allow-changing-the-rpc-d2-cloc.patch
+arm-dts-r8a7779-add-device-node-for-arm-global-timer.patch
+remoteproc-q6v5-mss-remove-mem-clk-from-the-active-p.patch
+selinux-ensure-we-cleanup-the-internal-avc-counters-.patch-8688
+scsi-lpfc-fix-rework-setting-of-fdmi-symbolic-node-n.patch
+arm64-dts-qcom-db845c-enable-ath10k-8bit-host-cap-qu.patch
+pci-ats-restore-export_symbol_gpl-for-pci_-enable-di.patch
+iommu-amd-check-feature-support-bit-before-accessing.patch
+iommu-amd-only-support-x2apic-with-ivhd-type-11h-40h.patch
+iommu-iova-silence-warnings-under-memory-pressure.patch
+clk-qcom-add-missing-msm8998-gcc_bimc_gfx_clk.patch
+clk-actually-call-the-clock-init-before-any-other-ca.patch
+dmaengine-store-module-owner-in-dma_device-struct.patch
+clk-bm1800-remove-set-but-not-used-variable-fref.patch
+dmaengine-imx-sdma-fix-memory-leak.patch
+bpf-print-error-message-for-bpftool-cgroup-show.patch
+net-phy-realtek-add-logging-for-the-rgmii-tx-delay-c.patch
+crypto-chtls-fixed-memory-leak.patch
+x86-vdso-provide-missing-include-file.patch
+pm-devfreq-exynos-ppmu-fix-excessive-stack-usage.patch
+pm-devfreq-change-time-stats-to-64-bit.patch
+pm-devfreq-rk3399_dmc-add-compile_test-and-have_arm_.patch
+drm-fbdev-fallback-to-non-tiled-mode-if-all-tiles-no.patch
+pinctrl-sh-pfc-sh7269-fix-can-function-gpios.patch
+reset-uniphier-add-scssi-reset-control-for-each-chan.patch
+asoc-soc-topology-fix-endianness-issues.patch
+fbdev-fix-numbering-of-fbcon-options.patch
+rdma-rxe-fix-error-type-of-mmap_offset.patch
+ice-add-extra-check-for-null-rx-descriptor.patch
+clk-sunxi-ng-add-mux-and-pll-notifiers-for-a64-cpu-c.patch
+alsa-sh-fix-unused-variable-warnings.patch
+clk-use-parent-node-pointer-during-registration-if-n.patch
+clk-uniphier-add-scssi-clock-gate-for-each-channel.patch
+alsa-hda-realtek-apply-mic-mute-led-quirk-for-dell-e.patch
+alsa-sh-fix-compile-warning-wrt-const.patch
+net-phy-fixed_phy-fix-use-after-free-when-checking-l.patch
+tools-lib-api-fs-fix-gcc9-stringop-truncation-compil.patch
+vfio-spapr-nvlink2-skip-unpinning-pages-on-error-exi.patch
+asoc-intel-sof_rt5682-ignore-the-speaker-amp-when-th.patch
+x86-unwind-orc-fix-config_modules-build-warning.patch
+acpi-button-add-dmi-quirk-for-razer-blade-stealth-13.patch
+iommu-vt-d-match-cpu-and-iommu-paging-mode.patch
+iommu-vt-d-avoid-sending-invalid-page-response.patch
+drm-amdkfd-fix-permissions-of-hang_hws.patch
+mlx5-work-around-high-stack-usage-with-gcc.patch
+rdma-hns-avoid-printing-address-of-mtt-page.patch
+drm-remove-the-newline-for-crc-source-name.patch
+usb-dwc3-use-proper-initializers-for-property-entrie.patch
+arm-dts-stm32-add-power-supply-for-dsi-panel-on-stm3.patch
+usbip-fix-unsafe-unaligned-pointer-usage.patch
+udf-fix-free-space-reporting-for-metadata-and-virtua.patch
+selftests-uninitialized-variable-in-test_cgcore_proc.patch
+kunit-remove-timeout-dependence-on-sysctl_hung_task_.patch
+drm-mediatek-add-gamma-property-according-to-hardwar.patch
+staging-rtl8188-avoid-excessive-stack-usage.patch
+ib-hfi1-add-software-counter-for-ctxt0-seq-drop.patch
+ib-hfi1-add-rcvshortlengtherrcnt-to-hfi1stats.patch
+soc-tegra-fuse-correct-straps-address-for-older-tegr.patch
+efi-x86-don-t-panic-or-bug-on-non-critical-error-con.patch
+rcu-use-write_once-for-assignments-to-pprev-for-hlis.patch
+input-edt-ft5x06-work-around-first-register-access-e.patch
+bnxt-detach-page-from-page-pool-before-sending-up-th.patch
+x86-nmi-remove-irq_work-from-the-long-duration-nmi-h.patch
+wan-ixp4xx_hss-fix-compile-testing-on-64-bit.patch
+clocksource-davinci-only-enable-clockevents-once-tim.patch
+arm64-dts-rockchip-fix-dwmmc-clock-name-for-px30.patch
+arm64-dts-rockchip-fix-dwmmc-clock-name-for-rk3308.patch
+arm64-dts-rockchip-add-reg-property-to-brcmf-sub-nod.patch
+arm-dts-rockchip-add-reg-property-to-brcmf-sub-node-.patch
+alsa-usb-audio-add-boot-quirk-for-motu-m-series.patch
+asoc-txx9-remove-unused-rtd-variable.patch
+asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch
+raid6-test-fix-a-compilation-warning.patch
+rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch
+tty-synclinkmp-adjust-indentation-in-several-functio.patch
+tty-synclink_gt-adjust-indentation-in-several-functi.patch
+bus-fsl-mc-properly-empty-initialize-structure.patch
+misc-xilinx_sdfec-fix-xsdfec_poll-s-return-type.patch
+visorbus-fix-uninitialized-variable-access.patch
+driver-core-platform-prevent-resouce-overflow-from-c.patch
+driver-core-print-device-when-resources-present-in-r.patch
+asoc-sof-intel-hda-dai-fix-compilation-warning-in-pc.patch
+bpf-return-ebadrqc-for-invalid-map-type-in-__bpf_tx_.patch
+vme-bridges-reduce-stack-usage.patch
+mips-ralink-dts-gardena_smart_gateway_mt7688-limit-u.patch
+drm-nouveau-secboot-gm20b-initialize-pointer-in-gm20.patch
+drm-nouveau-gr-gk20a-gm200-add-terminators-to-method.patch
+drm-nouveau-fix-copy-paste-error-in-nouveau_fence_wa.patch
+drm-nouveau-drm-ttm-remove-set-but-not-used-variable.patch
+drm-nouveau-fault-gv100-fix-memory-leak-on-module-un.patch
+dm-thin-don-t-allow-changing-data-device-during-thin.patch
+gpiolib-set-lockdep-class-for-hierarchical-irq-domai.patch
+drm-vmwgfx-prevent-memory-leak-in-vmw_cmdbuf_res_add.patch
+perf-imx_ddr-fix-cpu-hotplug-state-cleanup.patch
+usb-musb-omap2430-get-rid-of-musb-.set_vbus-for-omap.patch
+kbuild-remove-.tmp-file-when-filechk-fails.patch
+iommu-arm-smmu-v3-use-write_once-when-changing-valid.patch
+alsa-usb-audio-unlock-on-error-in-probe.patch
+f2fs-set-i_linkable-early-to-avoid-wrong-access-by-v.patch
+f2fs-free-sysfs-kobject.patch
+scsi-ufs-pass-device-information-to-apply_dev_quirks.patch
+scsi-ufs-mediatek-add-apply_dev_quirks-variant-opera.patch
+scsi-iscsi-don-t-destroy-session-if-there-are-outsta.patch
+crypto-hisilicon-update-debugfs-usage-of-sec-v2.patch
+crypto-hisilicon-bugfixed-tfm-leak.patch
+crypto-essiv-fix-aead-capitalization-and-preposition.patch
+alsa-usb-audio-add-implicit-fb-quirk-for-motu-m-seri.patch
+pm-devfreq-add-debugfs-support-with-devfreq_summary-.patch
+pinctrl-tigerlake-tiger-lake-uses-_hid-enumeration.patch
+rdma-mlx5-don-t-fake-udata-for-kernel-path.patch
+arm64-lse-fix-lse-atomics-with-llvm-s-integrated-ass.patch
+arm64-fix-alternatives-with-llvm-s-integrated-assemb.patch
+drm-amd-display-fixup-dml-dependencies.patch
+staging-wfx-fix-possible-overflow-on-jiffies-compara.patch
+edac-sifive-fix-return-value-check-in-ecc_register.patch
+kvm-ppc-remove-set-but-not-used-variable-ra-rs-rt.patch
+arm64-dts-ti-k3-j721e-main-add-missing-power-domains.patch
+sched-core-fix-size-of-rq-uclamp-initialization.patch
+sched-topology-assert-non-numa-topology-masks-don-t-.patch
+perf-x86-amd-constrain-large-increment-per-cycle-eve.patch
+watchdog-softlockup-enforce-that-timestamp-is-valid-.patch
+enetc-don-t-print-from-enetc_sched_speed_set-when-li.patch
+acpi-iort-fix-number-of-ids-handling-in-iort_id_map.patch
+x86-apic-uv-avoid-unused-variable-warning.patch
+debugobjects-fix-various-data-races.patch
+asoc-wm_adsp-correct-cache-handling-of-new-kernel-co.patch
+asoc-sof-intel-hda-fix-skl-dai-count.patch
+regulator-vctrl-regulator-avoid-deadlock-getting-and.patch
+f2fs-fix-memleak-of-kobject.patch
+x86-mm-fix-nx-bit-clearing-issue-in-kernel_map_pages.patch
+efi-arm-defer-probe-of-pcie-backed-efifb-on-dt-syste.patch
+x86-boot-compressed-relax-sed-symbol-type-regex-for-.patch
+pwm-omap-dmtimer-remove-pwm-chip-in-.remove-before-m.patch
+cmd64x-potential-buffer-overflow-in-cmd64x_program_t.patch
+ide-serverworks-potential-overflow-in-svwks_set_pio_.patch
+pwm-remove-set-but-not-set-variable-pwm.patch
+btrfs-fix-possible-null-pointer-dereference-in-integ.patch
+btrfs-safely-advance-counter-when-looking-up-bio-csu.patch
+btrfs-device-stats-log-when-stats-are-zeroed.patch
+module-avoid-setting-info-name-early-in-case-we-can-.patch
+remoteproc-initialize-rproc_class-before-use.patch
+regulator-core-fix-exported-symbols-to-the-exported-.patch
+irqchip-mbigen-set-driver-.suppress_bind_attrs-to-av.patch
+alsa-hda-hdmi-add-retry-logic-to-parse_intel_hdmi.patch
+spi-spi-fsl-qspi-ensure-width-is-respected-in-spi-me.patch
+kbuild-use-s-instead-of-e-for-precise-cc-option-test.patch
+objtool-fix-arch-x86_64-build-error.patch
+x86-decoder-add-test-opcode-to-group3-2.patch
+s390-adjust-mpacked-stack-support-check-for-clang-10.patch
+s390-ftrace-generate-traced-function-stack-frame.patch
+s390-fix-__emit_bug-macro.patch
+driver-core-platform-fix-u32-greater-or-equal-to-zer.patch
+bpf-btf-always-output-invariant-hit-in-pahole-dwarf-.patch
+alsa-hda-add-docking-station-support-for-lenovo-thin.patch
+sunrpc-fix-potential-leaks-in-sunrpc_cache_unhash.patch
+drm-nouveau-mmu-fix-comptag-memory-leak.patch
+net-mlx5e-fix-printk-format-warning.patch
+powerpc-sriov-remove-vf-eeh_dev-state-when-disabling.patch
+media-uvcvideo-add-a-quirk-to-force-geo-gc6500-camer.patch
+btrfs-separate-definition-of-assertion-failure-handl.patch
+btrfs-fix-split-brain-handling-when-changing-fsid-to.patch
+bcache-cached_dev_free-needs-to-put-the-sb-page.patch
+bcache-rework-error-unwinding-in-register_bcache.patch
+bcache-fix-use-after-free-in-register_bcache.patch
+iommu-vt-d-mark-firmware-tainted-if-rmrr-fails-sanit.patch
+iommu-vt-d-remove-unnecessary-warn_on_once.patch
+alarmtimer-make-alarmtimer-platform-device-child-of-.patch
+selftests-bpf-reset-global-state-between-reuseport-t.patch
+jbd2-switch-to-use-jbd2_journal_abort-when-failed-to.patch
+jbd2-make-sure-eshutdown-to-be-recorded-in-the-journ.patch
+powerpc-pseries-lparcfg-fix-display-of-maximum-memor.patch
+selftests-eeh-bump-eeh-wait-time-to-60s.patch
+arm-8941-1-decompressor-enable-cp15-barrier-instruct.patch
+arm-8951-1-fix-kexec-compilation-issue.patch
+alsa-usb-audio-add-quirks-for-line6-helix-devices-fw.patch
+hostap-adjust-indentation-in-prism2_hostapd_add_sta.patch
+rtw88-fix-potential-null-skb-access-in-tx-isr.patch
+iwlegacy-ensure-loop-counter-addr-does-not-wrap-and-.patch
+cifs-fix-unitialized-variable-poential-problem-with-.patch
+cifs-fix-mount-options-set-in-automount.patch
+cifs-fix-null-dereference-in-match_prepath.patch
+video-hyperv-hyperv_fb-use-physical-memory-for-fb-on.patch
+bpf-map_seq_next-should-always-increase-position-ind.patch
+powerpc-mm-don-t-log-user-reads-to-0xffffffff.patch
+ceph-check-availability-of-mds-cluster-on-mount-afte.patch
+rbd-work-around-wuninitialized-warning.patch
+asoc-intel-consistent-hdmi-codec-probing-code.patch
+drm-amd-display-do-not-allocate-display_mode_lib-unn.patch
+irqchip-gic-v3-only-provision-redistributors-that-ar.patch
+kvm-ppc-book3s-hv-release-lock-on-page-out-failure-p.patch
+drm-nouveau-disp-nv50-prevent-oops-when-no-channel-m.patch
+char-hpet-fix-out-of-bounds-read-bug.patch
+ftrace-fpid_next-should-increase-position-index.patch
+trigger_next-should-increase-position-index.patch
+radeon-insert-10ms-sleep-in-dce5_crtc_load_lut.patch
+powerpc-do-not-consider-weak-unresolved-symbol-reloc.patch
+btrfs-do-not-do-delalloc-reservation-under-page-lock.patch
+tracing-fix-now-invalid-var_ref_vals-assumption-in-t.patch
+ocfs2-make-local-header-paths-relative-to-c-files.patch
+ocfs2-fix-a-null-pointer-dereference-when-call-ocfs2.patch
+lib-scatterlist.c-adjust-indentation-in-__sg_alloc_t.patch
+reiserfs-prevent-null-pointer-dereference-in-reiserf.patch
+bcache-fix-memory-corruption-in-bch_cache_accounting.patch
+bcache-explicity-type-cast-in-bset_bkey_last.patch
+bcache-fix-incorrect-data-type-usage-in-btree_flush_.patch
+irqchip-gic-v3-its-reference-to-its_invall_cmd-descr.patch
+nvmet-pass-lockdep-expression-to-rcu-lists.patch
+nvmet-fix-dsm-failure-when-payload-does-not-match-sg.patch
+nvme-pci-remove-nvmeq-tags.patch
+iwlwifi-mvm-fix-thermal-zone-registration.patch
+iwlwifi-mvm-check-the-sta-is-not-null-in-iwl_mvm_cfg.patch
+asm-generic-tlb-add-missing-config-symbol.patch
+tc-testing-add-missing-nsplugin-to-basic.json.patch
+microblaze-prevent-the-overflow-of-the-start.patch
+brd-check-and-limit-max_part-par.patch
+drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_la.patch
+drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_vo.patch
+nfs-fix-memory-leaks.patch
+help_next-should-increase-position-index.patch
+i40e-relax-i40e_xsk_wakeup-s-return-value-when-pf-is.patch
+kbuild-make-multiple-directory-targets-work.patch
+cifs-log-warning-message-once-if-out-of-disk-space.patch
+virtio_balloon-prevent-pfn-array-overflow.patch
+fuse-don-t-overflow-llong_max-with-end-offset.patch
+mlxsw-core-add-validation-of-hardware-device-types-f.patch
+mlxsw-spectrum_dpipe-add-missing-error-path.patch
+s390-pci-recover-handle-in-clp_set_pci_fn.patch
+drm-amdgpu-display-handle-multiple-numbers-of-fclks-.patch
+bcache-properly-initialize-path-and-err-in-register_.patch
diff --git a/queue-5.5/soc-fsl-qe-change-return-type-of-cpm_muram_alloc-to-.patch b/queue-5.5/soc-fsl-qe-change-return-type-of-cpm_muram_alloc-to-.patch
new file mode 100644
index 00000000000..0af2f255784
--- /dev/null
+++ b/queue-5.5/soc-fsl-qe-change-return-type-of-cpm_muram_alloc-to-.patch
@@ -0,0 +1,188 @@
+From bb2933e84815dcc39d555f2746ffef8665dddbc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2019 15:55:40 +0100
+Subject: soc: fsl: qe: change return type of cpm_muram_alloc() to s32
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit 800cd6fb76f0ec7711deb72a86c924db1ae42648 ]
+
+There are a number of problems with cpm_muram_alloc() and its
+callers. Most callers assign the return value to some variable and
+then use IS_ERR_VALUE to check for allocation failure. However, when
+that variable is not sizeof(long), this leads to warnings - and it is
+indeed broken to do e.g.
+
+  u32 foo = cpm_muram_alloc();
+  if (IS_ERR_VALUE(foo))
+
+on a 64-bit platform, since the condition
+
+  foo >= (unsigned long)-ENOMEM
+
+is tautologically false. There are also callers that ignore the
+possibility of error, and then there are those that check for error by
+comparing the return value to 0...
+
+One could fix that by changing all callers to store the return value
+temporarily in an "unsigned long" and test that. However, use of
+IS_ERR_VALUE() is error-prone and should be restricted to things which
+are inherently long-sized (stuff in pt_regs etc.). Instead, let's aim
+for changing to the standard kernel style
+
+  int foo = cpm_muram_alloc();
+  if (foo < 0)
+    deal_with_it()
+  some->where = foo;
+
+Changing the return type from unsigned long to s32 (aka signed int)
+doesn't change the value that gets stored into any of the callers'
+variables except if the caller was storing the result in a u64 _and_
+the allocation failed, so in itself this patch should be a no-op.
+
+Another problem with cpm_muram_alloc() is that it can certainly
+validly return 0 - and except if some cpm_muram_alloc_fixed() call
+interferes, the very first cpm_muram_alloc() call will return just
+that. But that shows that both ucc_slow_free() and ucc_fast_free() are
+buggy, since they assume that a value of 0 means "that field was never
+allocated". We'll later change cpm_muram_free() to accept (and ignore)
+a negative offset, so callers can use a sentinel of -1 instead of 0
+and just unconditionally call cpm_muram_free().
+
+Reviewed-by: Timur Tabi <timur@kernel.org>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qe/qe_common.c | 29 ++++++++++++++++-------------
+ include/soc/fsl/qe/qe.h        | 16 ++++++++--------
+ 2 files changed, 24 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/soc/fsl/qe/qe_common.c b/drivers/soc/fsl/qe/qe_common.c
+index 83e85e61669f5..84c90105e588b 100644
+--- a/drivers/soc/fsl/qe/qe_common.c
++++ b/drivers/soc/fsl/qe/qe_common.c
+@@ -32,7 +32,7 @@ static phys_addr_t muram_pbase;
+ 
+ struct muram_block {
+ 	struct list_head head;
+-	unsigned long start;
++	s32 start;
+ 	int size;
+ };
+ 
+@@ -110,13 +110,14 @@ out_muram:
+  * @algo: algorithm for alloc.
+  * @data: data for genalloc's algorithm.
+  *
+- * This function returns an offset into the muram area.
++ * This function returns a non-negative offset into the muram area, or
++ * a negative errno on failure.
+  */
+-static unsigned long cpm_muram_alloc_common(unsigned long size,
+-		genpool_algo_t algo, void *data)
++static s32 cpm_muram_alloc_common(unsigned long size,
++				  genpool_algo_t algo, void *data)
+ {
+ 	struct muram_block *entry;
+-	unsigned long start;
++	s32 start;
+ 
+ 	if (!muram_pool && cpm_muram_init())
+ 		goto out2;
+@@ -137,7 +138,7 @@ static unsigned long cpm_muram_alloc_common(unsigned long size,
+ out1:
+ 	gen_pool_free(muram_pool, start, size);
+ out2:
+-	return (unsigned long)-ENOMEM;
++	return -ENOMEM;
+ }
+ 
+ /*
+@@ -145,13 +146,14 @@ out2:
+  * @size: number of bytes to allocate
+  * @align: requested alignment, in bytes
+  *
+- * This function returns an offset into the muram area.
++ * This function returns a non-negative offset into the muram area, or
++ * a negative errno on failure.
+  * Use cpm_dpram_addr() to get the virtual address of the area.
+  * Use cpm_muram_free() to free the allocation.
+  */
+-unsigned long cpm_muram_alloc(unsigned long size, unsigned long align)
++s32 cpm_muram_alloc(unsigned long size, unsigned long align)
+ {
+-	unsigned long start;
++	s32 start;
+ 	unsigned long flags;
+ 	struct genpool_data_align muram_pool_data;
+ 
+@@ -168,7 +170,7 @@ EXPORT_SYMBOL(cpm_muram_alloc);
+  * cpm_muram_free - free a chunk of multi-user ram
+  * @offset: The beginning of the chunk as returned by cpm_muram_alloc().
+  */
+-int cpm_muram_free(unsigned long offset)
++int cpm_muram_free(s32 offset)
+ {
+ 	unsigned long flags;
+ 	int size;
+@@ -194,13 +196,14 @@ EXPORT_SYMBOL(cpm_muram_free);
+  * cpm_muram_alloc_fixed - reserve a specific region of multi-user ram
+  * @offset: offset of allocation start address
+  * @size: number of bytes to allocate
+- * This function returns an offset into the muram area
++ * This function returns @offset if the area was available, a negative
++ * errno otherwise.
+  * Use cpm_dpram_addr() to get the virtual address of the area.
+  * Use cpm_muram_free() to free the allocation.
+  */
+-unsigned long cpm_muram_alloc_fixed(unsigned long offset, unsigned long size)
++s32 cpm_muram_alloc_fixed(unsigned long offset, unsigned long size)
+ {
+-	unsigned long start;
++	s32 start;
+ 	unsigned long flags;
+ 	struct genpool_data_fixed muram_pool_data_fixed;
+ 
+diff --git a/include/soc/fsl/qe/qe.h b/include/soc/fsl/qe/qe.h
+index c1036d16ed03b..2d35d5db16231 100644
+--- a/include/soc/fsl/qe/qe.h
++++ b/include/soc/fsl/qe/qe.h
+@@ -98,26 +98,26 @@ static inline void qe_reset(void) {}
+ int cpm_muram_init(void);
+ 
+ #if defined(CONFIG_CPM) || defined(CONFIG_QUICC_ENGINE)
+-unsigned long cpm_muram_alloc(unsigned long size, unsigned long align);
+-int cpm_muram_free(unsigned long offset);
+-unsigned long cpm_muram_alloc_fixed(unsigned long offset, unsigned long size);
++s32 cpm_muram_alloc(unsigned long size, unsigned long align);
++int cpm_muram_free(s32 offset);
++s32 cpm_muram_alloc_fixed(unsigned long offset, unsigned long size);
+ void __iomem *cpm_muram_addr(unsigned long offset);
+ unsigned long cpm_muram_offset(void __iomem *addr);
+ dma_addr_t cpm_muram_dma(void __iomem *addr);
+ #else
+-static inline unsigned long cpm_muram_alloc(unsigned long size,
+-					    unsigned long align)
++static inline s32 cpm_muram_alloc(unsigned long size,
++				  unsigned long align)
+ {
+ 	return -ENOSYS;
+ }
+ 
+-static inline int cpm_muram_free(unsigned long offset)
++static inline int cpm_muram_free(s32 offset)
+ {
+ 	return -ENOSYS;
+ }
+ 
+-static inline unsigned long cpm_muram_alloc_fixed(unsigned long offset,
+-						  unsigned long size)
++static inline s32 cpm_muram_alloc_fixed(unsigned long offset,
++					unsigned long size)
+ {
+ 	return -ENOSYS;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/soc-tegra-fuse-correct-straps-address-for-older-tegr.patch b/queue-5.5/soc-tegra-fuse-correct-straps-address-for-older-tegr.patch
new file mode 100644
index 00000000000..ddf166e47c1
--- /dev/null
+++ b/queue-5.5/soc-tegra-fuse-correct-straps-address-for-older-tegr.patch
@@ -0,0 +1,38 @@
+From bfafa95971ce50ce0b954dd39d9c0741fe8e8cc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 21:23:03 +0300
+Subject: soc/tegra: fuse: Correct straps' address for older Tegra124 device
+ trees
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 2d9ea1934f8ef0dfb862d103389562cc28b4fc03 ]
+
+Trying to read out Chip ID before APBMISC registers are mapped won't
+succeed, in a result Tegra124 gets a wrong address for the HW straps
+register if machine uses an old outdated device tree.
+
+Fixes: 297c4f3dcbff ("soc/tegra: fuse: Restrict legacy code to 32-bit ARM")
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/tegra-apbmisc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/tegra/fuse/tegra-apbmisc.c b/drivers/soc/tegra/fuse/tegra-apbmisc.c
+index df76778af601e..f8b9c4058926b 100644
+--- a/drivers/soc/tegra/fuse/tegra-apbmisc.c
++++ b/drivers/soc/tegra/fuse/tegra-apbmisc.c
+@@ -123,7 +123,7 @@ void __init tegra_init_apbmisc(void)
+ 			apbmisc.flags = IORESOURCE_MEM;
+ 
+ 			/* strapping options */
+-			if (tegra_get_chip_id() == TEGRA124) {
++			if (of_machine_is_compatible("nvidia,tegra124")) {
+ 				straps.start = 0x7000e864;
+ 				straps.end = 0x7000e867;
+ 			} else {
+-- 
+2.20.1
+
diff --git a/queue-5.5/sparc-add-.exit.data-section.patch b/queue-5.5/sparc-add-.exit.data-section.patch
new file mode 100644
index 00000000000..491f2517246
--- /dev/null
+++ b/queue-5.5/sparc-add-.exit.data-section.patch
@@ -0,0 +1,43 @@
+From 1be5b4572d3115a4bfcddd4601c7f0994e1c1991 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 00:07:42 -0800
+Subject: sparc: Add .exit.data section.
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 548f0b9a5f4cffa0cecf62eb12aa8db682e4eee6 ]
+
+This fixes build errors of all sorts.
+
+Also, emit .exit.text unconditionally.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/vmlinux.lds.S | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
+index 7ec79918b566b..f99e99e58075f 100644
+--- a/arch/sparc/kernel/vmlinux.lds.S
++++ b/arch/sparc/kernel/vmlinux.lds.S
+@@ -171,12 +171,14 @@ SECTIONS
+ 	}
+ 	PERCPU_SECTION(SMP_CACHE_BYTES)
+ 
+-#ifdef CONFIG_JUMP_LABEL
+ 	. = ALIGN(PAGE_SIZE);
+ 	.exit.text : {
+ 		EXIT_TEXT
+ 	}
+-#endif
++
++	.exit.data : {
++		EXIT_DATA
++	}
+ 
+ 	. = ALIGN(PAGE_SIZE);
+ 	__init_end = .;
+-- 
+2.20.1
+
diff --git a/queue-5.5/spi-fsl-lpspi-fix-only-one-cs-gpio-working.patch b/queue-5.5/spi-fsl-lpspi-fix-only-one-cs-gpio-working.patch
new file mode 100644
index 00000000000..4a2b71192f6
--- /dev/null
+++ b/queue-5.5/spi-fsl-lpspi-fix-only-one-cs-gpio-working.patch
@@ -0,0 +1,90 @@
+From 5941647de5e6fe997f94f6ddf92c65cebddfc4f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 14:13:33 +0000
+Subject: spi: fsl-lpspi: fix only one cs-gpio working
+
+From: Philippe Schenker <philippe.schenker@toradex.com>
+
+[ Upstream commit bc3a8b295e5bca9d1ec2622a6ba38289f9fd3d8a ]
+
+Why it does not work at the moment:
+- num_chipselect sets the number of cs-gpios that are in the DT.
+  This comes from drivers/spi/spi.c
+- num_chipselect gets set with devm_spi_register_controller, that is
+  called in drivers/spi/spi.c
+- devm_spi_register_controller got called after num_chipselect has
+  been used.
+
+How this commit fixes the issue:
+- devm_spi_register_controller gets called before num_chipselect is
+  being used.
+
+Fixes: c7a402599504 ("spi: lpspi: use the core way to implement cs-gpio function")
+Signed-off-by: Philippe Schenker <philippe.schenker@toradex.com>
+Link: https://lore.kernel.org/r/20191204141312.1411251-1-philippe.schenker@toradex.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 2cc0ddb4a9889..1375bdfc587bf 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -862,6 +862,22 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ 	fsl_lpspi->dev = &pdev->dev;
+ 	fsl_lpspi->is_slave = is_slave;
+ 
++	controller->bits_per_word_mask = SPI_BPW_RANGE_MASK(8, 32);
++	controller->transfer_one = fsl_lpspi_transfer_one;
++	controller->prepare_transfer_hardware = lpspi_prepare_xfer_hardware;
++	controller->unprepare_transfer_hardware = lpspi_unprepare_xfer_hardware;
++	controller->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH;
++	controller->flags = SPI_MASTER_MUST_RX | SPI_MASTER_MUST_TX;
++	controller->dev.of_node = pdev->dev.of_node;
++	controller->bus_num = pdev->id;
++	controller->slave_abort = fsl_lpspi_slave_abort;
++
++	ret = devm_spi_register_controller(&pdev->dev, controller);
++	if (ret < 0) {
++		dev_err(&pdev->dev, "spi_register_controller error.\n");
++		goto out_controller_put;
++	}
++
+ 	if (!fsl_lpspi->is_slave) {
+ 		for (i = 0; i < controller->num_chipselect; i++) {
+ 			int cs_gpio = of_get_named_gpio(np, "cs-gpios", i);
+@@ -885,16 +901,6 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ 		controller->prepare_message = fsl_lpspi_prepare_message;
+ 	}
+ 
+-	controller->bits_per_word_mask = SPI_BPW_RANGE_MASK(8, 32);
+-	controller->transfer_one = fsl_lpspi_transfer_one;
+-	controller->prepare_transfer_hardware = lpspi_prepare_xfer_hardware;
+-	controller->unprepare_transfer_hardware = lpspi_unprepare_xfer_hardware;
+-	controller->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH;
+-	controller->flags = SPI_MASTER_MUST_RX | SPI_MASTER_MUST_TX;
+-	controller->dev.of_node = pdev->dev.of_node;
+-	controller->bus_num = pdev->id;
+-	controller->slave_abort = fsl_lpspi_slave_abort;
+-
+ 	init_completion(&fsl_lpspi->xfer_done);
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+@@ -952,12 +958,6 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ 	if (ret < 0)
+ 		dev_err(&pdev->dev, "dma setup error %d, use pio\n", ret);
+ 
+-	ret = devm_spi_register_controller(&pdev->dev, controller);
+-	if (ret < 0) {
+-		dev_err(&pdev->dev, "spi_register_controller error.\n");
+-		goto out_controller_put;
+-	}
+-
+ 	return 0;
+ 
+ out_controller_put:
+-- 
+2.20.1
+
diff --git a/queue-5.5/spi-spi-fsl-qspi-ensure-width-is-respected-in-spi-me.patch b/queue-5.5/spi-spi-fsl-qspi-ensure-width-is-respected-in-spi-me.patch
new file mode 100644
index 00000000000..1548508f634
--- /dev/null
+++ b/queue-5.5/spi-spi-fsl-qspi-ensure-width-is-respected-in-spi-me.patch
@@ -0,0 +1,41 @@
+From d696e9aaee3edb590e90a1e0d561a027f1a62ef5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2020 16:46:13 +0100
+Subject: spi: spi-fsl-qspi: Ensure width is respected in spi-mem operations
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit b0177aca7aea7e8917d4e463334b51facb293d02 ]
+
+Make use of a core helper to ensure the desired width is respected
+when calling spi-mem operators.
+
+Otherwise only the SPI controller will be matched with the flash chip,
+which might lead to wrong widths. Also consider the width specified by
+the user in the device tree.
+
+Fixes: 84d043185dbe ("spi: Add a driver for the Freescale/NXP QuadSPI controller")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Link: https://lore.kernel.org/r/20200114154613.8195-1-michael@walle.cc
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-qspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-qspi.c b/drivers/spi/spi-fsl-qspi.c
+index 79b1558b74b8a..e8a499cd1f135 100644
+--- a/drivers/spi/spi-fsl-qspi.c
++++ b/drivers/spi/spi-fsl-qspi.c
+@@ -410,7 +410,7 @@ static bool fsl_qspi_supports_op(struct spi_mem *mem,
+ 	    op->data.nbytes > q->devtype_data->txfifo)
+ 		return false;
+ 
+-	return true;
++	return spi_mem_default_supports_op(mem, op);
+ }
+ 
+ static void fsl_qspi_prepare_lut(struct fsl_qspi *q,
+-- 
+2.20.1
+
diff --git a/queue-5.5/staging-rtl8188-avoid-excessive-stack-usage.patch b/queue-5.5/staging-rtl8188-avoid-excessive-stack-usage.patch
new file mode 100644
index 00000000000..584406eddd9
--- /dev/null
+++ b/queue-5.5/staging-rtl8188-avoid-excessive-stack-usage.patch
@@ -0,0 +1,74 @@
+From 856d6ff3b08248a0c86581fd361dd638f37cb728 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2020 22:48:21 +0100
+Subject: staging: rtl8188: avoid excessive stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit c497ae2077c055b85c1bf04f3d182a84bd8f365b ]
+
+The rtl8188 copy of the os_dep support code causes a
+warning about a very significant stack usage in the translate_scan()
+function:
+
+drivers/staging/rtl8188eu/os_dep/ioctl_linux.c: In function 'translate_scan':
+drivers/staging/rtl8188eu/os_dep/ioctl_linux.c:306:1: error: the frame size of 1560 bytes is larger than 1400 bytes [-Werror=frame-larger-than=]
+
+Use the same trick as in the rtl8723bs copy of the same function, and
+allocate it dynamically.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200104214832.558198-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8188eu/os_dep/ioctl_linux.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+index 710c33fd49658..47f4cc6a19a9a 100644
+--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+@@ -222,18 +222,21 @@ static char *translate_scan(struct adapter *padapter,
+ 
+ 	/* parsing WPA/WPA2 IE */
+ 	{
+-		u8 buf[MAX_WPA_IE_LEN];
++		u8 *buf;
+ 		u8 wpa_ie[255], rsn_ie[255];
+ 		u16 wpa_len = 0, rsn_len = 0;
+ 		u8 *p;
+ 
++		buf = kzalloc(MAX_WPA_IE_LEN, GFP_ATOMIC);
++		if (!buf)
++			return start;
++
+ 		rtw_get_sec_ie(pnetwork->network.ies, pnetwork->network.ie_length, rsn_ie, &rsn_len, wpa_ie, &wpa_len);
+ 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_wx_get_scan: ssid =%s\n", pnetwork->network.ssid.ssid));
+ 		RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_wx_get_scan: wpa_len =%d rsn_len =%d\n", wpa_len, rsn_len));
+ 
+ 		if (wpa_len > 0) {
+ 			p = buf;
+-			memset(buf, 0, MAX_WPA_IE_LEN);
+ 			p += sprintf(p, "wpa_ie=");
+ 			for (i = 0; i < wpa_len; i++)
+ 				p += sprintf(p, "%02x", wpa_ie[i]);
+@@ -250,7 +253,6 @@ static char *translate_scan(struct adapter *padapter,
+ 		}
+ 		if (rsn_len > 0) {
+ 			p = buf;
+-			memset(buf, 0, MAX_WPA_IE_LEN);
+ 			p += sprintf(p, "rsn_ie=");
+ 			for (i = 0; i < rsn_len; i++)
+ 				p += sprintf(p, "%02x", rsn_ie[i]);
+@@ -264,6 +266,7 @@ static char *translate_scan(struct adapter *padapter,
+ 			iwe.u.data.length = rsn_len;
+ 			start = iwe_stream_add_point(info, start, stop, &iwe, rsn_ie);
+ 		}
++		kfree(buf);
+ 	}
+ 
+ 	{/* parsing WPS IE */
+-- 
+2.20.1
+
diff --git a/queue-5.5/staging-wfx-fix-possible-overflow-on-jiffies-compara.patch b/queue-5.5/staging-wfx-fix-possible-overflow-on-jiffies-compara.patch
new file mode 100644
index 00000000000..a4c08f21b64
--- /dev/null
+++ b/queue-5.5/staging-wfx-fix-possible-overflow-on-jiffies-compara.patch
@@ -0,0 +1,61 @@
+From 18a8e20cf369082973aadb98910ed008add853eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 13:55:06 +0000
+Subject: staging: wfx: fix possible overflow on jiffies comparaison
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jérôme Pouiller <jerome.pouiller@silabs.com>
+
+[ Upstream commit def39be019b6494acd3570ce6f3f11ba1c3203a3 ]
+
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It is recommended to use function time_*() to compare jiffies.
+
+Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
+Link: https://lore.kernel.org/r/20200115135338.14374-45-Jerome.Pouiller@silabs.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/wfx/data_tx.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/staging/wfx/data_tx.c b/drivers/staging/wfx/data_tx.c
+index b13d7341f8bba..0c6a3a1a1ddfd 100644
+--- a/drivers/staging/wfx/data_tx.c
++++ b/drivers/staging/wfx/data_tx.c
+@@ -282,8 +282,7 @@ void wfx_tx_policy_init(struct wfx_vif *wvif)
+ static int wfx_alloc_link_id(struct wfx_vif *wvif, const u8 *mac)
+ {
+ 	int i, ret = 0;
+-	unsigned long max_inactivity = 0;
+-	unsigned long now = jiffies;
++	unsigned long oldest;
+ 
+ 	spin_lock_bh(&wvif->ps_state_lock);
+ 	for (i = 0; i < WFX_MAX_STA_IN_AP_MODE; ++i) {
+@@ -292,13 +291,10 @@ static int wfx_alloc_link_id(struct wfx_vif *wvif, const u8 *mac)
+ 			break;
+ 		} else if (wvif->link_id_db[i].status != WFX_LINK_HARD &&
+ 			   !wvif->wdev->tx_queue_stats.link_map_cache[i + 1]) {
+-			unsigned long inactivity =
+-				now - wvif->link_id_db[i].timestamp;
+-
+-			if (inactivity < max_inactivity)
+-				continue;
+-			max_inactivity = inactivity;
+-			ret = i + 1;
++			if (!ret || time_after(oldest, wvif->link_id_db[i].timestamp)) {
++				oldest = wvif->link_id_db[i].timestamp;
++				ret = i + 1;
++			}
+ 		}
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/sunrpc-fix-potential-leaks-in-sunrpc_cache_unhash.patch b/queue-5.5/sunrpc-fix-potential-leaks-in-sunrpc_cache_unhash.patch
new file mode 100644
index 00000000000..670851b495a
--- /dev/null
+++ b/queue-5.5/sunrpc-fix-potential-leaks-in-sunrpc_cache_unhash.patch
@@ -0,0 +1,36 @@
+From 72f3063521e2d0fec1dd66280c87ec7456b779d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 13:40:34 -0500
+Subject: sunrpc: Fix potential leaks in sunrpc_cache_unhash()
+
+From: Trond Myklebust <trondmy@gmail.com>
+
+[ Upstream commit 1d82163714c16ebe09c7a8c9cd3cef7abcc16208 ]
+
+When we unhash the cache entry, we need to handle any pending upcalls
+by calling cache_fresh_unlocked().
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/cache.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index f740cb51802af..7ede1e52fd812 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -1888,7 +1888,9 @@ void sunrpc_cache_unhash(struct cache_detail *cd, struct cache_head *h)
+ 	if (!hlist_unhashed(&h->cache_list)){
+ 		hlist_del_init_rcu(&h->cache_list);
+ 		cd->entries--;
++		set_bit(CACHE_CLEANED, &h->flags);
+ 		spin_unlock(&cd->hash_lock);
++		cache_fresh_unlocked(h, cd);
+ 		cache_put(h, cd);
+ 	} else
+ 		spin_unlock(&cd->hash_lock);
+-- 
+2.20.1
+
diff --git a/queue-5.5/tc-testing-add-missing-nsplugin-to-basic.json.patch b/queue-5.5/tc-testing-add-missing-nsplugin-to-basic.json.patch
new file mode 100644
index 00000000000..777824958e3
--- /dev/null
+++ b/queue-5.5/tc-testing-add-missing-nsplugin-to-basic.json.patch
@@ -0,0 +1,199 @@
+From 04c1ef20c24e99d8e45def6f0a2e1318ab3cd27d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 16:29:30 +0100
+Subject: tc-testing: add missing 'nsPlugin' to basic.json
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit e9ed4fa7b4400d7b2cf03108842a30e6c9bd0eb2 ]
+
+since tdc tests for cls_basic need $DEV1, use 'nsPlugin' so that the
+following command can be run without errors:
+
+ [root@f31 tc-testing]# ./tdc.py -c basic
+
+Fixes: 4717b05328ba ("tc-testing: Introduced tdc tests for basic filter")
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../tc-testing/tc-tests/filters/basic.json    | 51 +++++++++++++++++++
+ 1 file changed, 51 insertions(+)
+
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/filters/basic.json b/tools/testing/selftests/tc-testing/tc-tests/filters/basic.json
+index 2e361cea63bcd..98a20faf31986 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/filters/basic.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/filters/basic.json
+@@ -6,6 +6,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -25,6 +28,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -44,6 +50,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -63,6 +72,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -82,6 +94,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -101,6 +116,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -120,6 +138,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -139,6 +160,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -158,6 +182,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -177,6 +204,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -196,6 +226,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -215,6 +248,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -234,6 +270,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -253,6 +292,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -272,6 +314,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -291,6 +336,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+@@ -310,6 +358,9 @@
+             "filter",
+             "basic"
+         ],
++        "plugins": {
++            "requires": "nsPlugin"
++        },
+         "setup": [
+             "$TC qdisc add dev $DEV1 ingress"
+         ],
+-- 
+2.20.1
+
diff --git a/queue-5.5/tools-lib-api-fs-fix-gcc9-stringop-truncation-compil.patch b/queue-5.5/tools-lib-api-fs-fix-gcc9-stringop-truncation-compil.patch
new file mode 100644
index 00000000000..5c895bbfa7e
--- /dev/null
+++ b/queue-5.5/tools-lib-api-fs-fix-gcc9-stringop-truncation-compil.patch
@@ -0,0 +1,67 @@
+From dfed45f8038be4c24c3b309cb198fd0594ae3332 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 08:01:09 +0000
+Subject: tools lib api fs: Fix gcc9 stringop-truncation compilation error
+
+From: Andrey Zhizhikin <andrey.z@gmail.com>
+
+[ Upstream commit 6794200fa3c9c3e6759dae099145f23e4310f4f7 ]
+
+GCC9 introduced string hardening mechanisms, which exhibits the error
+during fs api compilation:
+
+error: '__builtin_strncpy' specified bound 4096 equals destination size
+[-Werror=stringop-truncation]
+
+This comes when the length of copy passed to strncpy is is equal to
+destination size, which could potentially lead to buffer overflow.
+
+There is a need to mitigate this potential issue by limiting the size of
+destination by 1 and explicitly terminate the destination with NULL.
+
+Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Andrii Nakryiko <andriin@fb.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Yonghong Song <yhs@fb.com>
+Cc: bpf@vger.kernel.org
+Cc: netdev@vger.kernel.org
+Link: http://lore.kernel.org/lkml/20191211080109.18765-1-andrey.zhizhikin@leica-geosystems.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/api/fs/fs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
+index 11b3885e833ed..027b18f7ed8cf 100644
+--- a/tools/lib/api/fs/fs.c
++++ b/tools/lib/api/fs/fs.c
+@@ -210,6 +210,7 @@ static bool fs__env_override(struct fs *fs)
+ 	size_t name_len = strlen(fs->name);
+ 	/* name + "_PATH" + '\0' */
+ 	char upper_name[name_len + 5 + 1];
++
+ 	memcpy(upper_name, fs->name, name_len);
+ 	mem_toupper(upper_name, name_len);
+ 	strcpy(&upper_name[name_len], "_PATH");
+@@ -219,7 +220,8 @@ static bool fs__env_override(struct fs *fs)
+ 		return false;
+ 
+ 	fs->found = true;
+-	strncpy(fs->path, override_path, sizeof(fs->path));
++	strncpy(fs->path, override_path, sizeof(fs->path) - 1);
++	fs->path[sizeof(fs->path) - 1] = '\0';
+ 	return true;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/tracing-fix-now-invalid-var_ref_vals-assumption-in-t.patch b/queue-5.5/tracing-fix-now-invalid-var_ref_vals-assumption-in-t.patch
new file mode 100644
index 00000000000..5f05f08eec9
--- /dev/null
+++ b/queue-5.5/tracing-fix-now-invalid-var_ref_vals-assumption-in-t.patch
@@ -0,0 +1,175 @@
+From 88c39725cf7759207670011e3c3c0f6ff40b2da6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 21:18:18 -0500
+Subject: tracing: Fix now invalid var_ref_vals assumption in trace action
+
+From: Tom Zanussi <zanussi@kernel.org>
+
+[ Upstream commit d380dcde9a07ca5de4805dee11f58a98ec0ad6ff ]
+
+The patch 'tracing: Fix histogram code when expression has same var as
+value' added code to return an existing variable reference when
+creating a new variable reference, which resulted in var_ref_vals
+slots being reused instead of being duplicated.
+
+The implementation of the trace action assumes that the end of the
+var_ref_vals array starting at action_data.var_ref_idx corresponds to
+the values that will be assigned to the trace params. The patch
+mentioned above invalidates that assumption, which means that each
+param needs to explicitly specify its index into var_ref_vals.
+
+This fix changes action_data.var_ref_idx to an array of var ref
+indexes to account for that.
+
+Link: https://lore.kernel.org/r/1580335695.6220.8.camel@kernel.org
+
+Fixes: 8bcebc77e85f ("tracing: Fix histogram code when expression has same var as value")
+Signed-off-by: Tom Zanussi <zanussi@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events_hist.c | 53 +++++++++++++++++++++++---------
+ 1 file changed, 38 insertions(+), 15 deletions(-)
+
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 48f9075e4fa18..e10585ef00e15 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -470,11 +470,12 @@ struct action_data {
+ 	 * When a histogram trigger is hit, the values of any
+ 	 * references to variables, including variables being passed
+ 	 * as parameters to synthetic events, are collected into a
+-	 * var_ref_vals array.  This var_ref_idx is the index of the
+-	 * first param in the array to be passed to the synthetic
+-	 * event invocation.
++	 * var_ref_vals array.  This var_ref_idx array is an array of
++	 * indices into the var_ref_vals array, one for each synthetic
++	 * event param, and is passed to the synthetic event
++	 * invocation.
+ 	 */
+-	unsigned int		var_ref_idx;
++	unsigned int		var_ref_idx[TRACING_MAP_VARS_MAX];
+ 	struct synth_event	*synth_event;
+ 	bool			use_trace_keyword;
+ 	char			*synth_event_name;
+@@ -875,14 +876,14 @@ static struct trace_event_functions synth_event_funcs = {
+ 
+ static notrace void trace_event_raw_event_synth(void *__data,
+ 						u64 *var_ref_vals,
+-						unsigned int var_ref_idx)
++						unsigned int *var_ref_idx)
+ {
+ 	struct trace_event_file *trace_file = __data;
+ 	struct synth_trace_event *entry;
+ 	struct trace_event_buffer fbuffer;
+ 	struct ring_buffer *buffer;
+ 	struct synth_event *event;
+-	unsigned int i, n_u64;
++	unsigned int i, n_u64, val_idx;
+ 	int fields_size = 0;
+ 
+ 	event = trace_file->event_call->data;
+@@ -905,15 +906,16 @@ static notrace void trace_event_raw_event_synth(void *__data,
+ 		goto out;
+ 
+ 	for (i = 0, n_u64 = 0; i < event->n_fields; i++) {
++		val_idx = var_ref_idx[i];
+ 		if (event->fields[i]->is_string) {
+-			char *str_val = (char *)(long)var_ref_vals[var_ref_idx + i];
++			char *str_val = (char *)(long)var_ref_vals[val_idx];
+ 			char *str_field = (char *)&entry->fields[n_u64];
+ 
+ 			strscpy(str_field, str_val, STR_VAR_LEN_MAX);
+ 			n_u64 += STR_VAR_LEN_MAX / sizeof(u64);
+ 		} else {
+ 			struct synth_field *field = event->fields[i];
+-			u64 val = var_ref_vals[var_ref_idx + i];
++			u64 val = var_ref_vals[val_idx];
+ 
+ 			switch (field->size) {
+ 			case 1:
+@@ -1113,10 +1115,10 @@ static struct tracepoint *alloc_synth_tracepoint(char *name)
+ }
+ 
+ typedef void (*synth_probe_func_t) (void *__data, u64 *var_ref_vals,
+-				    unsigned int var_ref_idx);
++				    unsigned int *var_ref_idx);
+ 
+ static inline void trace_synth(struct synth_event *event, u64 *var_ref_vals,
+-			       unsigned int var_ref_idx)
++			       unsigned int *var_ref_idx)
+ {
+ 	struct tracepoint *tp = event->tp;
+ 
+@@ -2651,6 +2653,22 @@ static int init_var_ref(struct hist_field *ref_field,
+ 	goto out;
+ }
+ 
++static int find_var_ref_idx(struct hist_trigger_data *hist_data,
++			    struct hist_field *var_field)
++{
++	struct hist_field *ref_field;
++	int i;
++
++	for (i = 0; i < hist_data->n_var_refs; i++) {
++		ref_field = hist_data->var_refs[i];
++		if (ref_field->var.idx == var_field->var.idx &&
++		    ref_field->var.hist_data == var_field->hist_data)
++			return i;
++	}
++
++	return -ENOENT;
++}
++
+ /**
+  * create_var_ref - Create a variable reference and attach it to trigger
+  * @hist_data: The trigger that will be referencing the variable
+@@ -4224,11 +4242,11 @@ static int trace_action_create(struct hist_trigger_data *hist_data,
+ 	struct trace_array *tr = hist_data->event_file->tr;
+ 	char *event_name, *param, *system = NULL;
+ 	struct hist_field *hist_field, *var_ref;
+-	unsigned int i, var_ref_idx;
++	unsigned int i;
+ 	unsigned int field_pos = 0;
+ 	struct synth_event *event;
+ 	char *synth_event_name;
+-	int ret = 0;
++	int var_ref_idx, ret = 0;
+ 
+ 	lockdep_assert_held(&event_mutex);
+ 
+@@ -4245,8 +4263,6 @@ static int trace_action_create(struct hist_trigger_data *hist_data,
+ 
+ 	event->ref++;
+ 
+-	var_ref_idx = hist_data->n_var_refs;
+-
+ 	for (i = 0; i < data->n_params; i++) {
+ 		char *p;
+ 
+@@ -4295,6 +4311,14 @@ static int trace_action_create(struct hist_trigger_data *hist_data,
+ 				goto err;
+ 			}
+ 
++			var_ref_idx = find_var_ref_idx(hist_data, var_ref);
++			if (WARN_ON(var_ref_idx < 0)) {
++				ret = var_ref_idx;
++				goto err;
++			}
++
++			data->var_ref_idx[i] = var_ref_idx;
++
+ 			field_pos++;
+ 			kfree(p);
+ 			continue;
+@@ -4313,7 +4337,6 @@ static int trace_action_create(struct hist_trigger_data *hist_data,
+ 	}
+ 
+ 	data->synth_event = event;
+-	data->var_ref_idx = var_ref_idx;
+  out:
+ 	return ret;
+  err:
+-- 
+2.20.1
+
diff --git a/queue-5.5/tracing-fix-tracing_stat-return-values-in-error-hand.patch b/queue-5.5/tracing-fix-tracing_stat-return-values-in-error-hand.patch
new file mode 100644
index 00000000000..118921965ff
--- /dev/null
+++ b/queue-5.5/tracing-fix-tracing_stat-return-values-in-error-hand.patch
@@ -0,0 +1,58 @@
+From caf77d4836a40e4eb8ff5dfeeb5b02629a15bb79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2014 22:49:41 +0100
+Subject: tracing: Fix tracing_stat return values in error handling paths
+
+From: Luis Henriques <luis.henriques@canonical.com>
+
+[ Upstream commit afccc00f75bbbee4e4ae833a96c2d29a7259c693 ]
+
+tracing_stat_init() was always returning '0', even on the error paths.  It
+now returns -ENODEV if tracing_init_dentry() fails or -ENOMEM if it fails
+to created the 'trace_stat' debugfs directory.
+
+Link: http://lkml.kernel.org/r/1410299381-20108-1-git-send-email-luis.henriques@canonical.com
+
+Fixes: ed6f1c996bfe4 ("tracing: Check return value of tracing_init_dentry()")
+Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
+[ Pulled from the archeological digging of my INBOX ]
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_stat.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c
+index 874f1274cf999..2b4d6e674d876 100644
+--- a/kernel/trace/trace_stat.c
++++ b/kernel/trace/trace_stat.c
+@@ -280,18 +280,22 @@ static int tracing_stat_init(void)
+ 
+ 	d_tracing = tracing_init_dentry();
+ 	if (IS_ERR(d_tracing))
+-		return 0;
++		return -ENODEV;
+ 
+ 	stat_dir = tracefs_create_dir("trace_stat", d_tracing);
+-	if (!stat_dir)
++	if (!stat_dir) {
+ 		pr_warn("Could not create tracefs 'trace_stat' entry\n");
++		return -ENOMEM;
++	}
+ 	return 0;
+ }
+ 
+ static int init_stat_file(struct stat_session *session)
+ {
+-	if (!stat_dir && tracing_stat_init())
+-		return -ENODEV;
++	int ret;
++
++	if (!stat_dir && (ret = tracing_stat_init()))
++		return ret;
+ 
+ 	session->file = tracefs_create_file(session->ts->name, 0644,
+ 					    stat_dir,
+-- 
+2.20.1
+
diff --git a/queue-5.5/tracing-fix-very-unlikely-race-of-registering-two-st.patch b/queue-5.5/tracing-fix-very-unlikely-race-of-registering-two-st.patch
new file mode 100644
index 00000000000..6295f22a56b
--- /dev/null
+++ b/queue-5.5/tracing-fix-very-unlikely-race-of-registering-two-st.patch
@@ -0,0 +1,87 @@
+From 0c13f793172a524db7291437cf13fc5ae512998d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 17:47:49 -0500
+Subject: tracing: Fix very unlikely race of registering two stat tracers
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+[ Upstream commit dfb6cd1e654315168e36d947471bd2a0ccd834ae ]
+
+Looking through old emails in my INBOX, I came across a patch from Luis
+Henriques that attempted to fix a race of two stat tracers registering the
+same stat trace (extremely unlikely, as this is done in the kernel, and
+probably doesn't even exist). The submitted patch wasn't quite right as it
+needed to deal with clean up a bit better (if two stat tracers were the
+same, it would have the same files).
+
+But to make the code cleaner, all we needed to do is to keep the
+all_stat_sessions_mutex held for most of the registering function.
+
+Link: http://lkml.kernel.org/r/1410299375-20068-1-git-send-email-luis.henriques@canonical.com
+
+Fixes: 002bb86d8d42f ("tracing/ftrace: separate events tracing and stats tracing engine")
+Reported-by: Luis Henriques <luis.henriques@canonical.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_stat.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c
+index 2b4d6e674d876..d1fa19773cc8e 100644
+--- a/kernel/trace/trace_stat.c
++++ b/kernel/trace/trace_stat.c
+@@ -308,7 +308,7 @@ static int init_stat_file(struct stat_session *session)
+ int register_stat_tracer(struct tracer_stat *trace)
+ {
+ 	struct stat_session *session, *node;
+-	int ret;
++	int ret = -EINVAL;
+ 
+ 	if (!trace)
+ 		return -EINVAL;
+@@ -319,17 +319,15 @@ int register_stat_tracer(struct tracer_stat *trace)
+ 	/* Already registered? */
+ 	mutex_lock(&all_stat_sessions_mutex);
+ 	list_for_each_entry(node, &all_stat_sessions, session_list) {
+-		if (node->ts == trace) {
+-			mutex_unlock(&all_stat_sessions_mutex);
+-			return -EINVAL;
+-		}
++		if (node->ts == trace)
++			goto out;
+ 	}
+-	mutex_unlock(&all_stat_sessions_mutex);
+ 
++	ret = -ENOMEM;
+ 	/* Init the session */
+ 	session = kzalloc(sizeof(*session), GFP_KERNEL);
+ 	if (!session)
+-		return -ENOMEM;
++		goto out;
+ 
+ 	session->ts = trace;
+ 	INIT_LIST_HEAD(&session->session_list);
+@@ -338,15 +336,16 @@ int register_stat_tracer(struct tracer_stat *trace)
+ 	ret = init_stat_file(session);
+ 	if (ret) {
+ 		destroy_session(session);
+-		return ret;
++		goto out;
+ 	}
+ 
++	ret = 0;
+ 	/* Register */
+-	mutex_lock(&all_stat_sessions_mutex);
+ 	list_add_tail(&session->session_list, &all_stat_sessions);
++ out:
+ 	mutex_unlock(&all_stat_sessions_mutex);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ void unregister_stat_tracer(struct tracer_stat *trace)
+-- 
+2.20.1
+
diff --git a/queue-5.5/tracing-simplify-assignment-parsing-for-hist-trigger.patch b/queue-5.5/tracing-simplify-assignment-parsing-for-hist-trigger.patch
new file mode 100644
index 00000000000..52da2405978
--- /dev/null
+++ b/queue-5.5/tracing-simplify-assignment-parsing-for-hist-trigger.patch
@@ -0,0 +1,193 @@
+From 48c70834e2f7332467ea1caf4fdcf1f754c52428 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2019 12:40:20 -0500
+Subject: tracing: Simplify assignment parsing for hist triggers
+
+From: Tom Zanussi <zanussi@kernel.org>
+
+[ Upstream commit b527b638fd63ba791dc90a0a6e9a3035b10df52b ]
+
+In the process of adding better error messages for sorting, I realized
+that strsep was being used incorrectly and some of the error paths I
+was expecting to be hit weren't and just fell through to the common
+invalid key error case.
+
+It also became obvious that for keyword assignments, it wasn't
+necessary to save the full assignment and reparse it later, and having
+a common empty-assignment check would also make more sense in terms of
+error processing.
+
+Change the code to fix these problems and simplify it for new error
+message changes in a subsequent patch.
+
+Link: http://lkml.kernel.org/r/1c3ef0b6655deaf345f6faee2584a0298ac2d743.1561743018.git.zanussi@kernel.org
+
+Fixes: e62347d24534 ("tracing: Add hist trigger support for user-defined sorting ('sort=' param)")
+Fixes: 7ef224d1d0e3 ("tracing: Add 'hist' event trigger command")
+Fixes: a4072fe85ba3 ("tracing: Add a clock attribute for hist triggers")
+Reported-by: Masami Hiramatsu <mhiramat@kernel.org>
+Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Tom Zanussi <zanussi@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events_hist.c | 70 ++++++++++++--------------------
+ 1 file changed, 27 insertions(+), 43 deletions(-)
+
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 6ac35b9e195de..48f9075e4fa18 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -2035,12 +2035,6 @@ static int parse_map_size(char *str)
+ 	unsigned long size, map_bits;
+ 	int ret;
+ 
+-	strsep(&str, "=");
+-	if (!str) {
+-		ret = -EINVAL;
+-		goto out;
+-	}
+-
+ 	ret = kstrtoul(str, 0, &size);
+ 	if (ret)
+ 		goto out;
+@@ -2100,25 +2094,25 @@ static int parse_action(char *str, struct hist_trigger_attrs *attrs)
+ static int parse_assignment(struct trace_array *tr,
+ 			    char *str, struct hist_trigger_attrs *attrs)
+ {
+-	int ret = 0;
++	int len, ret = 0;
+ 
+-	if ((str_has_prefix(str, "key=")) ||
+-	    (str_has_prefix(str, "keys="))) {
+-		attrs->keys_str = kstrdup(str, GFP_KERNEL);
++	if ((len = str_has_prefix(str, "key=")) ||
++	    (len = str_has_prefix(str, "keys="))) {
++		attrs->keys_str = kstrdup(str + len, GFP_KERNEL);
+ 		if (!attrs->keys_str) {
+ 			ret = -ENOMEM;
+ 			goto out;
+ 		}
+-	} else if ((str_has_prefix(str, "val=")) ||
+-		   (str_has_prefix(str, "vals=")) ||
+-		   (str_has_prefix(str, "values="))) {
+-		attrs->vals_str = kstrdup(str, GFP_KERNEL);
++	} else if ((len = str_has_prefix(str, "val=")) ||
++		   (len = str_has_prefix(str, "vals=")) ||
++		   (len = str_has_prefix(str, "values="))) {
++		attrs->vals_str = kstrdup(str + len, GFP_KERNEL);
+ 		if (!attrs->vals_str) {
+ 			ret = -ENOMEM;
+ 			goto out;
+ 		}
+-	} else if (str_has_prefix(str, "sort=")) {
+-		attrs->sort_key_str = kstrdup(str, GFP_KERNEL);
++	} else if ((len = str_has_prefix(str, "sort="))) {
++		attrs->sort_key_str = kstrdup(str + len, GFP_KERNEL);
+ 		if (!attrs->sort_key_str) {
+ 			ret = -ENOMEM;
+ 			goto out;
+@@ -2129,12 +2123,8 @@ static int parse_assignment(struct trace_array *tr,
+ 			ret = -ENOMEM;
+ 			goto out;
+ 		}
+-	} else if (str_has_prefix(str, "clock=")) {
+-		strsep(&str, "=");
+-		if (!str) {
+-			ret = -EINVAL;
+-			goto out;
+-		}
++	} else if ((len = str_has_prefix(str, "clock="))) {
++		str += len;
+ 
+ 		str = strstrip(str);
+ 		attrs->clock = kstrdup(str, GFP_KERNEL);
+@@ -2142,8 +2132,8 @@ static int parse_assignment(struct trace_array *tr,
+ 			ret = -ENOMEM;
+ 			goto out;
+ 		}
+-	} else if (str_has_prefix(str, "size=")) {
+-		int map_bits = parse_map_size(str);
++	} else if ((len = str_has_prefix(str, "size="))) {
++		int map_bits = parse_map_size(str + len);
+ 
+ 		if (map_bits < 0) {
+ 			ret = map_bits;
+@@ -2183,8 +2173,14 @@ parse_hist_trigger_attrs(struct trace_array *tr, char *trigger_str)
+ 
+ 	while (trigger_str) {
+ 		char *str = strsep(&trigger_str, ":");
++		char *rhs;
+ 
+-		if (strchr(str, '=')) {
++		rhs = strchr(str, '=');
++		if (rhs) {
++			if (!strlen(++rhs)) {
++				ret = -EINVAL;
++				goto free;
++			}
+ 			ret = parse_assignment(tr, str, attrs);
+ 			if (ret)
+ 				goto free;
+@@ -4536,10 +4532,6 @@ static int create_val_fields(struct hist_trigger_data *hist_data,
+ 	if (!fields_str)
+ 		goto out;
+ 
+-	strsep(&fields_str, "=");
+-	if (!fields_str)
+-		goto out;
+-
+ 	for (i = 0, j = 1; i < TRACING_MAP_VALS_MAX &&
+ 		     j < TRACING_MAP_VALS_MAX; i++) {
+ 		field_str = strsep(&fields_str, ",");
+@@ -4634,10 +4626,6 @@ static int create_key_fields(struct hist_trigger_data *hist_data,
+ 	if (!fields_str)
+ 		goto out;
+ 
+-	strsep(&fields_str, "=");
+-	if (!fields_str)
+-		goto out;
+-
+ 	for (i = n_vals; i < n_vals + TRACING_MAP_KEYS_MAX; i++) {
+ 		field_str = strsep(&fields_str, ",");
+ 		if (!field_str)
+@@ -4795,12 +4783,6 @@ static int create_sort_keys(struct hist_trigger_data *hist_data)
+ 	if (!fields_str)
+ 		goto out;
+ 
+-	strsep(&fields_str, "=");
+-	if (!fields_str) {
+-		ret = -EINVAL;
+-		goto out;
+-	}
+-
+ 	for (i = 0; i < TRACING_MAP_SORT_KEYS_MAX; i++) {
+ 		struct hist_field *hist_field;
+ 		char *field_str, *field_name;
+@@ -4809,9 +4791,11 @@ static int create_sort_keys(struct hist_trigger_data *hist_data)
+ 		sort_key = &hist_data->sort_keys[i];
+ 
+ 		field_str = strsep(&fields_str, ",");
+-		if (!field_str) {
+-			if (i == 0)
+-				ret = -EINVAL;
++		if (!field_str)
++			break;
++
++		if (!*field_str) {
++			ret = -EINVAL;
+ 			break;
+ 		}
+ 
+@@ -4821,7 +4805,7 @@ static int create_sort_keys(struct hist_trigger_data *hist_data)
+ 		}
+ 
+ 		field_name = strsep(&field_str, ".");
+-		if (!field_name) {
++		if (!field_name || !*field_name) {
+ 			ret = -EINVAL;
+ 			break;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-5.5/trigger_next-should-increase-position-index.patch b/queue-5.5/trigger_next-should-increase-position-index.patch
new file mode 100644
index 00000000000..3c293b58fef
--- /dev/null
+++ b/queue-5.5/trigger_next-should-increase-position-index.patch
@@ -0,0 +1,64 @@
+From 76633ccc97c9bac7a656885074f83fd9eaa18129 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 10:03:06 +0300
+Subject: trigger_next should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 6722b23e7a2ace078344064a9735fb73e554e9ef ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+Without patch:
+ # dd bs=30 skip=1 if=/sys/kernel/tracing/events/sched/sched_switch/trigger
+ dd: /sys/kernel/tracing/events/sched/sched_switch/trigger: cannot skip to specified offset
+ n traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist
+ # Available triggers:
+ # traceon traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist
+ 6+1 records in
+ 6+1 records out
+ 206 bytes copied, 0.00027916 s, 738 kB/s
+
+Notice the printing of "# Available triggers:..." after the line.
+
+With the patch:
+ # dd bs=30 skip=1 if=/sys/kernel/tracing/events/sched/sched_switch/trigger
+ dd: /sys/kernel/tracing/events/sched/sched_switch/trigger: cannot skip to specified offset
+ n traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist
+ 2+1 records in
+ 2+1 records out
+ 88 bytes copied, 0.000526867 s, 167 kB/s
+
+It only prints the end of the file, and does not restart.
+
+Link: http://lkml.kernel.org/r/3c35ee24-dd3a-8119-9c19-552ed253388a@virtuozzo.com
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events_trigger.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index 40106fff06a48..287d77eae59b3 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -116,9 +116,10 @@ static void *trigger_next(struct seq_file *m, void *t, loff_t *pos)
+ {
+ 	struct trace_event_file *event_file = event_file_data(m->private);
+ 
+-	if (t == SHOW_AVAILABLE_TRIGGERS)
++	if (t == SHOW_AVAILABLE_TRIGGERS) {
++		(*pos)++;
+ 		return NULL;
+-
++	}
+ 	return seq_list_next(t, &event_file->triggers, pos);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/tty-synclink_gt-adjust-indentation-in-several-functi.patch b/queue-5.5/tty-synclink_gt-adjust-indentation-in-several-functi.patch
new file mode 100644
index 00000000000..bf8724f03d0
--- /dev/null
+++ b/queue-5.5/tty-synclink_gt-adjust-indentation-in-several-functi.patch
@@ -0,0 +1,118 @@
+From d870f7716ecf4cd89ee4a84fdda49b2b4d76d53d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 19:39:13 -0700
+Subject: tty: synclink_gt: Adjust indentation in several functions
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 446e76873b5e4e70bdee5db2f2a894d5b4a7d081 ]
+
+Clang warns:
+
+../drivers/tty/synclink_gt.c:1337:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+        if (C_CRTSCTS(tty)) {
+        ^
+../drivers/tty/synclink_gt.c:1335:2: note: previous statement is here
+        if (I_IXOFF(tty))
+        ^
+../drivers/tty/synclink_gt.c:2563:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+        if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+        ^
+../drivers/tty/synclink_gt.c:2561:2: note: previous statement is here
+        if (I_INPCK(info->port.tty))
+        ^
+../drivers/tty/synclink_gt.c:3221:3: warning: misleading indentation;
+statement is not part of the previous 'else' [-Wmisleading-indentation]
+        set_signals(info);
+        ^
+../drivers/tty/synclink_gt.c:3219:2: note: previous statement is here
+        else
+        ^
+3 warnings generated.
+
+The indentation on these lines is not at all consistent, tabs and spaces
+are mixed together. Convert to just using tabs to be consistent with the
+Linux kernel coding style and eliminate these warnings from clang.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/822
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Link: https://lore.kernel.org/r/20191218023912.13827-1-natechancellor@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/synclink_gt.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
+index e8a9047de4516..36f1a4d870eb1 100644
+--- a/drivers/tty/synclink_gt.c
++++ b/drivers/tty/synclink_gt.c
+@@ -1334,10 +1334,10 @@ static void throttle(struct tty_struct * tty)
+ 	DBGINFO(("%s throttle\n", info->device_name));
+ 	if (I_IXOFF(tty))
+ 		send_xchar(tty, STOP_CHAR(tty));
+- 	if (C_CRTSCTS(tty)) {
++	if (C_CRTSCTS(tty)) {
+ 		spin_lock_irqsave(&info->lock,flags);
+ 		info->signals &= ~SerialSignal_RTS;
+-	 	set_signals(info);
++		set_signals(info);
+ 		spin_unlock_irqrestore(&info->lock,flags);
+ 	}
+ }
+@@ -1359,10 +1359,10 @@ static void unthrottle(struct tty_struct * tty)
+ 		else
+ 			send_xchar(tty, START_CHAR(tty));
+ 	}
+- 	if (C_CRTSCTS(tty)) {
++	if (C_CRTSCTS(tty)) {
+ 		spin_lock_irqsave(&info->lock,flags);
+ 		info->signals |= SerialSignal_RTS;
+-	 	set_signals(info);
++		set_signals(info);
+ 		spin_unlock_irqrestore(&info->lock,flags);
+ 	}
+ }
+@@ -2560,8 +2560,8 @@ static void change_params(struct slgt_info *info)
+ 	info->read_status_mask = IRQ_RXOVER;
+ 	if (I_INPCK(info->port.tty))
+ 		info->read_status_mask |= MASK_PARITY | MASK_FRAMING;
+- 	if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+- 		info->read_status_mask |= MASK_BREAK;
++	if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
++		info->read_status_mask |= MASK_BREAK;
+ 	if (I_IGNPAR(info->port.tty))
+ 		info->ignore_status_mask |= MASK_PARITY | MASK_FRAMING;
+ 	if (I_IGNBRK(info->port.tty)) {
+@@ -3192,7 +3192,7 @@ static int tiocmset(struct tty_struct *tty,
+ 		info->signals &= ~SerialSignal_DTR;
+ 
+ 	spin_lock_irqsave(&info->lock,flags);
+- 	set_signals(info);
++	set_signals(info);
+ 	spin_unlock_irqrestore(&info->lock,flags);
+ 	return 0;
+ }
+@@ -3203,7 +3203,7 @@ static int carrier_raised(struct tty_port *port)
+ 	struct slgt_info *info = container_of(port, struct slgt_info, port);
+ 
+ 	spin_lock_irqsave(&info->lock,flags);
+- 	get_signals(info);
++	get_signals(info);
+ 	spin_unlock_irqrestore(&info->lock,flags);
+ 	return (info->signals & SerialSignal_DCD) ? 1 : 0;
+ }
+@@ -3218,7 +3218,7 @@ static void dtr_rts(struct tty_port *port, int on)
+ 		info->signals |= SerialSignal_RTS | SerialSignal_DTR;
+ 	else
+ 		info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+- 	set_signals(info);
++	set_signals(info);
+ 	spin_unlock_irqrestore(&info->lock,flags);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/tty-synclinkmp-adjust-indentation-in-several-functio.patch b/queue-5.5/tty-synclinkmp-adjust-indentation-in-several-functio.patch
new file mode 100644
index 00000000000..a484ceabd97
--- /dev/null
+++ b/queue-5.5/tty-synclinkmp-adjust-indentation-in-several-functio.patch
@@ -0,0 +1,159 @@
+From a55522703460a6cff9e7f0525dae67b582ab5708 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 19:47:20 -0700
+Subject: tty: synclinkmp: Adjust indentation in several functions
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 1feedf61e7265128244f6993f23421f33dd93dbc ]
+
+Clang warns:
+
+../drivers/tty/synclinkmp.c:1456:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+        if (C_CRTSCTS(tty)) {
+        ^
+../drivers/tty/synclinkmp.c:1453:2: note: previous statement is here
+        if (I_IXOFF(tty))
+        ^
+../drivers/tty/synclinkmp.c:2473:8: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+                                                info->port.tty->hw_stopped = 0;
+                                                ^
+../drivers/tty/synclinkmp.c:2471:7: note: previous statement is here
+                                                if ( debug_level >= DEBUG_LEVEL_ISR )
+                                                ^
+../drivers/tty/synclinkmp.c:2482:8: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+                                                info->port.tty->hw_stopped = 1;
+                                                ^
+../drivers/tty/synclinkmp.c:2480:7: note: previous statement is here
+                                                if ( debug_level >= DEBUG_LEVEL_ISR )
+                                                ^
+../drivers/tty/synclinkmp.c:2809:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+        if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+        ^
+../drivers/tty/synclinkmp.c:2807:2: note: previous statement is here
+        if (I_INPCK(info->port.tty))
+        ^
+../drivers/tty/synclinkmp.c:3246:3: warning: misleading indentation;
+statement is not part of the previous 'else' [-Wmisleading-indentation]
+        set_signals(info);
+        ^
+../drivers/tty/synclinkmp.c:3244:2: note: previous statement is here
+        else
+        ^
+5 warnings generated.
+
+The indentation on these lines is not at all consistent, tabs and spaces
+are mixed together. Convert to just using tabs to be consistent with the
+Linux kernel coding style and eliminate these warnings from clang.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/823
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Link: https://lore.kernel.org/r/20191218024720.3528-1-natechancellor@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/synclinkmp.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/tty/synclinkmp.c b/drivers/tty/synclinkmp.c
+index fcb91bf7a15ba..54b897a646d02 100644
+--- a/drivers/tty/synclinkmp.c
++++ b/drivers/tty/synclinkmp.c
+@@ -1453,10 +1453,10 @@ static void throttle(struct tty_struct * tty)
+ 	if (I_IXOFF(tty))
+ 		send_xchar(tty, STOP_CHAR(tty));
+ 
+- 	if (C_CRTSCTS(tty)) {
++	if (C_CRTSCTS(tty)) {
+ 		spin_lock_irqsave(&info->lock,flags);
+ 		info->serial_signals &= ~SerialSignal_RTS;
+-	 	set_signals(info);
++		set_signals(info);
+ 		spin_unlock_irqrestore(&info->lock,flags);
+ 	}
+ }
+@@ -1482,10 +1482,10 @@ static void unthrottle(struct tty_struct * tty)
+ 			send_xchar(tty, START_CHAR(tty));
+ 	}
+ 
+- 	if (C_CRTSCTS(tty)) {
++	if (C_CRTSCTS(tty)) {
+ 		spin_lock_irqsave(&info->lock,flags);
+ 		info->serial_signals |= SerialSignal_RTS;
+-	 	set_signals(info);
++		set_signals(info);
+ 		spin_unlock_irqrestore(&info->lock,flags);
+ 	}
+ }
+@@ -2470,7 +2470,7 @@ static void isr_io_pin( SLMP_INFO *info, u16 status )
+ 					if (status & SerialSignal_CTS) {
+ 						if ( debug_level >= DEBUG_LEVEL_ISR )
+ 							printk("CTS tx start...");
+-			 			info->port.tty->hw_stopped = 0;
++						info->port.tty->hw_stopped = 0;
+ 						tx_start(info);
+ 						info->pending_bh |= BH_TRANSMIT;
+ 						return;
+@@ -2479,7 +2479,7 @@ static void isr_io_pin( SLMP_INFO *info, u16 status )
+ 					if (!(status & SerialSignal_CTS)) {
+ 						if ( debug_level >= DEBUG_LEVEL_ISR )
+ 							printk("CTS tx stop...");
+-			 			info->port.tty->hw_stopped = 1;
++						info->port.tty->hw_stopped = 1;
+ 						tx_stop(info);
+ 					}
+ 				}
+@@ -2806,8 +2806,8 @@ static void change_params(SLMP_INFO *info)
+ 	info->read_status_mask2 = OVRN;
+ 	if (I_INPCK(info->port.tty))
+ 		info->read_status_mask2 |= PE | FRME;
+- 	if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+- 		info->read_status_mask1 |= BRKD;
++	if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
++		info->read_status_mask1 |= BRKD;
+ 	if (I_IGNPAR(info->port.tty))
+ 		info->ignore_status_mask2 |= PE | FRME;
+ 	if (I_IGNBRK(info->port.tty)) {
+@@ -3177,7 +3177,7 @@ static int tiocmget(struct tty_struct *tty)
+  	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&info->lock,flags);
+- 	get_signals(info);
++	get_signals(info);
+ 	spin_unlock_irqrestore(&info->lock,flags);
+ 
+ 	result = ((info->serial_signals & SerialSignal_RTS) ? TIOCM_RTS : 0) |
+@@ -3215,7 +3215,7 @@ static int tiocmset(struct tty_struct *tty,
+ 		info->serial_signals &= ~SerialSignal_DTR;
+ 
+ 	spin_lock_irqsave(&info->lock,flags);
+- 	set_signals(info);
++	set_signals(info);
+ 	spin_unlock_irqrestore(&info->lock,flags);
+ 
+ 	return 0;
+@@ -3227,7 +3227,7 @@ static int carrier_raised(struct tty_port *port)
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&info->lock,flags);
+- 	get_signals(info);
++	get_signals(info);
+ 	spin_unlock_irqrestore(&info->lock,flags);
+ 
+ 	return (info->serial_signals & SerialSignal_DCD) ? 1 : 0;
+@@ -3243,7 +3243,7 @@ static void dtr_rts(struct tty_port *port, int on)
+ 		info->serial_signals |= SerialSignal_RTS | SerialSignal_DTR;
+ 	else
+ 		info->serial_signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+- 	set_signals(info);
++	set_signals(info);
+ 	spin_unlock_irqrestore(&info->lock,flags);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/udf-allow-writing-to-rewritable-partitions.patch b/queue-5.5/udf-allow-writing-to-rewritable-partitions.patch
new file mode 100644
index 00000000000..346c6485b89
--- /dev/null
+++ b/queue-5.5/udf-allow-writing-to-rewritable-partitions.patch
@@ -0,0 +1,60 @@
+From e9f4b51a6bd6c2f30254185c074c0ede837f1d60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2020 12:11:14 +0100
+Subject: udf: Allow writing to 'Rewritable' partitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 15fb05fd286ac57a0802d71624daeb5c1c2d5b07 ]
+
+UDF 2.60 standard states in section 2.2.14.2:
+
+    A partition with Access Type 3 (rewritable) shall define a Freed
+    Space Bitmap or a Freed Space Table, see 2.3.3. All other partitions
+    shall not define a Freed Space Bitmap or a Freed Space Table.
+
+    Rewritable partitions are used on media that require some form of
+    preprocessing before re-writing data (for example legacy MO). Such
+    partitions shall use Access Type 3.
+
+    Overwritable partitions are used on media that do not require
+    preprocessing before overwriting data (for example: CD-RW, DVD-RW,
+    DVD+RW, DVD-RAM, BD-RE, HD DVD-Rewritable). Such partitions shall
+    use Access Type 4.
+
+however older versions of the standard didn't have this wording and
+there are tools out there that create UDF filesystems with rewritable
+partitions but that don't contain a Freed Space Bitmap or a Freed Space
+Table on media that does not require pre-processing before overwriting a
+block. So instead of forcing media with rewritable partition read-only,
+base this decision on presence of a Freed Space Bitmap or a Freed Space
+Table.
+
+Reported-by: Pali Rohár <pali.rohar@gmail.com>
+Reviewed-by: Pali Rohár <pali.rohar@gmail.com>
+Fixes: b085fbe2ef7f ("udf: Fix crash during mount")
+Link: https://lore.kernel.org/linux-fsdevel/20200112144735.hj2emsoy4uwsouxz@pali
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/super.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 8c28e93e9b730..008bf96b1732d 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -1035,7 +1035,6 @@ static int check_partition_desc(struct super_block *sb,
+ 	switch (le32_to_cpu(p->accessType)) {
+ 	case PD_ACCESS_TYPE_READ_ONLY:
+ 	case PD_ACCESS_TYPE_WRITE_ONCE:
+-	case PD_ACCESS_TYPE_REWRITABLE:
+ 	case PD_ACCESS_TYPE_NONE:
+ 		goto force_ro;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.5/udf-fix-free-space-reporting-for-metadata-and-virtua.patch b/queue-5.5/udf-fix-free-space-reporting-for-metadata-and-virtua.patch
new file mode 100644
index 00000000000..7ac24a00006
--- /dev/null
+++ b/queue-5.5/udf-fix-free-space-reporting-for-metadata-and-virtua.patch
@@ -0,0 +1,76 @@
+From 4561938c925b6d511d2aa0c3ad7adafb560ee457 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 16:36:49 +0100
+Subject: udf: Fix free space reporting for metadata and virtual partitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit a4a8b99ec819ca60b49dc582a4287ef03411f117 ]
+
+Free space on filesystems with metadata or virtual partition maps
+currently gets misreported. This is because these partitions are just
+remapped onto underlying real partitions from which keep track of free
+blocks. Take this remapping into account when counting free blocks as
+well.
+
+Reviewed-by: Pali Rohár <pali.rohar@gmail.com>
+Reported-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/super.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 008bf96b1732d..4baa1ca91e9be 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -2491,17 +2491,29 @@ static unsigned int udf_count_free_table(struct super_block *sb,
+ static unsigned int udf_count_free(struct super_block *sb)
+ {
+ 	unsigned int accum = 0;
+-	struct udf_sb_info *sbi;
++	struct udf_sb_info *sbi = UDF_SB(sb);
+ 	struct udf_part_map *map;
++	unsigned int part = sbi->s_partition;
++	int ptype = sbi->s_partmaps[part].s_partition_type;
++
++	if (ptype == UDF_METADATA_MAP25) {
++		part = sbi->s_partmaps[part].s_type_specific.s_metadata.
++							s_phys_partition_ref;
++	} else if (ptype == UDF_VIRTUAL_MAP15 || ptype == UDF_VIRTUAL_MAP20) {
++		/*
++		 * Filesystems with VAT are append-only and we cannot write to
++ 		 * them. Let's just report 0 here.
++		 */
++		return 0;
++	}
+ 
+-	sbi = UDF_SB(sb);
+ 	if (sbi->s_lvid_bh) {
+ 		struct logicalVolIntegrityDesc *lvid =
+ 			(struct logicalVolIntegrityDesc *)
+ 			sbi->s_lvid_bh->b_data;
+-		if (le32_to_cpu(lvid->numOfPartitions) > sbi->s_partition) {
++		if (le32_to_cpu(lvid->numOfPartitions) > part) {
+ 			accum = le32_to_cpu(
+-					lvid->freeSpaceTable[sbi->s_partition]);
++					lvid->freeSpaceTable[part]);
+ 			if (accum == 0xFFFFFFFF)
+ 				accum = 0;
+ 		}
+@@ -2510,7 +2522,7 @@ static unsigned int udf_count_free(struct super_block *sb)
+ 	if (accum)
+ 		return accum;
+ 
+-	map = &sbi->s_partmaps[sbi->s_partition];
++	map = &sbi->s_partmaps[part];
+ 	if (map->s_partition_flags & UDF_PART_FLAG_UNALLOC_BITMAP) {
+ 		accum += udf_count_free_bitmap(sb,
+ 					       map->s_uspace.s_bitmap);
+-- 
+2.20.1
+
diff --git a/queue-5.5/uio-fix-a-sleep-in-atomic-context-bug-in-uio_dmem_ge.patch b/queue-5.5/uio-fix-a-sleep-in-atomic-context-bug-in-uio_dmem_ge.patch
new file mode 100644
index 00000000000..8280cbb234c
--- /dev/null
+++ b/queue-5.5/uio-fix-a-sleep-in-atomic-context-bug-in-uio_dmem_ge.patch
@@ -0,0 +1,57 @@
+From c3fec4ed4ec72cdfaceab82fdc418098fdedf8de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 17:44:05 +0800
+Subject: uio: fix a sleep-in-atomic-context bug in
+ uio_dmem_genirq_irqcontrol()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit b74351287d4bd90636c3f48bc188c2f53824c2d4 ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+kernel/irq/manage.c, 523:
+	synchronize_irq in disable_irq
+drivers/uio/uio_dmem_genirq.c, 140:
+	disable_irq in uio_dmem_genirq_irqcontrol
+drivers/uio/uio_dmem_genirq.c, 134:
+	_raw_spin_lock_irqsave in uio_dmem_genirq_irqcontrol
+
+synchronize_irq() can sleep at runtime.
+
+To fix this bug, disable_irq() is called without holding the spinlock.
+
+This bug is found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20191218094405.6009-1-baijiaju1990@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/uio/uio_dmem_genirq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c
+index 81c88f7bbbcbb..f6ab3f28c8382 100644
+--- a/drivers/uio/uio_dmem_genirq.c
++++ b/drivers/uio/uio_dmem_genirq.c
+@@ -132,11 +132,13 @@ static int uio_dmem_genirq_irqcontrol(struct uio_info *dev_info, s32 irq_on)
+ 	if (irq_on) {
+ 		if (test_and_clear_bit(0, &priv->flags))
+ 			enable_irq(dev_info->irq);
++		spin_unlock_irqrestore(&priv->lock, flags);
+ 	} else {
+-		if (!test_and_set_bit(0, &priv->flags))
++		if (!test_and_set_bit(0, &priv->flags)) {
++			spin_unlock_irqrestore(&priv->lock, flags);
+ 			disable_irq(dev_info->irq);
++		}
+ 	}
+-	spin_unlock_irqrestore(&priv->lock, flags);
+ 
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.5/usb-dwc2-fix-in-fifo-allocation.patch b/queue-5.5/usb-dwc2-fix-in-fifo-allocation.patch
new file mode 100644
index 00000000000..a26688dd1a8
--- /dev/null
+++ b/queue-5.5/usb-dwc2-fix-in-fifo-allocation.patch
@@ -0,0 +1,84 @@
+From c9b4e1f94bc946a2f7b1c428c7a0f88151a9b503 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 11:34:31 +0000
+Subject: usb: dwc2: Fix IN FIFO allocation
+
+From: John Keeping <john@metanate.com>
+
+[ Upstream commit 644139f8b64d818f6345351455f14471510879a5 ]
+
+On chips with fewer FIFOs than endpoints (for example RK3288 which has 9
+endpoints, but only 6 which are cabable of input), the DPTXFSIZN
+registers above the FIFO count may return invalid values.
+
+With logging added on startup, I see:
+
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=1 sz=256
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=2 sz=128
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=3 sz=128
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=4 sz=64
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=5 sz=64
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=6 sz=32
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=7 sz=0
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=8 sz=0
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=9 sz=0
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=10 sz=0
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=11 sz=0
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=12 sz=0
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=13 sz=0
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=14 sz=0
+	dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=15 sz=0
+
+but:
+
+	# cat /sys/kernel/debug/ff580000.usb/fifo
+	Non-periodic FIFOs:
+	RXFIFO: Size 275
+	NPTXFIFO: Size 16, Start 0x00000113
+
+	Periodic TXFIFOs:
+		DPTXFIFO 1: Size 256, Start 0x00000123
+		DPTXFIFO 2: Size 128, Start 0x00000223
+		DPTXFIFO 3: Size 128, Start 0x000002a3
+		DPTXFIFO 4: Size 64, Start 0x00000323
+		DPTXFIFO 5: Size 64, Start 0x00000363
+		DPTXFIFO 6: Size 32, Start 0x000003a3
+		DPTXFIFO 7: Size 0, Start 0x000003e3
+		DPTXFIFO 8: Size 0, Start 0x000003a3
+		DPTXFIFO 9: Size 256, Start 0x00000123
+
+so it seems that FIFO 9 is mirroring FIFO 1.
+
+Fix the allocation by using the FIFO count instead of the endpoint count
+when selecting a FIFO for an endpoint.
+
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: John Keeping <john@metanate.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/gadget.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 6be10e496e105..a9133773b89e4 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -4056,11 +4056,12 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,
+ 	 * a unique tx-fifo even if it is non-periodic.
+ 	 */
+ 	if (dir_in && hsotg->dedicated_fifos) {
++		unsigned fifo_count = dwc2_hsotg_tx_fifo_count(hsotg);
+ 		u32 fifo_index = 0;
+ 		u32 fifo_size = UINT_MAX;
+ 
+ 		size = hs_ep->ep.maxpacket * hs_ep->mc;
+-		for (i = 1; i < hsotg->num_of_eps; ++i) {
++		for (i = 1; i <= fifo_count; ++i) {
+ 			if (hsotg->fifo_map & (1 << i))
+ 				continue;
+ 			val = dwc2_readl(hsotg, DPTXFSIZN(i));
+-- 
+2.20.1
+
diff --git a/queue-5.5/usb-dwc3-use-proper-initializers-for-property-entrie.patch b/queue-5.5/usb-dwc3-use-proper-initializers-for-property-entrie.patch
new file mode 100644
index 00000000000..cb2223b8694
--- /dev/null
+++ b/queue-5.5/usb-dwc3-use-proper-initializers-for-property-entrie.patch
@@ -0,0 +1,54 @@
+From 53928bb8fc4835335082a1450d0d90cc42b5a87d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 09:46:23 -0800
+Subject: usb: dwc3: use proper initializers for property entries
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 5eb5afb07853d6e90d3a2b230c825e028e948f79 ]
+
+We should not be reaching into property entries and initialize them by
+hand, but rather use proper initializer macros. This way we can alter
+internal representation of property entries with no visible changes to
+their users.
+
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/host.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
+index 5567ed2cddbec..fa252870c926f 100644
+--- a/drivers/usb/dwc3/host.c
++++ b/drivers/usb/dwc3/host.c
+@@ -88,10 +88,10 @@ int dwc3_host_init(struct dwc3 *dwc)
+ 	memset(props, 0, sizeof(struct property_entry) * ARRAY_SIZE(props));
+ 
+ 	if (dwc->usb3_lpm_capable)
+-		props[prop_idx++].name = "usb3-lpm-capable";
++		props[prop_idx++] = PROPERTY_ENTRY_BOOL("usb3-lpm-capable");
+ 
+ 	if (dwc->usb2_lpm_disable)
+-		props[prop_idx++].name = "usb2-lpm-disable";
++		props[prop_idx++] = PROPERTY_ENTRY_BOOL("usb2-lpm-disable");
+ 
+ 	/**
+ 	 * WORKAROUND: dwc3 revisions <=3.00a have a limitation
+@@ -103,7 +103,7 @@ int dwc3_host_init(struct dwc3 *dwc)
+ 	 * This following flag tells XHCI to do just that.
+ 	 */
+ 	if (dwc->revision <= DWC3_REVISION_300A)
+-		props[prop_idx++].name = "quirk-broken-port-ped";
++		props[prop_idx++] = PROPERTY_ENTRY_BOOL("quirk-broken-port-ped");
+ 
+ 	if (prop_idx) {
+ 		ret = platform_device_add_properties(xhci, props);
+-- 
+2.20.1
+
diff --git a/queue-5.5/usb-gadget-udc-fix-possible-sleep-in-atomic-context-.patch b/queue-5.5/usb-gadget-udc-fix-possible-sleep-in-atomic-context-.patch
new file mode 100644
index 00000000000..c8e84cf8a29
--- /dev/null
+++ b/queue-5.5/usb-gadget-udc-fix-possible-sleep-in-atomic-context-.patch
@@ -0,0 +1,111 @@
+From 164c6bdbd47aac8af2e1444310aca8afb8e36857 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 11:43:49 +0800
+Subject: usb: gadget: udc: fix possible sleep-in-atomic-context bugs in
+ gr_probe()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 9c1ed62ae0690dfe5d5e31d8f70e70a95cb48e52 ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+drivers/usb/gadget/udc/core.c, 1175:
+	kzalloc(GFP_KERNEL) in usb_add_gadget_udc_release
+drivers/usb/gadget/udc/core.c, 1272:
+	usb_add_gadget_udc_release in usb_add_gadget_udc
+drivers/usb/gadget/udc/gr_udc.c, 2186:
+	usb_add_gadget_udc in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+	spin_lock in gr_probe
+
+drivers/usb/gadget/udc/core.c, 1195:
+	mutex_lock in usb_add_gadget_udc_release
+drivers/usb/gadget/udc/core.c, 1272:
+	usb_add_gadget_udc_release in usb_add_gadget_udc
+drivers/usb/gadget/udc/gr_udc.c, 2186:
+	usb_add_gadget_udc in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+	spin_lock in gr_probe
+
+drivers/usb/gadget/udc/gr_udc.c, 212:
+	debugfs_create_file in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2197:
+	gr_dfs_create in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+    spin_lock in gr_probe
+
+drivers/usb/gadget/udc/gr_udc.c, 2114:
+	devm_request_threaded_irq in gr_request_irq
+drivers/usb/gadget/udc/gr_udc.c, 2202:
+	gr_request_irq in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+    spin_lock in gr_probe
+
+kzalloc(GFP_KERNEL), mutex_lock(), debugfs_create_file() and
+devm_request_threaded_irq() can sleep at runtime.
+
+To fix these possible bugs, usb_add_gadget_udc(), gr_dfs_create() and
+gr_request_irq() are called without handling the spinlock.
+
+These bugs are found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/gr_udc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
+index 64d80c65bb967..aaf975c809bf9 100644
+--- a/drivers/usb/gadget/udc/gr_udc.c
++++ b/drivers/usb/gadget/udc/gr_udc.c
+@@ -2175,8 +2175,6 @@ static int gr_probe(struct platform_device *pdev)
+ 		return -ENOMEM;
+ 	}
+ 
+-	spin_lock(&dev->lock);
+-
+ 	/* Inside lock so that no gadget can use this udc until probe is done */
+ 	retval = usb_add_gadget_udc(dev->dev, &dev->gadget);
+ 	if (retval) {
+@@ -2185,15 +2183,21 @@ static int gr_probe(struct platform_device *pdev)
+ 	}
+ 	dev->added = 1;
+ 
++	spin_lock(&dev->lock);
++
+ 	retval = gr_udc_init(dev);
+-	if (retval)
++	if (retval) {
++		spin_unlock(&dev->lock);
+ 		goto out;
+-
+-	gr_dfs_create(dev);
++	}
+ 
+ 	/* Clear all interrupt enables that might be left on since last boot */
+ 	gr_disable_interrupts_and_pullup(dev);
+ 
++	spin_unlock(&dev->lock);
++
++	gr_dfs_create(dev);
++
+ 	retval = gr_request_irq(dev, dev->irq);
+ 	if (retval) {
+ 		dev_err(dev->dev, "Failed to request irq %d\n", dev->irq);
+@@ -2222,8 +2226,6 @@ static int gr_probe(struct platform_device *pdev)
+ 		dev_info(dev->dev, "regs: %p, irq %d\n", dev->regs, dev->irq);
+ 
+ out:
+-	spin_unlock(&dev->lock);
+-
+ 	if (retval)
+ 		gr_remove(pdev);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/usb-musb-omap2430-get-rid-of-musb-.set_vbus-for-omap.patch b/queue-5.5/usb-musb-omap2430-get-rid-of-musb-.set_vbus-for-omap.patch
new file mode 100644
index 00000000000..f8eb5229a1e
--- /dev/null
+++ b/queue-5.5/usb-musb-omap2430-get-rid-of-musb-.set_vbus-for-omap.patch
@@ -0,0 +1,56 @@
+From 56bd5db2b2cf368f215a001eca1f3e19b6c5a8d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 07:25:26 -0600
+Subject: usb: musb: omap2430: Get rid of musb .set_vbus for omap2430 glue
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 91b6dec32e5c25fbdbb564d1e5af23764ec17ef1 ]
+
+We currently have musb_set_vbus() called from two different paths. Mostly
+it gets called from the USB PHY via omap_musb_set_mailbox(), but in some
+cases it can get also called from musb_stage0_irq() rather via .set_vbus:
+
+(musb_set_host [musb_hdrc])
+(omap2430_musb_set_vbus [omap2430])
+(musb_stage0_irq [musb_hdrc])
+(musb_interrupt [musb_hdrc])
+(omap2430_musb_interrupt [omap2430])
+
+This is racy and will not work with introducing generic helper functions
+for musb_set_host() and musb_set_peripheral(). We want to get rid of the
+busy loops in favor of usleep_range().
+
+Let's just get rid of .set_vbus for omap2430 glue layer and let the PHY
+code handle VBUS with musb_set_vbus(). Note that in the follow-up patch
+we can completely remove omap2430_musb_set_vbus(), but let's do it in a
+separate patch as this change may actually turn out to be needed as a
+fix.
+
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Link: https://lore.kernel.org/r/20200115132547.364-5-b-liu@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/musb/omap2430.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
+index a3d2fef677468..5c93226e0e20a 100644
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -361,8 +361,6 @@ static const struct musb_platform_ops omap2430_ops = {
+ 	.init		= omap2430_musb_init,
+ 	.exit		= omap2430_musb_exit,
+ 
+-	.set_vbus	= omap2430_musb_set_vbus,
+-
+ 	.enable		= omap2430_musb_enable,
+ 	.disable	= omap2430_musb_disable,
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/usbip-fix-unsafe-unaligned-pointer-usage.patch b/queue-5.5/usbip-fix-unsafe-unaligned-pointer-usage.patch
new file mode 100644
index 00000000000..62316cd9d10
--- /dev/null
+++ b/queue-5.5/usbip-fix-unsafe-unaligned-pointer-usage.patch
@@ -0,0 +1,156 @@
+From 5ad74bd2e8ba5fa9c2c52987257fc206b547aeb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 18:24:16 -0700
+Subject: usbip: Fix unsafe unaligned pointer usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit 585c91f40d201bc564d4e76b83c05b3b5363fe7e ]
+
+Fix unsafe unaligned pointer usage in usbip network interfaces. usbip tool
+build fails with new gcc -Werror=address-of-packed-member checks.
+
+usbip_network.c: In function ‘usbip_net_pack_usb_device’:
+usbip_network.c:79:32: error: taking address of packed member of ‘struct usbip_usb_device’ may result in an unaligned pointer value [-Werror=address-of-packed-member]
+   79 |  usbip_net_pack_uint32_t(pack, &udev->busnum);
+
+Fix with minor changes to pass by value instead of by address.
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20200109012416.2875-1-skhan@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/usb/usbip/src/usbip_network.c | 40 +++++++++++++++++------------
+ tools/usb/usbip/src/usbip_network.h | 12 +++------
+ 2 files changed, 27 insertions(+), 25 deletions(-)
+
+diff --git a/tools/usb/usbip/src/usbip_network.c b/tools/usb/usbip/src/usbip_network.c
+index d595d72693fbb..ed4dc8c142690 100644
+--- a/tools/usb/usbip/src/usbip_network.c
++++ b/tools/usb/usbip/src/usbip_network.c
+@@ -50,39 +50,39 @@ void usbip_setup_port_number(char *arg)
+ 	info("using port %d (\"%s\")", usbip_port, usbip_port_string);
+ }
+ 
+-void usbip_net_pack_uint32_t(int pack, uint32_t *num)
++uint32_t usbip_net_pack_uint32_t(int pack, uint32_t num)
+ {
+ 	uint32_t i;
+ 
+ 	if (pack)
+-		i = htonl(*num);
++		i = htonl(num);
+ 	else
+-		i = ntohl(*num);
++		i = ntohl(num);
+ 
+-	*num = i;
++	return i;
+ }
+ 
+-void usbip_net_pack_uint16_t(int pack, uint16_t *num)
++uint16_t usbip_net_pack_uint16_t(int pack, uint16_t num)
+ {
+ 	uint16_t i;
+ 
+ 	if (pack)
+-		i = htons(*num);
++		i = htons(num);
+ 	else
+-		i = ntohs(*num);
++		i = ntohs(num);
+ 
+-	*num = i;
++	return i;
+ }
+ 
+ void usbip_net_pack_usb_device(int pack, struct usbip_usb_device *udev)
+ {
+-	usbip_net_pack_uint32_t(pack, &udev->busnum);
+-	usbip_net_pack_uint32_t(pack, &udev->devnum);
+-	usbip_net_pack_uint32_t(pack, &udev->speed);
++	udev->busnum = usbip_net_pack_uint32_t(pack, udev->busnum);
++	udev->devnum = usbip_net_pack_uint32_t(pack, udev->devnum);
++	udev->speed = usbip_net_pack_uint32_t(pack, udev->speed);
+ 
+-	usbip_net_pack_uint16_t(pack, &udev->idVendor);
+-	usbip_net_pack_uint16_t(pack, &udev->idProduct);
+-	usbip_net_pack_uint16_t(pack, &udev->bcdDevice);
++	udev->idVendor = usbip_net_pack_uint16_t(pack, udev->idVendor);
++	udev->idProduct = usbip_net_pack_uint16_t(pack, udev->idProduct);
++	udev->bcdDevice = usbip_net_pack_uint16_t(pack, udev->bcdDevice);
+ }
+ 
+ void usbip_net_pack_usb_interface(int pack __attribute__((unused)),
+@@ -129,6 +129,14 @@ ssize_t usbip_net_send(int sockfd, void *buff, size_t bufflen)
+ 	return usbip_net_xmit(sockfd, buff, bufflen, 1);
+ }
+ 
++static inline void usbip_net_pack_op_common(int pack,
++					    struct op_common *op_common)
++{
++	op_common->version = usbip_net_pack_uint16_t(pack, op_common->version);
++	op_common->code = usbip_net_pack_uint16_t(pack, op_common->code);
++	op_common->status = usbip_net_pack_uint32_t(pack, op_common->status);
++}
++
+ int usbip_net_send_op_common(int sockfd, uint32_t code, uint32_t status)
+ {
+ 	struct op_common op_common;
+@@ -140,7 +148,7 @@ int usbip_net_send_op_common(int sockfd, uint32_t code, uint32_t status)
+ 	op_common.code    = code;
+ 	op_common.status  = status;
+ 
+-	PACK_OP_COMMON(1, &op_common);
++	usbip_net_pack_op_common(1, &op_common);
+ 
+ 	rc = usbip_net_send(sockfd, &op_common, sizeof(op_common));
+ 	if (rc < 0) {
+@@ -164,7 +172,7 @@ int usbip_net_recv_op_common(int sockfd, uint16_t *code, int *status)
+ 		goto err;
+ 	}
+ 
+-	PACK_OP_COMMON(0, &op_common);
++	usbip_net_pack_op_common(0, &op_common);
+ 
+ 	if (op_common.version != USBIP_VERSION) {
+ 		err("USBIP Kernel and tool version mismatch: %d %d:",
+diff --git a/tools/usb/usbip/src/usbip_network.h b/tools/usb/usbip/src/usbip_network.h
+index 555215eae43e9..83b4c5344f721 100644
+--- a/tools/usb/usbip/src/usbip_network.h
++++ b/tools/usb/usbip/src/usbip_network.h
+@@ -32,12 +32,6 @@ struct op_common {
+ 
+ } __attribute__((packed));
+ 
+-#define PACK_OP_COMMON(pack, op_common)  do {\
+-	usbip_net_pack_uint16_t(pack, &(op_common)->version);\
+-	usbip_net_pack_uint16_t(pack, &(op_common)->code);\
+-	usbip_net_pack_uint32_t(pack, &(op_common)->status);\
+-} while (0)
+-
+ /* ---------------------------------------------------------------------- */
+ /* Dummy Code */
+ #define OP_UNSPEC	0x00
+@@ -163,11 +157,11 @@ struct op_devlist_reply_extra {
+ } while (0)
+ 
+ #define PACK_OP_DEVLIST_REPLY(pack, reply)  do {\
+-	usbip_net_pack_uint32_t(pack, &(reply)->ndev);\
++	(reply)->ndev = usbip_net_pack_uint32_t(pack, (reply)->ndev);\
+ } while (0)
+ 
+-void usbip_net_pack_uint32_t(int pack, uint32_t *num);
+-void usbip_net_pack_uint16_t(int pack, uint16_t *num);
++uint32_t usbip_net_pack_uint32_t(int pack, uint32_t num);
++uint16_t usbip_net_pack_uint16_t(int pack, uint16_t num);
+ void usbip_net_pack_usb_device(int pack, struct usbip_usb_device *udev);
+ void usbip_net_pack_usb_interface(int pack, struct usbip_usb_interface *uinf);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/vfio-spapr-nvlink2-skip-unpinning-pages-on-error-exi.patch b/queue-5.5/vfio-spapr-nvlink2-skip-unpinning-pages-on-error-exi.patch
new file mode 100644
index 00000000000..f88b264d923
--- /dev/null
+++ b/queue-5.5/vfio-spapr-nvlink2-skip-unpinning-pages-on-error-exi.patch
@@ -0,0 +1,49 @@
+From 5f9f717df8348aa809e62a1afd4cbe73964e3007 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Dec 2019 12:09:27 +1100
+Subject: vfio/spapr/nvlink2: Skip unpinning pages on error exit
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit 338b4e10f939a71194d8ecef7ece205a942cec05 ]
+
+The nvlink2 subdriver for IBM Witherspoon machines preregisters
+GPU memory in the IOMMI API so KVM TCE code can map this memory
+for DMA as well. This is done by mm_iommu_newdev() called from
+vfio_pci_nvgpu_regops::mmap.
+
+In an unlikely event of failure the data->mem remains NULL and
+since mm_iommu_put() (which unregisters the region and unpins memory
+if that was regular memory) does not expect mem=NULL, it should not be
+called.
+
+This adds a check to only call mm_iommu_put() for a valid data->mem.
+
+Fixes: 7f92891778df ("vfio_pci: Add NVIDIA GV100GL [Tesla V100 SXM2] subdriver")
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_nvlink2.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci_nvlink2.c b/drivers/vfio/pci/vfio_pci_nvlink2.c
+index f2983f0f84bea..3f5f8198a6bb1 100644
+--- a/drivers/vfio/pci/vfio_pci_nvlink2.c
++++ b/drivers/vfio/pci/vfio_pci_nvlink2.c
+@@ -97,8 +97,10 @@ static void vfio_pci_nvgpu_release(struct vfio_pci_device *vdev,
+ 
+ 	/* If there were any mappings at all... */
+ 	if (data->mm) {
+-		ret = mm_iommu_put(data->mm, data->mem);
+-		WARN_ON(ret);
++		if (data->mem) {
++			ret = mm_iommu_put(data->mm, data->mem);
++			WARN_ON(ret);
++		}
+ 
+ 		mmdrop(data->mm);
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.5/video-hyperv-hyperv_fb-use-physical-memory-for-fb-on.patch b/queue-5.5/video-hyperv-hyperv_fb-use-physical-memory-for-fb-on.patch
new file mode 100644
index 00000000000..ee3fec33a20
--- /dev/null
+++ b/queue-5.5/video-hyperv-hyperv_fb-use-physical-memory-for-fb-on.patch
@@ -0,0 +1,360 @@
+From 2008f17990f1e4ccaa1bbe089e5674a30090595c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 15:57:49 +0800
+Subject: video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1
+ VMs.
+
+From: Wei Hu <weh@microsoft.com>
+
+[ Upstream commit 3a6fb6c4255c3893ab61e2bd4e9ae01ca6bbcd94 ]
+
+On Hyper-V, Generation 1 VMs can directly use VM's physical memory for
+their framebuffers. This can improve the efficiency of framebuffer and
+overall performence for VM. The physical memory assigned to framebuffer
+must be contiguous. We use CMA allocator to get contiguouse physicial
+memory when the framebuffer size is greater than 4MB. For size under
+4MB, we use alloc_pages to achieve this.
+
+To enable framebuffer memory allocation from CMA, supply a kernel
+parameter to give enough space to CMA allocator at boot time. For
+example:
+    cma=130m
+This gives 130MB memory to CAM allocator that can be allocated to
+framebuffer. If this fails, we fall back to the old way of using
+mmio for framebuffer.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Wei Hu <weh@microsoft.com>
+Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/Kconfig     |   1 +
+ drivers/video/fbdev/hyperv_fb.c | 182 +++++++++++++++++++++++++-------
+ 2 files changed, 144 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index aa9541bf964b9..f65991a67af28 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -2215,6 +2215,7 @@ config FB_HYPERV
+ 	select FB_CFB_COPYAREA
+ 	select FB_CFB_IMAGEBLIT
+ 	select FB_DEFERRED_IO
++	select DMA_CMA if HAVE_DMA_CONTIGUOUS && CMA
+ 	help
+ 	  This framebuffer driver supports Microsoft Hyper-V Synthetic Video.
+ 
+diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
+index 4cd27e5172a16..8cf39d98b2bdf 100644
+--- a/drivers/video/fbdev/hyperv_fb.c
++++ b/drivers/video/fbdev/hyperv_fb.c
+@@ -31,6 +31,16 @@
+  * "set-vmvideo" command. For example
+  *     set-vmvideo -vmname name -horizontalresolution:1920 \
+  * -verticalresolution:1200 -resolutiontype single
++ *
++ * Gen 1 VMs also support direct using VM's physical memory for framebuffer.
++ * It could improve the efficiency and performance for framebuffer and VM.
++ * This requires to allocate contiguous physical memory from Linux kernel's
++ * CMA memory allocator. To enable this, supply a kernel parameter to give
++ * enough memory space to CMA allocator for framebuffer. For example:
++ *    cma=130m
++ * This gives 130MB memory to CMA allocator that can be allocated to
++ * framebuffer. For reference, 8K resolution (7680x4320) takes about
++ * 127MB memory.
+  */
+ 
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+@@ -228,7 +238,6 @@ struct synthvid_msg {
+ } __packed;
+ 
+ 
+-
+ /* FB driver definitions and structures */
+ #define HVFB_WIDTH 1152 /* default screen width */
+ #define HVFB_HEIGHT 864 /* default screen height */
+@@ -258,12 +267,15 @@ struct hvfb_par {
+ 	/* If true, the VSC notifies the VSP on every framebuffer change */
+ 	bool synchronous_fb;
+ 
++	/* If true, need to copy from deferred IO mem to framebuffer mem */
++	bool need_docopy;
++
+ 	struct notifier_block hvfb_panic_nb;
+ 
+ 	/* Memory for deferred IO and frame buffer itself */
+ 	unsigned char *dio_vp;
+ 	unsigned char *mmio_vp;
+-	unsigned long mmio_pp;
++	phys_addr_t mmio_pp;
+ 
+ 	/* Dirty rectangle, protected by delayed_refresh_lock */
+ 	int x1, y1, x2, y2;
+@@ -434,7 +446,7 @@ static void synthvid_deferred_io(struct fb_info *p,
+ 		maxy = max_t(int, maxy, y2);
+ 
+ 		/* Copy from dio space to mmio address */
+-		if (par->fb_ready)
++		if (par->fb_ready && par->need_docopy)
+ 			hvfb_docopy(par, start, PAGE_SIZE);
+ 	}
+ 
+@@ -751,12 +763,12 @@ static void hvfb_update_work(struct work_struct *w)
+ 		return;
+ 
+ 	/* Copy the dirty rectangle to frame buffer memory */
+-	for (j = y1; j < y2; j++) {
+-		hvfb_docopy(par,
+-			    j * info->fix.line_length +
+-			    (x1 * screen_depth / 8),
+-			    (x2 - x1) * screen_depth / 8);
+-	}
++	if (par->need_docopy)
++		for (j = y1; j < y2; j++)
++			hvfb_docopy(par,
++				    j * info->fix.line_length +
++				    (x1 * screen_depth / 8),
++				    (x2 - x1) * screen_depth / 8);
+ 
+ 	/* Refresh */
+ 	if (par->fb_ready && par->update)
+@@ -801,7 +813,8 @@ static int hvfb_on_panic(struct notifier_block *nb,
+ 	par = container_of(nb, struct hvfb_par, hvfb_panic_nb);
+ 	par->synchronous_fb = true;
+ 	info = par->info;
+-	hvfb_docopy(par, 0, dio_fb_size);
++	if (par->need_docopy)
++		hvfb_docopy(par, 0, dio_fb_size);
+ 	synthvid_update(info, 0, 0, INT_MAX, INT_MAX);
+ 
+ 	return NOTIFY_DONE;
+@@ -940,6 +953,62 @@ static void hvfb_get_option(struct fb_info *info)
+ 	return;
+ }
+ 
++/*
++ * Allocate enough contiguous physical memory.
++ * Return physical address if succeeded or -1 if failed.
++ */
++static phys_addr_t hvfb_get_phymem(struct hv_device *hdev,
++				   unsigned int request_size)
++{
++	struct page *page = NULL;
++	dma_addr_t dma_handle;
++	void *vmem;
++	phys_addr_t paddr = 0;
++	unsigned int order = get_order(request_size);
++
++	if (request_size == 0)
++		return -1;
++
++	if (order < MAX_ORDER) {
++		/* Call alloc_pages if the size is less than 2^MAX_ORDER */
++		page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
++		if (!page)
++			return -1;
++
++		paddr = (page_to_pfn(page) << PAGE_SHIFT);
++	} else {
++		/* Allocate from CMA */
++		hdev->device.coherent_dma_mask = DMA_BIT_MASK(64);
++
++		vmem = dma_alloc_coherent(&hdev->device,
++					  round_up(request_size, PAGE_SIZE),
++					  &dma_handle,
++					  GFP_KERNEL | __GFP_NOWARN);
++
++		if (!vmem)
++			return -1;
++
++		paddr = virt_to_phys(vmem);
++	}
++
++	return paddr;
++}
++
++/* Release contiguous physical memory */
++static void hvfb_release_phymem(struct hv_device *hdev,
++				phys_addr_t paddr, unsigned int size)
++{
++	unsigned int order = get_order(size);
++
++	if (order < MAX_ORDER)
++		__free_pages(pfn_to_page(paddr >> PAGE_SHIFT), order);
++	else
++		dma_free_coherent(&hdev->device,
++				  round_up(size, PAGE_SIZE),
++				  phys_to_virt(paddr),
++				  paddr);
++}
++
+ 
+ /* Get framebuffer memory from Hyper-V video pci space */
+ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
+@@ -949,22 +1018,61 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
+ 	void __iomem *fb_virt;
+ 	int gen2vm = efi_enabled(EFI_BOOT);
+ 	resource_size_t pot_start, pot_end;
++	phys_addr_t paddr;
+ 	int ret;
+ 
+-	dio_fb_size =
+-		screen_width * screen_height * screen_depth / 8;
++	info->apertures = alloc_apertures(1);
++	if (!info->apertures)
++		return -ENOMEM;
+ 
+-	if (gen2vm) {
+-		pot_start = 0;
+-		pot_end = -1;
+-	} else {
++	if (!gen2vm) {
+ 		pdev = pci_get_device(PCI_VENDOR_ID_MICROSOFT,
+-			      PCI_DEVICE_ID_HYPERV_VIDEO, NULL);
++			PCI_DEVICE_ID_HYPERV_VIDEO, NULL);
+ 		if (!pdev) {
+ 			pr_err("Unable to find PCI Hyper-V video\n");
++			kfree(info->apertures);
+ 			return -ENODEV;
+ 		}
+ 
++		info->apertures->ranges[0].base = pci_resource_start(pdev, 0);
++		info->apertures->ranges[0].size = pci_resource_len(pdev, 0);
++
++		/*
++		 * For Gen 1 VM, we can directly use the contiguous memory
++		 * from VM. If we succeed, deferred IO happens directly
++		 * on this allocated framebuffer memory, avoiding extra
++		 * memory copy.
++		 */
++		paddr = hvfb_get_phymem(hdev, screen_fb_size);
++		if (paddr != (phys_addr_t) -1) {
++			par->mmio_pp = paddr;
++			par->mmio_vp = par->dio_vp = __va(paddr);
++
++			info->fix.smem_start = paddr;
++			info->fix.smem_len = screen_fb_size;
++			info->screen_base = par->mmio_vp;
++			info->screen_size = screen_fb_size;
++
++			par->need_docopy = false;
++			goto getmem_done;
++		}
++		pr_info("Unable to allocate enough contiguous physical memory on Gen 1 VM. Using MMIO instead.\n");
++	} else {
++		info->apertures->ranges[0].base = screen_info.lfb_base;
++		info->apertures->ranges[0].size = screen_info.lfb_size;
++	}
++
++	/*
++	 * Cannot use the contiguous physical memory.
++	 * Allocate mmio space for framebuffer.
++	 */
++	dio_fb_size =
++		screen_width * screen_height * screen_depth / 8;
++
++	if (gen2vm) {
++		pot_start = 0;
++		pot_end = -1;
++	} else {
+ 		if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM) ||
+ 		    pci_resource_len(pdev, 0) < screen_fb_size) {
+ 			pr_err("Resource not available or (0x%lx < 0x%lx)\n",
+@@ -993,20 +1101,6 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
+ 	if (par->dio_vp == NULL)
+ 		goto err3;
+ 
+-	info->apertures = alloc_apertures(1);
+-	if (!info->apertures)
+-		goto err4;
+-
+-	if (gen2vm) {
+-		info->apertures->ranges[0].base = screen_info.lfb_base;
+-		info->apertures->ranges[0].size = screen_info.lfb_size;
+-		remove_conflicting_framebuffers(info->apertures,
+-						KBUILD_MODNAME, false);
+-	} else {
+-		info->apertures->ranges[0].base = pci_resource_start(pdev, 0);
+-		info->apertures->ranges[0].size = pci_resource_len(pdev, 0);
+-	}
+-
+ 	/* Physical address of FB device */
+ 	par->mmio_pp = par->mem->start;
+ 	/* Virtual address of FB device */
+@@ -1017,13 +1111,15 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
+ 	info->screen_base = par->dio_vp;
+ 	info->screen_size = dio_fb_size;
+ 
++getmem_done:
++	remove_conflicting_framebuffers(info->apertures,
++					KBUILD_MODNAME, false);
+ 	if (!gen2vm)
+ 		pci_dev_put(pdev);
++	kfree(info->apertures);
+ 
+ 	return 0;
+ 
+-err4:
+-	vfree(par->dio_vp);
+ err3:
+ 	iounmap(fb_virt);
+ err2:
+@@ -1032,18 +1128,25 @@ err2:
+ err1:
+ 	if (!gen2vm)
+ 		pci_dev_put(pdev);
++	kfree(info->apertures);
+ 
+ 	return -ENOMEM;
+ }
+ 
+ /* Release the framebuffer */
+-static void hvfb_putmem(struct fb_info *info)
++static void hvfb_putmem(struct hv_device *hdev, struct fb_info *info)
+ {
+ 	struct hvfb_par *par = info->par;
+ 
+-	vfree(par->dio_vp);
+-	iounmap(info->screen_base);
+-	vmbus_free_mmio(par->mem->start, screen_fb_size);
++	if (par->need_docopy) {
++		vfree(par->dio_vp);
++		iounmap(info->screen_base);
++		vmbus_free_mmio(par->mem->start, screen_fb_size);
++	} else {
++		hvfb_release_phymem(hdev, info->fix.smem_start,
++				    screen_fb_size);
++	}
++
+ 	par->mem = NULL;
+ }
+ 
+@@ -1062,6 +1165,7 @@ static int hvfb_probe(struct hv_device *hdev,
+ 	par = info->par;
+ 	par->info = info;
+ 	par->fb_ready = false;
++	par->need_docopy = true;
+ 	init_completion(&par->wait);
+ 	INIT_DELAYED_WORK(&par->dwork, hvfb_update_work);
+ 
+@@ -1147,7 +1251,7 @@ static int hvfb_probe(struct hv_device *hdev,
+ 
+ error:
+ 	fb_deferred_io_cleanup(info);
+-	hvfb_putmem(info);
++	hvfb_putmem(hdev, info);
+ error2:
+ 	vmbus_close(hdev->channel);
+ error1:
+@@ -1177,7 +1281,7 @@ static int hvfb_remove(struct hv_device *hdev)
+ 	vmbus_close(hdev->channel);
+ 	hv_set_drvdata(hdev, NULL);
+ 
+-	hvfb_putmem(info);
++	hvfb_putmem(hdev, info);
+ 	framebuffer_release(info);
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.5/virtio_balloon-prevent-pfn-array-overflow.patch b/queue-5.5/virtio_balloon-prevent-pfn-array-overflow.patch
new file mode 100644
index 00000000000..ef5ef95bb5d
--- /dev/null
+++ b/queue-5.5/virtio_balloon-prevent-pfn-array-overflow.patch
@@ -0,0 +1,36 @@
+From 99f243101f13eb2e8105cb28d99d3d8cb15fdefa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2020 02:40:58 -0500
+Subject: virtio_balloon: prevent pfn array overflow
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit 6e9826e77249355c09db6ba41cd3f84e89f4b614 ]
+
+Make sure, at build time, that pfn array is big enough to hold a single
+page.  It happens to be true since the PAGE_SHIFT value at the moment is
+20, which is 1M - exactly 256 4K balloon pages.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_balloon.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index 7e5d84caeb940..7bfe365d93720 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -158,6 +158,8 @@ static void set_page_pfns(struct virtio_balloon *vb,
+ {
+ 	unsigned int i;
+ 
++	BUILD_BUG_ON(VIRTIO_BALLOON_PAGES_PER_PAGE > VIRTIO_BALLOON_ARRAY_PFNS_MAX);
++
+ 	/*
+ 	 * Set balloon pfns pointing at this page.
+ 	 * Note that the first pfn points at start of the page.
+-- 
+2.20.1
+
diff --git a/queue-5.5/visorbus-fix-uninitialized-variable-access.patch b/queue-5.5/visorbus-fix-uninitialized-variable-access.patch
new file mode 100644
index 00000000000..ce9c4cf3417
--- /dev/null
+++ b/queue-5.5/visorbus-fix-uninitialized-variable-access.patch
@@ -0,0 +1,60 @@
+From 966a4996e70083e76c3d564726f995dda3d08ec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 21:29:40 +0100
+Subject: visorbus: fix uninitialized variable access
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit caf82f727e69b647f09d57a1fc56e69d22a5f483 ]
+
+The setup_crash_devices_work_queue function only partially initializes
+the message it sends to chipset_init, leading to undefined behavior:
+
+drivers/visorbus/visorchipset.c: In function 'setup_crash_devices_work_queue':
+drivers/visorbus/visorchipset.c:333:6: error: '((unsigned char*)&msg.hdr.flags)[0]' is used uninitialized in this function [-Werror=uninitialized]
+  if (inmsg->hdr.flags.response_expected)
+
+Set up the entire structure, zero-initializing the 'response_expected'
+flag.
+
+This was apparently found by the patch that added the -O3 build option
+in Kconfig.
+
+Fixes: 12e364b9f08a ("staging: visorchipset driver to provide registration and other services")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200107202950.782951-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/visorbus/visorchipset.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/visorbus/visorchipset.c b/drivers/visorbus/visorchipset.c
+index ca752b8f495fa..cb1eb7e05f871 100644
+--- a/drivers/visorbus/visorchipset.c
++++ b/drivers/visorbus/visorchipset.c
+@@ -1210,14 +1210,17 @@ static void setup_crash_devices_work_queue(struct work_struct *work)
+ {
+ 	struct controlvm_message local_crash_bus_msg;
+ 	struct controlvm_message local_crash_dev_msg;
+-	struct controlvm_message msg;
++	struct controlvm_message msg = {
++		.hdr.id = CONTROLVM_CHIPSET_INIT,
++		.cmd.init_chipset = {
++			.bus_count = 23,
++			.switch_count = 0,
++		},
++	};
+ 	u32 local_crash_msg_offset;
+ 	u16 local_crash_msg_count;
+ 
+ 	/* send init chipset msg */
+-	msg.hdr.id = CONTROLVM_CHIPSET_INIT;
+-	msg.cmd.init_chipset.bus_count = 23;
+-	msg.cmd.init_chipset.switch_count = 0;
+ 	chipset_init(&msg);
+ 	/* get saved message count */
+ 	if (visorchannel_read(chipset_dev->controlvm_channel,
+-- 
+2.20.1
+
diff --git a/queue-5.5/vme-bridges-reduce-stack-usage.patch b/queue-5.5/vme-bridges-reduce-stack-usage.patch
new file mode 100644
index 00000000000..4f8ec0be2cb
--- /dev/null
+++ b/queue-5.5/vme-bridges-reduce-stack-usage.patch
@@ -0,0 +1,110 @@
+From b399f89666706418dd6095c06d22b5590b4ecf78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 21:05:43 +0100
+Subject: vme: bridges: reduce stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7483e7a939c074d887450ef1c4d9ccc5909405f8 ]
+
+With CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3, the stack usage in vme_fake
+grows above the warning limit:
+
+drivers/vme/bridges/vme_fake.c: In function 'fake_master_read':
+drivers/vme/bridges/vme_fake.c:610:1: error: the frame size of 1160 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+drivers/vme/bridges/vme_fake.c: In function 'fake_master_write':
+drivers/vme/bridges/vme_fake.c:797:1: error: the frame size of 1160 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+
+The problem is that in some configurations, each call to
+fake_vmereadX() puts another variable on the stack.
+
+Reduce the amount of inlining to get back to the previous state,
+with no function using more than 200 bytes each.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200107200610.3482901-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vme/bridges/vme_fake.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/vme/bridges/vme_fake.c b/drivers/vme/bridges/vme_fake.c
+index 3208a4409e44e..6a1bc284f297c 100644
+--- a/drivers/vme/bridges/vme_fake.c
++++ b/drivers/vme/bridges/vme_fake.c
+@@ -414,8 +414,9 @@ static void fake_lm_check(struct fake_driver *bridge, unsigned long long addr,
+ 	}
+ }
+ 
+-static u8 fake_vmeread8(struct fake_driver *bridge, unsigned long long addr,
+-		u32 aspace, u32 cycle)
++static noinline_for_stack u8 fake_vmeread8(struct fake_driver *bridge,
++					   unsigned long long addr,
++					   u32 aspace, u32 cycle)
+ {
+ 	u8 retval = 0xff;
+ 	int i;
+@@ -446,8 +447,9 @@ static u8 fake_vmeread8(struct fake_driver *bridge, unsigned long long addr,
+ 	return retval;
+ }
+ 
+-static u16 fake_vmeread16(struct fake_driver *bridge, unsigned long long addr,
+-		u32 aspace, u32 cycle)
++static noinline_for_stack u16 fake_vmeread16(struct fake_driver *bridge,
++					     unsigned long long addr,
++					     u32 aspace, u32 cycle)
+ {
+ 	u16 retval = 0xffff;
+ 	int i;
+@@ -478,8 +480,9 @@ static u16 fake_vmeread16(struct fake_driver *bridge, unsigned long long addr,
+ 	return retval;
+ }
+ 
+-static u32 fake_vmeread32(struct fake_driver *bridge, unsigned long long addr,
+-		u32 aspace, u32 cycle)
++static noinline_for_stack u32 fake_vmeread32(struct fake_driver *bridge,
++					     unsigned long long addr,
++					     u32 aspace, u32 cycle)
+ {
+ 	u32 retval = 0xffffffff;
+ 	int i;
+@@ -609,8 +612,9 @@ out:
+ 	return retval;
+ }
+ 
+-static void fake_vmewrite8(struct fake_driver *bridge, u8 *buf,
+-			   unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite8(struct fake_driver *bridge,
++					      u8 *buf, unsigned long long addr,
++					      u32 aspace, u32 cycle)
+ {
+ 	int i;
+ 	unsigned long long start, end, offset;
+@@ -639,8 +643,9 @@ static void fake_vmewrite8(struct fake_driver *bridge, u8 *buf,
+ 
+ }
+ 
+-static void fake_vmewrite16(struct fake_driver *bridge, u16 *buf,
+-			    unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite16(struct fake_driver *bridge,
++					       u16 *buf, unsigned long long addr,
++					       u32 aspace, u32 cycle)
+ {
+ 	int i;
+ 	unsigned long long start, end, offset;
+@@ -669,8 +674,9 @@ static void fake_vmewrite16(struct fake_driver *bridge, u16 *buf,
+ 
+ }
+ 
+-static void fake_vmewrite32(struct fake_driver *bridge, u32 *buf,
+-			    unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite32(struct fake_driver *bridge,
++					       u32 *buf, unsigned long long addr,
++					       u32 aspace, u32 cycle)
+ {
+ 	int i;
+ 	unsigned long long start, end, offset;
+-- 
+2.20.1
+
diff --git a/queue-5.5/wan-hdlc_x25-fix-skb-handling.patch b/queue-5.5/wan-hdlc_x25-fix-skb-handling.patch
new file mode 100644
index 00000000000..56e5a3955c3
--- /dev/null
+++ b/queue-5.5/wan-hdlc_x25-fix-skb-handling.patch
@@ -0,0 +1,70 @@
+From dba7948d3c5a1c23b39ca5e73f1c934c396c9b18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 07:00:34 +0100
+Subject: wan/hdlc_x25: fix skb handling
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 953c4a08dfc9ffe763a8340ac10f459d6c6cc4eb ]
+
+o call skb_reset_network_header() before hdlc->xmit()
+ o change skb proto to HDLC (0x0019) before hdlc->xmit()
+ o call dev_queue_xmit_nit() before hdlc->xmit()
+
+This changes make it possible to trace (tcpdump) outgoing layer2
+(ETH_P_HDLC) packets
+
+Additionally call skb_reset_network_header() after each skb_push() /
+skb_pull().
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/hdlc_x25.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
+index 5643675ff7241..bf78073ee7fd9 100644
+--- a/drivers/net/wan/hdlc_x25.c
++++ b/drivers/net/wan/hdlc_x25.c
+@@ -62,11 +62,12 @@ static int x25_data_indication(struct net_device *dev, struct sk_buff *skb)
+ {
+ 	unsigned char *ptr;
+ 
+-	skb_push(skb, 1);
+-
+ 	if (skb_cow(skb, 1))
+ 		return NET_RX_DROP;
+ 
++	skb_push(skb, 1);
++	skb_reset_network_header(skb);
++
+ 	ptr  = skb->data;
+ 	*ptr = X25_IFACE_DATA;
+ 
+@@ -79,6 +80,13 @@ static int x25_data_indication(struct net_device *dev, struct sk_buff *skb)
+ static void x25_data_transmit(struct net_device *dev, struct sk_buff *skb)
+ {
+ 	hdlc_device *hdlc = dev_to_hdlc(dev);
++
++	skb_reset_network_header(skb);
++	skb->protocol = hdlc_type_trans(skb, dev);
++
++	if (dev_nit_active(dev))
++		dev_queue_xmit_nit(skb, dev);
++
+ 	hdlc->xmit(skb, dev); /* Ignore return value :-( */
+ }
+ 
+@@ -93,6 +101,7 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	switch (skb->data[0]) {
+ 	case X25_IFACE_DATA:	/* Data to be transmitted */
+ 		skb_pull(skb, 1);
++		skb_reset_network_header(skb);
+ 		if ((result = lapb_data_request(dev, skb)) != LAPB_OK)
+ 			dev_kfree_skb(skb);
+ 		return NETDEV_TX_OK;
+-- 
+2.20.1
+
diff --git a/queue-5.5/wan-ixp4xx_hss-fix-compile-testing-on-64-bit.patch b/queue-5.5/wan-ixp4xx_hss-fix-compile-testing-on-64-bit.patch
new file mode 100644
index 00000000000..cb2f907cfd4
--- /dev/null
+++ b/queue-5.5/wan-ixp4xx_hss-fix-compile-testing-on-64-bit.patch
@@ -0,0 +1,55 @@
+From c9660699d94b98f4bfa9bce1e1cad4c47f8aecfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 13:04:42 +0100
+Subject: wan: ixp4xx_hss: fix compile-testing on 64-bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 504c28c853ec5c626900b914b5833daf0581a344 ]
+
+Change the driver to use portable integer types to avoid
+warnings during compile testing:
+
+drivers/net/wan/ixp4xx_hss.c:863:21: error: cast to 'u32 *' (aka 'unsigned int *') from smaller integer type 'int' [-Werror,-Wint-to-pointer-cast]
+        memcpy_swab32(mem, (u32 *)((int)skb->data & ~3), bytes / 4);
+                           ^
+drivers/net/wan/ixp4xx_hss.c:979:12: error: incompatible pointer types passing 'u32 *' (aka 'unsigned int *') to parameter of type 'dma_addr_t *' (aka 'unsigned long long *') [-Werror,-Wincompatible-pointer-types]
+                                              &port->desc_tab_phys)))
+                                              ^~~~~~~~~~~~~~~~~~~~
+include/linux/dmapool.h:27:20: note: passing argument to parameter 'handle' here
+                     dma_addr_t *handle);
+                                 ^
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/ixp4xx_hss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
+index ea6ee6a608ce3..e7619cec978a8 100644
+--- a/drivers/net/wan/ixp4xx_hss.c
++++ b/drivers/net/wan/ixp4xx_hss.c
+@@ -258,7 +258,7 @@ struct port {
+ 	struct hss_plat_info *plat;
+ 	buffer_t *rx_buff_tab[RX_DESCS], *tx_buff_tab[TX_DESCS];
+ 	struct desc *desc_tab;	/* coherent */
+-	u32 desc_tab_phys;
++	dma_addr_t desc_tab_phys;
+ 	unsigned int id;
+ 	unsigned int clock_type, clock_rate, loopback;
+ 	unsigned int initialized, carrier;
+@@ -858,7 +858,7 @@ static int hss_hdlc_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		dev->stats.tx_dropped++;
+ 		return NETDEV_TX_OK;
+ 	}
+-	memcpy_swab32(mem, (u32 *)((int)skb->data & ~3), bytes / 4);
++	memcpy_swab32(mem, (u32 *)((uintptr_t)skb->data & ~3), bytes / 4);
+ 	dev_kfree_skb(skb);
+ #endif
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/watchdog-softlockup-enforce-that-timestamp-is-valid-.patch b/queue-5.5/watchdog-softlockup-enforce-that-timestamp-is-valid-.patch
new file mode 100644
index 00000000000..e0387d61175
--- /dev/null
+++ b/queue-5.5/watchdog-softlockup-enforce-that-timestamp-is-valid-.patch
@@ -0,0 +1,81 @@
+From 37e4dd02f6901c53b784e23d71e5d3edbc3403b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 19:17:02 +0100
+Subject: watchdog/softlockup: Enforce that timestamp is valid on boot
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 11e31f608b499f044f24b20be73f1dcab3e43f8a ]
+
+Robert reported that during boot the watchdog timestamp is set to 0 for one
+second which is the indicator for a watchdog reset.
+
+The reason for this is that the timestamp is in seconds and the time is
+taken from sched clock and divided by ~1e9. sched clock starts at 0 which
+means that for the first second during boot the watchdog timestamp is 0,
+i.e. reset.
+
+Use ULONG_MAX as the reset indicator value so the watchdog works correctly
+right from the start. ULONG_MAX would only conflict with a real timestamp
+if the system reaches an uptime of 136 years on 32bit and almost eternity
+on 64bit.
+
+Reported-by: Robert Richter <rrichter@marvell.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/87o8v3uuzl.fsf@nanos.tec.linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/watchdog.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/watchdog.c b/kernel/watchdog.c
+index f41334ef09713..cbd3cf503c904 100644
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -161,6 +161,8 @@ static void lockup_detector_update_enable(void)
+ 
+ #ifdef CONFIG_SOFTLOCKUP_DETECTOR
+ 
++#define SOFTLOCKUP_RESET	ULONG_MAX
++
+ /* Global variables, exported for sysctl */
+ unsigned int __read_mostly softlockup_panic =
+ 			CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE;
+@@ -274,7 +276,7 @@ notrace void touch_softlockup_watchdog_sched(void)
+ 	 * Preemption can be enabled.  It doesn't matter which CPU's timestamp
+ 	 * gets zeroed here, so use the raw_ operation.
+ 	 */
+-	raw_cpu_write(watchdog_touch_ts, 0);
++	raw_cpu_write(watchdog_touch_ts, SOFTLOCKUP_RESET);
+ }
+ 
+ notrace void touch_softlockup_watchdog(void)
+@@ -298,14 +300,14 @@ void touch_all_softlockup_watchdogs(void)
+ 	 * the softlockup check.
+ 	 */
+ 	for_each_cpu(cpu, &watchdog_allowed_mask)
+-		per_cpu(watchdog_touch_ts, cpu) = 0;
++		per_cpu(watchdog_touch_ts, cpu) = SOFTLOCKUP_RESET;
+ 	wq_watchdog_touch(-1);
+ }
+ 
+ void touch_softlockup_watchdog_sync(void)
+ {
+ 	__this_cpu_write(softlockup_touch_sync, true);
+-	__this_cpu_write(watchdog_touch_ts, 0);
++	__this_cpu_write(watchdog_touch_ts, SOFTLOCKUP_RESET);
+ }
+ 
+ static int is_softlockup(unsigned long touch_ts)
+@@ -383,7 +385,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
+ 	/* .. and repeat */
+ 	hrtimer_forward_now(hrtimer, ns_to_ktime(sample_period));
+ 
+-	if (touch_ts == 0) {
++	if (touch_ts == SOFTLOCKUP_RESET) {
+ 		if (unlikely(__this_cpu_read(softlockup_touch_sync))) {
+ 			/*
+ 			 * If the time stamp was touched atomically
+-- 
+2.20.1
+
diff --git a/queue-5.5/wil6210-fix-break-that-is-never-reached-because-of-z.patch b/queue-5.5/wil6210-fix-break-that-is-never-reached-because-of-z.patch
new file mode 100644
index 00000000000..1d5ef6784f2
--- /dev/null
+++ b/queue-5.5/wil6210-fix-break-that-is-never-reached-because-of-z.patch
@@ -0,0 +1,51 @@
+From 87b1ed28dafc65ee03886c5e86ca0d7930ceaa8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 12:09:53 +0000
+Subject: wil6210: fix break that is never reached because of zero'ing of a
+ retry counter
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 5b1413f00b5beb9f5fed94e43ea0c497d5db9633 ]
+
+There is a check on the retry counter invalid_buf_id_retry that is always
+false because invalid_buf_id_retry is initialized to zero on each iteration
+of a while-loop.  Fix this by initializing the retry counter before the
+while-loop starts.
+
+Addresses-Coverity: ("Logically dead code")
+Fixes: b4a967b7d0f5 ("wil6210: reset buff id in status message after completion")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Maya Erez <merez@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/wil6210/txrx_edma.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/wil6210/txrx_edma.c b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+index 778b63be6a9a4..02548d40253c7 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx_edma.c
++++ b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+@@ -869,6 +869,7 @@ static struct sk_buff *wil_sring_reap_rx_edma(struct wil6210_priv *wil,
+ 	u8 data_offset;
+ 	struct wil_rx_status_extended *s;
+ 	u16 sring_idx = sring - wil->srings;
++	int invalid_buff_id_retry;
+ 
+ 	BUILD_BUG_ON(sizeof(struct wil_rx_status_extended) > sizeof(skb->cb));
+ 
+@@ -882,9 +883,9 @@ again:
+ 	/* Extract the buffer ID from the status message */
+ 	buff_id = le16_to_cpu(wil_rx_status_get_buff_id(msg));
+ 
++	invalid_buff_id_retry = 0;
+ 	while (!buff_id) {
+ 		struct wil_rx_status_extended *s;
+-		int invalid_buff_id_retry = 0;
+ 
+ 		wil_dbg_txrx(wil,
+ 			     "buff_id is not updated yet by HW, (swhead 0x%x)\n",
+-- 
+2.20.1
+
diff --git a/queue-5.5/x86-apic-uv-avoid-unused-variable-warning.patch b/queue-5.5/x86-apic-uv-avoid-unused-variable-warning.patch
new file mode 100644
index 00000000000..9f47d407e23
--- /dev/null
+++ b/queue-5.5/x86-apic-uv-avoid-unused-variable-warning.patch
@@ -0,0 +1,106 @@
+From 36abcc12108ffdc7e289995d68b316396eb5ced2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 15:03:57 +0100
+Subject: x86/apic/uv: Avoid unused variable warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit d0b7788804482b2689946cd8d910ac3e03126c8d ]
+
+When CONFIG_PROC_FS is disabled, the compiler warns about an unused
+variable:
+
+arch/x86/kernel/apic/x2apic_uv_x.c: In function 'uv_setup_proc_files':
+arch/x86/kernel/apic/x2apic_uv_x.c:1546:8: error: unused variable 'name' [-Werror=unused-variable]
+  char *name = hubless ? "hubless" : "hubbed";
+
+Simplify the code so this variable is no longer needed.
+
+Fixes: 8785968bce1c ("x86/platform/uv: Add UV Hubbed/Hubless Proc FS Files")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20191212140419.315264-1-arnd@arndb.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/x2apic_uv_x.c | 43 +++++-------------------------
+ 1 file changed, 6 insertions(+), 37 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
+index d5b51a740524d..ad53b2abc859f 100644
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -1493,65 +1493,34 @@ static void check_efi_reboot(void)
+ }
+ 
+ /* Setup user proc fs files */
+-static int proc_hubbed_show(struct seq_file *file, void *data)
++static int __maybe_unused proc_hubbed_show(struct seq_file *file, void *data)
+ {
+ 	seq_printf(file, "0x%x\n", uv_hubbed_system);
+ 	return 0;
+ }
+ 
+-static int proc_hubless_show(struct seq_file *file, void *data)
++static int __maybe_unused proc_hubless_show(struct seq_file *file, void *data)
+ {
+ 	seq_printf(file, "0x%x\n", uv_hubless_system);
+ 	return 0;
+ }
+ 
+-static int proc_oemid_show(struct seq_file *file, void *data)
++static int __maybe_unused proc_oemid_show(struct seq_file *file, void *data)
+ {
+ 	seq_printf(file, "%s/%s\n", oem_id, oem_table_id);
+ 	return 0;
+ }
+ 
+-static int proc_hubbed_open(struct inode *inode, struct file *file)
+-{
+-	return single_open(file, proc_hubbed_show, (void *)NULL);
+-}
+-
+-static int proc_hubless_open(struct inode *inode, struct file *file)
+-{
+-	return single_open(file, proc_hubless_show, (void *)NULL);
+-}
+-
+-static int proc_oemid_open(struct inode *inode, struct file *file)
+-{
+-	return single_open(file, proc_oemid_show, (void *)NULL);
+-}
+-
+-/* (struct is "non-const" as open function is set at runtime) */
+-static struct file_operations proc_version_fops = {
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
+-};
+-
+-static const struct file_operations proc_oemid_fops = {
+-	.open		= proc_oemid_open,
+-	.read		= seq_read,
+-	.llseek		= seq_lseek,
+-	.release	= single_release,
+-};
+-
+ static __init void uv_setup_proc_files(int hubless)
+ {
+ 	struct proc_dir_entry *pde;
+-	char *name = hubless ? "hubless" : "hubbed";
+ 
+ 	pde = proc_mkdir(UV_PROC_NODE, NULL);
+-	proc_create("oemid", 0, pde, &proc_oemid_fops);
+-	proc_create(name, 0, pde, &proc_version_fops);
++	proc_create_single("oemid", 0, pde, proc_oemid_show);
+ 	if (hubless)
+-		proc_version_fops.open = proc_hubless_open;
++		proc_create_single("hubless", 0, pde, proc_hubless_show);
+ 	else
+-		proc_version_fops.open = proc_hubbed_open;
++		proc_create_single("hubbed", 0, pde, proc_hubbed_show);
+ }
+ 
+ /* Initialize UV hubless systems */
+-- 
+2.20.1
+
diff --git a/queue-5.5/x86-boot-compressed-relax-sed-symbol-type-regex-for-.patch b/queue-5.5/x86-boot-compressed-relax-sed-symbol-type-regex-for-.patch
new file mode 100644
index 00000000000..c3aa9388f48
--- /dev/null
+++ b/queue-5.5/x86-boot-compressed-relax-sed-symbol-type-regex-for-.patch
@@ -0,0 +1,68 @@
+From 1dc7cb184763b3ad02f29efed6031fab16a6edf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jan 2020 17:57:04 +0100
+Subject: x86/boot/compressed: Relax sed symbol type regex for LLVM ld.lld
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit bc310baf2ba381c648983c7f4748327f17324562 ]
+
+The final build stage of the x86 kernel captures some symbol
+addresses from the decompressor binary and copies them into zoffset.h.
+It uses sed with a regular expression that matches the address, symbol
+type and symbol name, and mangles the captured addresses and the names
+of symbols of interest into #define directives that are added to
+zoffset.h
+
+The symbol type is indicated by a single letter, which we match
+strictly: only letters in the set 'ABCDGRSTVW' are matched, even
+though the actual symbol type is relevant and therefore ignored.
+
+Commit bc7c9d620 ("efi/libstub/x86: Force 'hidden' visibility for
+extern declarations") made a change to the way external symbol
+references are classified, resulting in 'startup_32' now being
+emitted as a hidden symbol. This prevents the use of GOT entries to
+refer to this symbol via its absolute address, which recent toolchains
+(including Clang based ones) already avoid by default, making this
+change a no-op in the majority of cases.
+
+However, as it turns out, the LLVM linker classifies such hidden
+symbols as symbols with static linkage in fully linked ELF binaries,
+causing tools such as NM to output a lowercase 't' rather than an upper
+case 'T' for the type of such symbols. Since our sed expression only
+matches upper case letters for the symbol type, the line describing
+startup_32 is disregarded, resulting in a build error like the following
+
+  arch/x86/boot/header.S:568:18: error: symbol 'ZO_startup_32' can not be
+                                        undefined in a subtraction expression
+  init_size: .long (0x00000000008fd000 - ZO_startup_32 +
+                    (((0x0000000001f6361c + ((0x0000000001f6361c >> 8) + 65536)
+                     - 0x00000000008c32e5) + 4095) & ~4095)) # kernel initialization size
+
+Given that we are only interested in the value of the symbol, let's match
+any character in the set 'a-zA-Z' instead.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/boot/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
+index 95410d6ee2ff8..748b6d28a91de 100644
+--- a/arch/x86/boot/Makefile
++++ b/arch/x86/boot/Makefile
+@@ -88,7 +88,7 @@ $(obj)/vmlinux.bin: $(obj)/compressed/vmlinux FORCE
+ 
+ SETUP_OBJS = $(addprefix $(obj)/,$(setup-y))
+ 
+-sed-zoffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|kernel_info\|_end\|_ehead\|_text\|z_.*\)$$/\#define ZO_\2 0x\1/p'
++sed-zoffset := -e 's/^\([0-9a-fA-F]*\) [a-zA-Z] \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|kernel_info\|_end\|_ehead\|_text\|z_.*\)$$/\#define ZO_\2 0x\1/p'
+ 
+ quiet_cmd_zoffset = ZOFFSET $@
+       cmd_zoffset = $(NM) $< | sed -n $(sed-zoffset) > $@
+-- 
+2.20.1
+
diff --git a/queue-5.5/x86-decoder-add-test-opcode-to-group3-2.patch b/queue-5.5/x86-decoder-add-test-opcode-to-group3-2.patch
new file mode 100644
index 00000000000..bdd89ece1f7
--- /dev/null
+++ b/queue-5.5/x86-decoder-add-test-opcode-to-group3-2.patch
@@ -0,0 +1,80 @@
+From 5edb20d4d6cc1b86334cdce360b48580fcd8d582 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 13:11:54 +0900
+Subject: x86/decoder: Add TEST opcode to Group3-2
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 8b7e20a7ba54836076ff35a28349dabea4cec48f ]
+
+Add TEST opcode to Group3-2 reg=001b as same as Group3-1 does.
+
+Commit
+
+  12a78d43de76 ("x86/decoder: Add new TEST instruction pattern")
+
+added a TEST opcode assignment to f6 XX/001/XXX (Group 3-1), but did
+not add f7 XX/001/XXX (Group 3-2).
+
+Actually, this TEST opcode variant (ModRM.reg /1) is not described in
+the Intel SDM Vol2 but in AMD64 Architecture Programmer's Manual Vol.3,
+Appendix A.2 Table A-6. ModRM.reg Extensions for the Primary Opcode Map.
+
+Without this fix, Randy found a warning by insn_decoder_test related
+to this issue as below.
+
+    HOSTCC  arch/x86/tools/insn_decoder_test
+    HOSTCC  arch/x86/tools/insn_sanity
+    TEST    posttest
+  arch/x86/tools/insn_decoder_test: warning: Found an x86 instruction decoder bug, please report this.
+  arch/x86/tools/insn_decoder_test: warning: ffffffff81000bf1:	f7 0b 00 01 08 00    	testl  $0x80100,(%rbx)
+  arch/x86/tools/insn_decoder_test: warning: objdump says 6 bytes, but insn_get_length() says 2
+  arch/x86/tools/insn_decoder_test: warning: Decoded and checked 11913894 instructions with 1 failures
+    TEST    posttest
+  arch/x86/tools/insn_sanity: Success: decoded and checked 1000000 random instructions with 0 errors (seed:0x871ce29c)
+
+To fix this error, add the TEST opcode according to AMD64 APM Vol.3.
+
+ [ bp: Massage commit message. ]
+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lkml.kernel.org/r/157966631413.9580.10311036595431878351.stgit@devnote2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/x86-opcode-map.txt       | 2 +-
+ tools/arch/x86/lib/x86-opcode-map.txt | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
+index 8908c58bd6cd2..53adc1762ec08 100644
+--- a/arch/x86/lib/x86-opcode-map.txt
++++ b/arch/x86/lib/x86-opcode-map.txt
+@@ -929,7 +929,7 @@ EndTable
+ 
+ GrpTable: Grp3_2
+ 0: TEST Ev,Iz
+-1:
++1: TEST Ev,Iz
+ 2: NOT Ev
+ 3: NEG Ev
+ 4: MUL rAX,Ev
+diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt
+index 8908c58bd6cd2..53adc1762ec08 100644
+--- a/tools/arch/x86/lib/x86-opcode-map.txt
++++ b/tools/arch/x86/lib/x86-opcode-map.txt
+@@ -929,7 +929,7 @@ EndTable
+ 
+ GrpTable: Grp3_2
+ 0: TEST Ev,Iz
+-1:
++1: TEST Ev,Iz
+ 2: NOT Ev
+ 3: NEG Ev
+ 4: MUL rAX,Ev
+-- 
+2.20.1
+
diff --git a/queue-5.5/x86-fpu-deactivate-fpu-state-after-failure-during-st.patch b/queue-5.5/x86-fpu-deactivate-fpu-state-after-failure-during-st.patch
new file mode 100644
index 00000000000..d2b4f451171
--- /dev/null
+++ b/queue-5.5/x86-fpu-deactivate-fpu-state-after-failure-during-st.patch
@@ -0,0 +1,88 @@
+From 1d9f757b800434df552ae9551cf1f30277cde2f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 20:59:06 +0100
+Subject: x86/fpu: Deactivate FPU state after failure during state load
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit bbc55341b9c67645d1a5471506370caf7dd4a203 ]
+
+In __fpu__restore_sig(), fpu_fpregs_owner_ctx needs to be reset if the
+FPU state was not fully restored. Otherwise the following may happen (on
+the same CPU):
+
+  Task A                     Task B               fpu_fpregs_owner_ctx
+  *active*                                        A.fpu
+  __fpu__restore_sig()
+                             ctx switch           load B.fpu
+                             *active*             B.fpu
+  fpregs_lock()
+  copy_user_to_fpregs_zeroing()
+    copy_kernel_to_xregs() *modify*
+    copy_user_to_xregs() *fails*
+  fpregs_unlock()
+                            ctx switch            skip loading B.fpu,
+                            *active*              B.fpu
+
+In the success case, fpu_fpregs_owner_ctx is set to the current task.
+
+In the failure case, the FPU state might have been modified by loading
+the init state.
+
+In this case, fpu_fpregs_owner_ctx needs to be reset in order to ensure
+that the FPU state of the following task is loaded from saved state (and
+not skipped because it was the previous state).
+
+Reset fpu_fpregs_owner_ctx after a failure during restore occurred, to
+ensure that the FPU state for the next task is always loaded.
+
+The problem was debugged-by Yu-cheng Yu <yu-cheng.yu@intel.com>.
+
+ [ bp: Massage commit message. ]
+
+Fixes: 5f409e20b7945 ("x86/fpu: Defer FPU state load until return to userspace")
+Reported-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jann Horn <jannh@google.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/20191220195906.plk6kpmsrikvbcfn@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/fpu/signal.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
+index 0071b794ed193..400a05e1c1c51 100644
+--- a/arch/x86/kernel/fpu/signal.c
++++ b/arch/x86/kernel/fpu/signal.c
+@@ -352,6 +352,7 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
+ 			fpregs_unlock();
+ 			return 0;
+ 		}
++		fpregs_deactivate(fpu);
+ 		fpregs_unlock();
+ 	}
+ 
+@@ -403,6 +404,8 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
+ 	}
+ 	if (!ret)
+ 		fpregs_mark_activate();
++	else
++		fpregs_deactivate(fpu);
+ 	fpregs_unlock();
+ 
+ err_out:
+-- 
+2.20.1
+
diff --git a/queue-5.5/x86-mce-therm_throt-mark-throttle_active_work-as-__m.patch b/queue-5.5/x86-mce-therm_throt-mark-throttle_active_work-as-__m.patch
new file mode 100644
index 00000000000..80fcb793b86
--- /dev/null
+++ b/queue-5.5/x86-mce-therm_throt-mark-throttle_active_work-as-__m.patch
@@ -0,0 +1,53 @@
+From be10e627d513e31ed2e9e3a48fa758054b78cf7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 21:39:13 +0100
+Subject: x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit db1ae0314f47e88ae06679270adf17ffa245afd4 ]
+
+throttle_active_work() is only called if CONFIG_SYSFS is set, otherwise
+we get a harmless warning:
+
+  arch/x86/kernel/cpu/mce/therm_throt.c:238:13: error: 'throttle_active_work' \
+	  defined but not used [-Werror=unused-function]
+
+Mark the function as __maybe_unused to avoid the warning.
+
+Fixes: f6656208f04e ("x86/mce/therm_throt: Optimize notifications of thermal throttle")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: bberg@redhat.com
+Cc: ckellner@redhat.com
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: hdegoede@redhat.com
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/20191210203925.3119091-1-arnd@arndb.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mce/therm_throt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/mce/therm_throt.c b/arch/x86/kernel/cpu/mce/therm_throt.c
+index 6c3e1c92f1835..58b4ee3cda777 100644
+--- a/arch/x86/kernel/cpu/mce/therm_throt.c
++++ b/arch/x86/kernel/cpu/mce/therm_throt.c
+@@ -235,7 +235,7 @@ static void get_therm_status(int level, bool *proc_hot, u8 *temp)
+ 	*temp = (msr_val >> 16) & 0x7F;
+ }
+ 
+-static void throttle_active_work(struct work_struct *work)
++static void __maybe_unused throttle_active_work(struct work_struct *work)
+ {
+ 	struct _thermal_state *state = container_of(to_delayed_work(work),
+ 						struct _thermal_state, therm_work);
+-- 
+2.20.1
+
diff --git a/queue-5.5/x86-mm-fix-nx-bit-clearing-issue-in-kernel_map_pages.patch b/queue-5.5/x86-mm-fix-nx-bit-clearing-issue-in-kernel_map_pages.patch
new file mode 100644
index 00000000000..d264b4e106f
--- /dev/null
+++ b/queue-5.5/x86-mm-fix-nx-bit-clearing-issue-in-kernel_map_pages.patch
@@ -0,0 +1,62 @@
+From 4f88ce75655df366717d3dd793656f45952237da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 18:22:36 +0100
+Subject: x86/mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 75fbef0a8b6b4bb19b9a91b5214f846c2dc5139e ]
+
+The following commit:
+
+  15f003d20782 ("x86/mm/pat: Don't implicitly allow _PAGE_RW in kernel_map_pages_in_pgd()")
+
+modified kernel_map_pages_in_pgd() to manage writable permissions
+of memory mappings in the EFI page table in a different way, but
+in the process, it removed the ability to clear NX attributes from
+read-only mappings, by clobbering the clear mask if _PAGE_RW is not
+being requested.
+
+Failure to remove the NX attribute from read-only mappings is
+unlikely to be a security issue, but it does prevent us from
+tightening the permissions in the EFI page tables going forward,
+so let's fix it now.
+
+Fixes: 15f003d20782 ("x86/mm/pat: Don't implicitly allow _PAGE_RW in kernel_map_pages_in_pgd()
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20200113172245.27925-5-ardb@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/pageattr.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index 1b99ad05b1177..f42780ba08937 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -2215,7 +2215,7 @@ int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
+ 		.pgd = pgd,
+ 		.numpages = numpages,
+ 		.mask_set = __pgprot(0),
+-		.mask_clr = __pgprot(0),
++		.mask_clr = __pgprot(~page_flags & (_PAGE_NX|_PAGE_RW)),
+ 		.flags = 0,
+ 	};
+ 
+@@ -2224,12 +2224,6 @@ int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
+ 	if (!(__supported_pte_mask & _PAGE_NX))
+ 		goto out;
+ 
+-	if (!(page_flags & _PAGE_NX))
+-		cpa.mask_clr = __pgprot(_PAGE_NX);
+-
+-	if (!(page_flags & _PAGE_RW))
+-		cpa.mask_clr = __pgprot(_PAGE_RW);
+-
+ 	if (!(page_flags & _PAGE_ENC))
+ 		cpa.mask_clr = pgprot_encrypted(cpa.mask_clr);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.5/x86-nmi-remove-irq_work-from-the-long-duration-nmi-h.patch b/queue-5.5/x86-nmi-remove-irq_work-from-the-long-duration-nmi-h.patch
new file mode 100644
index 00000000000..26fd1d6f532
--- /dev/null
+++ b/queue-5.5/x86-nmi-remove-irq_work-from-the-long-duration-nmi-h.patch
@@ -0,0 +1,100 @@
+From dea0982a4823b1efbf476799586e2449df4e0cd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 20:54:27 +0800
+Subject: x86/nmi: Remove irq_work from the long duration NMI handler
+
+From: Changbin Du <changbin.du@gmail.com>
+
+[ Upstream commit 248ed51048c40d36728e70914e38bffd7821da57 ]
+
+First, printk() is NMI-context safe now since the safe printk() has been
+implemented and it already has an irq_work to make NMI-context safe.
+
+Second, this NMI irq_work actually does not work if a NMI handler causes
+panic by watchdog timeout. It has no chance to run in such case, while
+the safe printk() will flush its per-cpu buffers before panicking.
+
+While at it, repurpose the irq_work callback into a function which
+concentrates the NMI duration checking and makes the code easier to
+follow.
+
+ [ bp: Massage. ]
+
+Signed-off-by: Changbin Du <changbin.du@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20200111125427.15662-1-changbin.du@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/nmi.h |  1 -
+ arch/x86/kernel/nmi.c      | 20 +++++++++-----------
+ 2 files changed, 9 insertions(+), 12 deletions(-)
+
+diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h
+index 75ded1d13d98d..9d5d949e662e1 100644
+--- a/arch/x86/include/asm/nmi.h
++++ b/arch/x86/include/asm/nmi.h
+@@ -41,7 +41,6 @@ struct nmiaction {
+ 	struct list_head	list;
+ 	nmi_handler_t		handler;
+ 	u64			max_duration;
+-	struct irq_work		irq_work;
+ 	unsigned long		flags;
+ 	const char		*name;
+ };
+diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
+index e676a9916c498..54c21d6abd5ac 100644
+--- a/arch/x86/kernel/nmi.c
++++ b/arch/x86/kernel/nmi.c
+@@ -104,18 +104,22 @@ static int __init nmi_warning_debugfs(void)
+ }
+ fs_initcall(nmi_warning_debugfs);
+ 
+-static void nmi_max_handler(struct irq_work *w)
++static void nmi_check_duration(struct nmiaction *action, u64 duration)
+ {
+-	struct nmiaction *a = container_of(w, struct nmiaction, irq_work);
++	u64 whole_msecs = READ_ONCE(action->max_duration);
+ 	int remainder_ns, decimal_msecs;
+-	u64 whole_msecs = READ_ONCE(a->max_duration);
++
++	if (duration < nmi_longest_ns || duration < action->max_duration)
++		return;
++
++	action->max_duration = duration;
+ 
+ 	remainder_ns = do_div(whole_msecs, (1000 * 1000));
+ 	decimal_msecs = remainder_ns / 1000;
+ 
+ 	printk_ratelimited(KERN_INFO
+ 		"INFO: NMI handler (%ps) took too long to run: %lld.%03d msecs\n",
+-		a->handler, whole_msecs, decimal_msecs);
++		action->handler, whole_msecs, decimal_msecs);
+ }
+ 
+ static int nmi_handle(unsigned int type, struct pt_regs *regs)
+@@ -142,11 +146,7 @@ static int nmi_handle(unsigned int type, struct pt_regs *regs)
+ 		delta = sched_clock() - delta;
+ 		trace_nmi_handler(a->handler, (int)delta, thishandled);
+ 
+-		if (delta < nmi_longest_ns || delta < a->max_duration)
+-			continue;
+-
+-		a->max_duration = delta;
+-		irq_work_queue(&a->irq_work);
++		nmi_check_duration(a, delta);
+ 	}
+ 
+ 	rcu_read_unlock();
+@@ -164,8 +164,6 @@ int __register_nmi_handler(unsigned int type, struct nmiaction *action)
+ 	if (!action->handler)
+ 		return -EINVAL;
+ 
+-	init_irq_work(&action->irq_work, nmi_max_handler);
+-
+ 	raw_spin_lock_irqsave(&desc->lock, flags);
+ 
+ 	/*
+-- 
+2.20.1
+
diff --git a/queue-5.5/x86-sysfb-fix-check-for-bad-vram-size.patch b/queue-5.5/x86-sysfb-fix-check-for-bad-vram-size.patch
new file mode 100644
index 00000000000..212036a7d44
--- /dev/null
+++ b/queue-5.5/x86-sysfb-fix-check-for-bad-vram-size.patch
@@ -0,0 +1,50 @@
+From e3f2e71f3f1bf2e6693ace8cd07e4739762601b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 18:04:10 -0500
+Subject: x86/sysfb: Fix check for bad VRAM size
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+[ Upstream commit dacc9092336be20b01642afe1a51720b31f60369 ]
+
+When checking whether the reported lfb_size makes sense, the height
+* stride result is page-aligned before seeing whether it exceeds the
+reported size.
+
+This doesn't work if height * stride is not an exact number of pages.
+For example, as reported in the kernel bugzilla below, an 800x600x32 EFI
+framebuffer gets skipped because of this.
+
+Move the PAGE_ALIGN to after the check vs size.
+
+Reported-by: Christopher Head <chead@chead.ca>
+Tested-by: Christopher Head <chead@chead.ca>
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206051
+Link: https://lkml.kernel.org/r/20200107230410.2291947-1-nivedita@alum.mit.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/sysfb_simplefb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/sysfb_simplefb.c b/arch/x86/kernel/sysfb_simplefb.c
+index 01f0e2263b86b..298fc1edd9c95 100644
+--- a/arch/x86/kernel/sysfb_simplefb.c
++++ b/arch/x86/kernel/sysfb_simplefb.c
+@@ -90,11 +90,11 @@ __init int create_simplefb(const struct screen_info *si,
+ 	if (si->orig_video_isVGA == VIDEO_TYPE_VLFB)
+ 		size <<= 16;
+ 	length = mode->height * mode->stride;
+-	length = PAGE_ALIGN(length);
+ 	if (length > size) {
+ 		printk(KERN_WARNING "sysfb: VRAM smaller than advertised\n");
+ 		return -EINVAL;
+ 	}
++	length = PAGE_ALIGN(length);
+ 
+ 	/* setup IORESOURCE_MEM as framebuffer memory */
+ 	memset(&res, 0, sizeof(res));
+-- 
+2.20.1
+
diff --git a/queue-5.5/x86-unwind-orc-fix-config_modules-build-warning.patch b/queue-5.5/x86-unwind-orc-fix-config_modules-build-warning.patch
new file mode 100644
index 00000000000..da2f8573ef5
--- /dev/null
+++ b/queue-5.5/x86-unwind-orc-fix-config_modules-build-warning.patch
@@ -0,0 +1,55 @@
+From 2699ccb6e2b3849abbaf81a3696425cf55fc2667 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 11:07:29 +0800
+Subject: x86/unwind/orc: Fix !CONFIG_MODULES build warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shile Zhang <shile.zhang@linux.alibaba.com>
+
+[ Upstream commit 22a7fa8848c5e881d87ef2f7f3c2ea77b286e6f9 ]
+
+To fix follwowing warning due to ORC sort moved to build time:
+
+  arch/x86/kernel/unwind_orc.c:210:12: warning: ‘orc_sort_cmp’ defined but not used [-Wunused-function]
+  arch/x86/kernel/unwind_orc.c:190:13: warning: ‘orc_sort_swap’ defined but not used [-Wunused-function]
+
+Signed-off-by: Shile Zhang <shile.zhang@linux.alibaba.com>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/c9c81536-2afc-c8aa-c5f8-c7618ecd4f54@linux.alibaba.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/unwind_orc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 332ae6530fa88..7a9306bc5982f 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -187,6 +187,8 @@ static struct orc_entry *orc_find(unsigned long ip)
+ 	return orc_ftrace_find(ip);
+ }
+ 
++#ifdef CONFIG_MODULES
++
+ static void orc_sort_swap(void *_a, void *_b, int size)
+ {
+ 	struct orc_entry *orc_a, *orc_b;
+@@ -229,7 +231,6 @@ static int orc_sort_cmp(const void *_a, const void *_b)
+ 	return orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end ? -1 : 1;
+ }
+ 
+-#ifdef CONFIG_MODULES
+ void unwind_module_init(struct module *mod, void *_orc_ip, size_t orc_ip_size,
+ 			void *_orc, size_t orc_size)
+ {
+-- 
+2.20.1
+
diff --git a/queue-5.5/x86-vdso-provide-missing-include-file.patch b/queue-5.5/x86-vdso-provide-missing-include-file.patch
new file mode 100644
index 00000000000..702ab8ad2fb
--- /dev/null
+++ b/queue-5.5/x86-vdso-provide-missing-include-file.patch
@@ -0,0 +1,47 @@
+From 8c4006b98ce7e2320939b1a9589e21b0bc1ee0ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 21:36:07 -0500
+Subject: x86/vdso: Provide missing include file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Valdis Klētnieks <valdis.kletnieks@vt.edu>
+
+[ Upstream commit bff47c2302cc249bcd550b17067f8dddbd4b6f77 ]
+
+When building with C=1, sparse issues a warning:
+
+  CHECK   arch/x86/entry/vdso/vdso32-setup.c
+  arch/x86/entry/vdso/vdso32-setup.c:28:28: warning: symbol 'vdso32_enabled' was not declared. Should it be static?
+
+Provide the missing header file.
+
+Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/36224.1575599767@turing-police
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/vdso/vdso32-setup.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/entry/vdso/vdso32-setup.c b/arch/x86/entry/vdso/vdso32-setup.c
+index 240626e7f55aa..43842fade8fa1 100644
+--- a/arch/x86/entry/vdso/vdso32-setup.c
++++ b/arch/x86/entry/vdso/vdso32-setup.c
+@@ -11,6 +11,7 @@
+ #include <linux/smp.h>
+ #include <linux/kernel.h>
+ #include <linux/mm_types.h>
++#include <linux/elf.h>
+ 
+ #include <asm/processor.h>
+ #include <asm/vdso.h>
+-- 
+2.20.1
+
-- 
2.47.3